Function at 0x100365b0
Capabilities:
Contain obfuscated stackstrings
Inspect section memory permissions
Parse pe header

Disassembly:
push 0xffffffffffffffff
push 0x100445c5
mov eax, dword fs:[0]
push eax
sub esp, 0x1b8
mov eax, dword [0x10054020]
xor eax, esp
mov dword [esp + 0x1b4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10054020]
xor eax, esp
push eax
lea eax, [esp + 0x1cc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x14], ebx
push 0xd
mov edi, 7
push str.CoralExplorer
lea esi, [esp + 0xd4]
mov dword [esp + 0xec], edi
mov dword [esp + 0xe8], ebx
mov word [esp + 0xd8], bx
call fcn.100025e0
mov dword [esp + 0x1d4], ebx
push 0xc
push str.2345Explorer
lea esi, [esp + 0x10c]
mov dword [esp + 0x124], edi
mov dword [esp + 0x120], ebx
mov word [esp + 0x110], bx
call fcn.100025e0
mov byte [esp + 0x1d4], 1
push 0x11
push str.SoftwareClasses_
lea esi, [esp + 0x9c]
mov dword [esp + 0xb4], edi
mov dword [esp + 0xb0], ebx
mov word [esp + 0xa0], bx
call fcn.100025e0
mov byte [esp + 0x1d4], 2
push 0x10
push str.2345ExplorerHTML
lea esi, [esp + 0x128]
mov dword [esp + 0x140], edi
mov dword [esp + 0x13c], ebx
mov word [esp + 0x12c], bx
call fcn.100025e0
mov byte [esp + 0x1d4], 3
push 0x11
push str.CoralExplorerHTML
lea esi, [esp + 0xb8]
mov dword [esp + 0xd0], edi
mov dword [esp + 0xcc], ebx
mov word [esp + 0xbc], bx
call fcn.100025e0
mov byte [esp + 0x1d4], 4
push 0x2c
push str.SoftwareClientsStartMenuInternetCoral.exe
lea esi, [esp + 0x17c]
mov dword [esp + 0x194], edi
mov dword [esp + 0x190], ebx
mov word [esp + 0x180], bx
call fcn.100025e0
mov byte [esp + 0x1d4], 5
push 0x33
push str.SoftwareClientsStartMenuInternet2345Explorer.exe
lea esi, [esp + 0x1b4]
mov dword [esp + 0x1cc], edi
mov dword [esp + 0x1c8], ebx
mov word [esp + 0x1b8], bx
call fcn.100025e0
mov byte [esp + 0x1d4], 6
push 0x22
push str.SoftwareClientsStartMenuInternet
lea esi, [esp + 0x198]
mov dword [esp + 0x1b0], edi
mov dword [esp + 0x1ac], ebx
mov word [esp + 0x19c], bx
call fcn.100025e0
mov byte [esp + 0x1d4], 7
mov dword [esp + 0x154], edi
mov dword [esp + 0x150], ebx
mov word [esp + 0x140], bx
push 0x34
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths_
lea esi, [esp + 0x144]
call fcn.100025e0
mov byte [esp + 0x1d4], 8
push 0x34
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
lea esi, [esp + 0x160]
mov dword [esp + 0x178], edi
mov dword [esp + 0x174], ebx
mov word [esp + 0x164], bx
call fcn.100025e0
mov byte [esp + 0x1d4], 9
push 0x15
push str.SOFTWARE2345Explorer
lea esi, [esp + 0x48]
mov byte [esp + 0x24], bl
mov byte [esp + 0x25], bl
mov dword [esp + 0x60], edi
mov dword [esp + 0x5c], ebx
mov word [esp + 0x4c], bx
call fcn.100025e0
mov byte [esp + 0x1d4], 0xa
cmp dword [esp + 0x58], 8
mov eax, dword [esp + 0x44]
mov dword [esp + 0x14], 1
mov dword [esp + 0x20], ebx
jae 0x1003682f
lea eax, [esp + 0x44]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [esp + 0x20]
push ecx
push 0x20019
push ebx
push eax
push 0x80000002
call ebp
cmp eax, ebx
jne 0x10036949
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [esp + 0x1b], bl
test byte [esp + 0x14], 2
je 0x10036895
and dword [esp + 0x14], 0xfffffffd
cmp dword [esp + 0x90], 8
jb 0x10036882
mov eax, dword [esp + 0x7c]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x90], edi
mov dword [esp + 0x8c], ebx
mov word [esp + 0x7c], bx
mov dword [esp + 0x1d4], 9
test byte [esp + 0x14], 1
je 0x100368c0
and dword [esp + 0x14], 0xfffffffe
cmp dword [esp + 0x58], 8
jb 0x100368c0
mov ecx, dword [esp + 0x44]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp byte [esp + 0x1b], bl
je 0x100369c0
lea edx, [esp + 0x104]
push edx
lea eax, [esp + 0xd0]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x44], esp
push 0x16
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], ebx
push str.SOFTWARECoralExplorer
mov word [esi + 4], bx
call fcn.100025e0
push 0x80000002
lea ecx, [esp + 0x44]
call fcn.1003d240
push 0x16
push str.SOFTWARECoralExplorer
lea esi, [esp + 0x48]
mov dword [esp + 0x60], edi
mov dword [esp + 0x5c], ebx
mov word [esp + 0x4c], bx
call fcn.100025e0
push 0x80000002
mov edi, esi
lea ebx, [esp + 0x20]
call fcn.1003c330
cmp dword [esp + 0x58], 8
jb 0x10036b0c
mov ecx, dword [esp + 0x44]
push ecx
jmp 0x10036b04
push 0x16
push str.SOFTWARECoralExplorer
lea esi, [esp + 0x80]
mov dword [esp + 0x98], edi
mov dword [esp + 0x94], ebx
mov word [esp + 0x84], bx
call fcn.100025e0
cmp dword [esp + 0x90], 8
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x14], 3
mov dword [esp + 0x20], ebx
jae 0x10036990
lea eax, [esp + 0x7c]
lea ecx, [esp + 0x20]
push ecx
push 0x20019
push ebx
push eax
push 0x80000002
call ebp
cmp eax, ebx
jne 0x1003685b
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [esp + 0x1b], 1
jmp 0x1003685f
push 0x15
push str.SOFTWARE2345Explorer
lea esi, [esp + 0x48]
mov dword [esp + 0x60], edi
mov dword [esp + 0x5c], ebx
mov word [esp + 0x4c], bx
call fcn.100025e0
mov byte [esp + 0x1d4], 0xb
or dword [esp + 0x14], 4
cmp dword [esp + 0x58], 8
mov eax, dword [esp + 0x44]
mov dword [esp + 0x20], ebx
jae 0x100369fd
lea eax, [esp + 0x44]
lea edx, [esp + 0x20]
push edx
push 0x20019
push ebx
push eax
push 0x80000002
call ebp
cmp eax, ebx
jne 0x10036a6a
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x16
push str.SOFTWARECoralExplorer
lea esi, [esp + 0x80]
mov dword [esp + 0x98], edi
mov dword [esp + 0x94], ebx
mov word [esp + 0x84], bx
call fcn.100025e0
mov esi, 8
or dword [esp + 0x14], esi
lea eax, [esp + 0x78]
mov edx, 0x80000002
call fcn.1003c3b0
test al, al
je 0x10036a6f
mov byte [esp + 0x1b], 1
jmp 0x10036a73
mov esi, 8
mov byte [esp + 0x1b], bl
test byte [esp + 0x14], 8
je 0x10036aa8
and dword [esp + 0x14], 0xfffffff7
cmp dword [esp + 0x90], esi
jb 0x10036a95
mov ecx, dword [esp + 0x7c]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x90], edi
mov dword [esp + 0x8c], ebx
mov word [esp + 0x7c], bx
mov dword [esp + 0x1d4], 9
test byte [esp + 0x14], 4
je 0x10036ad2
and dword [esp + 0x14], 0xfffffffb
cmp dword [esp + 0x58], esi
jb 0x10036ad2
mov edx, dword [esp + 0x44]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp byte [esp + 0x1b], bl
je 0x10036b11
mov edx, str.SOFTWARECoralExplorer
lea eax, [esp + 0x5c]
call fcn.10001ec0
push 0x80000002
lea edi, [esp + 0x60]
lea ebx, [esp + 0x20]
call fcn.1003c330
cmp dword [esp + 0x74], 8
jb 0x10036b0c
mov eax, dword [esp + 0x60]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
xor ebx, ebx
lea edi, [ebx + 7]
lea eax, [esp + 0x1ac]
mov edx, 0x80000002
call fcn.1003c3b0
test al, al
jne 0x10036c57
lea eax, [esp + 0x174]
mov edx, 0x80000002
call fcn.1003c3b0
test al, al
je 0x10036c57
mov edx, str.2345Explorer.exe
lea eax, [esp + 0x5c]
call fcn.10001ec0
mov edx, str.Coral.exe
lea eax, [esp + 0x40]
mov byte [esp + 0x1d4], 0xc
call fcn.10001ec0
lea ecx, [esp + 0x5c]
push ecx
lea edx, [esp + 0x44]
push edx
sub esp, 0x1c
mov byte [esp + 0x1f8], 0xd
mov ecx, esp
mov dword [esp + 0x44], esp
push 0xffffffffffffffff
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push ebx
lea eax, [esp + 0x1a0]
mov word [ecx + 4], bx
call fcn.100020a0
push 0x80000002
lea ecx, [esp + 0x44]
call fcn.1003d240
mov esi, 8
cmp dword [esp + 0x58], esi
jb 0x10036bc1
mov eax, dword [esp + 0x44]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov byte [esp + 0x1d4], 9
cmp dword [esp + 0x74], esi
mov dword [esp + 0x58], edi
mov dword [esp + 0x54], ebx
mov word [esp + 0x44], bx
jb 0x10036be9
mov ecx, dword [esp + 0x60]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov edx, str.SoftwareClientsStartMenuInternet2345Explorer.exe_shellopencommand
lea eax, [esp + 0x5c]
call fcn.10001ec0
lea edx, [esp + 0x104]
push edx
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0xd8]
mov ecx, 0x80000002
mov byte [esp + 0x1e0], 0xe
call fcn.1003c3f0
mov byte [esp + 0x1d4], 9
cmp dword [esp + 0x74], esi
jb 0x10036c3d
mov edx, dword [esp + 0x60]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
push 0x80000002
lea edi, [esp + 0x178]
lea ebx, [esp + 0x20]
call fcn.1003c330
xor ebx, ebx
lea edi, [ebx + 7]
mov edx, str.SoftwareClasses2345ExplorerHTML
lea eax, [esp + 0x5c]
call fcn.10001ec0
mov byte [esp + 0x1d4], 0xf
or dword [esp + 0x14], 0x10
lea eax, [esp + 0x5c]
mov edx, 0x80000001
call fcn.1003c3b0
test al, al
jne 0x10036cae
mov edx, str.SoftwareClassesCoralExplorerHTML
lea eax, [esp + 0x40]
call fcn.10001ec0
or dword [esp + 0x14], 0x20
lea eax, [esp + 0x40]
mov edx, 0x80000001
call fcn.1003c3b0
test al, al
mov byte [esp + 0x1b], 1
jne 0x10036cb2
mov byte [esp + 0x1b], bl
test byte [esp + 0x14], 0x20
je 0x10036cdf
and dword [esp + 0x14], 0xffffffdf
cmp dword [esp + 0x58], 8
jb 0x10036cd2
mov eax, dword [esp + 0x44]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x58], edi
mov dword [esp + 0x54], ebx
mov word [esp + 0x44], bx
mov dword [esp + 0x1d4], 9
test byte [esp + 0x14], 0x10
je 0x10036d0a
and dword [esp + 0x14], 0xffffffef
cmp dword [esp + 0x74], 8
jb 0x10036d0a
mov ecx, dword [esp + 0x60]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp byte [esp + 0x1b], bl
je 0x10036e4a
lea edx, [esp + 0x104]
push edx
lea eax, [esp + 0xd0]
push eax
sub esp, 0x1c
mov edx, str.SoftwareClassesCoralExplorerHTML
mov eax, esp
mov dword [esp + 0x44], esp
call fcn.10001ec0
push 0x80000001
lea ecx, [esp + 0x44]
call fcn.1003d240
mov edx, str.2345Explorer.exe
lea eax, [esp + 0x5c]
call fcn.10001ec0
mov edx, str.Coral.exe
lea eax, [esp + 0x78]
mov byte [esp + 0x1d4], 0x10
call fcn.10001ec0
mov edx, str.SoftwareClasses2345ExplorerHTML_shellopencommand
lea eax, [esp + 0x40]
mov byte [esp + 0x1d4], 0x11
call fcn.10001ec0
lea ecx, [esp + 0x5c]
push ecx
lea edx, [esp + 0x44]
push edx
lea eax, [esp + 0x24]
push eax
lea edx, [esp + 0x84]
mov ecx, 0x80000001
mov byte [esp + 0x1e0], 0x12
call fcn.1003c3f0
mov esi, 8
cmp dword [esp + 0x58], esi
jb 0x10036dbf
mov ecx, dword [esp + 0x44]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp dword [esp + 0x90], esi
mov edi, 7
mov dword [esp + 0x58], edi
mov dword [esp + 0x54], ebx
mov word [esp + 0x44], bx
jb 0x10036de7
mov edx, dword [esp + 0x7c]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov byte [esp + 0x1d4], 9
cmp dword [esp + 0x74], esi
mov dword [esp + 0x90], edi
mov dword [esp + 0x8c], ebx
mov word [esp + 0x7c], bx
jb 0x10036e15
mov eax, dword [esp + 0x60]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov edx, str.SoftwareClassesCoralExplorerHTML
lea eax, [esp + 0x5c]
call fcn.10001ec0
push 0x80000001
lea edi, [esp + 0x60]
lea ebx, [esp + 0x20]
call fcn.1003c330
cmp dword [esp + 0x74], esi
jb 0x10036e48
mov ecx, dword [esp + 0x60]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
xor ebx, ebx
mov edx, str.SoftwareClasses2345ExplorerHTML
lea eax, [esp + 0x5c]
call fcn.10001ec0
mov byte [esp + 0x1d4], 0x13
or dword [esp + 0x14], 0x40
lea eax, [esp + 0x5c]
mov edx, 0x80000002
call fcn.1003c3b0
test al, al
jne 0x10036ea4
mov edx, str.SoftwareClassesCoralExplorerHTML
lea eax, [esp + 0x40]
call fcn.10001ec0
or dword [esp + 0x14], 0x80
lea eax, [esp + 0x40]
mov edx, 0x80000002
call fcn.1003c3b0
test al, al
mov byte [esp + 0x1b], 1
jne 0x10036ea8
mov byte [esp + 0x1b], bl
test byte [esp + 0x14], 0x80
je 0x10036edc
and dword [esp + 0x14], 0xffffff7f
cmp dword [esp + 0x58], 8
jb 0x10036ecb
mov edx, dword [esp + 0x44]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x58], 7
mov dword [esp + 0x54], ebx
mov word [esp + 0x44], bx
mov dword [esp + 0x1d4], 9
test byte [esp + 0x14], 0x40
je 0x10036f07
and dword [esp + 0x14], 0xffffffbf
cmp dword [esp + 0x74], 8
jb 0x10036f07
mov eax, dword [esp + 0x60]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp byte [esp + 0x1b], bl
je 0x10037047
lea ecx, [esp + 0x104]
push ecx
lea edx, [esp + 0xd0]
push edx
sub esp, 0x1c
mov edx, str.SoftwareClassesCoralExplorerHTML
mov eax, esp
mov dword [esp + 0x44], esp
call fcn.10001ec0
push 0x80000002
lea ecx, [esp + 0x44]
call fcn.1003d240
mov edx, str.2345Explorer.exe
lea eax, [esp + 0x5c]
call fcn.10001ec0
mov edx, str.Coral.exe
lea eax, [esp + 0x78]
mov byte [esp + 0x1d4], 0x14
call fcn.10001ec0
mov edx, str.SoftwareClasses2345ExplorerHTML_shellopencommand
lea eax, [esp + 0x40]
mov byte [esp + 0x1d4], 0x15
call fcn.10001ec0
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x44]
push ecx
lea edx, [esp + 0x24]
push edx
lea edx, [esp + 0x84]
mov ecx, 0x80000002
mov byte [esp + 0x1e0], 0x16
call fcn.1003c3f0
mov esi, 8
cmp dword [esp + 0x58], esi
jb 0x10036fbc
mov eax, dword [esp + 0x44]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp dword [esp + 0x90], esi
mov edi, 7
mov dword [esp + 0x58], edi
mov dword [esp + 0x54], ebx
mov word [esp + 0x44], bx
jb 0x10036fe4
mov ecx, dword [esp + 0x7c]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov byte [esp + 0x1d4], 9
cmp dword [esp + 0x74], esi
mov dword [esp + 0x90], edi
mov dword [esp + 0x8c], ebx
mov word [esp + 0x7c], bx
jb 0x10037012
mov edx, dword [esp + 0x60]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov edx, str.SoftwareClassesCoralExplorerHTML
lea eax, [esp + 0x5c]
call fcn.10001ec0
push 0x80000002
lea edi, [esp + 0x60]
lea ebx, [esp + 0x20]
call fcn.1003c330
cmp dword [esp + 0x74], esi
jb 0x10037045
mov eax, dword [esp + 0x60]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
xor ebx, ebx
mov edx, str.Software2345Explorer
lea eax, [esp + 0x5c]
call fcn.10001ec0
mov byte [esp + 0x1d4], 0x17
mov edi, pe_nt_image_headers32
or dword [esp + 0x14], edi
lea eax, [esp + 0x5c]
mov edx, 0x80000001
call fcn.1003c3b0
test al, al
mov esi, 0x200
jne 0x100370a6
mov edx, str.SoftwareCoralExplorer
lea eax, [esp + 0x40]
call fcn.10001ec0
or dword [esp + 0x14], esi
lea eax, [esp + 0x40]
mov edx, 0x80000001
call fcn.1003c3b0
test al, al
mov byte [esp + 0x1b], 1
jne 0x100370aa
mov byte [esp + 0x1b], bl
test dword [esp + 0x14], esi
je 0x100370dd
and dword [esp + 0x14], 0xfffffdff
cmp dword [esp + 0x58], 8
jb 0x100370cc
mov ecx, dword [esp + 0x44]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x58], 7
mov dword [esp + 0x54], ebx
mov word [esp + 0x44], bx
mov dword [esp + 0x1d4], 9
test dword [esp + 0x14], edi
je 0x1003710a
and dword [esp + 0x14], 0xfffffeff
cmp dword [esp + 0x74], 8
jb 0x1003710a
mov edx, dword [esp + 0x60]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp byte [esp + 0x1b], bl
je 0x10037177
lea eax, [esp + 0x104]
push eax
lea ecx, [esp + 0xd0]
push ecx
sub esp, 0x1c
mov edx, str.SoftwareCoralExplorer
mov eax, esp
mov dword [esp + 0x44], esp
call fcn.10001ec0
push 0x80000001
lea ecx, [esp + 0x44]
call fcn.1003d240
mov edx, str.SoftwareCoralExplorer
lea eax, [esp + 0x5c]
call fcn.10001ec0
push 0x80000001
lea edi, [esp + 0x60]
lea ebx, [esp + 0x20]
call fcn.1003c330
cmp dword [esp + 0x74], 8
jb 0x10037175
mov edx, dword [esp + 0x60]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
xor ebx, ebx
mov edx, str.2345ExplorerHTML
lea eax, [esp + 0x5c]
call fcn.10001ec0
mov byte [esp + 0x1d4], 0x18
mov edi, 0x400
or dword [esp + 0x14], edi
lea eax, [esp + 0x5c]
mov edx, 0x80000000
call fcn.1003c3b0
test al, al
mov esi, 0x800
jne 0x100371d6
mov edx, str.CoralExplorerHTML
lea eax, [esp + 0x40]
call fcn.10001ec0
or dword [esp + 0x14], esi
lea eax, [esp + 0x40]
mov edx, 0x80000000
call fcn.1003c3b0
test al, al
mov byte [esp + 0x1b], 1
jne 0x100371da
mov byte [esp + 0x1b], bl
test dword [esp + 0x14], esi
je 0x1003720d
and dword [esp + 0x14], 0xfffff7ff
cmp dword [esp + 0x58], 8
jb 0x100371fc
mov eax, dword [esp + 0x44]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x58], 7
mov dword [esp + 0x54], ebx
mov word [esp + 0x44], bx
mov dword [esp + 0x1d4], 9
test dword [esp + 0x14], edi
je 0x1003723a
and dword [esp + 0x14], 0xfffffbff
cmp dword [esp + 0x74], 8
jb 0x1003723a
mov ecx, dword [esp + 0x60]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp byte [esp + 0x1b], bl
je 0x1003737a
lea edx, [esp + 0x104]
push edx
lea eax, [esp + 0xd0]
push eax
sub esp, 0x1c
mov edx, str.CoralExplorerHTML
mov eax, esp
mov dword [esp + 0x44], esp
call fcn.10001ec0
push 0x80000000
lea ecx, [esp + 0x44]
call fcn.1003d240
mov edx, str.2345Explorer.exe
lea eax, [esp + 0x5c]
call fcn.10001ec0
mov edx, str.Coral.exe
lea eax, [esp + 0x78]
mov byte [esp + 0x1d4], 0x19
call fcn.10001ec0
mov edx, str.2345ExplorerHTML_shellopencommand
lea eax, [esp + 0x40]
mov byte [esp + 0x1d4], 0x1a
call fcn.10001ec0
lea ecx, [esp + 0x5c]
push ecx
lea edx, [esp + 0x44]
push edx
lea eax, [esp + 0x24]
push eax
lea edx, [esp + 0x84]
mov ecx, 0x80000000
mov byte [esp + 0x1e0], 0x1b
call fcn.1003c3f0
mov esi, 8
cmp dword [esp + 0x58], esi
jb 0x100372ef
mov ecx, dword [esp + 0x44]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp dword [esp + 0x90], esi
mov edi, 7
mov dword [esp + 0x58], edi
mov dword [esp + 0x54], ebx
mov word [esp + 0x44], bx
jb 0x10037317
mov edx, dword [esp + 0x7c]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov byte [esp + 0x1d4], 9
cmp dword [esp + 0x74], esi
mov dword [esp + 0x90], edi
mov dword [esp + 0x8c], ebx
mov word [esp + 0x7c], bx
jb 0x10037345
mov eax, dword [esp + 0x60]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov edx, str.CoralExplorerHTML
lea eax, [esp + 0x5c]
call fcn.10001ec0
push 0x80000000
lea edi, [esp + 0x60]
lea ebx, [esp + 0x20]
call fcn.1003c330
cmp dword [esp + 0x74], esi
jb 0x10037378
mov ecx, dword [esp + 0x60]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
xor ebx, ebx
lea edx, [esp + 0x120]
push edx
lea eax, [esp + 0x98]
push eax
lea edi, [esp + 0x2c]
call fcn.1001dd20
add esp, 8
mov byte [esp + 0x1d4], 0x1c
mov ebp, 0x1000
or dword [esp + 0x14], ebp
mov edx, 0x80000001
call fcn.1003c3b0
test al, al
mov esi, 0x2000
jne 0x100373ed
lea ecx, [esp + 0xb0]
push ecx
lea edx, [esp + 0x98]
push edx
lea edi, [esp + 0x48]
call fcn.1001dd20
or dword [esp + 0x1c], esi
add esp, 8
mov edx, 0x80000001
call fcn.1003c3b0
test al, al
mov byte [esp + 0x1b], 1
jne 0x100373f1
mov byte [esp + 0x1b], bl
test dword [esp + 0x14], esi
je 0x10037424
and dword [esp + 0x14], 0xffffdfff
cmp dword [esp + 0x58], 8
jb 0x10037413
mov eax, dword [esp + 0x44]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x58], 7
mov dword [esp + 0x54], ebx
mov word [esp + 0x44], bx
mov dword [esp + 0x1d4], 9
test dword [esp + 0x14], ebp
je 0x10037451
and dword [esp + 0x14], 0xffffefff
cmp dword [esp + 0x3c], 8
jb 0x10037451
mov ecx, dword [esp + 0x28]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp byte [esp + 0x1b], bl
je 0x100375ea
lea edx, [esp + 0x120]
push edx
lea eax, [esp + 0xb4]
push eax
sub esp, 0x1c
mov edi, esp
mov ecx, eax
mov dword [esp + 0x44], esp
push ecx
lea edx, [esp + 0xbc]
push edx
call fcn.1001dd20
add esp, 8
push 0x80000001
lea ecx, [esp + 0x44]
call fcn.1003d240
mov edx, str.2345Explorer.exe
lea eax, [esp + 0x24]
call fcn.10001ec0
mov edx, str.Coral.exe
lea eax, [esp + 0x40]
mov byte [esp + 0x1d4], 0x1d
call fcn.10001ec0
lea eax, [esp + 0x120]
push eax
lea ecx, [esp + 0x98]
push ecx
lea edi, [esp + 0x64]
mov byte [esp + 0x1dc], 0x1e
call fcn.1001dd20
push eax
mov ebx, str.shellopencommand
lea esi, [esp + 0x84]
mov byte [esp + 0x1e0], 0x1f
call fcn.1000a380
add esp, 0xc
lea edx, [esp + 0x24]
push edx
push eax
lea eax, [esp + 0x24]
push eax
lea edx, [esp + 0x4c]
mov ecx, 0x80000001
mov byte [esp + 0x1e0], 0x20
call fcn.1003c3f0
mov edi, 8
cmp dword [esp + 0x90], edi
jb 0x10037533
mov ecx, dword [esp + 0x7c]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
xor esi, esi
cmp dword [esp + 0x74], edi
mov ebx, 7
mov dword [esp + 0x90], ebx
mov dword [esp + 0x8c], esi
mov word [esp + 0x7c], si
jb 0x10037560
mov edx, dword [esp + 0x60]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp dword [esp + 0x58], edi
mov dword [esp + 0x74], ebx
mov dword [esp + 0x70], esi
mov word [esp + 0x60], si
jb 0x10037580
mov eax, dword [esp + 0x44]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov byte [esp + 0x1d4], 9
cmp dword [esp + 0x3c], edi
mov dword [esp + 0x58], ebx
mov dword [esp + 0x54], esi
mov word [esp + 0x44], si
jb 0x100375a8
mov ecx, dword [esp + 0x28]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
lea edx, [esp + 0xb0]
push edx
lea eax, [esp + 0x98]
push eax
lea edi, [esp + 0x2c]
call fcn.1001dd20
add esp, 8
push 0x80000001
mov edi, eax
lea ebx, [esp + 0x20]
call fcn.1003c330
cmp dword [esp + 0x3c], 8
jb 0x100375e8
mov ecx, dword [esp + 0x28]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
xor ebx, ebx
lea edx, [esp + 0x120]
push edx
lea eax, [esp + 0x98]
push eax
lea edi, [esp + 0x2c]
call fcn.1001dd20
add esp, 8
mov byte [esp + 0x1d4], 0x21
mov ebp, 0x4000
or dword [esp + 0x14], ebp
mov edx, 0x80000002
call fcn.1003c3b0
test al, al
mov esi, 0x8000
jne 0x1003765d
lea ecx, [esp + 0xb0]
push ecx
lea edx, [esp + 0x98]
push edx
lea edi, [esp + 0x64]
call fcn.1001dd20
or dword [esp + 0x1c], esi
add esp, 8
mov edx, 0x80000002
call fcn.1003c3b0
test al, al
mov byte [esp + 0x1b], 1
jne 0x10037661
mov byte [esp + 0x1b], bl
test dword [esp + 0x14], esi
je 0x10037694
and dword [esp + 0x14], 0xffff7fff
cmp dword [esp + 0x74], 8
jb 0x10037683
mov eax, dword [esp + 0x60]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x74], 7
mov dword [esp + 0x70], ebx
mov word [esp + 0x60], bx
mov dword [esp + 0x1d4], 9
test dword [esp + 0x14], ebp
je 0x100376c1
and dword [esp + 0x14], 0xffffbfff
cmp dword [esp + 0x3c], 8
jb 0x100376c1
mov ecx, dword [esp + 0x28]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp byte [esp + 0x1b], bl
je 0x1003785a
lea edx, [esp + 0x120]
push edx
lea eax, [esp + 0xb4]
push eax
sub esp, 0x1c
mov edi, esp
mov ecx, eax
mov dword [esp + 0x44], esp
push ecx
lea edx, [esp + 0xbc]
push edx
call fcn.1001dd20
add esp, 8
push 0x80000002
lea ecx, [esp + 0x44]
call fcn.1003d240
mov edx, str.2345Explorer.exe
lea eax, [esp + 0x24]
call fcn.10001ec0
mov edx, str.Coral.exe
lea eax, [esp + 0x40]
mov byte [esp + 0x1d4], 0x22
call fcn.10001ec0
lea eax, [esp + 0x120]
push eax
lea ecx, [esp + 0x98]
push ecx
lea edi, [esp + 0x80]
mov byte [esp + 0x1dc], 0x23
call fcn.1001dd20
push eax
mov ebx, str.shellopencommand
lea esi, [esp + 0x68]
mov byte [esp + 0x1e0], 0x24
call fcn.1000a380
add esp, 0xc
lea edx, [esp + 0x24]
push edx
push eax
lea eax, [esp + 0x24]
push eax
lea edx, [esp + 0x4c]
mov ecx, 0x80000002
mov byte [esp + 0x1e0], 0x25
call fcn.1003c3f0
mov edi, 8
cmp dword [esp + 0x74], edi
jb 0x100377a0
mov ecx, dword [esp + 0x60]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
xor esi, esi
cmp dword [esp + 0x90], edi
mov ebx, 7
mov dword [esp + 0x74], ebx
mov dword [esp + 0x70], esi
mov word [esp + 0x60], si
jb 0x100377ca
mov edx, dword [esp + 0x7c]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp dword [esp + 0x58], edi
mov dword [esp + 0x90], ebx
mov dword [esp + 0x8c], esi
mov word [esp + 0x7c], si
jb 0x100377f0
mov eax, dword [esp + 0x44]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov byte [esp + 0x1d4], 9
cmp dword [esp + 0x3c], edi
mov dword [esp + 0x58], ebx
mov dword [esp + 0x54], esi
mov word [esp + 0x44], si
jb 0x10037818
mov ecx, dword [esp + 0x28]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
lea edx, [esp + 0xb0]
push edx
lea eax, [esp + 0x98]
push eax
lea edi, [esp + 0x2c]
call fcn.1001dd20
add esp, 8
push 0x80000002
mov edi, eax
lea ebx, [esp + 0x20]
call fcn.1003c330
cmp dword [esp + 0x3c], 8
jb 0x10037858
mov ecx, dword [esp + 0x28]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
xor ebx, ebx
mov edx, str.Progid
lea eax, [esp + 0x24]
call fcn.10001ec0
mov edx, str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
lea eax, [esp + 0x40]
mov byte [esp + 0x1d4], 0x26
call fcn.10001ec0
lea edx, [esp + 0x104]
push edx
lea eax, [esp + 0x44]
push eax
push 0x80000001
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0xdc]
lea edx, [esp + 0x34]
mov byte [esp + 0x1e4], 0x27
call fcn.1003cfb0
mov esi, 8
cmp dword [esp + 0x58], esi
jb 0x100378c5
mov edx, dword [esp + 0x44]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov byte [esp + 0x1d4], 9
cmp dword [esp + 0x3c], esi
mov dword [esp + 0x58], 7
mov dword [esp + 0x54], ebx
mov word [esp + 0x44], bx
jb 0x100378f1
mov eax, dword [esp + 0x28]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov edx, str.2345ExplorerHTML
lea eax, [esp + 0x24]
call fcn.10001ec0
mov edx, str.CoralExplorerHTML
lea eax, [esp + 0x40]
mov byte [esp + 0x1d4], 0x28
call fcn.10001ec0
sub esp, 0x1c
mov byte [esp + 0x1f0], 0x29
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.mhtml
mov eax, esp
lea edi, [esp + 0x40]
lea ebp, [esp + 0x5c]
mov dword [esp + 0x3c], esp
call fcn.10001ec0
lea ecx, [esp + 0x38]
push ecx
mov edx, edi
mov ecx, ebp
call fcn.1003d770
cmp dword [esp + 0x58], esi
jb 0x10037959
mov edx, dword [esp + 0x44]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov byte [esp + 0x1d4], 9
cmp dword [esp + 0x3c], esi
mov dword [esp + 0x58], 7
mov dword [esp + 0x54], ebx
mov word [esp + 0x44], bx
jb 0x10037985
mov eax, dword [esp + 0x28]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov edx, str.2345ExplorerHTML
lea eax, [esp + 0x24]
call fcn.10001ec0
mov edx, str.CoralExplorerHTML
lea eax, [esp + 0x40]
mov byte [esp + 0x1d4], 0x2a
call fcn.10001ec0
sub esp, 0x1c
mov byte [esp + 0x1f0], 0x2b
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.mht
mov eax, esp
lea edi, [esp + 0x40]
lea ebp, [esp + 0x5c]
mov dword [esp + 0x3c], esp
call fcn.10001ec0
lea ecx, [esp + 0x38]
push ecx
mov edx, edi
mov ecx, ebp
call fcn.1003d770
cmp dword [esp + 0x58], esi
jb 0x100379ed
mov edx, dword [esp + 0x44]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov byte [esp + 0x1d4], 9
cmp dword [esp + 0x3c], esi
mov dword [esp + 0x58], 7
mov dword [esp + 0x54], ebx
mov word [esp + 0x44], bx
jb 0x10037a19
mov eax, dword [esp + 0x28]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov edx, str.2345Explorer.exe
lea eax, [esp + 0x24]
call fcn.10001ec0
mov edx, str.Coral.exe
lea eax, [esp + 0x40]
mov byte [esp + 0x1d4], 0x2c
call fcn.10001ec0
sub esp, 0x1c
mov byte [esp + 0x1f0], 0x2d
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.mht
mov eax, esp
lea edi, [esp + 0x40]
lea ebp, [esp + 0x5c]
mov dword [esp + 0x3c], esp
call fcn.10001ec0
lea ecx, [esp + 0x38]
push ecx
mov edx, edi
mov ecx, ebp
call fcn.1003d770
cmp dword [esp + 0x58], esi
jb 0x10037a81
mov edx, dword [esp + 0x44]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov byte [esp + 0x1d4], 9
cmp dword [esp + 0x3c], esi
mov dword [esp + 0x58], 7
mov dword [esp + 0x54], ebx
mov word [esp + 0x44], bx
jb 0x10037aad
mov eax, dword [esp + 0x28]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov edx, str.2345ExplorerHTML
lea eax, [esp + 0x24]
call fcn.10001ec0
mov edx, str.CoralExplorerHTML
lea eax, [esp + 0x40]
mov byte [esp + 0x1d4], 0x2e
call fcn.10001ec0
sub esp, 0x1c
mov byte [esp + 0x1f0], 0x2f
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.html
mov eax, esp
lea edi, [esp + 0x40]
lea ebp, [esp + 0x5c]
mov dword [esp + 0x3c], esp
call fcn.10001ec0
lea ecx, [esp + 0x38]
push ecx
mov edx, edi
mov ecx, ebp
call fcn.1003d770
cmp dword [esp + 0x58], esi
jb 0x10037b15
mov edx, dword [esp + 0x44]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov byte [esp + 0x1d4], 9
cmp dword [esp + 0x3c], esi
mov dword [esp + 0x58], 7
mov dword [esp + 0x54], ebx
mov word [esp + 0x44], bx
jb 0x10037b41
mov eax, dword [esp + 0x28]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov edx, str.2345Explorer.exe
lea eax, [esp + 0x24]
call fcn.10001ec0
mov edx, str.Coral.exe
lea eax, [esp + 0x40]
mov byte [esp + 0x1d4], 0x30
call fcn.10001ec0
sub esp, 0x1c
mov byte [esp + 0x1f0], 0x31
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.html
mov eax, esp
lea edi, [esp + 0x40]
lea ebp, [esp + 0x5c]
mov dword [esp + 0x3c], esp
call fcn.10001ec0
lea ecx, [esp + 0x38]
push ecx
mov edx, edi
mov ecx, ebp
call fcn.1003d770
cmp dword [esp + 0x58], esi
jb 0x10037ba9
mov edx, dword [esp + 0x44]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov byte [esp + 0x1d4], 9
cmp dword [esp + 0x3c], esi
mov dword [esp + 0x58], 7
mov dword [esp + 0x54], ebx
mov word [esp + 0x44], bx
jb 0x10037bd5
mov eax, dword [esp + 0x28]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov edx, str.2345ExplorerHTML
lea eax, [esp + 0x24]
call fcn.10001ec0
mov edx, str.CoralExplorerHTML
lea eax, [esp + 0x40]
mov byte [esp + 0x1d4], 0x32
call fcn.10001ec0
sub esp, 0x1c
mov byte [esp + 0x1f0], 0x33
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.htm
mov eax, esp
lea edi, [esp + 0x40]
lea ebp, [esp + 0x5c]
mov dword [esp + 0x3c], esp
call fcn.10001ec0
lea ecx, [esp + 0x38]
push ecx
mov edx, edi
mov ecx, ebp
call fcn.1003d770
cmp dword [esp + 0x58], esi
jb 0x10037c3d
mov edx, dword [esp + 0x44]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov byte [esp + 0x1d4], 9
cmp dword [esp + 0x3c], esi
mov dword [esp + 0x58], 7
mov dword [esp + 0x54], ebx
mov word [esp + 0x44], bx
jb 0x10037c69
mov eax, dword [esp + 0x28]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov edx, str.2345Explorer.exe
lea eax, [esp + 0x24]
call fcn.10001ec0
mov edx, str.Coral.exe
lea eax, [esp + 0x40]
mov byte [esp + 0x1d4], 0x34
call fcn.10001ec0
sub esp, 0x1c
mov byte [esp + 0x1f0], 0x35
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.htm
mov eax, esp
lea edi, [esp + 0x40]
lea ebp, [esp + 0x5c]
mov dword [esp + 0x3c], esp
call fcn.10001ec0
lea ecx, [esp + 0x38]
push ecx
mov edx, edi
mov ecx, ebp
call fcn.1003d770
cmp dword [esp + 0x58], esi
jb 0x10037cd1
mov edx, dword [esp + 0x44]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov byte [esp + 0x1d4], 9
cmp dword [esp + 0x3c], esi
mov dword [esp + 0x58], 7
mov dword [esp + 0x54], ebx
mov word [esp + 0x44], bx
jb 0x10037cfd
mov eax, dword [esp + 0x28]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
lea ecx, [esp + 0x94]
push ecx
mov ebx, str.http_shell_
lea esi, [esp + 0x7c]
call fcn.1000a380
mov byte [esp + 0x1d8], 0x36
mov esi, dword [esp + 0x18]
lea edx, [esp + 0x108]
push edx
or esi, 0x10000
push eax
lea edi, [esp + 0x4c]
mov dword [esp + 0x20], esi
call fcn.1001dd20
add esp, 0xc
mov dword [esp + 0x1d4], 0x37
or esi, 0x20000
mov edx, 0x80000001
mov dword [esp + 0x14], esi
call fcn.1003c3b0
test al, al
jne 0x10037db8
lea eax, [esp + 0x94]
push eax
lea esi, [esp + 0x60]
call fcn.1000a380
lea ecx, [esp + 0xd0]
push ecx
mov dword [esp + 0x1dc], 0x38
or dword [esp + 0x1c], 0x40000
push eax
lea edi, [esp + 0x30]
call fcn.1001dd20
or dword [esp + 0x20], 0x80000
add esp, 0xc
mov edx, 0x80000001
call fcn.1003c3b0
test al, al
mov esi, dword [esp + 0x14]
je 0x10037db8
mov bl, 1
jmp 0x10037dba
xor bl, bl
test esi, 0x80000
je 0x10037dd5
and esi, 0xfff7ffff
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], esi
call fcn.10001f30
test esi, 0x40000
je 0x10037df0
and esi, 0xfffbffff
lea ecx, [esp + 0x5c]
mov dword [esp + 0x14], esi
call fcn.10001f30
test esi, 0x20000
je 0x10037e0b
and esi, 0xfffdffff
lea ecx, [esp + 0x40]
mov dword [esp + 0x14], esi
call fcn.10001f30
test esi, 0x10000
mov dword [esp + 0x1d4], 9
je 0x10037e31
and esi, 0xfffeffff
lea ecx, [esp + 0x78]
mov dword [esp + 0x14], esi
call fcn.10001f30
test bl, bl
je 0x10037ff1
lea edx, [esp + 0x104]
push edx
lea eax, [esp + 0xd0]
push eax
lea ecx, [esp + 0x9c]
push ecx
mov ebx, str.http_shell_
lea esi, [esp + 0x30]
call fcn.1000a380
sub esp, 0x18
mov byte [esp + 0x1f8], 0x39
mov edi, esp
lea edx, [esp + 0xf0]
mov dword [esp + 0x44], esp
push edx
push eax
call fcn.1001dd20
add esp, 8
push 0x80000001
lea ecx, [esp + 0x44]
call fcn.1003d240
mov ecx, esi
mov byte [esp + 0x1d4], 9
call fcn.10001f30
mov edx, str.2345Explorer.exe
lea eax, [esp + 0x5c]
call fcn.10001ec0
mov edx, str.Coral.exe
lea eax, [esp + 0x24]
mov byte [esp + 0x1d4], 0x3a
call fcn.10001ec0
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x28]
push ecx
sub esp, 0x1c
mov byte [esp + 0x1f8], 0x3b
lea edx, [esp + 0xb8]
mov esi, esp
mov dword [esp + 0x44], esp
push edx
mov ebx, str.http_
call fcn.1000a380
add esp, 4
push 0x80000001
lea ecx, [esp + 0x44]
call fcn.1003d240
lea ecx, [esp + 0x24]
call fcn.10001f30
lea ecx, [esp + 0x5c]
mov byte [esp + 0x1d4], 9
call fcn.10001f30
lea eax, [esp + 0x94]
push eax
mov ebx, str.http_shell_
lea esi, [esp + 0x7c]
call fcn.1000a380
lea ecx, [esp + 0xd0]
push ecx
push eax
lea edi, [esp + 0x30]
mov byte [esp + 0x1e0], 0x3c
call fcn.1001dd20
add esp, 0xc
push 0x80000001
mov edi, eax
lea ebx, [esp + 0x20]
call fcn.1003c330
lea ecx, [esp + 0x24]
call fcn.10001f30
mov ecx, esi
mov byte [esp + 0x1d4], 9
call fcn.10001f30
mov edx, str.2345Explorer
lea eax, [esp + 0x40]
call fcn.10001ec0
mov edx, str.CoralExplorer
lea eax, [esp + 0x24]
mov byte [esp + 0x1d4], 0x3d
call fcn.10001ec0
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x28]
push eax
sub esp, 0x1c
mov byte [esp + 0x1f8], 0x3e
lea ecx, [esp + 0xb8]
mov esi, esp
mov dword [esp + 0x44], esp
push ecx
mov ebx, str.http_
call fcn.1000a380
add esp, 4
push 0x80000001
lea ecx, [esp + 0x44]
call fcn.1003d240
lea ecx, [esp + 0x24]
call fcn.10001f30
lea ecx, [esp + 0x40]
mov byte [esp + 0x1d4], 9
call fcn.10001f30
lea edx, [esp + 0x94]
push edx
mov ebx, str.http_shell_
lea esi, [esp + 0x7c]
call fcn.1000a380
mov byte [esp + 0x1d8], 0x3f
mov esi, dword [esp + 0x18]
lea ecx, [esp + 0x108]
push ecx
or esi, 0x100000
push eax
lea edi, [esp + 0x4c]
mov dword [esp + 0x20], esi
call fcn.1001dd20
add esp, 0xc
mov dword [esp + 0x1d4], 0x40
or esi, 0x200000
mov edx, 0x80000002
mov dword [esp + 0x14], esi
call fcn.1003c3b0
test al, al
jne 0x100380ac
lea edx, [esp + 0x94]
push edx
lea esi, [esp + 0x60]
call fcn.1000a380
lea ecx, [esp + 0xd0]
push ecx
mov dword [esp + 0x1dc], 0x41
or dword [esp + 0x1c], 0x400000
push eax
lea edi, [esp + 0x30]
call fcn.1001dd20
or dword [esp + 0x20], 0x800000
add esp, 0xc
mov edx, 0x80000002
call fcn.1003c3b0
test al, al
mov esi, dword [esp + 0x14]
je 0x100380ac
mov bl, 1
jmp 0x100380ae
xor bl, bl
test esi, 0x800000
je 0x100380c9
and esi, 0xff7fffff
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], esi
call fcn.10001f30
test esi, 0x400000
je 0x100380e4
and esi, 0xffbfffff
lea ecx, [esp + 0x5c]
mov dword [esp + 0x14], esi
call fcn.10001f30
test esi, 0x200000
je 0x100380ff
and esi, 0xffdfffff
lea ecx, [esp + 0x40]
mov dword [esp + 0x14], esi
call fcn.10001f30
test esi, 0x100000
mov dword [esp + 0x1d4], 9
je 0x10038125
and esi, 0xffefffff
lea ecx, [esp + 0x78]
mov dword [esp + 0x14], esi
call fcn.10001f30
test bl, bl
je 0x100382e5
lea edx, [esp + 0x104]
push edx
lea eax, [esp + 0xd0]
push eax
lea ecx, [esp + 0x9c]
push ecx
mov ebx, str.http_shell_
lea esi, [esp + 0x30]
call fcn.1000a380
sub esp, 0x18
mov byte [esp + 0x1f8], 0x42
mov edi, esp
lea edx, [esp + 0xf0]
mov dword [esp + 0x44], esp
push edx
push eax
call fcn.1001dd20
add esp, 8
push 0x80000002
lea ecx, [esp + 0x44]
call fcn.1003d240
mov ecx, esi
mov byte [esp + 0x1d4], 9
call fcn.10001f30
mov edx, str.2345Explorer.exe
lea eax, [esp + 0x5c]
call fcn.10001ec0
mov edx, str.Coral.exe
lea eax, [esp + 0x24]
mov byte [esp + 0x1d4], 0x43
call fcn.10001ec0
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x28]
push ecx
sub esp, 0x1c
mov byte [esp + 0x1f8], 0x44
lea edx, [esp + 0xb8]
mov esi, esp
mov dword [esp + 0x44], esp
push edx
mov ebx, str.http_
call fcn.1000a380
add esp, 4
push 0x80000002
lea ecx, [esp + 0x44]
call fcn.1003d240
lea ecx, [esp + 0x24]
call fcn.10001f30
lea ecx, [esp + 0x5c]
mov byte [esp + 0x1d4], 9
call fcn.10001f30
lea eax, [esp + 0x94]
push eax
mov ebx, str.http_shell_
lea esi, [esp + 0x7c]
call fcn.1000a380
lea ecx, [esp + 0xd0]
push ecx
push eax
lea edi, [esp + 0x30]
mov byte [esp + 0x1e0], 0x45
call fcn.1001dd20
add esp, 0xc
push 0x80000002
mov edi, eax
lea ebx, [esp + 0x20]
call fcn.1003c330
lea ecx, [esp + 0x24]
call fcn.10001f30
mov ecx, esi
mov byte [esp + 0x1d4], 9
call fcn.10001f30
mov edx, str.2345Explorer
lea eax, [esp + 0x40]
call fcn.10001ec0
mov edx, str.CoralExplorer
lea eax, [esp + 0x24]
mov byte [esp + 0x1d4], 0x46
call fcn.10001ec0
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x28]
push eax
sub esp, 0x1c
mov byte [esp + 0x1f8], 0x47
lea ecx, [esp + 0xb8]
mov esi, esp
mov dword [esp + 0x44], esp
push ecx
mov ebx, str.http_
call fcn.1000a380
add esp, 4
push 0x80000002
lea ecx, [esp + 0x44]
call fcn.1003d240
lea ecx, [esp + 0x24]
call fcn.10001f30
lea ecx, [esp + 0x40]
mov byte [esp + 0x1d4], 9
call fcn.10001f30
lea edx, [esp + 0x94]
push edx
mov ebx, str.https_shell_
lea esi, [esp + 0x7c]
call fcn.1000a380
mov byte [esp + 0x1d8], 0x48
mov esi, dword [esp + 0x18]
lea ecx, [esp + 0x108]
push ecx
or esi, 0x1000000
push eax
lea edi, [esp + 0x4c]
mov dword [esp + 0x20], esi
call fcn.1001dd20
add esp, 0xc
mov dword [esp + 0x1d4], 0x49
or esi, 0x2000000
mov edx, 0x80000001
mov dword [esp + 0x14], esi
call fcn.1003c3b0
test al, al
jne 0x100383a0
lea edx, [esp + 0x94]
push edx
lea esi, [esp + 0x60]
call fcn.1000a380
lea ecx, [esp + 0xd0]
push ecx
mov dword [esp + 0x1dc], 0x4a
or dword [esp + 0x1c], 0x4000000
push eax
lea edi, [esp + 0x30]
call fcn.1001dd20
or dword [esp + 0x20], 0x8000000
add esp, 0xc
mov edx, 0x80000001
call fcn.1003c3b0
test al, al
mov esi, dword [esp + 0x14]
je 0x100383a0
mov bl, 1
jmp 0x100383a2
xor bl, bl
test esi, 0x8000000
je 0x100383bd
and esi, 0xf7ffffff
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], esi
call fcn.10001f30
test esi, 0x4000000
je 0x100383d8
and esi, 0xfbffffff
lea ecx, [esp + 0x5c]
mov dword [esp + 0x14], esi
call fcn.10001f30
test esi, 0x2000000
je 0x100383f3
and esi, 0xfdffffff
lea ecx, [esp + 0x40]
mov dword [esp + 0x14], esi
call fcn.10001f30
test esi, 0x1000000
mov dword [esp + 0x1d4], 9
je 0x10038419
and esi, 0xfeffffff
lea ecx, [esp + 0x78]
mov dword [esp + 0x14], esi
call fcn.10001f30
test bl, bl
je 0x100385d9
lea edx, [esp + 0x104]
push edx
lea eax, [esp + 0xd0]
push eax
lea ecx, [esp + 0x9c]
push ecx
mov ebx, str.https_shell_
lea esi, [esp + 0x30]
call fcn.1000a380
sub esp, 0x18
mov byte [esp + 0x1f8], 0x4b
mov edi, esp
lea edx, [esp + 0xf0]
mov dword [esp + 0x44], esp
push edx
push eax
call fcn.1001dd20
add esp, 8
push 0x80000001
lea ecx, [esp + 0x44]
call fcn.1003d240
mov ecx, esi
mov byte [esp + 0x1d4], 9
call fcn.10001f30
mov edx, str.2345Explorer.exe
lea eax, [esp + 0x5c]
call fcn.10001ec0
mov edx, str.Coral.exe
lea eax, [esp + 0x24]
mov byte [esp + 0x1d4], 0x4c
call fcn.10001ec0
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x28]
push ecx
sub esp, 0x1c
mov byte [esp + 0x1f8], 0x4d
lea edx, [esp + 0xb8]
mov esi, esp
mov dword [esp + 0x44], esp
push edx
mov ebx, str.https_
call fcn.1000a380
add esp, 4
push 0x80000001
lea ecx, [esp + 0x44]
call fcn.1003d240
lea ecx, [esp + 0x24]
call fcn.10001f30
lea ecx, [esp + 0x5c]
mov byte [esp + 0x1d4], 9
call fcn.10001f30
lea eax, [esp + 0x94]
push eax
mov ebx, str.https_shell_
lea esi, [esp + 0x7c]
call fcn.1000a380
lea ecx, [esp + 0xd0]
push ecx
push eax
lea edi, [esp + 0x30]
mov byte [esp + 0x1e0], 0x4e
call fcn.1001dd20
add esp, 0xc
push 0x80000001
mov edi, eax
lea ebx, [esp + 0x20]
call fcn.1003c330
lea ecx, [esp + 0x24]
call fcn.10001f30
mov ecx, esi
mov byte [esp + 0x1d4], 9
call fcn.10001f30
mov edx, str.2345Explorer
lea eax, [esp + 0x40]
call fcn.10001ec0
mov edx, str.CoralExplorer
lea eax, [esp + 0x24]
mov byte [esp + 0x1d4], 0x4f
call fcn.10001ec0
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x28]
push eax
sub esp, 0x1c
mov byte [esp + 0x1f8], 0x50
lea ecx, [esp + 0xb8]
mov esi, esp
mov dword [esp + 0x44], esp
push ecx
mov ebx, str.https_
call fcn.1000a380
add esp, 4
push 0x80000001
lea ecx, [esp + 0x44]
call fcn.1003d240
lea ecx, [esp + 0x24]
call fcn.10001f30
lea ecx, [esp + 0x40]
mov byte [esp + 0x1d4], 9
call fcn.10001f30
lea edx, [esp + 0x94]
push edx
mov ebx, str.https_shell_
lea esi, [esp + 0x7c]
call fcn.1000a380
mov byte [esp + 0x1d8], 0x51
mov esi, dword [esp + 0x18]
lea ecx, [esp + 0x108]
push ecx
or esi, 0x10000000
push eax
lea edi, [esp + 0x4c]
mov dword [esp + 0x20], esi
call fcn.1001dd20
add esp, 0xc
mov dword [esp + 0x1d4], 0x52
or esi, 0x20000000
mov edx, 0x80000002
mov dword [esp + 0x14], esi
call fcn.1003c3b0
test al, al
jne 0x10038694
lea edx, [esp + 0x94]
push edx
lea esi, [esp + 0x60]
call fcn.1000a380
lea ecx, [esp + 0xd0]
push ecx
mov dword [esp + 0x1dc], 0x53
or dword [esp + 0x1c], 0x40000000
push eax
lea edi, [esp + 0x30]
call fcn.1001dd20
or dword [esp + 0x20], 0x80000000
add esp, 0xc
mov edx, 0x80000002
call fcn.1003c3b0
test al, al
mov esi, dword [esp + 0x14]
je 0x10038694
mov bl, 1
jmp 0x10038696
xor bl, bl
test esi, esi
jns 0x100386a9
lea ecx, [esp + 0x24]
and esi, 0x7fffffff
call fcn.10001f30
test esi, 0x40000000
je 0x100386c0
lea ecx, [esp + 0x5c]
and esi, 0xbfffffff
call fcn.10001f30
test esi, 0x20000000
je 0x100386d7
lea ecx, [esp + 0x40]
and esi, 0xdfffffff
call fcn.10001f30
test esi, 0x10000000
mov dword [esp + 0x1d4], 9
je 0x100386f3
lea ecx, [esp + 0x78]
call fcn.10001f30
test bl, bl
je 0x100388b3
lea edx, [esp + 0x104]
push edx
lea eax, [esp + 0xd0]
push eax
lea ecx, [esp + 0x9c]
push ecx
mov ebx, str.https_shell_
lea esi, [esp + 0x30]
call fcn.1000a380
sub esp, 0x18
mov byte [esp + 0x1f8], 0x54
mov edi, esp
lea edx, [esp + 0xf0]
mov dword [esp + 0x44], esp
push edx
push eax
call fcn.1001dd20
add esp, 8
push 0x80000002
lea ecx, [esp + 0x44]
call fcn.1003d240
mov ecx, esi
mov byte [esp + 0x1d4], 9
call fcn.10001f30
mov edx, str.2345Explorer.exe
lea eax, [esp + 0x5c]
call fcn.10001ec0
mov edx, str.Coral.exe
lea eax, [esp + 0x24]
mov byte [esp + 0x1d4], 0x55
call fcn.10001ec0
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x28]
push ecx
sub esp, 0x1c
mov byte [esp + 0x1f8], 0x56
lea edx, [esp + 0xb8]
mov esi, esp
mov dword [esp + 0x44], esp
push edx
mov ebx, str.https_
call fcn.1000a380
add esp, 4
push 0x80000002
lea ecx, [esp + 0x44]
call fcn.1003d240
lea ecx, [esp + 0x24]
call fcn.10001f30
lea ecx, [esp + 0x5c]
mov byte [esp + 0x1d4], 9
call fcn.10001f30
lea eax, [esp + 0x94]
push eax
mov ebx, str.https_shell_
lea esi, [esp + 0x7c]
call fcn.1000a380
lea ecx, [esp + 0xd0]
push ecx
push eax
lea edi, [esp + 0x30]
mov byte [esp + 0x1e0], 0x57
call fcn.1001dd20
add esp, 0xc
push 0x80000002
mov edi, eax
lea ebx, [esp + 0x20]
call fcn.1003c330
lea ecx, [esp + 0x24]
call fcn.10001f30
mov ecx, esi
mov byte [esp + 0x1d4], 9
call fcn.10001f30
mov edx, str.2345Explorer
lea eax, [esp + 0x40]
call fcn.10001ec0
mov edx, str.CoralExplorer
lea eax, [esp + 0x24]
mov byte [esp + 0x1d4], 0x58
call fcn.10001ec0
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x28]
push eax
sub esp, 0x1c
mov byte [esp + 0x1f8], 0x59
lea ecx, [esp + 0xb8]
mov esi, esp
mov dword [esp + 0x44], esp
push ecx
mov ebx, str.https_
call fcn.1000a380
add esp, 4
push 0x80000002
lea ecx, [esp + 0x44]
call fcn.1003d240
lea ecx, [esp + 0x24]
call fcn.10001f30
lea ecx, [esp + 0x40]
mov byte [esp + 0x1d4], 9
call fcn.10001f30
lea edx, [esp + 0x94]
push edx
mov ebx, str.file_shell_
lea esi, [esp + 0x7c]
call fcn.1000a380
lea ecx, [esp + 0x108]
push ecx
mov byte [esp + 0x1dc], 0x5a
push eax
lea edi, [esp + 0x4c]
mov dword [esp + 0x20], 1
call fcn.1001dd20
add esp, 0xc
mov dword [esp + 0x1d4], 0x5b
mov ebx, 3
mov edx, 0x80000001
mov dword [esp + 0x14], ebx
call fcn.1003c3b0
test al, al
jne 0x1003896d
lea edx, [esp + 0x94]
push edx
mov ebx, str.file_shell_
lea esi, [esp + 0x60]
call fcn.1000a380
lea ecx, [esp + 0xd0]
push ecx
mov dword [esp + 0x1dc], 0x5c
push eax
lea edi, [esp + 0x30]
mov dword [esp + 0x20], 7
call fcn.1001dd20
add esp, 0xc
mov edx, 0x80000001
mov dword [esp + 0x14], 0xf
call fcn.1003c3b0
test al, al
mov ebx, dword [esp + 0x14]
mov byte [esp + 0x1b], 1
jne 0x10038972
mov byte [esp + 0x1b], 0
test bl, 8
je 0x10038987
and ebx, 0xfffffff7
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], ebx
call fcn.10001f30
test bl, 4
je 0x1003899c
and ebx, 0xfffffffb
lea ecx, [esp + 0x5c]
mov dword [esp + 0x14], ebx
call fcn.10001f30
test bl, 2
je 0x100389b1
and ebx, 0xfffffffd
lea ecx, [esp + 0x40]
mov dword [esp + 0x14], ebx
call fcn.10001f30
test bl, 1
mov dword [esp + 0x1d4], 9
je 0x100389d1
and ebx, 0xfffffffe
lea ecx, [esp + 0x78]
mov dword [esp + 0x14], ebx
call fcn.10001f30
cmp byte [esp + 0x1b], 0
je 0x10038b94
lea edx, [esp + 0x104]
push edx
lea eax, [esp + 0xd0]
push eax
lea ecx, [esp + 0x9c]
push ecx
mov ebx, str.file_shell_
lea esi, [esp + 0x30]
call fcn.1000a380
sub esp, 0x18
mov byte [esp + 0x1f8], 0x5d
mov edi, esp
lea edx, [esp + 0xf0]
mov dword [esp + 0x44], esp
push edx
push eax
call fcn.1001dd20
add esp, 8
push 0x80000001
lea ecx, [esp + 0x44]
call fcn.1003d240
mov ecx, esi
mov byte [esp + 0x1d4], 9
call fcn.10001f30
mov edx, str.2345Explorer.exe
lea eax, [esp + 0x5c]
call fcn.10001ec0
mov edx, str.Coral.exe
lea eax, [esp + 0x24]
mov byte [esp + 0x1d4], 0x5e
call fcn.10001ec0
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x28]
push ecx
sub esp, 0x1c
mov byte [esp + 0x1f8], 0x5f
lea edx, [esp + 0xb8]
mov esi, esp
mov dword [esp + 0x44], esp
push edx
mov ebx, str.file_
call fcn.1000a380
add esp, 4
push 0x80000001
lea ecx, [esp + 0x44]
call fcn.1003d240
lea ecx, [esp + 0x24]
call fcn.10001f30
lea ecx, [esp + 0x5c]
mov byte [esp + 0x1d4], 9
call fcn.10001f30
lea eax, [esp + 0x94]
push eax
mov ebx, str.file_shell_
lea esi, [esp + 0x7c]
call fcn.1000a380
lea ecx, [esp + 0xd0]
push ecx
push eax
lea edi, [esp + 0x30]
mov byte [esp + 0x1e0], 0x60
call fcn.1001dd20
add esp, 0xc
push 0x80000001
mov edi, eax
lea ebx, [esp + 0x20]
call fcn.1003c330
lea ecx, [esp + 0x24]
call fcn.10001f30
mov ecx, esi
mov byte [esp + 0x1d4], 9
call fcn.10001f30
mov edx, str.2345Explorer
lea eax, [esp + 0x40]
call fcn.10001ec0
mov edx, str.CoralExplorer
lea eax, [esp + 0x24]
mov byte [esp + 0x1d4], 0x61
call fcn.10001ec0
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x28]
push eax
sub esp, 0x1c
mov byte [esp + 0x1f8], 0x62
lea ecx, [esp + 0xb8]
mov esi, esp
mov dword [esp + 0x44], esp
push ecx
mov ebx, str.file_
call fcn.1000a380
add esp, 4
push 0x80000001
lea ecx, [esp + 0x44]
call fcn.1003d240
lea ecx, [esp + 0x24]
call fcn.10001f30
lea ecx, [esp + 0x40]
mov byte [esp + 0x1d4], 9
call fcn.10001f30
lea edx, [esp + 0x94]
push edx
mov ebx, str.file_shell_
lea esi, [esp + 0x7c]
call fcn.1000a380
lea ecx, [esp + 0x108]
push ecx
mov byte [esp + 0x1dc], 0x63
or dword [esp + 0x1c], 0x10
push eax
lea edi, [esp + 0x4c]
call fcn.1001dd20
add esp, 0xc
mov dword [esp + 0x1d4], 0x64
or dword [esp + 0x14], 0x20
mov edx, 0x80000002
call fcn.1003c3b0
test al, al
jne 0x10038c3f
lea edx, [esp + 0x94]
push edx
lea esi, [esp + 0x60]
call fcn.1000a380
lea ecx, [esp + 0xd0]
push ecx
mov dword [esp + 0x1dc], 0x65
or dword [esp + 0x1c], 0x40
push eax
lea edi, [esp + 0x30]
call fcn.1001dd20
or dword [esp + 0x20], 0x80
add esp, 0xc
mov edx, 0x80000002
call fcn.1003c3b0
test al, al
je 0x10038c3f
mov byte [esp + 0x1b], 1
xor ebx, ebx
jmp 0x10038c45
xor ebx, ebx
mov byte [esp + 0x1b], bl
test byte [esp + 0x14], 0x80
je 0x10038c5d
and dword [esp + 0x14], 0xffffff7f
lea ecx, [esp + 0x24]
call fcn.10001f30
test byte [esp + 0x14], 0x40
je 0x10038c72
and dword [esp + 0x14], 0xffffffbf
lea ecx, [esp + 0x5c]
call fcn.10001f30
test byte [esp + 0x14], 0x20
je 0x10038c87
and dword [esp + 0x14], 0xffffffdf
lea ecx, [esp + 0x40]
call fcn.10001f30
mov dword [esp + 0x1d4], 9
test byte [esp + 0x14], 0x10
je 0x10038ca7
and dword [esp + 0x14], 0xffffffef
lea ecx, [esp + 0x78]
call fcn.10001f30
cmp byte [esp + 0x1b], bl
je 0x10038e6b
lea edx, [esp + 0x104]
push edx
lea eax, [esp + 0xd0]
push eax
lea ecx, [esp + 0x9c]
push ecx
mov ebx, str.file_shell_
lea esi, [esp + 0x30]
call fcn.1000a380
sub esp, 0x18
mov byte [esp + 0x1f8], 0x66
mov edi, esp
lea edx, [esp + 0xf0]
mov dword [esp + 0x44], esp
push edx
push eax
call fcn.1001dd20
add esp, 8
push 0x80000002
lea ecx, [esp + 0x44]
call fcn.1003d240
mov ecx, esi
mov byte [esp + 0x1d4], 9
call fcn.10001f30
mov edx, str.2345Explorer.exe
lea eax, [esp + 0x5c]
call fcn.10001ec0
mov edx, str.Coral.exe
lea eax, [esp + 0x24]
mov byte [esp + 0x1d4], 0x67
call fcn.10001ec0
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x28]
push ecx
sub esp, 0x1c
mov byte [esp + 0x1f8], 0x68
lea edx, [esp + 0xb8]
mov esi, esp
mov dword [esp + 0x44], esp
push edx
mov ebx, str.file_
call fcn.1000a380
add esp, 4
push 0x80000002
lea ecx, [esp + 0x44]
call fcn.1003d240
lea ecx, [esp + 0x24]
call fcn.10001f30
lea ecx, [esp + 0x5c]
mov byte [esp + 0x1d4], 9
call fcn.10001f30
lea eax, [esp + 0x94]
push eax
mov ebx, str.file_shell_
lea esi, [esp + 0x7c]
call fcn.1000a380
lea ecx, [esp + 0xd0]
push ecx
push eax
lea edi, [esp + 0x30]
mov byte [esp + 0x1e0], 0x69
call fcn.1001dd20
add esp, 0xc
push 0x80000002
mov edi, eax
lea ebx, [esp + 0x20]
call fcn.1003c330
lea ecx, [esp + 0x24]
call fcn.10001f30
mov ecx, esi
mov byte [esp + 0x1d4], 9
call fcn.10001f30
mov edx, str.2345Explorer
lea eax, [esp + 0x40]
call fcn.10001ec0
mov edx, str.CoralExplorer
lea eax, [esp + 0x24]
mov byte [esp + 0x1d4], 0x6a
call fcn.10001ec0
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x28]
push eax
sub esp, 0x1c
mov byte [esp + 0x1f8], 0x6b
lea ecx, [esp + 0xb8]
mov esi, esp
mov dword [esp + 0x44], esp
push ecx
mov ebx, str.file_
call fcn.1000a380
add esp, 4
push 0x80000002
lea ecx, [esp + 0x44]
call fcn.1003d240
lea ecx, [esp + 0x24]
call fcn.10001f30
lea ecx, [esp + 0x40]
mov byte [esp + 0x1d4], 9
call fcn.10001f30
xor ebx, ebx
mov edx, str.2345Explorer.exe
lea eax, [esp + 0x24]
call fcn.10001ec0
mov edx, str.Coral.exe
lea eax, [esp + 0x78]
mov byte [esp + 0x1d4], 0x6c
call fcn.10001ec0
mov edx, str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_BROWSER_EMULATION
lea eax, [esp + 0x40]
mov byte [esp + 0x1d4], 0x6d
call fcn.10001ec0
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x2c]
lea esi, [esp + 0x80]
mov byte [esp + 0x1dc], 0x6e
call fcn.1003ce60
mov edi, 8
cmp dword [esp + 0x58], edi
jb 0x10038edf
mov ecx, dword [esp + 0x44]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp dword [esp + 0x90], edi
mov ebp, 7
mov dword [esp + 0x58], ebp
mov dword [esp + 0x54], ebx
mov word [esp + 0x44], bx
jb 0x10038f07
mov edx, dword [esp + 0x7c]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov byte [esp + 0x1d4], 9
cmp dword [esp + 0x3c], edi
mov dword [esp + 0x90], ebp
mov dword [esp + 0x8c], ebx
mov word [esp + 0x7c], bx
jb 0x10038f35
mov eax, dword [esp + 0x28]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov edx, str.2345Explorer.exe
lea eax, [esp + 0x24]
call fcn.10001ec0
mov edx, str.Coral.exe
lea eax, [esp + 0x78]
mov byte [esp + 0x1d4], 0x6f
call fcn.10001ec0
mov edx, str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_ENABLE_SCRIPT_PASTE_URLACTION_IF_PROMPT
lea eax, [esp + 0x40]
mov byte [esp + 0x1d4], 0x70
call fcn.10001ec0
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x2c]
lea esi, [esp + 0x80]
mov byte [esp + 0x1dc], 0x71
call fcn.1003ce60
cmp dword [esp + 0x58], edi
jb 0x10038fa4
mov eax, dword [esp + 0x44]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp dword [esp + 0x90], edi
mov dword [esp + 0x58], ebp
mov dword [esp + 0x54], ebx
mov word [esp + 0x44], bx
jb 0x10038fc7
mov ecx, dword [esp + 0x7c]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov byte [esp + 0x1d4], 9
cmp dword [esp + 0x3c], edi
mov dword [esp + 0x90], ebp
mov dword [esp + 0x8c], ebx
mov word [esp + 0x7c], bx
jb 0x10038ff5
mov edx, dword [esp + 0x28]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov edx, str.2345Explorer.exe
lea eax, [esp + 0x24]
call fcn.10001ec0
mov edx, str.Coral.exe
lea eax, [esp + 0x78]
mov byte [esp + 0x1d4], 0x72
call fcn.10001ec0
mov edx, str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_SCRIPTURL_MITIGATION
lea eax, [esp + 0x40]
mov byte [esp + 0x1d4], 0x73
call fcn.10001ec0
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x2c]
lea esi, [esp + 0x80]
mov byte [esp + 0x1dc], 0x74
call fcn.1003ce60
cmp dword [esp + 0x58], edi
jb 0x10039064
mov edx, dword [esp + 0x44]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp dword [esp + 0x90], edi
mov dword [esp + 0x58], ebp
mov dword [esp + 0x54], ebx
mov word [esp + 0x44], bx
jb 0x10039087
mov eax, dword [esp + 0x7c]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp dword [esp + 0x3c], edi
mov dword [esp + 0x90], ebp
mov dword [esp + 0x8c], ebx
mov word [esp + 0x7c], bx
jb 0x100390ad
mov ecx, dword [esp + 0x28]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x100], ebp
mov dword [esp + 0xfc], ebx
mov word [esp + 0xec], bx
mov edx, 0x10047a94
lea eax, [esp + 0x24]
mov byte [esp + 0x1d4], 0x75
call fcn.10001ec0
lea edx, [esp + 0x94]
mov byte [esp + 0x1d4], 0x76
mov ebp, pe_nt_image_headers32
or dword [esp + 0x14], ebp
push edx
mov ebx, str.mhtmlfile_shellopencommand
lea esi, [esp + 0x60]
call fcn.1000a380
add esp, 4
lea ecx, [esp + 0xe8]
push ecx
mov dword [esp + 0x1d8], 0x77
or dword [esp + 0x18], 0x200
push eax
lea edx, [esp + 0x2c]
mov ecx, 0x80000001
call fcn.1003be90
test al, al
je 0x10039152
push str.Coral.exe
mov ebx, 9
xor eax, eax
lea edx, [esp + 0xec]
call fcn.100022f0
cmp eax, 0xffffffff
je 0x10039152
mov bl, 1
jmp 0x10039154
xor bl, bl
mov esi, dword [esp + 0x14]
test esi, 0x200
je 0x10039173
and esi, 0xfffffdff
lea ecx, [esp + 0x5c]
mov dword [esp + 0x14], esi
call fcn.10001f30
test ebp, esi
mov dword [esp + 0x1d4], 0x75
je 0x10039195
and esi, 0xfffffeff
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], esi
call fcn.10001f30
test bl, bl
je 0x10039215
mov edx, str.2345Explorer.exe
lea eax, [esp + 0x5c]
call fcn.10001ec0
mov edx, str.Coral.exe
lea eax, [esp + 0x24]
mov byte [esp + 0x1d4], 0x78
call fcn.10001ec0
lea edx, [esp + 0x5c]
push edx
lea eax, [esp + 0x28]
push eax
sub esp, 0x1c
mov byte [esp + 0x1f8], 0x79
lea ecx, [esp + 0xb8]
mov esi, esp
mov dword [esp + 0x44], esp
push ecx
mov ebx, str.mhtmlfile_
call fcn.1000a380
add esp, 4
push 0x80000001
lea ecx, [esp + 0x44]
call fcn.1003d240
lea ecx, [esp + 0x24]
call fcn.10001f30
lea ecx, [esp + 0x5c]
mov byte [esp + 0x1d4], 0x75
call fcn.10001f30
lea edi, [esp + 0xe8]
call fcn.10001fc0
mov edx, 0x10047a94
lea eax, [esp + 0x24]
call fcn.10001ec0
lea edx, [esp + 0x94]
mov byte [esp + 0x1d4], 0x7a
or dword [esp + 0x14], 0x400
push edx
mov ebx, str.mhtmlfile_shellopencommand
lea esi, [esp + 0x60]
call fcn.1000a380
add esp, 4
mov ecx, edi
push ecx
mov dword [esp + 0x1d8], 0x7b
or dword [esp + 0x18], 0x800
push eax
lea edx, [esp + 0x2c]
mov ecx, 0x80000002
call fcn.1003be90
test al, al
je 0x1003929d
push str.Coral.exe
mov ebx, 9
xor eax, eax
mov edx, edi
call fcn.100022f0
cmp eax, 0xffffffff
je 0x1003929d
mov bl, 1
jmp 0x1003929f
xor bl, bl
mov esi, dword [esp + 0x14]
test esi, 0x800
je 0x100392be
and esi, 0xfffff7ff
lea ecx, [esp + 0x5c]
mov dword [esp + 0x14], esi
call fcn.10001f30
test esi, 0x400
mov dword [esp + 0x1d4], 0x75
je 0x100392e4
and esi, 0xfffffbff
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], esi
call fcn.10001f30
test bl, bl
je 0x10039364
mov edx, str.2345Explorer.exe
lea eax, [esp + 0x5c]
call fcn.10001ec0
mov edx, str.Coral.exe
lea eax, [esp + 0x24]
mov byte [esp + 0x1d4], 0x7c
call fcn.10001ec0
lea edx, [esp + 0x5c]
push edx
lea eax, [esp + 0x28]
push eax
sub esp, 0x1c
mov byte [esp + 0x1f8], 0x7d
lea ecx, [esp + 0xb8]
mov esi, esp
mov dword [esp + 0x44], esp
push ecx
mov ebx, str.mhtmlfile_
call fcn.1000a380
add esp, 4
push 0x80000002
lea ecx, [esp + 0x44]
call fcn.1003d240
lea ecx, [esp + 0x24]
call fcn.10001f30
lea ecx, [esp + 0x5c]
mov byte [esp + 0x1d4], 0x75
call fcn.10001f30
lea edi, [esp + 0xe8]
call fcn.10001fc0
mov edx, 0x10047a94
lea eax, [esp + 0x24]
call fcn.10001ec0
lea edx, [esp + 0x94]
mov byte [esp + 0x1d4], 0x7e
or dword [esp + 0x14], 0x1000
push edx
mov ebx, str.htmlfile_shellopencommand
lea esi, [esp + 0x60]
call fcn.1000a380
add esp, 4
mov ecx, edi
push ecx
mov dword [esp + 0x1d8], 0x7f
or dword [esp + 0x18], 0x2000
push eax
lea edx, [esp + 0x2c]
mov ecx, 0x80000001
call fcn.1003be90
test al, al
je 0x100393ec
push str.Coral.exe
mov ebx, 9
xor eax, eax
mov edx, edi
call fcn.100022f0
cmp eax, 0xffffffff
je 0x100393ec
mov bl, 1
jmp 0x100393ee
xor bl, bl
mov esi, dword [esp + 0x14]
test esi, 0x2000
je 0x1003940d
and esi, 0xffffdfff
lea ecx, [esp + 0x5c]
mov dword [esp + 0x14], esi
call fcn.10001f30
test esi, 0x1000
mov dword [esp + 0x1d4], 0x75
je 0x10039433
and esi, 0xffffefff
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], esi
call fcn.10001f30
test bl, bl
je 0x100394b3
mov edx, str.2345Explorer.exe
lea eax, [esp + 0x5c]
call fcn.10001ec0
mov edx, str.Coral.exe
lea eax, [esp + 0x24]
mov byte [esp + 0x1d4], 0x80
call fcn.10001ec0
lea edx, [esp + 0x5c]
push edx
lea eax, [esp + 0x28]
push eax
sub esp, 0x1c
mov byte [esp + 0x1f8], 0x81
lea ecx, [esp + 0xb8]
mov esi, esp
mov dword [esp + 0x44], esp
push ecx
mov ebx, str.htmlfile_
call fcn.1000a380
add esp, 4
push 0x80000001
lea ecx, [esp + 0x44]
call fcn.1003d240
lea ecx, [esp + 0x24]
call fcn.10001f30
lea ecx, [esp + 0x5c]
mov byte [esp + 0x1d4], 0x75
call fcn.10001f30
lea edi, [esp + 0xe8]
call fcn.10001fc0
mov edx, 0x10047a94
lea eax, [esp + 0x24]
call fcn.10001ec0
lea edx, [esp + 0x94]
mov byte [esp + 0x1d4], 0x82
or dword [esp + 0x14], 0x4000
push edx
mov ebx, str.htmlfile_shellopencommand
lea esi, [esp + 0x60]
call fcn.1000a380
add esp, 4
mov ecx, edi
push ecx
mov dword [esp + 0x1d8], 0x83
or dword [esp + 0x18], 0x8000
push eax
lea edx, [esp + 0x2c]
mov ecx, 0x80000002
call fcn.1003be90
test al, al
je 0x1003953b
push str.Coral.exe
mov ebx, 9
xor eax, eax
mov edx, edi
call fcn.100022f0
cmp eax, 0xffffffff
je 0x1003953b
mov bl, 1
jmp 0x1003953d
xor bl, bl
mov esi, dword [esp + 0x14]
test esi, 0x8000
je 0x1003955c
and esi, 0xffff7fff
lea ecx, [esp + 0x5c]
mov dword [esp + 0x14], esi
call fcn.10001f30
test esi, 0x4000
mov dword [esp + 0x1d4], 0x75
je 0x10039582
and esi, 0xffffbfff
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], esi
call fcn.10001f30
test bl, bl
je 0x10039602
mov edx, str.2345Explorer.exe
lea eax, [esp + 0x5c]
call fcn.10001ec0
mov edx, str.Coral.exe
lea eax, [esp + 0x24]
mov byte [esp + 0x1d4], 0x84
call fcn.10001ec0
lea edx, [esp + 0x5c]
push edx
lea eax, [esp + 0x28]
push eax
sub esp, 0x1c
mov byte [esp + 0x1f8], 0x85
lea ecx, [esp + 0xb8]
mov esi, esp
mov dword [esp + 0x44], esp
push ecx
mov ebx, str.htmlfile_
call fcn.1000a380
add esp, 4
push 0x80000002
lea ecx, [esp + 0x44]
call fcn.1003d240
lea ecx, [esp + 0x24]
call fcn.10001f30
lea ecx, [esp + 0x5c]
mov byte [esp + 0x1d4], 0x75
call fcn.10001f30
lea edi, [esp + 0xe8]
call fcn.10001fc0
mov edx, 0x10047a94
lea eax, [esp + 0x24]
call fcn.10001ec0
lea edx, [esp + 0x94]
mov byte [esp + 0x1d4], 0x86
or dword [esp + 0x14], 0x10000
push edx
mov ebx, str..htm
lea esi, [esp + 0x60]
call fcn.1000a380
add esp, 4
mov ecx, edi
push ecx
mov dword [esp + 0x1d8], 0x87
or dword [esp + 0x18], 0x20000
push eax
lea edx, [esp + 0x2c]
mov ecx, 0x80000001
call fcn.1003be90
test al, al
je 0x100396a5
cmp dword [esp + 0xc8], 8
mov eax, dword [esp + 0xb4]
jae 0x10039686
lea eax, [esp + 0xb4]
mov ebx, dword [esp + 0xc4]
push eax
xor eax, eax
lea edx, [esp + 0xec]
call fcn.100022f0
cmp eax, 0xffffffff
je 0x100396a5
mov bl, 1
jmp 0x100396a7
xor bl, bl
mov esi, dword [esp + 0x14]
test esi, 0x20000
je 0x100396c6
and esi, 0xfffdffff
lea ecx, [esp + 0x5c]
mov dword [esp + 0x14], esi
call fcn.10001f30
test esi, 0x10000
mov dword [esp + 0x1d4], 0x75
je 0x100396ec
and esi, 0xfffeffff
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], esi
call fcn.10001f30
test bl, bl
je 0x1003972c
lea edx, [esp + 0x120]
push edx
lea eax, [esp + 0xb4]
push eax
sub esp, 0x1c
lea ecx, [esp + 0xb8]
mov esi, esp
mov dword [esp + 0x44], esp
push ecx
mov ebx, str..htm
call fcn.1000a380
add esp, 4
push 0x80000001
lea ecx, [esp + 0x44]
call fcn.1003d240
lea edi, [esp + 0xe8]
call fcn.10001fc0
mov edx, 0x10047a94
lea eax, [esp + 0x24]
call fcn.10001ec0
lea edx, [esp + 0x94]
mov byte [esp + 0x1d4], 0x88
or dword [esp + 0x14], 0x40000
push edx
mov ebx, str..htm
lea esi, [esp + 0x60]
call fcn.1000a380
add esp, 4
mov ecx, edi
push ecx
mov dword [esp + 0x1d8], 0x89
or dword [esp + 0x18], 0x80000
push eax
lea edx, [esp + 0x2c]
mov ecx, 0x80000002
call fcn.1003be90
test al, al
je 0x100397cf
cmp dword [esp + 0xc8], 8
mov eax, dword [esp + 0xb4]
jae 0x100397b0
lea eax, [esp + 0xb4]
mov ebx, dword [esp + 0xc4]
push eax
xor eax, eax
lea edx, [esp + 0xec]
call fcn.100022f0
cmp eax, 0xffffffff
je 0x100397cf
mov bl, 1
jmp 0x100397d1
xor bl, bl
mov esi, dword [esp + 0x14]
test esi, 0x80000
je 0x100397f0
and esi, 0xfff7ffff
lea ecx, [esp + 0x5c]
mov dword [esp + 0x14], esi
call fcn.10001f30
test esi, 0x40000
mov dword [esp + 0x1d4], 0x75
je 0x10039816
and esi, 0xfffbffff
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], esi
call fcn.10001f30
test bl, bl
je 0x10039856
lea edx, [esp + 0x120]
push edx
lea eax, [esp + 0xb4]
push eax
sub esp, 0x1c
lea ecx, [esp + 0xb8]
mov esi, esp
mov dword [esp + 0x44], esp
push ecx
mov ebx, str..htm
call fcn.1000a380
add esp, 4
push 0x80000002
lea ecx, [esp + 0x44]
call fcn.1003d240
lea edi, [esp + 0xe8]
call fcn.10001fc0
mov edx, 0x10047a94
lea eax, [esp + 0x24]
call fcn.10001ec0
lea edx, [esp + 0x94]
mov byte [esp + 0x1d4], 0x8a
or dword [esp + 0x14], 0x100000
push edx
mov ebx, str..html
lea esi, [esp + 0x60]
call fcn.1000a380
add esp, 4
mov ecx, edi
push ecx
mov dword [esp + 0x1d8], 0x8b
or dword [esp + 0x18], 0x200000
push eax
lea edx, [esp + 0x2c]
mov ecx, 0x80000001
call fcn.1003be90
test al, al
je 0x100398f9
cmp dword [esp + 0xc8], 8
mov eax, dword [esp + 0xb4]
jae 0x100398da
lea eax, [esp + 0xb4]
mov ebx, dword [esp + 0xc4]
push eax
xor eax, eax
lea edx, [esp + 0xec]
call fcn.100022f0
cmp eax, 0xffffffff
je 0x100398f9
mov bl, 1
jmp 0x100398fb
xor bl, bl
mov esi, dword [esp + 0x14]
test esi, 0x200000
je 0x1003991a
and esi, 0xffdfffff
lea ecx, [esp + 0x5c]
mov dword [esp + 0x14], esi
call fcn.10001f30
test esi, 0x100000
mov dword [esp + 0x1d4], 0x75
je 0x10039940
and esi, 0xffefffff
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], esi
call fcn.10001f30
test bl, bl
je 0x10039980
lea edx, [esp + 0x120]
push edx
lea eax, [esp + 0xb4]
push eax
sub esp, 0x1c
lea ecx, [esp + 0xb8]
mov esi, esp
mov dword [esp + 0x44], esp
push ecx
mov ebx, str..html
call fcn.1000a380
add esp, 4
push 0x80000001
lea ecx, [esp + 0x44]
call fcn.1003d240
lea edi, [esp + 0xe8]
call fcn.10001fc0
mov edx, 0x10047a94
lea eax, [esp + 0x24]
call fcn.10001ec0
lea edx, [esp + 0x94]
mov byte [esp + 0x1d4], 0x8c
or dword [esp + 0x14], 0x400000
push edx
mov ebx, str..html
lea esi, [esp + 0x60]
call fcn.1000a380
add esp, 4
mov ecx, edi
push ecx
mov dword [esp + 0x1d8], 0x8d
or dword [esp + 0x18], 0x800000
push eax
lea edx, [esp + 0x2c]
mov ecx, 0x80000002
call fcn.1003be90
test al, al
je 0x10039a23
cmp dword [esp + 0xc8], 8
mov eax, dword [esp + 0xb4]
jae 0x10039a04
lea eax, [esp + 0xb4]
mov ebx, dword [esp + 0xc4]
push eax
xor eax, eax
lea edx, [esp + 0xec]
call fcn.100022f0
cmp eax, 0xffffffff
je 0x10039a23
xor bl, bl
mov esi, dword [esp + 0x14]
test esi, 0x800000
je 0x10039a44
and esi, 0xff7fffff
lea ecx, [esp + 0x5c]
mov dword [esp + 0x14], esi
call fcn.10001f30
test esi, 0x400000
mov dword [esp + 0x1d4], 0x75
je 0x10039a6a