Function at 0x10014480
Capabilities:
Persist via run registry key

Disassembly:
push 0x3cc
mov eax, 0x1009c22f
call fcn.1007684e
push str.10003357
lea ecx, [ebp - 0xd4]
mov byte [ebp - 0x3b5], 1
call fcn.1000f6ca
xor ebx, ebx
push str.2.2.0.1452
lea ecx, [ebp - 0x208]
mov dword [ebp - 4], ebx
call fcn.1000f6ca
push str.63058180_1_pg
lea ecx, [ebp - 0x1ec]
mov byte [ebp - 4], 1
call fcn.1000f6ca
push str.MainFrame0_SearchBar2_Tray1_Dock0_Direction0_PtX0_PtY0
lea ecx, [ebp - 0x1d0]
mov byte [ebp - 4], 2
call fcn.1000f6ca
push 0x100afbf4
lea ecx, [ebp - 0x1b4]
mov byte [ebp - 4], 3
call fcn.1000f6ca
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea ecx, [ebp - 0x128]
mov byte [ebp - 4], 4
call fcn.1000f6ca
push str.Local_AppData
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 5
call fcn.1000f6ca
push 7
pop esi
xor eax, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], ax
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x70], ebx
mov word [ebp - 0x80], ax
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x54], ebx
mov word [ebp - 0x64], ax
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0xa8], ebx
mov word [ebp - 0xb8], ax
push 0x48
mov byte [ebp - 4], 0xa
mov byte [ebp - 0x3b6], bl
call fcn.1005d0ec
mov edi, eax
pop ecx
mov dword [ebp - 0x3c0], edi
cmp edi, ebx
je 0x100145a6
mov dword [edi + 4], ebx
mov dword [edi], vtable.CPathCloudControl.0
mov dword [edi + 8], ebx
xor eax, eax
mov dword [edi + 0x24], esi
mov dword [edi + 0x20], ebx
mov word [edi + 0x10], ax
mov dword [edi + 0x40], esi
mov dword [edi + 0x3c], ebx
mov word [edi + 0x2c], ax
mov byte [ebp - 4], 0xe
call fcn.10015250
mov dword [ebp - 0x3c4], edi
jmp 0x100145ae
mov dword [ebp - 0x3c4], ebx
mov edi, ebx
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x3d8], edi
cmp edi, ebx
je 0x100145c1
mov eax, dword [edi]
push edi
call dword [eax]
push edi
mov byte [ebp - 4], 0xf
call fcn.10015325
test al, al
je 0x1001463e
mov eax, dword [edi + 0xc]
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1001463e
cmp dword [edi + 0x20], ebx
je 0x100145f6
push 0xffffffffffffffff
push ebx
lea eax, [edi + 0x10]
push eax
lea ecx, [ebp - 0x64]
call fcn.1000f802
cmp dword [edi + 0x3c], ebx
je 0x1001460d
push 0xffffffffffffffff
push ebx
add edi, 0x2c
push edi
lea ecx, [ebp - 0xb8]
call fcn.1000f802
mov esi, 0x100b0490
push esi
call fcn.1005d0d1
pop ecx
push eax
push esi
push dword [ebp - 0xa8]
lea ecx, [ebp - 0xb8]
push ebx
call fcn.1000fe1a
test eax, eax
jne 0x1001463e
mov byte [ebp - 0x3b5], bl
mov byte [ebp - 0x3b6], 1
cmp dword [ebp - 0x54], ebx
jne 0x10014659
mov esi, str.BaiduBaiduClient_VERSION_
push esi
call fcn.1005d0d1
pop ecx
push eax
push esi
lea ecx, [ebp - 0x64]
call fcn.1000f93d
lea ebx, [ebp - 0x64]
call fcn.1001dc01
push 0x190
call fcn.1005d0ec
xor ebx, ebx
pop ecx
cmp eax, ebx
je 0x1001467f
call fcn.1001060e
mov dword [ebp - 0x3bc], eax
jmp 0x10014685
mov dword [ebp - 0x3bc], ebx
call fcn.100017cc
cmp dword [ebp - 0x3bc], ebx
jne 0x10014698
mov byte [ebp - 0x3b5], bl
mov esi, 0x100b14c8
cmp byte [ebp - 0x3b5], bl
je 0x10014867
lea eax, [ebp - 0x128]
push reloc.WS2_32.dll_accept
push eax
lea ecx, [ebp - 0x2c]
lea edx, [ebp - 0x160]
call fcn.1001ca54
dec eax
neg eax
sbb al, al
inc al
push 0x65
mov byte [ebp - 0x3b5], al
call fcn.1001d6bd
add esp, 0xc
call fcn.100073e0
cmp byte [ebp - 0x3b5], bl
je 0x10014867
call fcn.100103be
test eax, eax
jne 0x1001476a
mov edi, str.Local_Settings
push edi
call fcn.1005d0d1
pop ecx
push eax
push edi
lea eax, [ebp - 0x2c]
push eax
xor eax, eax
call fcn.10014014
cmp eax, 0xffffffff
je 0x1001476a
dec eax
push eax
push ebx
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x2c]
call fcn.10013ee3
lea eax, [ebp - 0x25c]
push str.AppDataLocal
push eax
lea edi, [ebp - 0x224]
mov byte [ebp - 4], 0x10
call fcn.10014290
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x11
call fcn.1000fd37
push ebx
push 1
lea ecx, [ebp - 0x25c]
call fcn.1000f89d
push ebx
push 1
mov ecx, edi
mov byte [ebp - 4], 0xf
call fcn.1000f89d
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x278]
push eax
lea ebx, [ebp - 0x64]
call fcn.100150d2
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0x12
call fcn.1000fd37
push 0
push 1
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 0xf
call fcn.1000f89d
mov edi, str.SoftwareBaiduBaidu
push edi
call fcn.1005d0d1
pop ecx
push eax
push edi
lea ecx, [ebp - 0x128]
call fcn.1000f93d
mov ebx, str.InstallDir
push ebx
call fcn.1005d0d1
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x160]
call fcn.1000f93d
push esi
call fcn.1005d0d1
pop ecx
push eax
push esi
lea ecx, [ebp - 0x2c]
call fcn.1000f93d
lea eax, [ebp - 0x128]
push reloc.OLEAUT32.dll_SysReAllocString
push eax
lea ecx, [ebp - 0x2c]
lea edx, [ebp - 0x160]
call fcn.1001ca54
push 0x66
call fcn.1001d6bd
add esp, 0xc
cmp dword [ebp - 0x1c], 0
je 0x10014860
lea eax, [ebp - 0x2b0]
push 0x100afb00
push eax
lea edi, [ebp - 0x2c]
call fcn.10014290
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0x13
call fcn.1000fd37
push 0
push 1
lea ecx, [ebp - 0x2b0]
mov byte [ebp - 4], 0xf
call fcn.1000f89d
mov edi, str._VERSION_
push edi
call fcn.1005d0d1
pop ecx
push eax
push edi
lea ecx, [ebp - 0x80]
call fcn.100104a9
lea ebx, [ebp - 0x80]
call fcn.1001dc01
call fcn.10002e98
xor ebx, ebx
push 7
pop eax
xor ecx, ecx
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x8c], ebx
mov word [ebp - 0x9c], cx
mov dword [ebp - 0xdc], eax
xor eax, eax
mov dword [ebp - 0xe0], ebx
mov word [ebp - 0xf0], ax
mov byte [ebp - 4], 0x15
cmp byte [ebp - 0x3b5], bl
je 0x10014a18
lea ebx, [ebp - 0x9c]
call fcn.1001da7d
push 0x67
call fcn.1001d6bd
lea eax, [ebp - 0xf0]
push eax
call fcn.1001d9b3
lea eax, [ebp - 0x294]
push 0x100afb00
push eax
mov edi, ebx
call fcn.10014290
lea ecx, [ebp - 0xf0]
push ecx
lea ecx, [ebp - 0x2cc]
push ecx
mov ecx, eax
mov byte [ebp - 4], 0x16
call fcn.100142fb
push 0x100b0528
push eax
lea eax, [ebp - 0x2e8]
push eax
mov byte [ebp - 4], 0x17
call fcn.1001431d
add esp, 0x24
push eax
mov ecx, ebx
mov byte [ebp - 4], 0x18
call fcn.1000fd37
xor edi, edi
push edi
push 1
lea ecx, [ebp - 0x2e8]
call fcn.1000f89d
push edi
push 1
lea ecx, [ebp - 0x2cc]
call fcn.1000f89d
push edi
push 1
lea ecx, [ebp - 0x294]
call fcn.1000f89d
call section..text
lea eax, [ebp - 0x3b4]
call fcn.10014d7d
or esi, 0xffffffff
push esi
push edi
mov eax, ebx
push eax
lea ecx, [ebp - 0x3b4]
mov byte [ebp - 4], 0x19
call fcn.1000f802
push esi
push edi
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x398]
call fcn.1000f802
push esi
push edi
lea eax, [ebp - 0x208]
push eax
lea ecx, [ebp - 0x37c]
call fcn.1000f802
push esi
push edi
lea eax, [ebp - 0xd4]
push eax
lea ecx, [ebp - 0x360]
call fcn.1000f802
push esi
push edi
lea eax, [ebp - 0x1ec]
push eax
lea ecx, [ebp - 0x344]
call fcn.1000f802
push esi
push edi
lea eax, [ebp - 0x1d0]
push eax
lea ecx, [ebp - 0x328]
call fcn.1000f802
push esi
push edi
lea eax, [ebp - 0x1b4]
push eax
lea ecx, [ebp - 0x308]
mov dword [ebp - 0x30c], edi
call fcn.1000f802
mov al, byte [ebp + 0x11]
mov ecx, dword [ebp - 0x3bc]
lea edx, [ebp - 0x3b4]
mov byte [ebp - 0x2ec], al
call fcn.100138a0
lea esi, [ebp - 0x3b4]
mov byte [ebp - 0x3b5], al
mov byte [ebp - 4], 0x15
call fcn.10014dea
xor ebx, ebx
inc edi
jmp 0x10014c65
push str.SoftwareBaiduBaidu
lea ecx, [ebp - 0x17c]
call fcn.1000f6ca
push str.SupplyID
lea ecx, [ebp - 0x198]
mov byte [ebp - 4], 0x1a
call fcn.1000f6ca
push 0x100af7c4
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0x1b
call fcn.1000f6ca
push esi
lea ecx, [ebp - 0x10c]
mov byte [ebp - 4], 0x1c
call fcn.1000f6ca
push esi
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x1d
call fcn.1000f6ca
push str.2.2.0.1452
lea ecx, [ebp - 0x144]
mov byte [ebp - 4], 0x1e
call fcn.1000f6ca
lea eax, [ebp - 0x3d4]
push eax
mov byte [ebp - 4], 0x1f
call fcn.1005d50b
mov eax, dword [ebp - 0x3d4]
mov dword [ebp - 0x3c0], eax
mov esi, reloc.OLEAUT32.dll_SysReAllocString
lea eax, [ebp - 0x17c]
push esi
push eax
lea ecx, [ebp - 0x10c]
lea edx, [ebp - 0x198]
call fcn.1001ca54
lea eax, [ebp - 0x17c]
push esi
push eax
lea ecx, [ebp - 0x48]
lea edx, [ebp - 0x240]
call fcn.1001ca54
mov eax, dword [ebp - 0x10c]
add esp, 0x14
push 8
pop esi
cmp dword [ebp - 0xf8], esi
jae 0x10014aeb
lea eax, [ebp - 0x10c]
push eax
call fcn.1005d3e2
mov dword [ebp - 0x3c8], eax
mov eax, dword [ebp - 0xd4]
pop ecx
cmp dword [ebp - 0xc0], esi
jae 0x10014b0c
lea eax, [ebp - 0xd4]
push eax
call fcn.1005d3e2
mov dword [ebp - 0x3cc], eax
call fcn.10024d49
mov edx, dword [eax]
mov ecx, eax
mov dword [esp], 0x1f7
call dword [edx]
mov edi, eax
cmp edi, ebx
je 0x10014b89
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x34], esi
jae 0x10014b3b
lea eax, [ebp - 0x48]
push ebx
push ebx
push 9
push dword [ebp - 0x3cc]
mov ecx, dword [edi]
push ebx
push esi
push dword [ebp - 0x3c8]
push ebx
push 7
push eax
movzx eax, byte [ebp - 0x3b6]
push 3
pop esi
push esi
push 6
neg eax
sbb eax, eax
and eax, esi
push eax
push ebx
push 4
push esi
push ebx
push esi
push 6
push edi
call dword [ecx + 0x38]
add esp, 0x50
call fcn.10024d49
mov edx, dword [eax]
push ebx
push ebx
push 1
push edi
mov ecx, eax
call dword [edx + 8]
jmp 0x10014b8c
push 3
pop esi
cmp byte [ebp - 0x3b6], bl
je 0x10014c13
call fcn.10024d49
mov edx, dword [eax]
push 0x531
mov ecx, eax
call dword [edx]
mov edi, eax
cmp edi, ebx
je 0x10014c13
cmp dword [ebp - 0x130], 8
mov ecx, dword [ebp - 0x144]
jae 0x10014bbf
lea ecx, [ebp - 0x144]
cmp dword [ebp - 0x34], 8
mov eax, dword [ebp - 0x48]
jae 0x10014bcb
lea eax, [ebp - 0x48]
push 2
push ebx
push 0x15
push 1
push ebx
push 0x14
push dword [ebp - 0x3c0]
mov edx, dword [edi]
push ebx
push 5
push dword [ebp - 0x3cc]
push ebx
push 4
push dword [ebp - 0x3c8]
push ebx
push esi
push ecx
push esi
push 2
push eax
push esi
push 1
push 7
push edi
call dword [edx + 0x38]
add esp, 0x5c
call fcn.10024d49
mov edx, dword [eax]
push ebx
push ebx
push 1
push edi
mov ecx, eax
call dword [edx + 8]
xor edi, edi
push ebx
inc edi
push edi
lea ecx, [ebp - 0x144]
call fcn.1000f89d
push ebx
push edi
lea ecx, [ebp - 0x48]
call fcn.1000f89d
push ebx
push edi
lea ecx, [ebp - 0x10c]
call fcn.1000f89d
push ebx
push edi
lea ecx, [ebp - 0x240]
call fcn.1000f89d
push ebx
push edi
lea ecx, [ebp - 0x198]
call fcn.1000f89d
push ebx
push edi
lea ecx, [ebp - 0x17c]
mov byte [ebp - 4], 0x15
call fcn.1000f89d
mov esi, dword [ebp - 0x3bc]
cmp esi, ebx
je 0x10014c7e
call fcn.1001073e
push esi
call fcn.1005c756
xor edi, edi
pop ecx
inc edi
mov eax, dword [0x100da478]
cmp eax, ebx
je 0x10014cbd
mov esi, 0x100da470
mov ecx, esi
mov dword [ebp - 0x3c0], esi
call fcn.10023dc8
mov byte [ebp - 4], 0x20
mov eax, dword [0x100da478]
cmp eax, ebx
je 0x10014cb2
push eax
call fcn.10024e75
mov dword [0x100da478], ebx
mov ecx, esi
mov byte [ebp - 4], 0x15
call fcn.10023e8b
push ebx
push edi
lea ecx, [ebp - 0xf0]
call fcn.1000f89d
push ebx
push edi
lea ecx, [ebp - 0x9c]
call fcn.1000f89d
mov eax, dword [ebp - 0x3c4]
mov byte [ebp - 4], 0xa
cmp eax, ebx
je 0x10014ceb
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
push ebx
push edi
lea ecx, [ebp - 0xb8]
call fcn.1000f89d
push ebx
push edi
lea ecx, [ebp - 0x64]
call fcn.1000f89d
push ebx
push edi
lea ecx, [ebp - 0x80]
call fcn.1000f89d
push ebx
push edi
lea ecx, [ebp - 0x2c]
call fcn.1000f89d
push ebx
push edi
lea ecx, [ebp - 0x160]
call fcn.1000f89d
push ebx
push edi
lea ecx, [ebp - 0x128]
call fcn.1000f89d
push ebx
push edi
lea ecx, [ebp - 0x1b4]
call fcn.1000f89d
push ebx
push edi
lea ecx, [ebp - 0x1d0]
call fcn.1000f89d
push ebx
push edi
lea ecx, [ebp - 0x1ec]
call fcn.1000f89d
push ebx
push edi
lea ecx, [ebp - 0x208]
call fcn.1000f89d
push ebx
push edi
lea ecx, [ebp - 0xd4]
call fcn.1000f89d
mov al, byte [ebp - 0x3b5]
call fcn.100768d1
ret