Function at 0x10054474
Capabilities:
Delete registry key
Enumerate files on windows
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78]
mov eax, 0x2cd4
call fcn.100a2680
push ebx
push esi
lea eax, [ebp + 0x50]
push edi
xor ebx, ebx
push eax
mov dword [ebp + 0x5c], ebx
call fcn.1003e953
pop ecx
mov esi, 0x100cb0a0
push esi
push 0x100cd86c
lea ecx, [ebp + 0x50]
call fcn.100047f1
lea eax, [ebp + 0x50]
push eax
call fcn.1003e6b4
push dword [0x10115fd4]
lea eax, [ebp - 0x3d4]
push 0x100d212c
push eax
call fcn.100a3075
lea eax, [ebp - 0x3d4]
push eax
lea eax, [ebp - 0xc8c]
push str.CLSID_s
push eax
call fcn.100a3075
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
add esp, 0x1c
push ebx
lea eax, [ebp + 0x54]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push str.SoftwareMicrosoftInternet_ExplorerToolbar
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0x54], ebx
call edi
push ebx
push ebx
push 3
push ebx
lea eax, [ebp - 0x3d4]
push eax
push dword [ebp + 0x54]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 0x54]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push 1
mov ecx, 0x101164dc
call fcn.10053424
push ebx
mov dword [ebp + 0x3c], eax
lea eax, [ebp + 0x54]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
lea eax, [ebp - 0xc8c]
push eax
push SysReAllocString
call edi
lea eax, [ebp + 0x4c]
push ebx
push eax
call fcn.100404f4
pop ecx
pop ecx
push ebx
lea ecx, [ebp + 0x4c]
call fcn.1000357f
push eax
lea eax, [ebp - 0x245c]
push str._ssettings
push eax
call fcn.100a3075
push 0x1a0
call fcn.100a2ba4
add esp, 0x10
cmp eax, ebx
je 0x10054594
push ebx
mov ecx, eax
call fcn.10021ad9
mov edi, eax
jmp 0x10054596
xor edi, edi
push ebx
push ebx
push ebx
push ebx
push ebx
push str.TOOLBAR
push edi
lea ecx, [ebp - 0x3c]
call fcn.10080634
push ebx
push 1
push ebx
lea eax, [ebp - 0x245c]
push eax
lea ecx, [ebp - 0x3c]
call fcn.1008184d
cmp dword [ebp + 0x10], 0xffffff92
je 0x100545e3
cmp dword [ebp + 0x10], ebx
je 0x100545e3
cmp dword [ebp + 0x10], 0xffffff96
je 0x100545e3
cmp edi, ebx
je 0x10054e57
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax + 8]
jmp 0x10054e57
lea ecx, [edi + 0x50]
mov eax, dword [ecx]
mov eax, dword [eax - 0xc]
push ebx
mov dword [ebp + 0x70], eax
call fcn.1000357f
mov ecx, dword [ebp + 0x70]
add ecx, ecx
push ecx
push eax
push 1
push ebx
push ebx
push dword [ebp + 0x54]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 0x54]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
mov ecx, esp
mov dword [ebp + 0x6c], esp
push esi
call fcn.10005f07
push dword [edi + 0x60]
push ecx
mov ecx, esp
mov dword [ebp + 0x6c], esp
push str.Height
call fcn.10005f07
call fcn.100402b5
push 1
call fcn.100599b6
add esp, 0xc
lea eax, [edi + 0x50]
mov dword [ebp + 0x6c], esp
mov ecx, esp
push eax
call fcn.10003561
push 1
call fcn.1004081a
pop ecx
pop ecx
push str.SoftwareMicrosoftWindowsCurrentVersionExtSettings_
lea ecx, [ebp + 0x74]
call fcn.10005f07
push 0x10115fd4
lea eax, [ebp + 0x74]
push eax
lea eax, [ebp + 0x70]
push eax
call fcn.10005363
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
add esp, 0xc
push dword [eax]
push SysReAllocString
call ebx
mov ecx, dword [ebp + 0x70]
add ecx, 0xfffffff0
call fcn.10001d29
push 0x10115fe0
lea eax, [ebp + 0x74]
push eax
lea eax, [ebp + 0x70]
push eax
call fcn.10005363
add esp, 0xc
push dword [eax]
push SysReAllocString
call ebx
mov ecx, dword [ebp + 0x70]
add ecx, 0xfffffff0
call fcn.10001d29
mov ecx, dword [ebp + 0x74]
add ecx, 0xfffffff0
call fcn.10001d29
lea eax, [ebp + 0x38]
push eax
call fcn.1004af7b
mov ecx, esp
mov dword [ebp + 0x6c], esp
push esi
call fcn.10005f07
push ecx
mov dword [ebp + 0x6c], esp
mov ebx, esp
push ecx
mov ecx, esp
mov dword [ebp + 0x6c], esp
push esi
call fcn.10005f07
push ecx
lea eax, [ebp + 0x38]
mov dword [ebp + 0x6c], esp
mov ecx, esp
push eax
call fcn.10003561
push ecx
mov ecx, esp
mov dword [ebp + 0x6c], esp
push str.toolbar_id
call fcn.10005f07
push ebx
call fcn.1003fd77
add esp, 0xc
mov ecx, esp
mov dword [ebp + 0x6c], esp
push str.toolbar_id
call fcn.10005f07
call fcn.1003ff80
add esp, 0xc
lea ecx, [ebp - 0x204c]
call fcn.100718f8
mov dword [ebp - 0xd70], edi
mov eax, dword [edi + 0x150]
test eax, eax
je 0x100547fb
lea ecx, [eax + 0x50]
mov eax, dword [ecx + 0x10]
sub eax, dword [ecx + 0xc]
xor ebx, ebx
sar eax, 2
test eax, eax
jbe 0x100547fb
push ebx
call fcn.10001bf2
mov ecx, dword [eax]
mov eax, dword [ecx]
lea edx, [ebp - 0x1f94]
push edx
push str.ToolbarPtr
call dword [eax + 0x30]
mov ecx, dword [edi + 0x150]
push ebx
add ecx, 0x50
call fcn.10001bf2
mov ecx, dword [eax]
mov eax, dword [ecx]
push esi
push str.type
call dword [eax + 0xc]
push str.ManualUpdate
push eax
mov dword [ebp + 0x58], eax
call fcn.100a26ab
pop ecx
pop ecx
test eax, eax
je 0x100547d0
push dword [ebp + 0x58]
lea ecx, [ebp - 0x1f94]
call fcn.100599aa
mov eax, dword [edi + 0x150]
lea ecx, [eax + 0x50]
mov eax, dword [ecx + 0x10]
sub eax, dword [ecx + 0xc]
inc ebx
sar eax, 2
cmp ebx, eax
jb 0x10054760
jmp 0x100547fb
mov ecx, dword [edi + 0x150]
push ebx
add ecx, 0x50
call fcn.10001bf2
mov ecx, dword [eax]
mov eax, dword [ecx]
lea edx, [ebp - 0x1f94]
push edx
call dword [eax + 0x2c]
push dword [ebp + 0x58]
lea ecx, [ebp - 0x1f94]
call fcn.100599aa
push ecx
mov ecx, esp
mov dword [ebp + 0x6c], esp
push esi
call fcn.10005f07
push ecx
mov ecx, esp
mov dword [ebp + 0x6c], esp
mov ebx, 0x100cbdcc
push ebx
call fcn.10005f07
push ecx
mov ecx, esp
mov dword [ebp + 0x6c], esp
push str.Updating
call fcn.10005f07
lea eax, [ebp + 0x48]
push eax
call fcn.1003fd77
add esp, 0x10
push ebx
lea ecx, [ebp + 0x48]
call fcn.10002834
test eax, eax
jne 0x10054875
push ecx
mov ecx, esp
mov dword [ebp + 0x6c], esp
push esi
call fcn.10005f07
push ecx
mov ecx, esp
mov dword [ebp + 0x6c], esp
push 0x100cb330
call fcn.10005f07
push ecx
mov ecx, esp
mov dword [ebp + 0x6c], esp
push str.firstTime
call fcn.10005f07
call fcn.1003ff80
add esp, 0xc
push 0x208
lea eax, [ebp - 0x244]
push eax
push dword [0x1011855c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x244]
push 0x5c
push eax
call fcn.100a679f
pop ecx
pop ecx
test eax, eax
je 0x100548a6
xor ecx, ecx
mov word [eax], cx
push 0x100ccd84
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x5dc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str..dll
lea eax, [ebp - 0x5dc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0xa34]
push eax
lea eax, [ebp - 0x5dc]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp + 0x70], eax
cmp eax, 0xffffffff
je 0x1005499a
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x7e4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0xa08]
push eax
lea eax, [ebp - 0x7e4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x7e4]
push eax
call fcn.10022776
mov dword [ebp + 0x74], eax
test eax, eax
je 0x10054979
push str.PlugInvoke
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.IsUnicode
push dword [ebp + 0x74]
mov dword [ebp + 0x58], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10054970
cmp dword [ebp + 0x58], 0
je 0x10054970
call eax
test al, al
je 0x10054970
push 0
push str.Registration
call dword [ebp + 0x58]
push dword [ebp + 0x74]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0xa34]
push eax
push dword [ebp + 0x70]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x100548fe
push dword [ebp + 0x70]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [edi + 0x14c]
test ecx, ecx
je 0x10054e2d
mov eax, dword [ecx + 0xdc]
sub eax, dword [ecx + 0xd8]
and dword [ebp + 0x74], 0
add ecx, 0xcc
sar eax, 2
test eax, eax
jbe 0x100549fe
push dword [ebp + 0x74]
call fcn.10001bf2
mov ecx, dword [eax]
mov eax, dword [ecx]
lea edx, [ebp - 0x1f94]
push edx
call dword [eax + 0x24]
mov ecx, dword [edi + 0x14c]
mov eax, dword [ecx + 0xdc]
sub eax, dword [ecx + 0xd8]
inc dword [ebp + 0x74]
add ecx, 0xcc
sar eax, 2
cmp dword [ebp + 0x74], eax
jb 0x100549c5
mov ecx, dword [edi + 0x14c]
mov eax, dword [ecx + 0xc4]
sub eax, dword [ecx + 0xc0]
and dword [ebp + 0x74], 0
add ecx, 0xb4
sar eax, 2
test eax, eax
jbe 0x10054a5a
push dword [ebp + 0x74]
call fcn.10001bf2
mov ecx, dword [eax]
mov eax, dword [ecx]
lea edx, [ebp - 0x1f94]
push edx
call dword [eax + 0x24]
mov ecx, dword [edi + 0x14c]
mov eax, dword [ecx + 0xc4]
sub eax, dword [ecx + 0xc0]
inc dword [ebp + 0x74]
add ecx, 0xb4
sar eax, 2
cmp dword [ebp + 0x74], eax
jb 0x10054a21
push 0x101185a8
lea ecx, [ebp + 0x74]
call fcn.1005a319
push ebx
lea ecx, [ebp + 0x48]
mov byte [ebp + 0x6b], 0
call fcn.10002834
push ecx
mov ecx, esp
mov dword [ebp + 0x6c], esp
test eax, eax
jne 0x10054aa9
push 0x100d3d14
call fcn.10005f07
lea eax, [ebp + 0x70]
push eax
mov ecx, edi
call fcn.1002bd1b
push eax
lea ecx, [ebp + 0x74]
call fcn.10004a20
mov ecx, dword [ebp + 0x70]
add ecx, 0xfffffff0
call fcn.10001d29
jmp 0x10054b06
push 0x100d3544
call fcn.10005f07
lea eax, [ebp + 0x70]
push eax
mov ecx, edi
call fcn.1002bd1b
push eax
lea ecx, [ebp + 0x74]
call fcn.10004a20
mov ecx, dword [ebp + 0x70]
add ecx, 0xfffffff0
call fcn.10001d29
push ecx
mov ecx, esp
mov dword [ebp + 0x6c], esp
push esi
call fcn.10005f07
push ecx
mov ecx, esp
mov dword [ebp + 0x6c], esp
push ebx
call fcn.10005f07
push ecx
mov ecx, esp
mov dword [ebp + 0x6c], esp
push str.Updating
call fcn.10005f07
call fcn.1003ff80
add esp, 0xc
mov byte [ebp + 0x6b], 1
mov eax, dword [ebp + 0x74]
cmp dword [eax - 0xc], 0
jne 0x10054b1c
push str.about:blank
lea ecx, [ebp + 0x74]
call fcn.10004da9
push dword [ebp + 0x74]
call fcn.1009e73f
mov dword [ebp + 0x58], eax
lea eax, [ebp + 0x58]
push eax
call fcn.10069f82
pop ecx
pop ecx
push dword [ebp + 0x58]
lea ecx, [ebp + 0x74]
call fcn.10004da9
push dword [ebp + 0x58]
call fcn.100a22e3
pop ecx
push dword [0x10115fd4]
lea ecx, [ebp + 0x6c]
call fcn.100027e0
push str.about:blank
lea ecx, [ebp + 0x74]
call fcn.10002834
test eax, eax
je 0x10054b6b
cmp byte [ebp + 0x6b], 0
je 0x10054bb8
cmp byte [ebp + 0x6b], 0
je 0x10054bbe
push ecx
mov ecx, esp
mov dword [ebp + 0x64], esp
push esi
mov dword [ebp + 0x5c], 1
call fcn.10005f07
push ecx
mov ecx, esp
mov dword [ebp + 0x64], esp
push ebx
call fcn.10005f07
push ecx
mov ecx, esp
mov dword [ebp + 0x64], esp
push str.updateWaitForRestart
call fcn.10005f07
lea eax, [ebp + 0x70]
push eax
call fcn.1003fd77
add esp, 0x10
push ebx
mov ecx, eax
call fcn.10002834
test eax, eax
jne 0x10054bbe
mov byte [ebp + 0x63], 1
jmp 0x10054bc2
mov byte [ebp + 0x63], 0
test byte [ebp + 0x5c], 1
je 0x10054bd7
mov ecx, dword [ebp + 0x70]
and dword [ebp + 0x5c], 0xfffffffe
add ecx, 0xfffffff0
call fcn.10001d29
cmp byte [ebp + 0x63], 0
je 0x10054cb2
push 0
push str.http:__
lea ecx, [ebp + 0x74]
call fcn.10003080
cmp eax, 0xffffffff
jne 0x10054c5a
push 0
push 0x100cb62c
lea ecx, [ebp + 0x74]
call fcn.10003080
cmp eax, 0xffffffff
jne 0x10054c5a
push 0
push str.about:blank
lea ecx, [ebp + 0x74]
call fcn.10003080
cmp eax, 0xffffffff
jne 0x10054c5a
lea eax, [ebp + 0x74]
push eax
lea eax, [ebp + 0x64]
push 0
push eax
call fcn.100404f4
pop ecx
pop ecx
push eax
lea eax, [ebp + 0x70]
push eax
call fcn.10005363
add esp, 0xc
push eax
lea ecx, [ebp + 0x74]
call fcn.10004a20
mov ecx, dword [ebp + 0x70]
add ecx, 0xfffffff0
call fcn.10001d29
mov ecx, dword [ebp + 0x64]
add ecx, 0xfffffff0
call fcn.10001d29
push ecx
mov ecx, esp
mov dword [ebp + 0x64], esp
push esi
call fcn.10005f07
push 1
push ecx
mov ecx, esp
mov dword [ebp + 0x64], esp
push str.force_parse_events
call fcn.10005f07
call fcn.100402b5
pop ecx
pop ecx
mov ecx, esp
mov dword [ebp + 0x64], esp
push esi
call fcn.10005f07
push ecx
mov ecx, esp
mov dword [ebp + 0x64], esp
push 0x100cb330
call fcn.10005f07
push ecx
mov ecx, esp
mov dword [ebp + 0x64], esp
push str.TBShow
call fcn.10005f07
call fcn.1003ff80
add esp, 0xc
cmp byte [ebp + 0x6b], 0
je 0x10054d15
push str.about:blank
lea ecx, [ebp + 0x74]
call fcn.10002834
test eax, eax
je 0x10054d15
or dword [ebp + 0x5c], 2
push ecx
mov ecx, esp
mov dword [ebp + 0x70], esp
push esi
call fcn.10005f07
push ecx
mov ecx, esp
mov dword [ebp + 0x70], esp
push ebx
call fcn.10005f07
push ecx
mov ecx, esp
mov dword [ebp + 0x70], esp
push str.updateWaitForRestart
call fcn.10005f07
lea eax, [ebp + 0x64]
push eax
call fcn.1003fd77
add esp, 0x10
push 0x100cb330
mov ecx, eax
call fcn.10002834
test eax, eax
jne 0x10054d15
mov bl, 1
jmp 0x10054d17
xor bl, bl
test byte [ebp + 0x5c], 2
je 0x10054d28
mov ecx, dword [ebp + 0x64]
add ecx, 0xfffffff0
call fcn.10001d29
test bl, bl
je 0x10054ddb
lea eax, [ebp + 0x64]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftInternet_ExplorerMain
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10054ddb
mov eax, dword [ebp + 0x64]
and dword [ebp + 0x44], 0
mov dword [ebp + 0x40], eax
lea eax, [ebp + 0x70]
push eax
mov ebx, str.Start_Page
push ebx
lea eax, [ebp - 0x2c5c]
push eax
lea ecx, [ebp + 0x40]
mov dword [ebp + 0x70], 0x3e8
call fcn.1003dfcf
push ecx
mov ecx, esp
mov dword [ebp + 0x5c], esp
push esi
call fcn.10005f07
push ecx
lea eax, [ebp - 0x2c5c]
mov ecx, esp
mov dword [ebp + 0x5c], esp
push eax
call fcn.10005f07
push ecx
mov ecx, esp
mov dword [ebp + 0x5c], esp
push str.prevHomePage
call fcn.10005f07
call fcn.1003ff80
add esp, 0xc
push 0xffffffffffffffff
push 0
push ebx
push 0
lea ecx, [ebp + 0x74]
call fcn.1000357f
push eax
lea ecx, [ebp + 0x40]
call fcn.1003e05e
lea ecx, [ebp + 0x40]
call fcn.10001489
lea ecx, [ebp + 0x40]
call fcn.10001489
and dword [ebp - 0xd70], 0
push ecx
mov ecx, esp
mov dword [ebp + 0x64], esp
push esi
call fcn.10005f07
push ecx
mov ecx, esp
mov dword [ebp + 0x64], esp
push 0x100cb330
call fcn.10005f07
push ecx
mov ecx, esp
mov dword [ebp + 0x64], esp
push str.TBShow
call fcn.10005f07
call fcn.1003ff80
mov ecx, dword [ebp + 0x6c]
add esp, 0xc
test ecx, ecx
je 0x10054e22
call fcn.10003111
mov ecx, dword [ebp + 0x74]
add ecx, 0xfffffff0
call fcn.10001d29
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax + 8]
mov ecx, dword [ebp + 0x48]
add ecx, 0xfffffff0
call fcn.10001d29
lea ecx, [ebp - 0x204c]
call fcn.100700f1
mov ecx, dword [ebp + 0x38]
add ecx, 0xfffffff0
call fcn.10001d29
lea ecx, [ebp - 0x3c]
call fcn.10080603
mov ecx, dword [ebp + 0x4c]
add ecx, 0xfffffff0
call fcn.10001d29
mov ecx, dword [ebp + 0x50]
add ecx, 0xfffffff0
call fcn.10001d29
mov eax, dword [ebp + 0x3c]
pop edi
pop esi
pop ebx
add ebp, 0x78
leave
ret