Function at 0x4abc40
Capabilities:
Contain obfuscated stackstrings
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6110fd
mov eax, dword fs:[0]
push eax
sub esp, 0x650
mov eax, dword [0x685680]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
push 0xffffffffffffffff
push 0
push 0x687a8c
lea ecx, [ebp - 0x4d4]
mov dword [ebp - 0x4c0], 0xf
mov dword [ebp - 0x4c4], 0
mov byte [ebp - 0x4d4], 0
call fcn.00403720
mov dword [ebp - 4], 0
push 8
push str.bing.com
lea ecx, [ebp - 0x48c]
mov dword [ebp - 0x478], 0xf
mov dword [ebp - 0x47c], 0
mov byte [ebp - 0x48c], 0
call fcn.00403850
mov byte [ebp - 4], 1
push 0x1f
push str.http:__www.bing.com_favicon.ico
lea ecx, [ebp - 0x474]
mov dword [ebp - 0x460], 0xf
mov dword [ebp - 0x464], 0
mov byte [ebp - 0x474], 0
call fcn.00403850
push 0xffffffffffffffff
mov byte [ebp - 4], 2
push 0
push 0x687b04
lea ecx, [ebp - 0x4a4]
mov dword [ebp - 0x490], 0xf
mov dword [ebp - 0x494], 0
mov byte [ebp - 0x4a4], 0
call fcn.00403720
mov byte [ebp - 4], 3
push 0x47
push str.http:__api.bing.com_osjson.aspx_querysearchTermslanguagelanguage
lea ecx, [ebp - 0x45c]
mov dword [ebp - 0x448], 0xf
mov dword [ebp - 0x44c], 0
mov byte [ebp - 0x45c], 0
call fcn.00403850
mov byte [ebp - 4], 4
push 0x15
push str.https:__www.bing.com_
lea ecx, [ebp - 0x4bc]
mov dword [ebp - 0x4a8], 0xf
mov dword [ebp - 0x4ac], 0
mov byte [ebp - 0x4bc], 0
call fcn.00403850
mov byte [ebp - 4], 5
cmp byte [0x690593], 0
je 0x4abe21
push 0xffffffffffffffff
push 0
push 0x687c6c
lea ecx, [ebp - 0x4d4]
call fcn.00403720
push 0xffffffffffffffff
push 0
push 0x687b7c
lea ecx, [ebp - 0x48c]
call fcn.00403720
push 0xffffffffffffffff
push 0
push 0x687b34
lea ecx, [ebp - 0x474]
call fcn.00403720
push 0xffffffffffffffff
push 0
push 0x687cb4
lea ecx, [ebp - 0x4a4]
call fcn.00403720
push 0xffffffffffffffff
push 0
push 0x687c3c
lea ecx, [ebp - 0x45c]
call fcn.00403720
push 0xffffffffffffffff
push 0
push 0x687e04
lea ecx, [ebp - 0x4bc]
call fcn.00403720
mov dword [ebp - 0x418], 0xf
mov dword [ebp - 0x41c], 0
mov byte [ebp - 0x42c], 0
lea eax, [ebp - 0x444]
push eax
mov ecx, esi
mov byte [ebp - 4], 6
call fcn.004a6ce0
mov byte [ebp - 4], 7
cmp dword [ebp - 0x430], 0x10
lea eax, [ebp - 0x444]
cmovae eax, dword [ebp - 0x444]
push eax
call dword [0x6905e0]
test eax, eax
jne 0x4abe78
xor bl, bl
jmp 0x4ac7af
cmp dword [ebp - 0x430], 0x10
lea edx, [ebp - 0x444]
cmovae edx, dword [ebp - 0x444]
mov dword [ebp - 0x510], 0xf
mov dword [ebp - 0x514], 0
mov byte [ebp - 0x524], 0
cmp byte [edx], 0
jne 0x4abeb0
xor ecx, ecx
jmp 0x4abebe
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4abeb5
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x524]
call fcn.00403850
sub esp, 8
lea edx, [ebp - 0x524]
lea ecx, [ebp - 0x4ec]
mov byte [ebp - 4], 8
call fcn.00452190
add esp, 8
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0x510], 0x10
jb 0x4abf01
push dword [ebp - 0x524]
call fcn.004b9997
add esp, 4
cmp dword [ebp - 0x4d8], 0x10
lea ecx, [ebp - 0x4f4]
lea eax, [ebp - 0x4ec]
cmovae eax, dword [ebp - 0x4ec]
push ecx
push eax
mov dword [ebp - 0x510], 0xf
mov dword [ebp - 0x514], 0
mov byte [ebp - 0x524], 0
call fcn.004a55d0
add esp, 8
test eax, eax
je 0x4abf59
push dword [ebp - 0x4f4]
call fcn.004a3e80
add esp, 4
xor bl, bl
jmp 0x4ac77d
lea eax, [ebp - 0x4d4]
push eax
mov edx, str.select_exists__select__from_keywords_where_short_name
lea ecx, [ebp - 0x50c]
mov dword [ebp - 0x4f0], 0
or ebx, 0xffffffff
call fcn.00456480
add esp, 4
push 0x65340c
mov edx, eax
lea ecx, [ebp - 0x53c]
mov byte [ebp - 4], 0xb
call fcn.00423480
mov esi, eax
lea eax, [ebp - 0x42c]
add esp, 4
cmp eax, esi
je 0x4abfe3
cmp dword [ebp - 0x418], 0x10
jb 0x4abfbc
push dword [ebp - 0x42c]
call fcn.004b9997
add esp, 4
push esi
lea ecx, [ebp - 0x42c]
mov dword [ebp - 0x418], 0xf
mov dword [ebp - 0x41c], 0
mov byte [ebp - 0x42c], 0
call fcn.00416e10
cmp dword [ebp - 0x528], 0x10
jb 0x4abffa
push dword [ebp - 0x53c]
call fcn.004b9997
add esp, 4
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0x4f8], 0x10
mov dword [ebp - 0x528], 0xf
mov dword [ebp - 0x52c], 0
mov byte [ebp - 0x53c], 0
jb 0x4ac030
push dword [ebp - 0x50c]
call fcn.004b9997
add esp, 4
cmp dword [ebp - 0x418], 0x10
mov esi, dword [ebp - 0x4f4]
push 0
lea ecx, [ebp - 0x4f0]
push ecx
lea eax, [ebp - 0x42c]
cmovae eax, dword [ebp - 0x42c]
push 0xffffffffffffffff
push eax
push esi
call fcn.00492b60
mov eax, dword [ebp - 0x4f0]
add esp, 0x14
test eax, eax
je 0x4ac733
push eax
call fcn.00474c10
add esp, 4
cmp eax, 0x64
jne 0x4ac08d
push 0
push dword [ebp - 0x4f0]
call fcn.00475070
add esp, 8
mov ebx, eax
push dword [ebp - 0x4f0]
call fcn.004745a0
add esp, 4
cmp ebx, 1
jne 0x4ac3fc
lea eax, [ebp - 0x48c]
push eax
mov edx, str.update_keywords_set_keyword__
lea ecx, [ebp - 0x56c]
call fcn.00456480
add esp, 4
push str.__url__
mov edx, eax
lea ecx, [ebp - 0x554]
mov byte [ebp - 4], 0xc
call fcn.00423480
add esp, 4
lea ecx, [ebp - 0x4a4]
push ecx
mov edx, eax
lea ecx, [ebp - 0x5cc]
mov byte [ebp - 4], 0xd
call fcn.00433c50
add esp, 4
push str.__favicon_url__
mov edx, eax
lea ecx, [ebp - 0x59c]
mov byte [ebp - 4], 0xe
call fcn.00423480
add esp, 4
lea ecx, [ebp - 0x474]
push ecx
mov edx, eax
lea ecx, [ebp - 0x644]
mov byte [ebp - 4], 0xf
call fcn.00433c50
add esp, 4
push str.__show_in_default_list__1__input_encodings__UTF_8__suggest_url__
mov edx, eax
lea ecx, [ebp - 0x5e4]
mov byte [ebp - 4], 0x10
call fcn.00423480
add esp, 4
lea ecx, [ebp - 0x45c]
push ecx
mov edx, eax
lea ecx, [ebp - 0x584]
mov byte [ebp - 4], 0x11
call fcn.00433c50
add esp, 4
push str.__sync_guid__
mov edx, eax
lea ecx, [ebp - 0x5b4]
mov byte [ebp - 4], 0x12
call fcn.00423480
add esp, 4
push 0x687da4
mov edx, eax
lea ecx, [ebp - 0x65c]
mov byte [ebp - 4], 0x13
call fcn.00433c50
add esp, 4
push str.__new_tab_url__
mov edx, eax
lea ecx, [ebp - 0x62c]
mov byte [ebp - 4], 0x14
call fcn.00423480
add esp, 4
lea ecx, [ebp - 0x4bc]
push ecx
mov edx, eax
lea ecx, [ebp - 0x5fc]
mov byte [ebp - 4], 0x15
call fcn.00433c50
add esp, 4
push str._where_short_name__
mov edx, eax
lea ecx, [ebp - 0x614]
mov byte [ebp - 4], 0x16
call fcn.00423480
add esp, 4
lea ecx, [ebp - 0x4d4]
push ecx
mov edx, eax
lea ecx, [ebp - 0x53c]
mov byte [ebp - 4], 0x17
call fcn.00433c50
add esp, 4
push 0x65343c
mov edx, eax
lea ecx, [ebp - 0x50c]
mov byte [ebp - 4], 0x18
call fcn.00423480
add esp, 4
lea ecx, [ebp - 0x42c]
push eax
call fcn.0040d290
lea ecx, [ebp - 0x50c]
call fcn.00401720
lea ecx, [ebp - 0x53c]
call fcn.00401720
lea ecx, [ebp - 0x614]
call fcn.00401720
lea ecx, [ebp - 0x5fc]
call fcn.00401720
lea ecx, [ebp - 0x62c]
call fcn.00401720
lea ecx, [ebp - 0x65c]
call fcn.00401720
lea ecx, [ebp - 0x5b4]
call fcn.00401720
lea ecx, [ebp - 0x584]
call fcn.00401720
lea ecx, [ebp - 0x5e4]
call fcn.00401720
lea ecx, [ebp - 0x644]
call fcn.00401720
lea ecx, [ebp - 0x59c]
call fcn.00401720
lea ecx, [ebp - 0x5cc]
call fcn.00401720
lea ecx, [ebp - 0x554]
call fcn.00401720
lea ecx, [ebp - 0x56c]
mov byte [ebp - 4], 0xa
call fcn.00401720
cmp dword [ebp - 0x418], 0x10
push 0
push 0
lea eax, [ebp - 0x42c]
cmovae eax, dword [ebp - 0x42c]
push 0
push eax
push esi
call fcn.0048f970
add esp, 0x14
lea eax, [ebp - 0x4d4]
push eax
mov edx, str.select_id_from_keywords_where_short_name
lea ecx, [ebp - 0x554]
call fcn.00456480
add esp, 4
push 0x65343c
mov edx, eax
lea ecx, [ebp - 0x56c]
mov byte [ebp - 4], 0x19
call fcn.00423480
add esp, 4
lea ecx, [ebp - 0x42c]
push eax
call fcn.0040d290
lea ecx, [ebp - 0x56c]
call fcn.00401720
lea ecx, [ebp - 0x554]
mov byte [ebp - 4], 0xa
call fcn.00401720
cmp dword [ebp - 0x418], 0x10
push 0
lea ecx, [ebp - 0x4f0]
push ecx
lea eax, [ebp - 0x42c]
cmovae eax, dword [ebp - 0x42c]
push 0xffffffffffffffff
push eax
push esi
call fcn.00492b60
add esp, 0x14
push dword [ebp - 0x4f0]
call fcn.00474c10
add esp, 4
cmp eax, 0x64
jne 0x4ac382
push 0
push dword [ebp - 0x4f0]
call fcn.00475070
add esp, 8
mov dword [edi], eax
push dword [ebp - 0x4f0]
call fcn.004745a0
add esp, 4
push 0
lea eax, [ebp - 0x4f0]
push eax
push 0xffffffffffffffff
push str.select_exists__select__from_meta_where_keyDefault_Search_Provider_ID_
push esi
call fcn.00492b60
mov eax, dword [ebp - 0x4f0]
add esp, 0x14
test eax, eax
je 0x4ac733
push eax
or ebx, 0xffffffff
call fcn.00474c10
add esp, 4
cmp eax, 0x64
jne 0x4ac3da
push 0
push dword [ebp - 0x4f0]
call fcn.00475070
add esp, 8
mov ebx, eax
push dword [ebp - 0x4f0]
call fcn.004745a0
add esp, 4
test ebx, ebx
jne 0x4ac702
push dword [edi]
push str.insert_into_meta__key_value__values__Default_Search_Provider_ID__d_
jmp 0x4ac70e
lea eax, [ebp - 0x4d4]
push eax
mov edx, str.insert_into_keywords__short_name__keyword__favicon_url__url__safe_for_autoreplace__date_created__usage_count__input_encodings__show_in_default_list__suggest_url__sync_guid__new_tab_url__alternate_urls__instant_url__search_terms_replacement_key__values__
lea ecx, [ebp - 0x53c]
call fcn.00456480
add esp, 4
push 0x6534f0
mov edx, eax
lea ecx, [ebp - 0x50c]
mov byte [ebp - 4], 0x1a
call fcn.00423480
add esp, 4
lea ecx, [ebp - 0x48c]
push ecx
mov edx, eax
lea ecx, [ebp - 0x614]
mov byte [ebp - 4], 0x1b
call fcn.00433c50
add esp, 4
push 0x6534f0
mov edx, eax
lea ecx, [ebp - 0x5fc]
mov byte [ebp - 4], 0x1c
call fcn.00423480
add esp, 4
lea ecx, [ebp - 0x474]
push ecx
mov edx, eax
lea ecx, [ebp - 0x62c]
mov byte [ebp - 4], 0x1d
call fcn.00433c50
add esp, 4
push 0x6534f0
mov edx, eax
lea ecx, [ebp - 0x65c]
mov byte [ebp - 4], 0x1e
call fcn.00423480
add esp, 4
lea ecx, [ebp - 0x4a4]
push ecx
mov edx, eax
lea ecx, [ebp - 0x5b4]
mov byte [ebp - 4], 0x1f
call fcn.00433c50
add esp, 4
push str._1_0_0_UTF_8_1_
mov edx, eax
lea ecx, [ebp - 0x584]
mov byte [ebp - 4], 0x20
call fcn.00423480
add esp, 4
lea ecx, [ebp - 0x45c]
push ecx
mov edx, eax
lea ecx, [ebp - 0x5e4]
mov byte [ebp - 4], 0x21
call fcn.00433c50
add esp, 4
push 0x6534f0
mov edx, eax
lea ecx, [ebp - 0x644]
mov byte [ebp - 4], 0x22
call fcn.00423480
add esp, 4
push 0x687da4
mov edx, eax
lea ecx, [ebp - 0x59c]
mov byte [ebp - 4], 0x23
call fcn.00433c50
add esp, 4
push 0x6534f0
mov edx, eax
lea ecx, [ebp - 0x5cc]
mov byte [ebp - 4], 0x24
call fcn.00423480
add esp, 4
lea ecx, [ebp - 0x4bc]
push ecx
mov edx, eax
lea ecx, [ebp - 0x554]
mov byte [ebp - 4], 0x25
call fcn.00433c50
add esp, 4
push 0x658184
mov edx, eax
lea ecx, [ebp - 0x56c]
mov byte [ebp - 4], 0x26
call fcn.00423480
add esp, 4
lea ecx, [ebp - 0x42c]
push eax
call fcn.0040d290
lea ecx, [ebp - 0x56c]
call fcn.00401720
lea ecx, [ebp - 0x554]
call fcn.00401720
lea ecx, [ebp - 0x5cc]
call fcn.00401720
lea ecx, [ebp - 0x59c]
call fcn.00401720
lea ecx, [ebp - 0x644]
call fcn.00401720
lea ecx, [ebp - 0x5e4]
call fcn.00401720
lea ecx, [ebp - 0x584]
call fcn.00401720
lea ecx, [ebp - 0x5b4]
call fcn.00401720
lea ecx, [ebp - 0x65c]
call fcn.00401720
lea ecx, [ebp - 0x62c]
call fcn.00401720
lea ecx, [ebp - 0x5fc]
call fcn.00401720
lea ecx, [ebp - 0x614]
call fcn.00401720
lea ecx, [ebp - 0x50c]
call fcn.00401720
lea ecx, [ebp - 0x53c]
mov byte [ebp - 4], 0xa
call fcn.00401720
cmp dword [ebp - 0x418], 0x10
push 0
push 0
lea eax, [ebp - 0x42c]
cmovae eax, dword [ebp - 0x42c]
push 0
push eax
push esi
call fcn.0048f970
add esp, 0x14
lea eax, [ebp - 0x4d4]
push eax
mov edx, str.select_id_from_keywords_where_short_name
lea ecx, [ebp - 0x554]
mov dword [edi], 0xffffffff
call fcn.00456480
add esp, 4
push 0x65343c
mov edx, eax
lea ecx, [ebp - 0x56c]
mov byte [ebp - 4], 0x27
call fcn.00423480
add esp, 4
lea ecx, [ebp - 0x42c]
push eax
call fcn.0040d290
lea ecx, [ebp - 0x56c]
call fcn.00401720
lea ecx, [ebp - 0x554]
mov byte [ebp - 4], 0xa
call fcn.00401720
cmp dword [ebp - 0x418], 0x10
push 0
lea ecx, [ebp - 0x4f0]
push ecx
lea eax, [ebp - 0x42c]
cmovae eax, dword [ebp - 0x42c]
push 0xffffffffffffffff
push eax
push esi
call fcn.00492b60
add esp, 0x14
push dword [ebp - 0x4f0]
call fcn.00474c10
add esp, 4
cmp eax, 0x64
jne 0x4ac6e0
push 0
push dword [ebp - 0x4f0]
call fcn.00475070
add esp, 8
mov dword [edi], eax
push dword [ebp - 0x4f0]
call fcn.004745a0
add esp, 4
cmp dword [edi], 0xffffffff
je 0x4ac733
mov dword [ebp - 0x4f0], 0
jmp 0x4ac390
cmp ebx, 1
jne 0x4ac733
push dword [edi]
push str.update_meta_set_value_d_where_keyDefault_Search_Provider_ID
lea eax, [ebp - 0x414]
push eax
call fcn.00456460
add esp, 0xc
lea eax, [ebp - 0x414]
push 0
push 0
push 0
push eax
push esi
call fcn.0048f970
add esp, 0x14
push esi
call fcn.004a3e80
add esp, 4
lea edx, [ebp - 0x444]
push str._journal
lea ecx, [ebp - 0x50c]
call fcn.0041b8e0
add esp, 4
cmp dword [eax + 0x14], 0x10
jb 0x4ac75d
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp - 0x4f8], 0x10
jb 0x4ac77b
push dword [ebp - 0x50c]
call fcn.004b9997
add esp, 4
mov bl, 1
cmp dword [ebp - 0x4d8], 0x10
jb 0x4ac794
push dword [ebp - 0x4ec]
call fcn.004b9997
add esp, 4
mov dword [ebp - 0x4d8], 0xf
mov dword [ebp - 0x4dc], 0
mov byte [ebp - 0x4ec], 0
cmp dword [ebp - 0x430], 0x10
jb 0x4ac7c6
push dword [ebp - 0x444]
call fcn.004b9997
add esp, 4
cmp dword [ebp - 0x418], 0x10
mov dword [ebp - 0x430], 0xf
mov dword [ebp - 0x434], 0
mov byte [ebp - 0x444], 0
jb 0x4ac7f8
push dword [ebp - 0x42c]
call fcn.004b9997
add esp, 4
cmp dword [ebp - 0x4a8], 0x10
mov dword [ebp - 0x418], 0xf
mov dword [ebp - 0x41c], 0
mov byte [ebp - 0x42c], 0
jb 0x4ac82a
push dword [ebp - 0x4bc]
call fcn.004b9997
add esp, 4
cmp dword [ebp - 0x448], 0x10
mov dword [ebp - 0x4a8], 0xf
mov dword [ebp - 0x4ac], 0
mov byte [ebp - 0x4bc], 0
jb 0x4ac85c
push dword [ebp - 0x45c]
call fcn.004b9997
add esp, 4
cmp dword [ebp - 0x490], 0x10
mov dword [ebp - 0x448], 0xf
mov dword [ebp - 0x44c], 0
mov byte [ebp - 0x45c], 0
jb 0x4ac88e
push dword [ebp - 0x4a4]
call fcn.004b9997
add esp, 4
cmp dword [ebp - 0x460], 0x10
mov dword [ebp - 0x490], 0xf
mov dword [ebp - 0x494], 0
mov byte [ebp - 0x4a4], 0
jb 0x4ac8c0
push dword [ebp - 0x474]
call fcn.004b9997
add esp, 4
cmp dword [ebp - 0x478], 0x10
mov dword [ebp - 0x460], 0xf
mov dword [ebp - 0x464], 0
mov byte [ebp - 0x474], 0
jb 0x4ac8f2
push dword [ebp - 0x48c]
call fcn.004b9997
add esp, 4
cmp dword [ebp - 0x4c0], 0x10
mov dword [ebp - 0x478], 0xf
mov dword [ebp - 0x47c], 0
mov byte [ebp - 0x48c], 0
jb 0x4ac924
push dword [ebp - 0x4d4]
call fcn.004b9997
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005cd355
mov esp, ebp
pop ebp
ret 4