Function at 0x10006070
Capabilities:
Accept command line arguments

Disassembly:
push ebp
lea ebp, [esp - 0x108]
sub esp, 0x108
push 0xfffffffffffffffe
push 0x10027428
push 0x1000bf90
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x100295e4]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x104], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor ebx, ebx
cmp dword [ebp + 0x114], 1
jne 0x100062a3
mov dword [ebp - 4], ebx
push str.C:IEHelpBHO2.txt
mov ecx, 0x1002a9bc
call fcn.100032d0
push str.Enter_DllMain3
push 0x1002a9bc
call fcn.10007ee0
add esp, 8
push 0x104
lea eax, [ebp]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov cl, 0x5c
mov dword [ebp - 0x1c], eax
cmp eax, ebx
jle 0x1000611f
cmp byte [ebp + eax], cl
jne 0x10006181
lea edx, [ebp + eax + 1]
push edx
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp]
push ecx
call fcn.1000c7bc
add esp, 4
push str.iexplore.exe
lea edx, [ebp]
push edx
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
call edi
mov esi, eax
neg esi
sbb esi, esi
add esi, 1
lea eax, [ebp]
push eax
mov ecx, 0x1002a9bc
call fcn.100032d0
cmp esi, ebx
jne 0x10006189
push str.regsvr32.exe
lea ecx, [ebp]
push ecx
call edi
test eax, eax
je 0x10006189
push str.ghome.exe
lea edx, [ebp]
push edx
call edi
test eax, eax
je 0x10006189
mov dword [ebp - 4], 0xfffffffe
jmp 0x100062d0
sub eax, 1
jmp 0x10006103
push str.Loader_perminsion
push 0x1002a9bc
call fcn.10007ee0
add esp, 8
cmp esi, ebx
jne 0x100061ab
mov dword [ebp - 4], 0xfffffffe
jmp 0x100062bb
push str.IEHElpBHO
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, ebx
je 0x100061c3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
push esi
mov ecx, 0x1002a9bc
call fcn.100032d0
push esi
push str.szCmdLine_:__s
push 0x1002a9bc
call fcn.10007ee0
call fcn.10005f20
push esi
call fcn.1000a8a0
add esp, 0x10
mov dword [0x1002a9b8], eax
call fcn.100085c0
mov esi, eax
push 4
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x10006215
mov dword [0x1002a9a4], ebx
jmp 0x10006253
mov byte [esi + 1], bl
push esi
call fcn.1000c567
add esp, 4
mov dword [0x1002a9a4], eax
cmp eax, 6
jne 0x10006232
call fcn.1000a280
jmp 0x1000624e
cmp eax, 8
jne 0x10006244
mov dword [0x1002a9b8], ebx
call fcn.1000a2f0
jmp 0x1000624e
cmp eax, 7
jne 0x10006253
call fcn.1000a350
mov dword [0x1002a9a0], eax
mov eax, dword [0x1002a9a0]
push eax
push str.DllMain_g_hIEAddressBar:__d
push 0x1002a9bc
call fcn.10007ee0
add esp, 0xc
jmp 0x1000629c
mov dword [ebp - 4], 0xfffffffe
cmp dword [ebp + 0x114], ebx
jne 0x100062bb
mov eax, dword [0x1002aee4]
cmp eax, ebx
je 0x100062bb
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
cmp dword [ebp + 0x114], eax
jne 0x100062d2
cmp byte [0x1002aea0], bl
je 0x100062d2
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x104]
xor ecx, ebp
call fcn.1000b6a3
add ebp, 0x108
mov esp, ebp
pop ebp
ret 0xc