Function at 0x1003ba58
Capabilities:
Create thread
Delete file

Disassembly:
mov eax, 0x10058fdb
call fcn.10052270
sub esp, 0x240
push ebx
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0x9c]
push 1
mov eax, dword [esi + 0xa0]
lea edi, [esi + 0x9c]
push eax
push ecx
mov ecx, esi
call fcn.1003ccac
test eax, eax
je 0x1003be2a
push edi
lea ecx, [ebp - 0x24c]
call fcn.10020a29
xor ebx, ebx
push str.option
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.100034da
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x24c]
push eax
mov byte [ebp - 4], 1
call fcn.10020c33
and byte [ebp - 4], bl
lea ecx, [ebp - 0x10]
call fcn.1000349d
push ebx
push ebx
push str.backHomePageStatus
lea ecx, [ebp - 0x24c]
call fcn.10020d3d
test al, al
jne 0x1003baf1
push dword [edi]
mov ecx, esi
call fcn.1004c899
xor esi, esi
jmp 0x1003bb37
mov ebx, str.http:__hao.360.cn_
lea ecx, [ebp - 0x14]
push ebx
call fcn.100034da
push 0x2f
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.10020fd6
mov ecx, dword [ebp + 8]
push 0
push dword [ebp - 0x14]
call fcn.100038ba
cmp eax, 0xffffffff
je 0x1003bb4d
push dword [edi]
mov ecx, esi
call fcn.1004c899
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.1000349d
push 1
pop esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24c]
call fcn.10020bf1
mov eax, esi
jmp 0x1003be2a
mov eax, dword [ebp + 8]
push str.about:blank
mov eax, dword [eax]
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
pop ecx
test eax, eax
pop ecx
jne 0x1003bb89
mov eax, ebx
test eax, eax
je 0x1003bb71
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp + 8]
push ebx
push eax
call fcn.100035e4
push dword [edi]
mov ecx, esi
call fcn.1004c899
jmp 0x1003be0c
mov al, byte [ebp + 0xb]
mov byte [ebp - 0x2c], al
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 3
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.back_hpage_black_list
call fcn.100034da
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.1003c107
push dword [edi]
mov ecx, esi
call fcn.1004c899
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.1000334b
push dword [edi]
call dword [sym.imp.USER32.dll_CharLowerA]
push edi
lea ecx, [ebp - 0x1c]
call fcn.1001e895
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
mov byte [ebp - 4], 5
call fcn.1003be3b
test eax, eax
je 0x1003bc99
xor edi, edi
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x1003bc99
mov ecx, dword [ebp - 0x24]
sub ecx, eax
sar ecx, 2
cmp edi, ecx
jae 0x1003bc99
mov eax, dword [eax + edi*4]
push 0x10078b14
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
pop ecx
test eax, eax
pop ecx
je 0x1003bc3f
mov eax, dword [ebp - 0x28]
push dword [eax + edi*4]
push dword [ebp - 0x1c]
call dword [sym.imp.MSVCRT.dll__mbscmp]
pop ecx
test eax, eax
pop ecx
je 0x1003bc42
inc edi
jmp 0x1003bbfa
mov eax, dword [0x10070040]
mov dword [ebp - 0x10], eax
inc edi
lea eax, [ebp - 0x10]
push edi
push 0x100717f4
push eax
mov byte [ebp - 4], 6
call fcn.10009c35
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.10018353
mov ecx, dword [ebp + 8]
push eax
mov byte [ebp - 4], 7
call fcn.10003640
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 6
call fcn.1000349d
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 5
call fcn.1000349d
jmp 0x1003bdf4
push dword [ebp + 8]
lea ecx, [esi + 0x8fc]
call fcn.10003640
lea eax, [ebp - 0x3c]
push eax
xor eax, eax
push eax
push esi
push 0x1003c0bc
push eax
push eax
call dword [sym.imp.MSVCRT.dll__beginthreadex]
lea edi, [esi + 0x8f8]
add esp, 0x18
test eax, eax
mov dword [edi], eax
je 0x1003bce2
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [edi], 0
push dword [esi + 0x900]
call fcn.1001e196
test eax, eax
pop ecx
jne 0x1003bd13
mov esi, str.about:blank
mov eax, esi
test eax, eax
je 0x1003bd04
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp + 8]
push esi
push eax
call fcn.100035e4
jmp 0x1003bdf4
mov eax, dword [esi + 0x900]
push 1
push eax
lea ecx, [ebp - 0x38]
call fcn.1001c0bc
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 8
call fcn.1001c192
test al, al
je 0x1003bdc9
mov edi, dword [ebp - 0x30]
mov eax, 0x1770
cmp edi, eax
jbe 0x1003bd4a
mov edi, eax
lea eax, [edi + 1]
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
pop ecx
mov dword [ebp - 0x10], eax
push edi
push eax
lea ecx, [ebp - 0x38]
call fcn.1001c19c
lea ecx, [ebp - 0x38]
call fcn.1001c179
mov eax, dword [ebp - 0x10]
and byte [eax + edi], 0
xor edi, edi
mov ecx, dword [esi + 0xa8]
test ecx, ecx
jne 0x1003bd81
xor eax, eax
jmp 0x1003bd8c
mov eax, dword [esi + 0xac]
sub eax, ecx
sar eax, 2
cmp edi, eax
jge 0x1003bdb9
mov eax, dword [esi + 0xa8]
push dword [eax + edi*4]
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1003bdb6
mov ecx, dword [ebp + 8]
push ebx
call fcn.100036ad
mov dword [ebp - 0x18], 1
inc edi
jmp 0x1003bd73
cmp dword [ebp - 0x10], 0
je 0x1003bdc9
push dword [ebp - 0x10]
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
push dword [esi + 0x900]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp - 0x18], 0
jne 0x1003bde8
mov ecx, dword [ebp + 8]
push str.about:blank
call fcn.100036ad
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 5
call fcn.1001c13a
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 3
call fcn.1000349d
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.10003457
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.1000349d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24c]
call fcn.10020bf1
push 1
pop eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4