Function at 0x1006834d
Capabilities:
Delete registry key
Enumerate files on windows
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78]
mov eax, 0x2ce0
call fcn.100c7e50
push ebx
push esi
lea eax, [ebp + 0x50]
push edi
xor ebx, ebx
push eax
mov dword [ebp + 0x5c], ebx
call fcn.10060a0a
pop ecx
mov edi, 0x1010d92c
push edi
push 0x100f777c
lea ecx, [ebp + 0x50]
call fcn.10006657
lea eax, [ebp + 0x50]
push eax
call fcn.10061b6f
push dword [0x1014f498]
lea eax, [ebp - 0x3d0]
push 0x100fc714
push eax
call fcn.100c886e
lea eax, [ebp - 0x3d0]
push eax
lea eax, [ebp - 0xc88]
push str.CLSID_s
push eax
call fcn.100c886e
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
add esp, 0x1c
push ebx
lea eax, [ebp + 0x54]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push str.SoftwareMicrosoftInternet_ExplorerToolbar
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x54], ebx
call esi
push ebx
push ebx
push 3
push ebx
lea eax, [ebp - 0x3d0]
push eax
push dword [ebp + 0x54]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 0x54]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push 1
mov ecx, 0x1014fab0
call fcn.10067473
push 1
push ebx
mov dword [ebp + 0x3c], eax
call fcn.10070821
pop ecx
pop ecx
push ebx
lea eax, [ebp + 0x54]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
lea eax, [ebp - 0xc88]
push eax
push SysReAllocString
call esi
lea eax, [ebp + 0x4c]
push eax
call fcn.10060b08
pop ecx
push ebx
lea ecx, [ebp + 0x4c]
call fcn.100054ad
push eax
lea eax, [ebp - 0x2468]
push str._ssettings
push eax
call fcn.100c886e
push 0x1bc
call fcn.100c839d
add esp, 0x10
cmp eax, ebx
je 0x10068475
push ebx
mov ecx, eax
call fcn.10030569
mov esi, eax
jmp 0x10068477
xor esi, esi
push ebx
push ebx
push ebx
push ebx
push ebx
push str.TOOLBAR
push esi
lea ecx, [ebp - 0x38]
call fcn.100986a8
push 1
push ebx
push ebx
push 1
push ebx
lea eax, [ebp - 0x2468]
push eax
lea ecx, [ebp - 0x38]
call fcn.1009a79b
cmp dword [ebp + 0x14], 0xffffff92
je 0x100684c7
cmp dword [ebp + 0x14], ebx
je 0x100684c7
cmp dword [ebp + 0x14], 0xffffff96
je 0x100684c7
cmp esi, ebx
je 0x10068e23
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 8]
jmp 0x10068e23
lea ecx, [esi + 0x54]
mov eax, dword [ecx]
mov eax, dword [eax - 0xc]
push ebx
mov dword [ebp + 0x70], eax
call fcn.100054ad
mov ecx, dword [ebp + 0x70]
add ecx, ecx
push ecx
push eax
push 1
push ebx
push ebx
push dword [ebp + 0x54]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 0x54]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
mov ecx, esp
mov dword [ebp + 0x6c], esp
push edi
call fcn.10009e15
push dword [esi + 0x64]
push ecx
mov ecx, esp
mov dword [ebp + 0x6c], esp
push str.Height
call fcn.10009e15
call fcn.10062441
push 1
call sym.Toolbar.DLL_ToolbarUpdateProc
add esp, 0xc
lea eax, [esi + 0x54]
mov dword [ebp + 0x6c], esp
mov ecx, esp
push eax
call fcn.1000548f
push 1
call fcn.10062c27
pop ecx
pop ecx
call fcn.1009612b
push str.SoftwareMicrosoftWindowsCurrentVersionExtSettings_
lea ecx, [ebp + 0x74]
call fcn.10009e15
push 0x1014f498
lea eax, [ebp + 0x74]
push eax
lea eax, [ebp + 0x70]
push eax
call fcn.10006f5b
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
add esp, 0xc
push dword [eax]
push SysReAllocString
call ebx
mov ecx, dword [ebp + 0x70]
add ecx, 0xfffffff0
call fcn.10003f60
push 0x1014f4d8
lea eax, [ebp + 0x74]
push eax
lea eax, [ebp + 0x70]
push eax
call fcn.10006f5b
add esp, 0xc
push dword [eax]
push SysReAllocString
call ebx
mov ecx, dword [ebp + 0x70]
add ecx, 0xfffffff0
call fcn.10003f60
mov ecx, dword [ebp + 0x74]
add ecx, 0xfffffff0
call fcn.10003f60
lea eax, [ebp + 0x38]
push eax
call fcn.1003e534
mov ecx, esp
mov dword [ebp + 0x6c], esp
push edi
call fcn.10009e15
push ecx
mov dword [ebp + 0x6c], esp
mov ebx, esp
push ecx
mov ecx, esp
mov dword [ebp + 0x6c], esp
push edi
call fcn.10009e15
push ecx
lea eax, [ebp + 0x38]
mov dword [ebp + 0x6c], esp
mov ecx, esp
push eax
call fcn.1000548f
push ecx
mov ecx, esp
mov dword [ebp + 0x6c], esp
push str.toolbar_id
call fcn.10009e15
push ebx
call fcn.10061f03
add esp, 0xc
mov ecx, esp
mov dword [ebp + 0x6c], esp
push str.toolbar_id
call fcn.10009e15
call fcn.1006210c
add esp, 0xc
lea ecx, [ebp - 0x2058]
call fcn.10089344
mov dword [ebp - 0xd9c], esi
mov eax, dword [esi + 0x16c]
test eax, eax
je 0x100686e4
lea ecx, [eax + 0x50]
mov eax, dword [ecx + 0x10]
sub eax, dword [ecx + 0xc]
xor ebx, ebx
sar eax, 2
test eax, eax
jbe 0x100686e4
push ebx
call fcn.1008d01e
mov ecx, dword [eax]
mov eax, dword [ecx]
lea edx, [ebp - 0x1fa0]
push edx
push str.ToolbarPtr
call dword [eax + 0x30]
mov ecx, dword [esi + 0x16c]
push ebx
add ecx, 0x50
call fcn.1008d01e
mov ecx, dword [eax]
mov eax, dword [ecx]
push edi
push 0x100f402c
call dword [eax + 0xc]
push str.ManualUpdate
push eax
mov dword [ebp + 0x58], eax
call fcn.100c810c
pop ecx
pop ecx
test eax, eax
je 0x100686b9
push dword [ebp + 0x58]
lea ecx, [ebp - 0x1fa0]
call fcn.10070e88
mov eax, dword [esi + 0x16c]
lea ecx, [eax + 0x50]
mov eax, dword [ecx + 0x10]
sub eax, dword [ecx + 0xc]
inc ebx
sar eax, 2
cmp ebx, eax
jb 0x10068649
jmp 0x100686e4
mov ecx, dword [esi + 0x16c]
push ebx
add ecx, 0x50
call fcn.1008d01e
mov ecx, dword [eax]
mov eax, dword [ecx]
lea edx, [ebp - 0x1fa0]
push edx
call dword [eax + 0x2c]
push dword [ebp + 0x58]
lea ecx, [ebp - 0x1fa0]
call fcn.10070e88
push ecx
mov ecx, esp
mov dword [ebp + 0x6c], esp
push edi
call fcn.10009e15
push ecx
mov ecx, esp
mov dword [ebp + 0x6c], esp
mov ebx, 0x1010d9f4
push ebx
call fcn.10009e15
push ecx
mov ecx, esp
mov dword [ebp + 0x6c], esp
push str.Updating
call fcn.10009e15
lea eax, [ebp + 0x48]
push eax
call fcn.10061f03
add esp, 0x10
push ebx
lea ecx, [ebp + 0x48]
call fcn.10004959
test eax, eax
jne 0x1006875e
push ecx
mov ecx, esp
mov dword [ebp + 0x6c], esp
push edi
call fcn.10009e15
push ecx
mov ecx, esp
mov dword [ebp + 0x6c], esp
push 0x100f45a0
call fcn.10009e15
push ecx
mov ecx, esp
mov dword [ebp + 0x6c], esp
push str.firstTime
call fcn.10009e15
call fcn.1006210c
add esp, 0xc
push 0x208
lea eax, [ebp - 0x240]
push eax
push dword [0x101519ac]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x240]
push 0x5c
push eax
call fcn.100cc287
pop ecx
pop ecx
test eax, eax
je 0x1006878f
xor ecx, ecx
mov word [eax], cx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x100f6c64
lea eax, [ebp - 0x240]
push eax
call ebx
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x5d8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str..dll
lea eax, [ebp - 0x5d8]
push eax
call ebx
lea eax, [ebp - 0xa30]
push eax
lea eax, [ebp - 0x5d8]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp + 0x70], eax
cmp eax, 0xffffffff
je 0x1006887d
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x7e0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0xa04]
push eax
lea eax, [ebp - 0x7e0]
push eax
call ebx
lea eax, [ebp - 0x7e0]
push eax
call fcn.1001f65e
mov dword [ebp + 0x74], eax
test eax, eax
je 0x1006885c
push str.PlugInvoke
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.IsUnicode
push dword [ebp + 0x74]
mov dword [ebp + 0x58], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10068853
cmp dword [ebp + 0x58], 0
je 0x10068853
call eax
test al, al
je 0x10068853
push 0
push str.Registration
call dword [ebp + 0x58]
push dword [ebp + 0x74]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0xa30]
push eax
push dword [ebp + 0x70]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x100687e5
push dword [ebp + 0x70]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esi + 0x168]
test ecx, ecx
je 0x10068df9
mov eax, dword [ecx + 0xdc]
sub eax, dword [ecx + 0xd8]
add ecx, 0xcc
sar eax, 2
xor ebx, ebx
test eax, eax
jbe 0x100688da
push ebx
call fcn.1008d01e
mov ecx, dword [eax]
mov eax, dword [ecx]
lea edx, [ebp - 0x1fa0]
push edx
call dword [eax + 0x24]
mov ecx, dword [esi + 0x168]
mov eax, dword [ecx + 0xdc]
sub eax, dword [ecx + 0xd8]
add ecx, 0xcc
inc ebx
sar eax, 2
cmp ebx, eax
jb 0x100688a6
mov ecx, dword [esi + 0x168]
mov eax, dword [ecx + 0xc4]
sub eax, dword [ecx + 0xc0]
add ecx, 0xb4
sar eax, 2
xor ebx, ebx
test eax, eax
jbe 0x1006892f
push ebx
call fcn.1008d01e
mov ecx, dword [eax]
mov eax, dword [ecx]
lea edx, [ebp - 0x1fa0]
push edx
call dword [eax + 0x24]
mov ecx, dword [esi + 0x168]
mov eax, dword [ecx + 0xc4]
sub eax, dword [ecx + 0xc0]
add ecx, 0xb4
inc ebx
sar eax, 2
cmp ebx, eax
jb 0x100688fb
mov ecx, dword [esi + 0x168]
mov eax, dword [ecx + 0x94]
sub eax, dword [ecx + 0x90]
add ecx, 0x84
sar eax, 2
xor ebx, ebx
test eax, eax
jbe 0x10068984
push ebx
call fcn.1008d01e
mov ecx, dword [eax]
mov eax, dword [ecx]
lea edx, [ebp - 0x1fa0]
push edx
call dword [eax + 0x24]
mov ecx, dword [esi + 0x168]
mov eax, dword [ecx + 0x94]
sub eax, dword [ecx + 0x90]
add ecx, 0x84
inc ebx
sar eax, 2
cmp ebx, eax
jb 0x10068950
mov ecx, dword [esi + 0x168]
mov eax, dword [ecx + 0x94]
sub eax, dword [ecx + 0x90]
add ecx, 0x84
sar eax, 2
xor ebx, ebx
test eax, eax
jbe 0x100689d9
push ebx
call fcn.1008d01e
mov ecx, dword [eax]
mov eax, dword [ecx]
lea edx, [ebp - 0x1fa0]
push edx
call dword [eax + 0x24]
mov ecx, dword [esi + 0x168]
mov eax, dword [ecx + 0x94]
sub eax, dword [ecx + 0x90]
add ecx, 0x84
inc ebx
sar eax, 2
cmp ebx, eax
jb 0x100689a5
mov ecx, dword [esi + 0x168]
mov eax, dword [ecx + 0x7c]
sub eax, dword [ecx + 0x78]
add ecx, 0x6c
sar eax, 2
xor ebx, ebx
test eax, eax
jbe 0x10068a1c
push ebx
call fcn.1008d01e
mov ecx, dword [eax]
mov eax, dword [ecx]
lea edx, [ebp - 0x1fa0]
push edx
call dword [eax + 0x24]
mov ecx, dword [esi + 0x168]
mov eax, dword [ecx + 0x7c]
sub eax, dword [ecx + 0x78]
add ecx, 0x6c
inc ebx
sar eax, 2
cmp ebx, eax
jb 0x100689f1
push esi
call fcn.100200a1
lea ecx, [ebp + 0x74]
mov dword [esp], 0x101519f8
call fcn.1007170f
mov ebx, 0x1010d9f4
push ebx
lea ecx, [ebp + 0x48]
mov byte [ebp + 0x6b], 0
call fcn.10004959
push ecx
mov ecx, esp
mov dword [ebp + 0x6c], esp
test eax, eax
jne 0x10068a78
push 0x100fb338
call fcn.10009e15
lea eax, [ebp + 0x70]
push eax
mov ecx, esi
call fcn.1004ee1b
push eax
lea ecx, [ebp + 0x74]
call fcn.1000688b
mov ecx, dword [ebp + 0x70]
add ecx, 0xfffffff0
call fcn.10003f60
jmp 0x10068ad5
push 0x100fb360
call fcn.10009e15
lea eax, [ebp + 0x70]
push eax
mov ecx, esi
call fcn.1004ee1b
push eax
lea ecx, [ebp + 0x74]
call fcn.1000688b
mov ecx, dword [ebp + 0x70]
add ecx, 0xfffffff0
call fcn.10003f60
push ecx
mov ecx, esp
mov dword [ebp + 0x6c], esp
push edi
call fcn.10009e15
push ecx
mov ecx, esp
mov dword [ebp + 0x6c], esp
push ebx
call fcn.10009e15
push ecx
mov ecx, esp
mov dword [ebp + 0x6c], esp
push str.Updating
call fcn.10009e15
call fcn.1006210c
add esp, 0xc
mov byte [ebp + 0x6b], 1
mov eax, dword [ebp + 0x74]
cmp dword [eax - 0xc], 0
jne 0x10068aeb
push str.about:blank
lea ecx, [ebp + 0x74]
call fcn.10006a3d
push dword [ebp + 0x74]
call fcn.100b9af6
mov dword [ebp + 0x58], eax
lea eax, [ebp + 0x58]
push eax
call fcn.1007c1d6
pop ecx
pop ecx
push dword [ebp + 0x58]
lea ecx, [ebp + 0x74]
call fcn.10006a3d
push dword [ebp + 0x58]
call fcn.100c7a58
pop ecx
push dword [0x1014f498]
lea ecx, [ebp + 0x6c]
call fcn.10004905
push str.about:blank
lea ecx, [ebp + 0x74]
call fcn.10004959
test eax, eax
je 0x10068b3a
cmp byte [ebp + 0x6b], 0
je 0x10068b87
cmp byte [ebp + 0x6b], 0
je 0x10068b8d
push ecx
mov ecx, esp
mov dword [ebp + 0x64], esp
push edi
mov dword [ebp + 0x5c], 1
call fcn.10009e15
push ecx
mov ecx, esp
mov dword [ebp + 0x64], esp
push ebx
call fcn.10009e15
push ecx
mov ecx, esp
mov dword [ebp + 0x64], esp
push str.updateWaitForRestart
call fcn.10009e15
lea eax, [ebp + 0x70]
push eax
call fcn.10061f03
add esp, 0x10
push ebx
mov ecx, eax
call fcn.10004959
test eax, eax
jne 0x10068b8d
mov byte [ebp + 0x63], 1
jmp 0x10068b91
mov byte [ebp + 0x63], 0
test byte [ebp + 0x5c], 1
je 0x10068ba6
mov ecx, dword [ebp + 0x70]
and dword [ebp + 0x5c], 0xfffffffe
add ecx, 0xfffffff0
call fcn.10003f60
cmp byte [ebp + 0x63], 0
je 0x10068c7e
push 0
push str.http:__
lea ecx, [ebp + 0x74]
call fcn.1000506b
cmp eax, 0xffffffff
jne 0x10068c26
push 0
push 0x100f446c
lea ecx, [ebp + 0x74]
call fcn.1000506b
cmp eax, 0xffffffff
jne 0x10068c26
push 0
push str.about:blank
lea ecx, [ebp + 0x74]
call fcn.1000506b
cmp eax, 0xffffffff
jne 0x10068c26
lea eax, [ebp + 0x74]
push eax
lea eax, [ebp + 0x64]
push eax
call fcn.10060b08
pop ecx
push eax
lea eax, [ebp + 0x70]
push eax
call fcn.10006f5b
add esp, 0xc
push eax
lea ecx, [ebp + 0x74]
call fcn.1000688b
mov ecx, dword [ebp + 0x70]
add ecx, 0xfffffff0
call fcn.10003f60
mov ecx, dword [ebp + 0x64]
add ecx, 0xfffffff0
call fcn.10003f60
push ecx
mov ecx, esp
mov dword [ebp + 0x64], esp
push edi
call fcn.10009e15
push 1
push ecx
mov ecx, esp
mov dword [ebp + 0x64], esp
push str.force_parse_events
call fcn.10009e15
call fcn.10062441
pop ecx
pop ecx
mov ecx, esp
mov dword [ebp + 0x64], esp
push edi
call fcn.10009e15
push ecx
mov ecx, esp
mov dword [ebp + 0x64], esp
push 0x100f45a0
call fcn.10009e15
push ecx
mov ecx, esp
mov dword [ebp + 0x64], esp
push str.TBShow
call fcn.10009e15
call fcn.1006210c
add esp, 0xc
cmp byte [ebp + 0x6b], 0
je 0x10068ce1
push str.about:blank
lea ecx, [ebp + 0x74]
call fcn.10004959
test eax, eax
je 0x10068ce1
or dword [ebp + 0x5c], 2
push ecx
mov ecx, esp
mov dword [ebp + 0x70], esp
push edi
call fcn.10009e15
push ecx
mov ecx, esp
mov dword [ebp + 0x70], esp
push ebx
call fcn.10009e15
push ecx
mov ecx, esp
mov dword [ebp + 0x70], esp
push str.updateWaitForRestart
call fcn.10009e15
lea eax, [ebp + 0x64]
push eax
call fcn.10061f03
add esp, 0x10
push 0x100f45a0
mov ecx, eax
call fcn.10004959
test eax, eax
jne 0x10068ce1
mov bl, 1
jmp 0x10068ce3
xor bl, bl
test byte [ebp + 0x5c], 2
je 0x10068cf4
mov ecx, dword [ebp + 0x64]
add ecx, 0xfffffff0
call fcn.10003f60
test bl, bl
je 0x10068da7
lea eax, [ebp + 0x64]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftInternet_ExplorerMain
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10068da7
mov eax, dword [ebp + 0x64]
and dword [ebp + 0x44], 0
mov dword [ebp + 0x40], eax
lea eax, [ebp + 0x70]
push eax
mov ebx, str.Start_Page
push ebx
lea eax, [ebp - 0x2c68]
push eax
lea ecx, [ebp + 0x40]
mov dword [ebp + 0x70], 0x3e8
call fcn.10030de1
push ecx
mov ecx, esp
mov dword [ebp + 0x5c], esp
push edi
call fcn.10009e15
push ecx
lea eax, [ebp - 0x2c68]
mov ecx, esp
mov dword [ebp + 0x5c], esp
push eax
call fcn.10009e15
push ecx
mov ecx, esp
mov dword [ebp + 0x5c], esp
push str.prevHomePage
call fcn.10009e15
call fcn.1006210c
add esp, 0xc
push 0xffffffffffffffff
push 0
push ebx
push 0
lea ecx, [ebp + 0x74]
call fcn.100054ad
push eax
lea ecx, [ebp + 0x40]
call fcn.10030ea8
lea ecx, [ebp + 0x40]
call fcn.10003780
lea ecx, [ebp + 0x40]
call fcn.10003780
and dword [ebp - 0xd9c], 0
push ecx
mov ecx, esp
mov dword [ebp + 0x64], esp
push edi
call fcn.10009e15
push ecx
mov ecx, esp
mov dword [ebp + 0x64], esp
push 0x100f45a0
call fcn.10009e15
push ecx
mov ecx, esp
mov dword [ebp + 0x64], esp
push str.TBShow
call fcn.10009e15
call fcn.1006210c
mov ecx, dword [ebp + 0x6c]
add esp, 0xc
test ecx, ecx
je 0x10068dee
call fcn.100050b9
mov ecx, dword [ebp + 0x74]
add ecx, 0xfffffff0
call fcn.10003f60
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 8]
mov ecx, dword [ebp + 0x48]
add ecx, 0xfffffff0
call fcn.10003f60
lea ecx, [ebp - 0x2058]
call fcn.10087db4
mov ecx, dword [ebp + 0x38]
add ecx, 0xfffffff0
call fcn.10003f60
lea ecx, [ebp - 0x38]
call fcn.10098460
mov ecx, dword [ebp + 0x4c]
add ecx, 0xfffffff0
call fcn.10003f60
mov ecx, dword [ebp + 0x50]
add ecx, 0xfffffff0
call fcn.10003f60
mov eax, dword [ebp + 0x3c]
pop edi
pop esi
pop ebx
add ebp, 0x78
leave
ret