Function at 0x100536e6
Capabilities:
Check internet connectivity via wininet
Create process on windows
Delete registry value

Disassembly:
push ebp
sub esp, 0x38
mov eax, 0x100bce66
call fcn.100a0664
push ecx
mov eax, 0x1690
call fcn.1009fbd0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor ebx, ebx
lea eax, [ebp + 0x28]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.100449b3
pop ecx
pop ecx
xor eax, eax
push 0x206
mov word [ebp - 0x2f8], ax
lea eax, [ebp - 0x2f6]
push ebx
push eax
mov byte [ebp - 4], 1
call fcn.1009f9b0
add esp, 0xc
push ebx
lea ecx, [ebp + 0x28]
call fcn.10003413
push eax
lea eax, [ebp - 0x2f8]
push str._ssettings
push eax
call fcn.100a0114
push 0x180
call fcn.100a00a4
mov ecx, eax
add esp, 0x10
mov dword [ebp + 0x38], ecx
mov byte [ebp - 4], 2
cmp ecx, ebx
je 0x10053777
push ebx
call fcn.1002c567
mov esi, eax
jmp 0x10053779
xor esi, esi
push ebx
xor edi, edi
inc edi
push edi
push ebx
push ebx
push ebx
push str.TOOLBAR
push esi
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 1
call fcn.10081e7f
push ebx
push edi
push ebx
lea eax, [ebp - 0x2f8]
push eax
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 3
call fcn.10082725
cmp dword [ebp - 0x28], 0xffffff92
je 0x100537f7
cmp dword [ebp - 0x28], ebx
je 0x100537f7
cmp dword [ebp - 0x28], 0xffffff96
je 0x100537f7
cmp esi, ebx
je 0x100537c6
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 8]
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 1
call fcn.10081e59
mov ecx, dword [ebp + 0x28]
add ecx, 0xfffffff0
call fcn.10001ccd
xor al, al
lea esp, [ebp - 0x16ac]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add ebp, 0x3c
leave
ret
cmp esi, ebx
je 0x10053ad7
cmp dword [esi + 0x130], ebx
je 0x10053acf
lea ecx, [ebp - 0x16a0]
call fcn.10074bbc
mov byte [ebp - 4], 4
mov dword [ebp - 0x3cc], esi
xor edi, edi
mov eax, dword [esi + 0x130]
lea ecx, [eax + 0xb0]
mov eax, dword [ecx + 0x10]
sub eax, dword [ecx + 0xc]
sar eax, 2
cmp edi, eax
jae 0x10053852
push edi
call fcn.1000b27e
mov ecx, dword [eax]
mov eax, dword [ecx]
lea edx, [ebp - 0x15e8]
push edx
call dword [eax + 0x24]
inc edi
jmp 0x10053822
xor edi, edi
mov eax, dword [esi + 0x130]
lea ecx, [eax + 0x98]
mov eax, dword [ecx + 0x10]
sub eax, dword [ecx + 0xc]
sar eax, 2
cmp edi, eax
jae 0x10053884
push edi
call fcn.1000b27e
mov ecx, dword [eax]
mov eax, dword [ecx]
lea edx, [ebp - 0x15e8]
push edx
call dword [eax + 0x24]
inc edi
jmp 0x10053854
push ecx
mov ecx, esp
mov dword [ebp + 0x38], esp
push str.urlAfterUninstall
call fcn.100057f4
lea eax, [ebp + 0x30]
push eax
mov ecx, esi
call fcn.1003111a
push ecx
lea eax, [esi + 0x34]
mov dword [ebp + 0x38], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 5
call fcn.100033f5
push ebx
call fcn.10044cd9
mov eax, dword [esi]
pop ecx
pop ecx
push 1
mov ecx, esi
call dword [eax + 8]
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x3cc], ebx
cmp dword [eax - 0xc], ebx
je 0x10053a48
push eax
call fcn.1009e314
mov dword [ebp + 0x24], eax
pop ecx
lea eax, [ebp + 0x24]
push eax
call fcn.1006dbde
pop ecx
push dword [ebp + 0x24]
lea ecx, [ebp + 0x30]
call fcn.100049c6
push dword [ebp + 0x24]
call fcn.1009f74b
lea eax, [ebp + 0x38]
push eax
call fcn.100166a6
pop ecx
pop ecx
push 0x1010c424
push eax
lea eax, [ebp + 0x2c]
push eax
mov byte [ebp - 4], 6
call fcn.10004f80
add esp, 0xc
push 0x100c7994
push eax
lea eax, [ebp + 0x10]
push eax
mov byte [ebp - 4], 7
call fcn.1000c4dd
add esp, 0xc
mov ecx, dword [ebp + 0x2c]
add ecx, 0xfffffff0
call fcn.10001ccd
mov ecx, dword [ebp + 0x38]
add ecx, 0xfffffff0
call fcn.10001ccd
mov dword [ebp + 0x1c], ebx
mov dword [ebp + 0x20], ebx
push ebx
push ebx
push 0x2001f
push ebx
push ebx
push dword [ebp + 0x10]
lea ecx, [ebp + 0x1c]
push SysReAllocString
mov byte [ebp - 4], 0xb
call fcn.10001485
lea eax, [ebp + 0x14]
push eax
push str.SilentUninstall
lea ecx, [ebp + 0x1c]
mov dword [ebp + 0x14], ebx
call fcn.100464c0
push ebx
cmp dword [ebp + 0x14], ebx
jne 0x100539a8
lea ecx, [ebp + 0x30]
call fcn.10003413
push 5
push ebx
push eax
push str.iexplore.exe
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x10053a35
lea eax, [ebp + 0x38]
push eax
mov dword [ebp + 0x38], ebx
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x10053a35
mov edi, dword [ebp + 0x30]
cmp edi, ebx
je 0x100539cf
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x100539d3
xor eax, eax
jmp 0x100539ec
lea esi, [eax + eax]
mov eax, esi
call fcn.100a2940
mov dword [ebp - 0x10], esp
mov eax, esp
push 3
push esi
push edi
push eax
call fcn.1000b154
sub esp, 0x1c
mov ecx, esp
mov dword [ebp + 0x2c], esp
push eax
call fcn.10005257
lea ecx, [ebp - 0xf0]
call fcn.1001488d
sub esp, 0x1c
mov ecx, esp
mov dword [ebp + 0x2c], esp
push 0x100c67c1
mov byte [ebp - 4], 0xc
call fcn.10005257
lea ecx, [ebp - 0xf0]
call fcn.10014c29
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 0xb
call fcn.10014233
lea ecx, [ebp + 0x1c]
call fcn.1000146a
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.10001ccd
mov dword [ebp + 0x34], ebx
mov dword [ebp + 0x38], ebx
push ebx
push ebx
push 0x2001f
push ebx
push ebx
push str.SoftwareMicrosoftInternet_ExplorerURLSearchHooks_
push SysReAllocString
lea ecx, [ebp + 0x34]
mov byte [ebp - 4], 0xd
call fcn.10001485
cmp eax, ebx
jne 0x10053a9d
push 0xffffffffffffffff
push ebx
push str.CFBFAE00_17A6_11D0_99CB_00C04FD64497
push 0x100c503c
lea ecx, [ebp + 0x34]
call fcn.10042522
push dword [0x1010c404]
push dword [ebp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp + 0x34]
call fcn.1000146a
lea ecx, [ebp + 0x34]
call fcn.1000146a
mov ecx, dword [ebp + 0x30]
add ecx, 0xfffffff0
call fcn.10001ccd
lea ecx, [ebp - 0x16a0]
mov byte [ebp - 4], 3
call fcn.1007300a
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 1
call fcn.10081e59
mov bl, 1
jmp 0x10053ae3
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 8]
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 1
call fcn.10081e59
mov ecx, dword [ebp + 0x28]
add ecx, 0xfffffff0
call fcn.10001ccd
mov al, bl
jmp 0x100537df