Function at 0x1003e072
Capabilities:
Check internet connectivity via wininet
Create process on windows
Delete registry value

Disassembly:
push ebp
sub esp, 0x38
mov eax, 0x100e5390
call fcn.100c908c
push ecx
mov eax, 0x1734
call fcn.100c7e50
push ebx
push esi
push edi
lea eax, [ebp + 0x24]
mov dword [ebp - 0x10], esp
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.10060b08
pop ecx
xor eax, eax
push 0x206
mov word [ebp - 0x374], ax
lea eax, [ebp - 0x372]
push ebx
push eax
mov byte [ebp - 4], 1
call fcn.100c7c60
add esp, 0xc
push ebx
lea ecx, [ebp + 0x24]
call fcn.100054ad
push eax
lea eax, [ebp - 0x374]
push str._ssettings
push eax
call fcn.100c886e
push 0x1bc
call fcn.100c839d
mov ecx, eax
add esp, 0x10
mov dword [ebp + 0x34], ecx
mov byte [ebp - 4], 2
cmp ecx, ebx
je 0x1003e101
push ebx
call fcn.10030569
mov esi, eax
jmp 0x1003e103
xor esi, esi
push ebx
xor edi, edi
inc edi
push edi
push ebx
push ebx
push ebx
push str.TOOLBAR
push esi
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 1
call fcn.100986a8
push edi
push ebx
push ebx
push edi
push ebx
lea eax, [ebp - 0x374]
push eax
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 3
call fcn.1009a79b
cmp dword [ebp - 0x34], 0xffffff92
je 0x1003e183
cmp dword [ebp - 0x34], ebx
je 0x1003e183
cmp dword [ebp - 0x34], 0xffffff96
je 0x1003e183
cmp esi, ebx
je 0x1003e152
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 8]
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 1
call fcn.10098460
mov ecx, dword [ebp + 0x24]
add ecx, 0xfffffff0
call fcn.10003f60
xor al, al
lea esp, [ebp - 0x1750]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add ebp, 0x3c
leave
ret
cmp esi, ebx
je 0x1003e483
cmp dword [esi + 0x168], ebx
je 0x1003e47b
lea ecx, [ebp - 0x1744]
call fcn.10089344
mov byte [ebp - 4], 4
mov dword [ebp - 0x488], esi
xor edi, edi
mov eax, dword [esi + 0x168]
lea ecx, [eax + 0xcc]
mov eax, dword [ecx + 0x10]
sub eax, dword [ecx + 0xc]
sar eax, 2
cmp edi, eax
jae 0x1003e1de
push edi
call fcn.1008d01e
mov ecx, dword [eax]
mov eax, dword [ecx]
lea edx, [ebp - 0x168c]
push edx
call dword [eax + 0x24]
inc edi
jmp 0x1003e1ae
xor edi, edi
mov eax, dword [esi + 0x168]
lea ecx, [eax + 0xb4]
mov eax, dword [ecx + 0x10]
sub eax, dword [ecx + 0xc]
sar eax, 2
cmp edi, eax
jae 0x1003e210
push edi
call fcn.1008d01e
mov ecx, dword [eax]
mov eax, dword [ecx]
lea edx, [ebp - 0x168c]
push edx
call dword [eax + 0x24]
inc edi
jmp 0x1003e1e0
push ecx
mov ecx, esp
mov dword [ebp + 0x34], esp
push str.urlAfterUninstall
call fcn.10009e15
lea eax, [ebp + 0x30]
push eax
mov ecx, esi
call fcn.1004ee1b
push ecx
lea eax, [esi + 0x54]
mov dword [ebp + 0x34], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 5
call fcn.1000548f
push ebx
call fcn.10062c27
mov eax, dword [esi]
pop ecx
pop ecx
push 1
mov ecx, esi
call dword [eax + 8]
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x488], ebx
cmp dword [eax - 0xc], ebx
je 0x1003e3f4
push eax
call fcn.100b9af6
mov dword [ebp + 0x38], eax
pop ecx
lea eax, [ebp + 0x38]
push eax
call fcn.1007c1d6
pop ecx
push dword [ebp + 0x38]
lea ecx, [ebp + 0x30]
call fcn.10006a3d
push dword [ebp + 0x38]
call fcn.100b9b2e
pop ecx
lea eax, [ebp + 0x34]
push eax
call fcn.10023b23
pop ecx
push 0x1014f4dc
push eax
lea eax, [ebp + 0x38]
push eax
mov byte [ebp - 4], 6
call fcn.10006f5b
add esp, 0xc
push 0x100f777c
push eax
lea eax, [ebp + 0x1c]
push eax
mov byte [ebp - 4], 7
call fcn.10006fb9
add esp, 0xc
mov ecx, dword [ebp + 0x38]
add ecx, 0xfffffff0
call fcn.10003f60
mov ecx, dword [ebp + 0x34]
add ecx, 0xfffffff0
call fcn.10003f60
mov dword [ebp + 0x14], ebx
mov dword [ebp + 0x18], ebx
push ebx
push ebx
push 0x2001f
push ebx
push ebx
push dword [ebp + 0x1c]
lea ecx, [ebp + 0x14]
push SysReAllocString
mov byte [ebp - 4], 0xb
call fcn.1000379b
lea eax, [ebp + 0x20]
push eax
push str.SilentUninstall
lea ecx, [ebp + 0x14]
mov dword [ebp + 0x20], ebx
call fcn.10030e70
push ebx
cmp dword [ebp + 0x20], ebx
jne 0x1003e334
lea ecx, [ebp + 0x30]
call fcn.100054ad
push 5
push ebx
push eax
push 0x100f646c
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1003e3e1
lea eax, [ebp + 0x34]
push eax
mov dword [ebp + 0x34], ebx
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x1003e3e1
mov edi, dword [ebp + 0x30]
cmp edi, ebx
je 0x1003e35f
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x1003e363
xor eax, eax
jmp 0x1003e37c
lea esi, [eax + eax]
mov eax, esi
call fcn.100c91f0
mov dword [ebp - 0x10], esp
mov eax, esp
push 3
push esi
push edi
push eax
call fcn.10003212
sub esp, 0x1c
mov ecx, esp
mov dword [ebp + 0x38], esp
push eax
call fcn.1000138b
lea ecx, [ebp - 0x16c]
call fcn.10018c0a
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp + 0x38], esp
mov esi, 0x1010d91c
push esi
mov byte [ebp - 4], 0xc
call fcn.1000138b
push 1
push ebx
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp + 0x2c], esp
push esi
mov byte [ebp - 4], 0xd
call fcn.1000138b
lea ecx, [ebp - 0x16c]
mov byte [ebp - 4], 0xc
call fcn.10001c0c
lea ecx, [ebp - 0x16c]
mov byte [ebp - 4], 0xb
call fcn.1000200c
lea ecx, [ebp + 0x14]
call fcn.10003780
mov ecx, dword [ebp + 0x1c]
add ecx, 0xfffffff0
call fcn.10003f60
mov dword [ebp + 0x28], ebx
mov dword [ebp + 0x2c], ebx
push ebx
push ebx
push 0x2001f
push ebx
push ebx
push str.SoftwareMicrosoftInternet_ExplorerURLSearchHooks_
push SysReAllocString
lea ecx, [ebp + 0x28]
mov byte [ebp - 4], 0xe
call fcn.1000379b
cmp eax, ebx
jne 0x1003e449
push 0xffffffffffffffff
push ebx
push str.CFBFAE00_17A6_11D0_99CB_00C04FD64497
push 0x1010d92c
lea ecx, [ebp + 0x28]
call fcn.10030ea8
push dword [0x1014f4b8]
push dword [ebp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp + 0x28]
call fcn.10003780
lea ecx, [ebp + 0x28]
call fcn.10003780
mov ecx, dword [ebp + 0x30]
add ecx, 0xfffffff0
call fcn.10003f60
lea ecx, [ebp - 0x1744]
mov byte [ebp - 4], 3
call fcn.10087db4
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 1
call fcn.10098460
mov bl, 1
jmp 0x1003e48f
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 8]
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 1
call fcn.10098460
mov ecx, dword [ebp + 0x24]
add ecx, 0xfffffff0
call fcn.10003f60
mov al, bl
jmp 0x1003e16b