Function at 0x1004a9ec
Capabilities:
Check internet connectivity via wininet
Create process on windows
Delete registry value

Disassembly:
push ebp
sub esp, 0x38
mov eax, 0x100c118c
call fcn.100a35ac
push ecx
mov eax, 0x16d0
call fcn.100a2680
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor ebx, ebx
lea eax, [ebp + 0x28]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.100404f4
pop ecx
pop ecx
xor eax, eax
push 0x206
mov word [ebp - 0x320], ax
lea eax, [ebp - 0x31e]
push ebx
push eax
mov byte [ebp - 4], 1
call fcn.100a2490
add esp, 0xc
push ebx
lea ecx, [ebp + 0x28]
call fcn.1000357f
push eax
lea eax, [ebp - 0x320]
push str._ssettings
push eax
call fcn.100a3075
push 0x1a0
call fcn.100a2ba4
mov ecx, eax
add esp, 0x10
mov dword [ebp + 0x38], ecx
mov byte [ebp - 4], 2
cmp ecx, ebx
je 0x1004aa7d
push ebx
call fcn.10021ad9
mov esi, eax
jmp 0x1004aa7f
xor esi, esi
push ebx
xor edi, edi
inc edi
push edi
push ebx
push ebx
push ebx
push str.TOOLBAR
push esi
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 1
call fcn.10080634
push ebx
push edi
push ebx
lea eax, [ebp - 0x320]
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 3
call fcn.1008184d
cmp dword [ebp - 0x38], 0xffffff92
je 0x1004ab06
cmp dword [ebp - 0x38], ebx
je 0x1004ab06
cmp dword [ebp - 0x38], 0xffffff96
je 0x1004ab06
cmp esi, ebx
je 0x1004aad2
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 8]
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 1
call fcn.10080603
mov ecx, dword [ebp + 0x28]
add ecx, 0xfffffff0
call fcn.10001d29
xor al, al
lea esp, [ebp - 0x16ec]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add ebp, 0x3c
leave
ret
cmp esi, ebx
je 0x1004ade9
cmp dword [esi + 0x14c], ebx
je 0x1004ade1
lea ecx, [ebp - 0x16e0]
call fcn.100718f8
mov byte [ebp - 4], 4
mov dword [ebp - 0x404], esi
xor edi, edi
mov eax, dword [esi + 0x14c]
lea ecx, [eax + 0xcc]
mov eax, dword [ecx + 0x10]
sub eax, dword [ecx + 0xc]
sar eax, 2
cmp edi, eax
jae 0x1004ab61
push edi
call fcn.10001bf2
mov ecx, dword [eax]
mov eax, dword [ecx]
lea edx, [ebp - 0x1628]
push edx
call dword [eax + 0x24]
inc edi
jmp 0x1004ab31
xor edi, edi
mov eax, dword [esi + 0x14c]
lea ecx, [eax + 0xb4]
mov eax, dword [ecx + 0x10]
sub eax, dword [ecx + 0xc]
sar eax, 2
cmp edi, eax
jae 0x1004ab93
push edi
call fcn.10001bf2
mov ecx, dword [eax]
mov eax, dword [ecx]
lea edx, [ebp - 0x1628]
push edx
call dword [eax + 0x24]
inc edi
jmp 0x1004ab63
push ecx
mov ecx, esp
mov dword [ebp + 0x38], esp
push str.urlAfterUninstall
call fcn.10005f07
lea eax, [ebp + 0x30]
push eax
mov ecx, esi
call fcn.1002bd1b
push ecx
lea eax, [esi + 0x50]
mov dword [ebp + 0x38], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 5
call fcn.10003561
push ebx
call fcn.1004081a
mov eax, dword [esi]
pop ecx
pop ecx
push 1
mov ecx, esi
call dword [eax + 8]
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x404], ebx
cmp dword [eax - 0xc], ebx
je 0x1004ad57
push eax
call fcn.1009e73f
mov dword [ebp + 0x24], eax
pop ecx
lea eax, [ebp + 0x24]
push eax
call fcn.10069f82
pop ecx
push dword [ebp + 0x24]
lea ecx, [ebp + 0x30]
call fcn.10004da9
push dword [ebp + 0x24]
call fcn.100a22e3
lea eax, [ebp + 0x38]
push eax
call fcn.100178d1
pop ecx
pop ecx
push 0x10115fdc
push eax
lea eax, [ebp + 0x2c]
push eax
mov byte [ebp - 4], 6
call fcn.10005363
add esp, 0xc
push 0x100cd86c
push eax
lea eax, [ebp + 0x10]
push eax
mov byte [ebp - 4], 7
call fcn.100053c1
add esp, 0xc
mov ecx, dword [ebp + 0x2c]
add ecx, 0xfffffff0
call fcn.10001d29
mov ecx, dword [ebp + 0x38]
add ecx, 0xfffffff0
call fcn.10001d29
mov dword [ebp + 0x1c], ebx
mov dword [ebp + 0x20], ebx
push ebx
push ebx
push 0x2001f
push ebx
push ebx
push dword [ebp + 0x10]
lea ecx, [ebp + 0x1c]
push SysReAllocString
mov byte [ebp - 4], 0xb
call fcn.100014a4
lea eax, [ebp + 0x14]
push eax
push str.SilentUninstall
lea ecx, [ebp + 0x1c]
mov dword [ebp + 0x14], ebx
call fcn.10042192
push ebx
cmp dword [ebp + 0x14], ebx
jne 0x1004acb7
lea ecx, [ebp + 0x30]
call fcn.1000357f
push 5
push ebx
push eax
push 0x100d2fcc
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1004ad44
lea eax, [ebp + 0x38]
push eax
mov dword [ebp + 0x38], ebx
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x1004ad44
mov edi, dword [ebp + 0x30]
cmp edi, ebx
je 0x1004acde
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x1004ace2
xor eax, eax
jmp 0x1004acfb
lea esi, [eax + eax]
mov eax, esi
call fcn.100a58a0
mov dword [ebp - 0x10], esp
mov eax, esp
push 3
push esi
push edi
push eax
call fcn.1000c578
sub esp, 0x1c
mov ecx, esp
mov dword [ebp + 0x2c], esp
push eax
call fcn.1000586e
lea ecx, [ebp - 0x118]
call fcn.10013d0f
sub esp, 0x1c
mov ecx, esp
mov dword [ebp + 0x2c], esp
push 0x100cc745
mov byte [ebp - 4], 0xc
call fcn.1000586e
lea ecx, [ebp - 0x118]
call fcn.100140ab
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 0xb
call fcn.100136b5
lea ecx, [ebp + 0x1c]
call fcn.10001489
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.10001d29
mov dword [ebp + 0x34], ebx
mov dword [ebp + 0x38], ebx
push ebx
push ebx
push 0x2001f
push ebx
push ebx
push str.SoftwareMicrosoftInternet_ExplorerURLSearchHooks_
push SysReAllocString
lea ecx, [ebp + 0x34]
mov byte [ebp - 4], 0xd
call fcn.100014a4
cmp eax, ebx
jne 0x1004adac
push 0xffffffffffffffff
push ebx
push str.CFBFAE00_17A6_11D0_99CB_00C04FD64497
push 0x100cb0a0
lea ecx, [ebp + 0x34]
call fcn.1003e05e
push dword [0x10115fd8]
push dword [ebp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp + 0x34]
call fcn.10001489
lea ecx, [ebp + 0x34]
call fcn.10001489
mov ecx, dword [ebp + 0x30]
add ecx, 0xfffffff0
call fcn.10001d29
lea ecx, [ebp - 0x16e0]
mov byte [ebp - 4], 3
call fcn.100700f1
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 1
call fcn.10080603
mov bl, 1
jmp 0x1004adf8
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 8]
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 1
call fcn.10080603
mov ecx, dword [ebp + 0x28]
add ecx, 0xfffffff0
call fcn.10001d29
mov al, bl
jmp 0x1004aaee