Function at 0x10002440
Capabilities:
Get common file path
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100125ed
mov eax, dword fs:[0]
push eax
sub esp, 0x968
mov eax, dword [0x10019154]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
xor esi, esi
push esi
mov dword [ebp - 0x95c], eax
mov dword [ebp - 0x970], edi
mov dword [ebp - 0x968], ebx
mov dword [ebp - 0x960], ecx
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x950], esi
mov dword [ebp - 0x958], esi
lea edx, [ebp - 0x958]
push edx
push 0x10013694
push 0x17
push esi
push 0x10014fa8
mov dword [ebp - 4], esi
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
jne 0x100027d2
mov dword [ebp - 0x944], 0
lea eax, [ebp - 0x944]
push eax
push 0x10014f98
push 1
push 0
push 0x10013a54
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x100027ac
mov dword [ebp - 0x948], eax
push str.__xml_version_1.0__encoding_UTF_8____n_OpenSearchDescription_xmlns_http:__a9.com___spec_opensearch_1.1___xmlns:ie_http:__schemas.microsoft.com_Search_2008____n_ShortName_
mov byte [ebp - 4], 2
call esi
push eax
push str.__xml_version_1.0__encoding_UTF_8____n_OpenSearchDescription_xmlns_http:__a9.com___spec_opensearch_1.1___xmlns:ie_http:__schemas.microsoft.com_Search_2008____n_ShortName_
lea ecx, [ebp - 0x948]
call fcn.10001d20
push edi
call esi
push eax
push edi
lea ecx, [ebp - 0x948]
call fcn.10001d20
push str.__ShortName__n
call esi
push eax
push str.__ShortName__n
lea ecx, [ebp - 0x948]
call fcn.10001d20
test ebx, ebx
je 0x1000258d
push str._Image_height_16__width_16__type_image_icon__
call esi
push eax
push str._Image_height_16__width_16__type_image_icon__
lea ecx, [ebp - 0x948]
call fcn.10001d20
push ebx
call esi
push eax
push ebx
lea ecx, [ebp - 0x948]
call fcn.10001d20
push str.__Image__n
call esi
push eax
push str.__Image__n
lea ecx, [ebp - 0x948]
call fcn.10001d20
push str._Url_type_text_html__template_
call esi
push eax
push str._Url_type_text_html__template_
lea ecx, [ebp - 0x948]
call fcn.10001d20
mov ebx, dword [ebp - 0x95c]
push ebx
call esi
push eax
push ebx
lea ecx, [ebp - 0x948]
call fcn.10001d20
push str.____n__OpenSearchDescription__n
call esi
push eax
push str.____n__OpenSearchDescription__n
lea ecx, [ebp - 0x948]
call fcn.10001d20
mov eax, dword [ebp - 0x944]
mov ecx, dword [eax]
lea edx, [ebp - 0x964]
push edx
mov edx, dword [ebp - 0x948]
push edx
push eax
mov eax, dword [ecx + 0x104]
call eax
lea ecx, [ebp - 0x930]
push ecx
push 0x410
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.metabar_search.xml
push 0x410
lea edx, [ebp - 0x930]
push edx
call fcn.10001b60
lea eax, [ebp - 0x930]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, eax
mov dword [ebp - 0x96c], ebx
test ebx, ebx
jne 0x1000263d
push 0x8007000e
call fcn.10001160
xor ecx, ecx
lea edx, [ebp - 0x96c]
mov word [ebp - 0x940], cx
push edx
lea ecx, [ebp - 0x940]
mov byte [ebp - 4], 3
call fcn.10001ef0
mov eax, dword [ebp - 0x944]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x940]
mov ecx, dword [ecx + 0x108]
sub esp, 0x10
mov eax, esp
mov dword [eax], edx
mov edx, dword [ebp - 0x93c]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x938]
mov dword [eax + 8], edx
mov edx, dword [ebp - 0x934]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 0x944]
push eax
mov byte [ebp - 4], 4
call ecx
lea edx, [ebp - 0x940]
push edx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [ebp - 0x94c], 0
mov eax, dword [ebp - 0x958]
mov ecx, dword [eax]
lea edx, [ebp - 0x94c]
push edx
push ebx
push eax
mov eax, dword [ecx + 0xc]
mov byte [ebp - 4], 5
call eax
mov eax, dword [ebp - 0x94c]
test eax, eax
je 0x1000278a
mov dword [ebp - 0x954], 0
mov ecx, dword [eax]
lea edx, [ebp - 0x954]
push edx
push eax
mov eax, dword [ecx + 0x14]
mov byte [ebp - 4], 6
call eax
mov ecx, dword [ebp - 0x954]
push 0x100137b0
push ecx
call fcn.100068d1
mov edi, eax
add esp, 8
test edi, edi
je 0x10002771
add edi, 4
mov edx, 0x7b
push str.iertutil.dll
mov word [edi], dx
mov dword [edi + 0x4a], 0x7d
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x974], eax
test eax, eax
je 0x10002771
push 0x28e
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002764
push 0x4e
push edi
push 2
push 2
push 0x100135d8
call eax
mov dword [ebp - 0x950], 1
mov edx, dword [ebp - 0x974]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x954]
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x94c]
mov edi, dword [ebp - 0x970]
mov byte [ebp - 4], 3
test eax, eax
je 0x1000279a
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
push ebx
mov ebx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call ebx
mov eax, dword [ebp - 0x948]
push eax
call ebx
mov eax, dword [ebp - 0x944]
mov byte [ebp - 4], 0
test eax, eax
je 0x100027c2
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov ebx, dword [ebp - 0x950]
test ebx, ebx
jne 0x10002936
jmp 0x100027d8
mov ebx, dword [ebp - 0x950]
lea eax, [ebp - 0x940]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
push 0x80
lea ecx, [ebp - 0x110]
push ecx
lea edx, [ebp - 0x940]
push edx
call dword [sym.imp.ole32.dll_StringFromGUID2]
push 0
lea eax, [ebp - 0x94c]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SoftwareMicrosoftInternet_ExplorerSearchScopes
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10002936
push eax
lea ecx, [ebp - 0x944]
push ecx
push eax
push 0x20006
push eax
push eax
push eax
mov eax, dword [ebp - 0x94c]
lea edx, [ebp - 0x110]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10002929
push edi
call esi
mov ecx, dword [ebp - 0x944]
lea eax, [eax + eax + 2]
push eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 1
push 0
push str.DisplayName
push ecx
call edi
mov ebx, dword [ebp - 0x95c]
push ebx
call esi
mov edx, dword [ebp - 0x944]
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
push 0
push 0x10013710
push edx
call edi
mov ebx, dword [ebp - 0x968]
test ebx, ebx
je 0x100028c0
push ebx
call esi
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ebp - 0x944]
push ebx
push 1
push 0
push str.FaviconURL
push eax
call edi
mov ebx, dword [ebp - 0x960]
test ebx, ebx
je 0x100028e5
push ebx
call esi
mov ecx, dword [ebp - 0x944]
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
push 0
push str.SuggestionsURL
push ecx
call edi
mov edx, dword [ebp - 0x944]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x110]
push eax
call esi
mov edx, dword [ebp - 0x94c]
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x110]
push ecx
push 1
push 0
push str.DefaultScope
push edx
call edi
mov dword [ebp - 0x950], 1
mov ebx, dword [ebp - 0x950]
mov eax, dword [ebp - 0x94c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x958]
neg ebx
sbb ebx, ebx
and ebx, 0x7fffbffb
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x10002959
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea eax, [ebx - 0x7fffbffb]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10007107
mov esp, ebp
pop ebp
ret 0x10