Function at 0x10047420
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x1005b324
call fcn.10052270
sub esp, 0x28
mov al, byte [ebp + 0xb]
push ebx
push esi
xor ebx, ebx
push edi
mov edi, ecx
mov byte [ebp - 0x24], al
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
push ecx
mov esi, str._START_PAGE_URL_
mov ecx, esp
mov dword [ebp - 0x10], esp
push esi
mov dword [ebp - 4], ebx
call fcn.100034da
push ecx
mov byte [ebp - 4], 1
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.HKCU__SoftwareMicrosoftInternet_ExplorerMain___Start_Page__0_
call fcn.100034da
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.1004785b
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 3
call fcn.10047fa8
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.1000349d
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], bl
call fcn.1000349d
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push esi
call fcn.100034da
push ecx
mov byte [ebp - 4], 6
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.HKLM__SoftwareMicrosoftInternet_ExplorerMain___Default_Page_URL__0_
call fcn.100034da
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.1004785b
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 8
call fcn.10047fa8
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 9
call fcn.1000349d
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], bl
call fcn.1000349d
push ecx
mov esi, str._SEARCH_PAGE_URL_
mov ecx, esp
mov dword [ebp - 0x14], esp
push esi
call fcn.100034da
push ecx
mov byte [ebp - 4], 0xb
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.HKLM__SoftwareMicrosoftInternet_ExplorerMain___Default_Search_URL__0_
call fcn.100034da
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.1004785b
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0xd
call fcn.10047fa8
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0xe
call fcn.1000349d
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], bl
call fcn.1000349d
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push esi
call fcn.100034da
push ecx
mov byte [ebp - 4], 0x10
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.HKLM__SoftwareMicrosoftInternet_ExplorerMain___Search_Page__0_
call fcn.100034da
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.1004785b
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x12
call fcn.10047fa8
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x13
call fcn.1000349d
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], bl
call fcn.1000349d
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push esi
call fcn.100034da
push ecx
mov byte [ebp - 4], 0x15
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.HKCU__SoftwareMicrosoftInternet_ExplorerMain___Search_Page__0_
call fcn.100034da
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.1004785b
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x17
call fcn.10047fa8
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x18
call fcn.1000349d
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], bl
call fcn.1000349d
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str._http:__ie.search.msn.com_SUB_RFC1766_srchasst_srchasst.htm_
call fcn.100034da
push ecx
mov byte [ebp - 4], 0x1a
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.HKLM__SoftwareMicrosoftInternet_ExplorerSearch___SearchAssistant__0_
call fcn.100034da
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.1004785b
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x1c
call fcn.10047fa8
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x1d
call fcn.1000349d
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], bl
call fcn.1000349d
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str._http:__ie.search.msn.com_SUB_RFC1766_srchasst_srchcust.htm_
call fcn.100034da
push ecx
mov byte [ebp - 4], 0x1f
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.HKLM__SoftwareMicrosoftInternet_ExplorerSearch___CustomizeSearch__0_
call fcn.100034da
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.1004785b
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x21
call fcn.10047fa8
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x22
call fcn.1000349d
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], bl
call fcn.1000349d
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str._http:__ie.search.msn.com__
call fcn.100034da
push ecx
mov byte [ebp - 4], 0x24
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.HKLM__SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsSafeSites___SAFESITE_VALUE__0_
call fcn.100034da
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.1004785b
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x26
call fcn.10047fa8
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x27
call fcn.1000349d
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], bl
call fcn.1000349d
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str._http:__www.microsoft.com_isapi_redir.dll_prdieariesearch_
call fcn.100034da
push ecx
mov byte [ebp - 4], 0x29
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.SEARCH_PAGE_URL
call fcn.100034da
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.1004785b
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x2b
call fcn.10047fa8
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x2c
call fcn.1000349d
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], bl
call fcn.1000349d
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str._ie.search.msn.com_
call fcn.100034da
push ecx
mov byte [ebp - 4], 0x2e
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.SAFESITE_VALUE
call fcn.100034da
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.1004785b
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x30
call fcn.10047fa8
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x31
call fcn.1000349d
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], bl
call fcn.1000349d
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str._http:__www.microsoft.com_isapi_redir.dll_prdiepver6armsnhome_
call fcn.100034da
push ecx
mov byte [ebp - 4], 0x33
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.MS_START_PAGE_URL
call fcn.100034da
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.1004785b
mov byte [ebp - 4], 0x35
push eax
lea ecx, [ebp - 0x24]
call fcn.10047fa8
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x36
call fcn.1000349d
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], bl
call fcn.1000349d
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.http:__www.microsoft.com_
call fcn.100034da
push ecx
mov byte [ebp - 4], 0x38
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.START_PAGE_URL
call fcn.100034da
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.1004785b
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x3a
call fcn.10047fa8
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x3b
call fcn.1000349d
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], bl
call fcn.1000349d
push dword [ebp + 8]
lea eax, [ebp - 0x24]
sub esp, 0x10
mov ecx, esp
mov dword [ebp + 8], esp
push eax
call fcn.10047f07
mov ecx, edi
mov byte [ebp - 4], bl
call fcn.10047904
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.10047f75
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4