Function at 0x101495c0
Capabilities:
Get common file path
Get program files directory
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xeb4
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 0x26
lea eax, [ebp - 0x414]
mov dword [ebp - 0xeb4], ecx
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.Internet_ExplorerIEXPLORE.EXE
push 0x104
lea eax, [ebp - 0x414]
push eax
call fcn.10026a30
call fcn.10175b00
push 0x438
mov edi, eax
lea eax, [ebp - 0xe84]
push 0
push eax
call sub.msvcrt.dll_memset
lea ecx, [ebp - 0xe84]
mov dword [ebp - 0xe88], 0x43c
lea esi, [ebp - 0x414]
mov eax, ecx
add esp, 0xc
mov edx, 0x104
sub esi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x10149660
movzx eax, word [esi + ecx]
test ax, ax
je 0x10149660
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x10149640
jmp 0x10149664
test edx, edx
jne 0x10149667
sub ecx, 2
xor eax, eax
mov word [ecx], ax
mov ecx, edi
mov dword [ebp - 0xa68], eax
lea eax, [ebp - 0xe88]
push eax
mov dword [ebp - 0xa6c], 0x1e
call fcn.10176640
mov dword [ebp - 0xe90], 0
cmp eax, 3
je 0x10149773
call fcn.100de170
test eax, eax
je 0x10149773
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0xe9c], 0x208
lea eax, [ebp - 0xe9c]
mov dword [ebp - 0xea0], 1
push 0x20219
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xea0]
push eax
push str.svcVersion
push str.SoftwareMicrosoftInternet_Explorer
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.100585c0
test eax, eax
jne 0x10149856
push eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xea4]
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0xea4], 0x2e
push eax
call sub.msvcrt.dll_wcstok
mov edx, eax
add esp, 0xc
test edx, edx
je 0x10149856
mov ecx, edx
lea esi, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10149740
sub ecx, esi
sar ecx, 1
je 0x10149856
push edx
call sub.msvcrt.dll__wtoi
mov esi, eax
add esp, 4
test esi, esi
jle 0x10149856
mov dword [ebp - 0xe90], esi
jmp 0x1014985c
lea eax, [ebp - 0xe90]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.100daa60
add esp, 8
lea eax, [ebp - 0xe90]
push eax
call fcn.100db0b0
push eax
call fcn.100daa60
add esp, 8
test eax, eax
je 0x10149856
mov esi, dword [ebp - 0xe90]
test esi, esi
je 0x1014985c
call fcn.10009c50
test eax, eax
je 0x10149806
cmp esi, 8
jne 0x10149856
lea eax, [ebp - 0xe94]
mov dword [ebp - 0xe94], 0
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionComponent_Based_ServicingRebootPending
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.100081c0
test eax, eax
jne 0x10149856
push dword [ebp - 0xe94]
call fcn.10034ac0
xor esi, esi
mov dword [ebp - 0xe90], esi
jmp 0x1014985c
push 0xf023f
lea eax, [ebp - 0xea8]
mov dword [ebp - 0xea8], 0x400
push eax
lea eax, [ebp - 0x814]
mov dword [ebp - 0xeac], 1
push eax
lea eax, [ebp - 0xeac]
push eax
push str.NoIE4StubProcessing
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.100585c0
test eax, eax
jne 0x10149856
xor esi, esi
mov dword [ebp - 0xe90], esi
jmp 0x1014985c
mov esi, dword [ebp - 0xe90]
xor edi, edi
cmp esi, 0xb
ja case.0x10149863.1
jmp dword [esi*4 + 0x10149c30]
mov edi, 0x100
jmp case.0x10149863.1
mov edi, 0x200
jmp case.0x10149863.1
mov edi, 0x400
jmp case.0x10149863.1
mov edi, 0x800
jmp case.0x10149863.1
mov edi, 0x1000000
jmp case.0x10149863.1
mov edi, 0x2000000
jmp case.0x10149863.1
mov edi, 0x700
push ebx
lea eax, [ebp - 0xe8c]
push str.360se6.exe
push eax
call fcn.100092f0
mov esi, dword [ebp - 0xe8c]
add esp, 8
or ebx, 0xffffffff
cmp dword [esi - 0xc], 0
jne 0x10149953
lea eax, [ebp - 0xeb0]
push str.360SE.exe
push eax
call fcn.100092f0
add esp, 8
lea ecx, [ebp - 0xe8c]
push eax
call fcn.10002790
mov edx, dword [ebp - 0xeb0]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x101498fe
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0xe8c]
cmp dword [esi - 0xc], 0
jne 0x10149953
lea eax, [ebp - 0xe98]
push str.360SE_3.exe
push eax
call fcn.100092f0
add esp, 8
lea ecx, [ebp - 0xe8c]
push eax
call fcn.10002790
mov edx, dword [ebp - 0xe98]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10149947
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0xe8c]
cmp dword [esi - 0xc], 0
je 0x101499a4
push str.360se.exe
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x101499a4
push esi
call fcn.1000aa00
add esp, 4
test eax, eax
je 0x101499a4
mov ecx, dword [ebp - 0xeb4]
lea eax, [ebp - 0xe8c]
push eax
add ecx, 0xdc
call fcn.10002790
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x1014999d
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, 0x2000
jmp 0x101499be
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x101499b9
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, 0x1000
push 0x118
lea eax, [ebp - 0x92c]
mov dword [ebp - 0x930], 0x11c
push 0
push eax
or esi, edi
call sub.msvcrt.dll_memset
mov edi, dword [0x10257644]
add esp, 0xc
pop ebx
test edi, edi
jne 0x10149a3a
mov ecx, 1
mov edx, 0x102575c4
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x10149a10
call fcn.1004f560
mov dword [0x102575c4], 2
jmp 0x10149a32
cmp dword [0x102575c4], 2
je 0x10149a2d
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
nop
push 1
call edi
cmp dword [0x102575c4], 2
jne 0x10149a20
call fcn.1004f560
mov edi, eax
mov dword [0x10257644], edi
cmp dword [edi + 4], 0xffffffff
je 0x10149a58
mov eax, dword [ebp - 0x930]
cmp eax, 0x11c
jb 0x10149a52
mov eax, 0x11c
push eax
lea eax, [edi + 8]
jmp 0x10149aa3
push 0x118
lea eax, [ebp - 0xa48]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0xa4c], 0x11c
lea eax, [ebp - 0xa4c]
mov ecx, edi
push eax
call fcn.10036290
test eax, eax
je 0x10149ab3
mov eax, dword [ebp - 0x930]
cmp eax, 0x11c
jb 0x10149a9c
mov eax, 0x11c
push eax
lea eax, [ebp - 0xa4c]
push eax
lea eax, [ebp - 0x930]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x92c]
cmp eax, 5
jne 0x10149ae5
mov eax, dword [ebp - 0x928]
test eax, eax
jne 0x10149ad2
mov eax, 2
jmp 0x10149b5d
cmp eax, 1
jne 0x10149ade
mov eax, 2
jmp 0x10149b5d
cmp eax, 2
jne 0x10149b4e
jmp 0x10149b5d
cmp eax, 6
jne 0x10149b2b
mov eax, dword [ebp - 0x928]
test eax, eax
jne 0x10149afb
mov eax, 8
jmp 0x10149b5d
cmp eax, 2
jne 0x10149b11
call fcn.10009c50
neg eax
sbb eax, eax
and eax, 0x40
add eax, 0x40
jmp 0x10149b5d
cmp eax, 3
jne 0x10149b4e
call fcn.10009c50
neg eax
sbb eax, eax
and eax, 0x10000000
add eax, 0x10000000
jmp 0x10149b5d
cmp eax, 0xa
jne 0x10149b4e
cmp dword [ebp - 0x928], 0
jne 0x10149b4e
call fcn.10009c50
neg eax
sbb eax, eax
and eax, 0x40000000
add eax, 0x40000000
jmp 0x10149b5d
call fcn.10009c50
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x10
movzx ecx, word [ebp - 0x81c]
or esi, eax
mov eax, esi
cmp ecx, 7
ja case.default.0x10149b71
jmp dword [ecx*4 + 0x10149c60]
mov eax, esi
pop edi
or eax, 0x10000
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
mov eax, esi
pop edi
or eax, 0x20000
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
mov eax, esi
pop edi
or eax, 0x40000
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
mov eax, esi
pop edi
or eax, 0x80000
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
mov eax, esi
pop edi
or eax, 0x100000
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
mov eax, esi
pop edi
or eax, 0x200000
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
mov eax, esi
pop edi
or eax, 0x400000
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
mov eax, esi
or eax, 0x800000
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.101f99c6
mov esp, ebp
pop ebp
ret