Function at 0x10057644
Capabilities:
Enumerate files on windows
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78]
mov eax, 0x2c94
call fcn.1009fbd0
push ebx
push esi
lea eax, [ebp + 0x50]
push edi
xor ebx, ebx
push eax
mov dword [ebp + 0x5c], ebx
call fcn.10042e0e
pop ecx
mov esi, 0x100c503c
push esi
push 0x100c7994
lea ecx, [ebp + 0x50]
call fcn.10004473
lea eax, [ebp + 0x50]
push eax
call fcn.10042b6f
push dword [0x1010c400]
lea eax, [ebp - 0x3ac]
push 0x100c691c
push eax
call fcn.100a0114
lea eax, [ebp - 0x3ac]
push eax
lea eax, [ebp - 0xc64]
push str.CLSID_s
push eax
call fcn.100a0114
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
add esp, 0x1c
push ebx
lea eax, [ebp + 0x54]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push str.SoftwareMicrosoftInternet_ExplorerToolbar
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x54], ebx
call edi
push ebx
push ebx
push 3
push ebx
lea eax, [ebp - 0x3ac]
push eax
push dword [ebp + 0x54]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 0x54]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push 1
mov ecx, 0x1010c90c
call fcn.1005641b
push ebx
mov dword [ebp + 0x3c], eax
lea eax, [ebp + 0x54]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
lea eax, [ebp - 0xc64]
push eax
push SysReAllocString
call edi
lea eax, [ebp + 0x4c]
push ebx
push eax
call fcn.100449b3
pop ecx
pop ecx
push ebx
lea ecx, [ebp + 0x4c]
call fcn.10003413
push eax
lea eax, [ebp - 0x241c]
push str._ssettings
push eax
call fcn.100a0114
push 0x180
call fcn.100a00a4
add esp, 0x10
cmp eax, ebx
je 0x10057764
push ebx
mov ecx, eax
call fcn.1002c567
mov edi, eax
jmp 0x10057766
xor edi, edi
push ebx
push ebx
push ebx
push ebx
push ebx
push str.TOOLBAR
push edi
lea ecx, [ebp - 0x14]
call fcn.10081e7f
push ebx
push 1
push ebx
lea eax, [ebp - 0x241c]
push eax
lea ecx, [ebp - 0x14]
call fcn.10082725
cmp dword [ebp + 0x20], 0xffffff92
je 0x100577b3
cmp dword [ebp + 0x20], ebx
je 0x100577b3
cmp dword [ebp + 0x20], 0xffffff96
je 0x100577b3
cmp edi, ebx
je 0x10057fb7
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax + 8]
jmp 0x10057fb7
lea ecx, [edi + 0x34]
mov eax, dword [ecx]
mov eax, dword [eax - 0xc]
push ebx
mov dword [ebp + 0x68], eax
call fcn.10003413
mov ecx, dword [ebp + 0x68]
add ecx, ecx
push ecx
push eax
push 1
push ebx
push ebx
push dword [ebp + 0x54]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 0x54]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
mov ecx, esp
mov dword [ebp + 0x70], esp
push esi
call fcn.100057f4
push dword [edi + 0x44]
push ecx
mov ecx, esp
mov dword [ebp + 0x70], esp
push str.Height
call fcn.100057f4
call fcn.10044774
push 1
call fcn.1002ccb8
add esp, 0xc
lea eax, [edi + 0x34]
mov dword [ebp + 0x70], esp
mov ecx, esp
push eax
call fcn.100033f5
push 1
call fcn.10044cd9
lea eax, [ebp + 0x38]
push eax
call fcn.1004f38d
pop ecx
pop ecx
mov ecx, esp
mov dword [ebp + 0x70], esp
push esi
call fcn.100057f4
push ecx
mov dword [ebp + 0x70], esp
mov ebx, esp
push ecx
mov ecx, esp
mov dword [ebp + 0x70], esp
push esi
call fcn.100057f4
push ecx
lea eax, [ebp + 0x38]
mov dword [ebp + 0x70], esp
mov ecx, esp
push eax
call fcn.100033f5
push ecx
mov ecx, esp
mov dword [ebp + 0x70], esp
push str.toolbar_id
call fcn.100057f4
push ebx
call fcn.10044254
add esp, 0xc
mov ecx, esp
mov dword [ebp + 0x70], esp
push str.toolbar_id
call fcn.100057f4
call fcn.1004443f
add esp, 0xc
lea ecx, [ebp - 0x200c]
call fcn.10074bbc
mov dword [ebp - 0xd38], edi
mov eax, dword [edi + 0x134]
test eax, eax
je 0x1005795b
lea ecx, [eax + 0x34]
mov eax, dword [ecx + 0x10]
sub eax, dword [ecx + 0xc]
xor ebx, ebx
sar eax, 2
test eax, eax
jbe 0x1005795b
push ebx
call fcn.1000b27e
mov ecx, dword [eax]
mov eax, dword [ecx]
lea edx, [ebp - 0x1f54]
push edx
push str.ToolbarPtr
call dword [eax + 0x30]
mov ecx, dword [edi + 0x134]
push ebx
add ecx, 0x34
call fcn.1000b27e
mov ecx, dword [eax]
mov eax, dword [ecx]
push esi
push str.type
call dword [eax + 0xc]
push str.ManualUpdate
push eax
mov dword [ebp + 0x58], eax
call fcn.1009fb99
pop ecx
pop ecx
test eax, eax
je 0x10057930
push dword [ebp + 0x58]
lea ecx, [ebp - 0x1f54]
call fcn.1005c57f
mov eax, dword [edi + 0x134]
lea ecx, [eax + 0x34]
mov eax, dword [ecx + 0x10]
sub eax, dword [ecx + 0xc]
inc ebx
sar eax, 2
cmp ebx, eax
jb 0x100578c0
jmp 0x1005795b
mov ecx, dword [edi + 0x134]
push ebx
add ecx, 0x34
call fcn.1000b27e
mov ecx, dword [eax]
mov eax, dword [ecx]
lea edx, [ebp - 0x1f54]
push edx
call dword [eax + 0x2c]
push dword [ebp + 0x58]
lea ecx, [ebp - 0x1f54]
call fcn.1005c57f
push ecx
mov ecx, esp
mov dword [ebp + 0x70], esp
push esi
call fcn.100057f4
push ecx
mov ecx, esp
mov dword [ebp + 0x70], esp
mov ebx, 0x100c5cf8
push ebx
call fcn.100057f4
push ecx
mov ecx, esp
mov dword [ebp + 0x70], esp
push str.Updating
call fcn.100057f4
lea eax, [ebp + 0x48]
push eax
call fcn.10044254
add esp, 0x10
push ebx
lea ecx, [ebp + 0x48]
call fcn.1000272b
test eax, eax
jne 0x100579d5
push ecx
mov ecx, esp
mov dword [ebp + 0x70], esp
push esi
call fcn.100057f4
push ecx
mov ecx, esp
mov dword [ebp + 0x70], esp
push 0x100c51a4
call fcn.100057f4
push ecx
mov ecx, esp
mov dword [ebp + 0x70], esp
push str.firstTime
call fcn.100057f4
call fcn.1004443f
add esp, 0xc
push 0x208
lea eax, [ebp - 0x21c]
push eax
push dword [0x1010dbb8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x21c]
push 0x5c
push eax
call fcn.100a3d96
pop ecx
pop ecx
test eax, eax
je 0x10057a06
xor ecx, ecx
mov word [eax], cx
push 0x100c6e54
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x5b4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str..dll
lea eax, [ebp - 0x5b4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0xa0c]
push eax
lea eax, [ebp - 0x5b4]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp + 0x68], eax
cmp eax, 0xffffffff
je 0x10057afa
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x7bc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x9e0]
push eax
lea eax, [ebp - 0x7bc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x7bc]
push eax
call fcn.100279d8
mov dword [ebp + 0x74], eax
test eax, eax
je 0x10057ad9
push str.PlugInvoke
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.IsUnicode
push dword [ebp + 0x74]
mov dword [ebp + 0x58], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10057ad0
cmp dword [ebp + 0x58], 0
je 0x10057ad0
call eax
test al, al
je 0x10057ad0
push 0
push str.Registration
call dword [ebp + 0x58]
push dword [ebp + 0x74]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0xa0c]
push eax
push dword [ebp + 0x68]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10057a5e
push dword [ebp + 0x68]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [edi + 0x130]
test ecx, ecx
je 0x10057f8d
mov eax, dword [ecx + 0xc0]
sub eax, dword [ecx + 0xbc]
and dword [ebp + 0x74], 0
add ecx, 0xb0
sar eax, 2
test eax, eax
jbe 0x10057b5e
push dword [ebp + 0x74]
call fcn.1000b27e
mov ecx, dword [eax]
mov eax, dword [ecx]
lea edx, [ebp - 0x1f54]
push edx
call dword [eax + 0x24]
mov ecx, dword [edi + 0x130]
mov eax, dword [ecx + 0xc0]
sub eax, dword [ecx + 0xbc]
inc dword [ebp + 0x74]
add ecx, 0xb0
sar eax, 2
cmp dword [ebp + 0x74], eax
jb 0x10057b25
mov ecx, dword [edi + 0x130]
mov eax, dword [ecx + 0xa8]
sub eax, dword [ecx + 0xa4]
and dword [ebp + 0x74], 0
add ecx, 0x98
sar eax, 2
test eax, eax
jbe 0x10057bba
push dword [ebp + 0x74]
call fcn.1000b27e
mov ecx, dword [eax]
mov eax, dword [ecx]
lea edx, [ebp - 0x1f54]
push edx
call dword [eax + 0x24]
mov ecx, dword [edi + 0x130]
mov eax, dword [ecx + 0xa8]
sub eax, dword [ecx + 0xa4]
inc dword [ebp + 0x74]
add ecx, 0x98
sar eax, 2
cmp dword [ebp + 0x74], eax
jb 0x10057b81
push 0x1010dc04
lea ecx, [ebp + 0x74]
call fcn.1005d077
push ebx
lea ecx, [ebp + 0x48]
mov byte [ebp + 0x6f], 0
call fcn.1000272b
push ecx
mov ecx, esp
mov dword [ebp + 0x70], esp
test eax, eax
jne 0x10057c09
push str.firstURL
call fcn.100057f4
lea eax, [ebp + 0x68]
push eax
mov ecx, edi
call fcn.1003111a
push eax
lea ecx, [ebp + 0x74]
call fcn.100046db
mov ecx, dword [ebp + 0x68]
add ecx, 0xfffffff0
call fcn.10001ccd
jmp 0x10057c66
push 0x100cdc98
call fcn.100057f4
lea eax, [ebp + 0x68]
push eax
mov ecx, edi
call fcn.1003111a
push eax
lea ecx, [ebp + 0x74]
call fcn.100046db
mov ecx, dword [ebp + 0x68]
add ecx, 0xfffffff0
call fcn.10001ccd
push ecx
mov ecx, esp
mov dword [ebp + 0x70], esp
push esi
call fcn.100057f4
push ecx
mov ecx, esp
mov dword [ebp + 0x70], esp
push ebx
call fcn.100057f4
push ecx
mov ecx, esp
mov dword [ebp + 0x70], esp
push str.Updating
call fcn.100057f4
call fcn.1004443f
add esp, 0xc
mov byte [ebp + 0x6f], 1
mov eax, dword [ebp + 0x74]
cmp dword [eax - 0xc], 0
jne 0x10057c7c
push str.about:blank
lea ecx, [ebp + 0x74]
call fcn.100049c6
push dword [ebp + 0x74]
call fcn.1009e314
mov dword [ebp + 0x58], eax
lea eax, [ebp + 0x58]
push eax
call fcn.1006dbde
pop ecx
pop ecx
push dword [ebp + 0x58]
lea ecx, [ebp + 0x74]
call fcn.100049c6
push dword [ebp + 0x58]
call fcn.1009f74b
pop ecx
push dword [0x1010c400]
lea ecx, [ebp + 0x70]
call fcn.1000274d
push str.about:blank
lea ecx, [ebp + 0x74]
call fcn.1000272b
test eax, eax
je 0x10057ccb
cmp byte [ebp + 0x6f], 0
je 0x10057d18
cmp byte [ebp + 0x6f], 0
je 0x10057d1e
push ecx
mov ecx, esp
mov dword [ebp + 0x64], esp
push esi
mov dword [ebp + 0x5c], 1
call fcn.100057f4
push ecx
mov ecx, esp
mov dword [ebp + 0x64], esp
push ebx
call fcn.100057f4
push ecx
mov ecx, esp
mov dword [ebp + 0x64], esp
push str.updateWaitForRestart
call fcn.100057f4
lea eax, [ebp + 0x68]
push eax
call fcn.10044254
add esp, 0x10
push ebx
mov ecx, eax
call fcn.1000272b
test eax, eax
jne 0x10057d1e
mov byte [ebp + 0x63], 1
jmp 0x10057d22
mov byte [ebp + 0x63], 0
test byte [ebp + 0x5c], 1
je 0x10057d37
mov ecx, dword [ebp + 0x68]
and dword [ebp + 0x5c], 0xfffffffe
add ecx, 0xfffffff0
call fcn.10001ccd
cmp byte [ebp + 0x63], 0
je 0x10057e12
push 0
push str.http:__
lea ecx, [ebp + 0x74]
call fcn.10002fb2
cmp eax, 0xffffffff
jne 0x10057dba
push 0
push 0x100c54a0
lea ecx, [ebp + 0x74]
call fcn.10002fb2
cmp eax, 0xffffffff
jne 0x10057dba
push 0
push str.about:blank
lea ecx, [ebp + 0x74]
call fcn.10002fb2
cmp eax, 0xffffffff
jne 0x10057dba
lea eax, [ebp + 0x74]
push eax
lea eax, [ebp + 0x64]
push 0
push eax
call fcn.100449b3
pop ecx
pop ecx
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.10004f80
add esp, 0xc
push eax
lea ecx, [ebp + 0x74]
call fcn.100046db
mov ecx, dword [ebp + 0x68]
add ecx, 0xfffffff0
call fcn.10001ccd
mov ecx, dword [ebp + 0x64]
add ecx, 0xfffffff0
call fcn.10001ccd
push ecx
mov ecx, esp
mov dword [ebp + 0x64], esp
push esi
call fcn.100057f4
push 1
push ecx
mov ecx, esp
mov dword [ebp + 0x64], esp
push str.force_parse_events
call fcn.100057f4
call fcn.10044774
pop ecx
pop ecx
mov ecx, esp
mov dword [ebp + 0x64], esp
push esi
call fcn.100057f4
push ecx
mov ecx, esp
mov dword [ebp + 0x64], esp
push 0x100c51a4
call fcn.100057f4
push ecx
mov ecx, esp
mov dword [ebp + 0x64], esp
push str.TBShow
call fcn.100057f4
call fcn.1004443f
add esp, 0xc
cmp byte [ebp + 0x6f], 0
je 0x10057e75
push str.about:blank
lea ecx, [ebp + 0x74]
call fcn.1000272b
test eax, eax
je 0x10057e75
or dword [ebp + 0x5c], 2
push ecx
mov ecx, esp
mov dword [ebp + 0x68], esp
push esi
call fcn.100057f4
push ecx
mov ecx, esp
mov dword [ebp + 0x68], esp
push ebx
call fcn.100057f4
push ecx
mov ecx, esp
mov dword [ebp + 0x68], esp
push str.updateWaitForRestart
call fcn.100057f4
lea eax, [ebp + 0x64]
push eax
call fcn.10044254
add esp, 0x10
push 0x100c51a4
mov ecx, eax
call fcn.1000272b
test eax, eax
jne 0x10057e75
mov bl, 1
jmp 0x10057e77
xor bl, bl
test byte [ebp + 0x5c], 2
je 0x10057e88
mov ecx, dword [ebp + 0x64]
add ecx, 0xfffffff0
call fcn.10001ccd
test bl, bl
je 0x10057f3b
lea eax, [ebp + 0x64]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftInternet_ExplorerMain
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10057f3b
mov eax, dword [ebp + 0x64]
and dword [ebp + 0x44], 0
mov dword [ebp + 0x40], eax
lea eax, [ebp + 0x68]
push eax
mov ebx, str.Start_Page
push ebx
lea eax, [ebp - 0x2c1c]
push eax
lea ecx, [ebp + 0x40]
mov dword [ebp + 0x68], 0x3e8
call fcn.10042493
push ecx
mov ecx, esp
mov dword [ebp + 0x5c], esp
push esi
call fcn.100057f4
push ecx
lea eax, [ebp - 0x2c1c]
mov ecx, esp
mov dword [ebp + 0x5c], esp
push eax
call fcn.100057f4
push ecx
mov ecx, esp
mov dword [ebp + 0x5c], esp
push str.prevHomePage
call fcn.100057f4
call fcn.1004443f
add esp, 0xc
push 0xffffffffffffffff
push 0
push ebx
push 0
lea ecx, [ebp + 0x74]
call fcn.10003413
push eax
lea ecx, [ebp + 0x40]
call fcn.10042522
lea ecx, [ebp + 0x40]
call fcn.1000146a
lea ecx, [ebp + 0x40]
call fcn.1000146a
and dword [ebp - 0xd38], 0
push ecx
mov ecx, esp
mov dword [ebp + 0x64], esp
push esi
call fcn.100057f4
push ecx
mov ecx, esp
mov dword [ebp + 0x64], esp
push 0x100c51a4
call fcn.100057f4
push ecx
mov ecx, esp
mov dword [ebp + 0x64], esp
push str.TBShow
call fcn.100057f4
call fcn.1004443f
mov ecx, dword [ebp + 0x70]
add esp, 0xc
test ecx, ecx
je 0x10057f82
call fcn.10003043
mov ecx, dword [ebp + 0x74]
add ecx, 0xfffffff0
call fcn.10001ccd
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax + 8]
mov ecx, dword [ebp + 0x48]
add ecx, 0xfffffff0
call fcn.10001ccd
lea ecx, [ebp - 0x200c]
call fcn.1007300a
mov ecx, dword [ebp + 0x38]
add ecx, 0xfffffff0
call fcn.10001ccd
lea ecx, [ebp - 0x14]
call fcn.10081e59
mov ecx, dword [ebp + 0x4c]
add ecx, 0xfffffff0
call fcn.10001ccd
mov ecx, dword [ebp + 0x50]
add ecx, 0xfffffff0
call fcn.10001ccd
mov eax, dword [ebp + 0x3c]
pop edi
pop esi
pop ebx
add ebp, 0x78
leave
ret