Function at 0x10033bf0
Capabilities:
Delete registry value
Resolve function by parsing pe exports
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x2a0
mov esi, esp
mov eax, dword [0x101b9014]
xor eax, ebp
mov dword [esi + 0x298], eax
call fcn.100857f0
push eax
call fcn.1005acd0
add esp, 4
mov ebx, dword [0x101bee38]
push str.Explorer_2345_Installing_Files
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
je 0x10033c77
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esi + 0x80]
mov dword [eax], str.restore_last_session_2345
mov dword [eax + 4], 0x19
lea ecx, [ebx + 0x18]
add ebx, 0x1c
lea edi, [esi + 0x20]
push eax
push edi
call fcn.1005d390
cmp dword [edi], ebx
jne 0x10033cab
push 0x240000
push 0x1019cd1e
push str.OmhVck_W
jmp 0x10033ca3
push str.doctor_2345explorer.named_mutex.repairing
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
je 0x10033cc4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x240000
push 0x1019cd1e
push 0x1019cda4
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor edi, edi
mov ecx, dword [esi + 0x298]
xor ecx, ebp
call fcn.101465a3
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, dword [ebp + 8]
mov dword [esi + 0x4c], 0
call dword [sym.imp.KERNEL32.dll_IsThreadAFiber]
mov dword [esi + 4], 2
test eax, eax
jne 0x10033d59
push 1
push 0
call dword [sym.imp.KERNEL32.dll_ConvertThreadToFiberEx]
test eax, eax
je 0x10033d36
lea ecx, [esi + 0x80]
mov dword [ecx], edi
mov dword [ecx + 4], eax
xor eax, eax
mov dword [ecx + 8], eax
push ecx
push 0x10034780
push 1
push 0x400000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFiberEx]
test eax, eax
je 0x10033d3f
mov edi, eax
push eax
call dword [sym.imp.KERNEL32.dll_SwitchToFiber]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFiber]
call dword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
mov edi, dword [esi + 0x88]
jmp 0x10033cad
mov dword [esi + 4], 0
jmp 0x10033d45
xor eax, eax
inc eax
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esi + 0x4c]
mov dword [ecx], eax
push ecx
call fcn.10012050
add esp, 4
call sub.chrome_elf.dll_IsBrowserProcess
test al, al
je 0x10033de1
lea edi, [esi + 0x82]
push 0x208
push 0xff
push edi
call fcn.10149430
add esp, 0xc
mov word [edi - 2], 0
lea edi, [esi + 0x80]
push 0x105
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [eax - 1]
cmp ecx, 0x103
ja 0x10033de1
lea ecx, [esi + 0x74]
push eax
push edi
call fcn.10060680
lea edi, [esi + 0x20]
lea ecx, [esi + 0x74]
push edi
call fcn.10060ec0
push edi
call fcn.1007f5c0
add esp, 4
cmp byte [edi + 0xb], 0
jns 0x10033dd0
push dword [esi + 0x20]
call fcn.10145bd4
add esp, 4
cmp byte [esi + 0x7f], 0
jns 0x10033de1
push dword [esi + 0x74]
call fcn.10145bd4
add esp, 4
call dword [sym.imp.chrome_elf.dll_GetInstallDetailsPayload]
mov edi, eax
push 8
call fcn.10145ba4
add esp, 4
mov dword [eax], method.std::Cr::locale::facet.virtual_0
mov dword [eax + 4], edi
mov dword [0x101bfe78], eax
call sub.chrome_elf.dll_SignalInitializeCrashReporting
call sub.chrome_elf.dll_IsBrowserProcess
test al, al
je 0x10033e16
mov byte [0x101be220], 1
mov dword [esi], ebx
cmp dword [esi + 4], 2
jne 0x10034766
push 0x10082190
call fcn.1015584d
add esp, 4
mov dword [0x101bfbe4], 1
mov byte [0x101bfbe0], 1
xor ebx, ebx
dec ebx
lea edi, [esi + 0x40]
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov ecx, dword [esi]
push 4
push str.type
push edi
call fcn.1005ae90
movzx eax, byte [edi + 0xb]
test al, al
js 0x10033e6e
test eax, eax
sete cl
mov edx, eax
jmp 0x10033e83
mov edi, dword [esi + 0x40]
mov edx, dword [esi + 0x44]
test edx, edx
sete cl
je 0x10033e83
test edi, edi
je 0x1003476c
cmp edx, 0x10
jne 0x10033ea8
test cl, cl
jne 0x10033ebd
movdqu xmm0, xmmword [edi]
movdqu xmm1, xmmword [str.crashpad_handler]
pcmpeqb xmm1, xmm0
pmovmskb ecx, xmm1
cmp ecx, 0xffff
je 0x10033ebd
test al, al
js 0x10033ffa
test eax, eax
sete dl
lea ecx, [esi + 0x40]
jmp 0x1003400f
mov ebx, dword [esi]
push ebx
call fcn.1008f778
add esp, 4
lea edi, [esi + 0x80]
mov dword [edi], str.no_periodic_tasks
mov dword [edi + 4], 0x11
lea ecx, [ebx + 0x18]
lea eax, [ebx + 0x1c]
mov dword [esi + 0xc], eax
lea eax, [esi + 0x20]
push edi
push eax
call fcn.1005d390
lea eax, [esi + 0x20]
mov dword [esi + 4], 0
mov ecx, dword [esi + 0xc]
cmp dword [eax], ecx
jne 0x100343d7
pxor xmm0, xmm0
lea edi, [esi + 0x80]
movdqa xmmword [edi], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmm0, xmmword [0x1019ccd0]
movdqa xmmword [edi + 0x30], xmm0
mov byte [edi + 0x38], 0
mov ecx, ebx
push 0x13
push str.initial_client_data
push eax
mov ebx, eax
call fcn.1005ae90
mov ecx, edi
push ebx
call fcn.100908d4
cmp byte [esi + 0x2b], 0
jns 0x10033f5a
push dword [esi + 0x20]
mov ebx, eax
call fcn.10145bd4
mov eax, ebx
add esp, 4
xor ebx, ebx
test al, al
je 0x100343cc
lea eax, [esi + 0x74]
mov dword [eax], 0xffffffff
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call ebx
mov edi, eax
mov eax, dword [esi + 0xb4]
mov dword [esi + 4], eax
call ebx
push 2
push 0
push 0x400
lea ecx, [esi + 0x74]
push ecx
push edi
push dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x100343ca
xor ebx, ebx
dec ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x20], ebx
lea ecx, [esi + 0x20]
push dword [esi + 0x74]
call fcn.100825c0
push 0x58
call fcn.10145ba4
add esp, 4
mov ebx, eax
mov ecx, eax
call fcn.1008f364
mov edi, esp
sub esp, 8
mov ecx, esp
lea eax, [esi + 0x20]
push eax
call fcn.10082630
mov ecx, ebx
call fcn.1008f40c
mov esp, edi
test al, al
je 0x10033fed
mov ecx, ebx
call fcn.1008f53e
lea ecx, [esi + 0x20]
call fcn.1003b3e0
jmp 0x100343cc
mov ecx, dword [esi + 0x40]
mov eax, dword [esi + 0x44]
test eax, eax
sete dl
je 0x1003400f
test ecx, ecx
je 0x10034772
cmp eax, 0x10
jne 0x1003403b
test dl, dl
jne 0x1003429b
movdqu xmm0, xmmword [ecx]
movdqu xmm1, xmmword [str.fallback_handler]
pcmpeqb xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
je 0x1003429b
lea edi, [esi + 0x38]
mov dword [edi + 4], ebx
mov dword [edi], ebx
mov ecx, dword [0x101bac60]
call dword [section..00cfg]
push edi
call ecx
add esp, 4
call sub.chrome_elf.dll_SignalChromeElf
lea ecx, [esi + 0x20]
mov dword [ecx + 0x14], ebx
mov dword [ecx + 0x10], ebx
pcmpeqd xmm0, xmm0
movdqa xmmword [ecx], xmm0
call fcn.10058c10
mov edi, dword [esi]
cmp dword [edi + 0x20], 1
jbe 0x100342a9
xor eax, eax
lea ecx, [esi + 0x80]
mov dword [ecx + 4], eax
mov dword [ecx], eax
mov dword [ecx + 8], eax
push ecx
push 1
call fcn.10071140
add esp, 8
test al, al
je 0x100345b2
lea ebx, [esi + 0x80]
mov ecx, ebx
call fcn.10062e00
test al, al
je 0x100345b2
xor edi, edi
lea ecx, [esi + 0x74]
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
push 0x2001f
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
push 0x80000001
call fcn.10084620
test eax, eax
jne 0x1003457c
mov dword [esi + 0x6c], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x70], edi
cmp byte [esi + 0x8b], 0
jns 0x100340f5
mov ebx, dword [esi + 0x80]
lea edi, [esi + 0x68]
lea ecx, [esi + 0x74]
push edi
push ebx
call fcn.10084690
test eax, eax
jne 0x1003456b
xor eax, eax
dec eax
mov dword [esi + 0x5c], eax
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], eax
movzx eax, byte [esi + 0x73]
test al, al
jns 0x10034124
mov edi, dword [esi + 0x68]
mov eax, dword [esi + 0x6c]
xor ecx, ecx
inc ecx
lea edx, [esi + 0x5c]
push ecx
push ecx
push ecx
push 0x1019d002
push eax
push edi
push edx
call fcn.10082ba0
add esp, 0x1c
mov ecx, 0x1019ceec
lea eax, [esi + 0x50]
mov dword [esi + 0x10], eax
mov ebx, dword [esi + 0x5c]
mov eax, dword [esi + 0x60]
cmp ebx, eax
mov dword [esi + 0x14], ecx
je 0x1003426d
mov dword [esi + 8], eax
mov edi, dword [ecx]
test edi, edi
je 0x1003476f
push edi
call fcn.10163aa4
add esp, 4
mov dword [esi], eax
mov eax, ebx
movzx edx, byte [ebx + 0xb]
test dl, dl
jns 0x10034182
mov ecx, ebx
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
test edx, edx
je 0x1003418e
test eax, eax
je 0x10034763
cmp edx, dword [esi]
jne 0x100341a9
test edx, edx
je 0x100341b9
xor edx, edx
movzx ecx, word [eax + edx*2]
cmp cx, word [edi + edx*2]
jne 0x100341a9
inc edx
cmp dword [esi], edx
jne 0x10034198
jmp 0x100341b9
add ebx, 0xc
cmp ebx, dword [esi + 8]
jne 0x10034171
mov eax, dword [esi + 8]
jmp 0x1003426d
mov eax, dword [esi + 8]
cmp ebx, eax
je 0x1003426d
mov ecx, eax
lea eax, [ebx + 0xc]
cmp eax, ecx
je 0x10034294
mov edx, ebx
mov dword [esi + 4], edx
mov dword [esi + 0xc], ebx
mov ebx, eax
push edi
call fcn.10163aa4
add esp, 4
movzx edx, byte [ebx + 0xb]
mov dword [esi], ebx
mov ecx, ebx
test dl, dl
jns 0x100341f7
mov edx, dword [esi]
mov ecx, dword [edx]
mov edx, dword [edx + 4]
test edx, edx
je 0x10034203
test ecx, ecx
je 0x1003475a
cmp edx, eax
jne 0x10034227
test edx, edx
je 0x10034220
xor edx, edx
mov ebx, edi
movzx edi, word [ecx + edx*2]
cmp di, word [ebx + edx*2]
mov edi, ebx
jne 0x10034227
inc edx
cmp eax, edx
jne 0x1003420d
mov ebx, dword [esi]
mov edx, dword [esi + 4]
jmp 0x1003425c
mov edx, dword [esi + 4]
cmp byte [edx + 0xb], 0
jns 0x1003423d
push dword [edx]
call fcn.10145bd4
mov edx, dword [esi + 4]
add esp, 4
mov ebx, dword [esi]
mov eax, dword [ebx + 8]
mov dword [edx + 8], eax
movq xmm0, qword [ebx]
movq qword [edx], xmm0
mov eax, dword [esi + 0xc]
mov byte [eax + 0x17], 0
mov word [ebx], 0
add edx, 0xc
lea eax, [ebx + 0xc]
cmp eax, dword [esi + 8]
jne 0x100341d3
mov eax, dword [esi + 0x60]
jmp 0x1003426f
mov edx, eax
lea ecx, [esi + 0x5c]
push eax
push edx
lea eax, [esi + 0x50]
push eax
call fcn.10034a9e
mov ecx, dword [esi + 0x14]
add ecx, 4
cmp ecx, str.WIN95
jne 0x10034148
jmp 0x100344ad
mov edx, ebx
mov eax, dword [esi + 8]
jmp 0x1003426f
mov ecx, dword [esi]
call fcn.10034800
mov edi, eax
jmp 0x10034727
mov eax, dword [edi + 0x18]
add edi, 0x1c
cmp eax, edi
je 0x10034346
movzx edx, byte [eax + 0x1b]
test dl, dl
js 0x100342c4
lea ecx, [eax + 0x10]
jmp 0x100342ca
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
test edx, edx
je 0x100342d6
test ecx, ecx
je 0x1003475d
cmp edx, 0x11
jne 0x1003407c
movdqu xmm0, xmmword [ecx]
movdqu xmm1, xmmword [str.profile_directory]
pcmpeqb xmm1, xmm0
movzx ecx, byte [ecx + 0x10]
movzx edx, byte [0x101a37ec]
movd xmm0, ecx
movd xmm2, edx
pcmpeqb xmm2, xmm0
pand xmm2, xmm1
pmovmskb ecx, xmm2
cmp ecx, 0xffff
jne 0x1003407c
test eax, eax
je 0x10034760
mov edx, dword [eax + 4]
test edx, edx
je 0x10034333
mov ecx, edx
mov edx, dword [edx]
test edx, edx
jne 0x10034329
jmp 0x1003433c
mov ecx, dword [eax + 8]
cmp dword [ecx], eax
mov eax, ecx
jne 0x10034333
mov eax, ecx
cmp ecx, edi
jne 0x100342b7
xor eax, eax
lea edi, [esi + 0x80]
mov dword [edi + 4], eax
mov dword [edi], eax
mov dword [edi + 8], eax
push edi
call fcn.1008e1f4
add esp, 4
test al, al
je 0x100343aa
push edi
call fcn.10035e58
add esp, 4
push edi
call fcn.1008da40
add esp, 4
test eax, eax
je 0x100343aa
push eax
call fcn.1008db27
add esp, 4
mov edi, eax
cmp byte [esi + 0x8b], 0
jns 0x1003439b
push dword [esi + 0x80]
call fcn.10145bd4
add esp, 4
test edi, edi
jne 0x1003407c
xor edi, edi
jmp 0x1003471f
cmp byte [esi + 0x8b], 0
jns 0x1003407c
push dword [esi + 0x80]
call fcn.10145bd4
add esp, 4
jmp 0x1003407c
xor ebx, ebx
mov dword [esi + 4], ebx
mov ebx, dword [esi]
lea edi, [esi + 0x80]
xor eax, eax
dec eax
mov dword [esi + 0x80], eax
mov dword [esi + 0x84], eax
mov dword [esi + 0x88], eax
mov eax, str.user_data_dir
mov ecx, ebx
push 0xd
push eax
mov ebx, str.user_data_dir
push edi
call fcn.1005b150
push ebx
push str.type
push edi
push dword [0x101bee38]
call fcn.1008fa94
add esp, 0x10
mov edi, eax
test eax, eax
je 0x1003444e
mov ebx, dword [esi + 4]
test ebx, ebx
je 0x10034491
mov eax, dword [ebx + 0x54]
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x10034435
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp byte [esi + 0x8b], 0
jns 0x1003446c
push dword [esi + 0x80]
call fcn.10145bd4
add esp, 4
jmp 0x1003446c
cmp byte [esi + 0x8b], 0
mov ebx, dword [esi + 4]
jns 0x10034468
push dword [esi + 0x80]
call fcn.10145bd4
add esp, 4
test ebx, ebx
je 0x100344a6
lea ecx, [ebx + 0x54]
call fcn.1003b3e0
lea ecx, [ebx + 8]
call fcn.100c7540
mov ecx, ebx
call fcn.1003b3e0
push ebx
call fcn.10145bd4
add esp, 4
jmp 0x10034727
cmp byte [esi + 0x8b], 0
jns 0x10034727
push dword [esi + 0x80]
jmp 0x10034484
xor edi, edi
jmp 0x10034727
mov eax, dword [esi + 0x5c]
mov ecx, dword [esi + 0x60]
cmp eax, ecx
je 0x10034504
xor edx, edx
dec edx
mov dword [esi + 0x50], edx
mov dword [esi + 0x54], edx
mov dword [esi + 0x58], edx
sub ecx, eax
sar ecx, 2
imul ecx, ecx, 0xaaaaaaab
xor ebx, ebx
inc ebx
push ebx
push 0x1019d002
push eax
push ecx
lea eax, [esi + 0x50]
push eax
call fcn.10083160
add esp, 0x14
cmp byte [esi + 0x5b], 0
jns 0x100344f1
mov eax, dword [esi + 0x50]
mov dword [esi + 0x10], eax
cmp byte [esi + 0x8b], 0
jns 0x10034515
mov edi, ebx
mov eax, dword [esi + 0x80]
jmp 0x1003451d
cmp byte [esi + 0x8b], 0
jns 0x10034553
mov eax, dword [esi + 0x80]
jmp 0x10034559
mov edi, ebx
lea eax, [esi + 0x80]
mov dword [esi], eax
mov ebx, dword [esi + 0x10]
push ebx
call fcn.10163aa4
add esp, 4
add eax, eax
add eax, 2
push eax
push ebx
push edi
push 0
push dword [esi]
push dword [esi + 0x74]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp byte [esi + 0x5b], 0
jns 0x10034563
push dword [esi + 0x50]
call fcn.10145bd4
add esp, 4
jmp 0x10034563
lea eax, [esi + 0x80]
push eax
push dword [esi + 0x74]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [esi + 0x5c]
call fcn.10034a50
cmp byte [esi + 0x73], 0
jns 0x1003457c
push dword [esi + 0x68]
call fcn.10145bd4
add esp, 4
mov eax, dword [esi + 0x74]
test eax, eax
je 0x10034592
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [esi + 0x74], eax
mov dword [esi + 0x78], eax
mov edi, dword [esi + 0x7c]
mov dword [esi + 0x7c], 0
test edi, edi
je 0x100345b2
mov eax, dword [edi]
mov ebx, dword [eax]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, edi
push 1
call ebx
cmp byte [esi + 0x8b], 0
jns 0x100345c9
push dword [esi + 0x80]
call fcn.10145bd4
add esp, 4
call fcn.100821e0
test al, al
mov ebx, 0xffffffff
je 0x10034600
push str.User32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.ChangeWindowMessageFilter
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10034600
mov ecx, eax
call dword [section..00cfg]
push 1
push 0x4a
call ecx
call fcn.10085360
mov edi, eax
push eax
call sub.chrome_elf.dll_SetCrashLogCacheHandler
add esp, 4
mov dword [esi + 0x74], edi
mov ecx, dword [0x101bee54]
test ecx, ecx
je 0x1003462d
push 0x27
push str.....chrome_appchrome_exe_main_win.cc
call fcn.100a36d0
mov ebx, eax
jmp 0x10034638
xor eax, eax
sub eax, dword [0x101bee4c]
cmovns ebx, eax
test ebx, ebx
jle 0x10034672
lea edi, [esi + 0x80]
mov ecx, edi
push 0xffffffffffffffff
push 0x1cd
push str.....chrome_appchrome_exe_main_win.cc
call fcn.100661d0
lea eax, [esi + 0x88]
push 0x17
push str.About_to_load_main_DLL.
push eax
call fcn.10034b83
add esp, 0xc
mov ecx, edi
call fcn.10066600
push 0x2c
call fcn.10145ba4
add esp, 4
mov ebx, eax
pxor xmm0, xmm0
movdqu xmmword [eax], xmm0
movdqu xmmword [eax + 0x10], xmm0
movdqu xmmword [eax + 0x1c], xmm0
mov ecx, eax
call fcn.10034fac
mov dword [ebx], 0x1019a808
mov eax, dword [esi + 0x38]
mov ecx, dword [esi + 0x3c]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ecx
sub esp, 0x10
movq xmm0, qword [esi + 0x18]
movq qword [esp + 4], xmm0
lea eax, [esi + 0x74]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov ecx, ebx
call fcn.1003533e
mov edi, eax
mov ecx, ebx
call fcn.10035ae8
test ebx, ebx
je 0x100346e8
mov ecx, ebx
call fcn.10035bd8
push ebx
call fcn.10145bd4
add esp, 4
lea eax, [esi + 0x40]
movzx ecx, byte [eax + 0xb]
test cl, cl
cmovs ecx, dword [eax + 4]
cmovs eax, dword [eax]
test ecx, ecx
je 0x10034700
test eax, eax
je 0x10034769
cmp ecx, 5
je 0x10034741
cmp ecx, 7
jne 0x1003471f
mov ecx, dword [eax]
xor ecx, dword [0x1019d58a]
mov eax, dword [eax + 3]
xor eax, dword [0x1019d58d]
or eax, ecx
je 0x10034754
lea ecx, [esi + 0x20]
call fcn.10058c70
cmp byte [esi + 0x4b], 0
jns 0x10033cad
push dword [esi + 0x40]
call fcn.10145bd4
add esp, 4
jmp 0x10033cad
push ecx
push str.ppapi
push eax
call fcn.10147f9d
add esp, 0xc
test eax, eax
jne 0x1003471f
push edi
call fcn.10082790
int3
int3
int3
int3
int3
int3
int3
int3
int3