Function at 0x10105cf0
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Delete directory
Delete file
Download url
Move file
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101af6a5
mov eax, dword fs:[0]
push eax
mov eax, 0x10c8
call fcn.101742d0
mov eax, dword [0x1022c684]
xor eax, ebp
mov dword [ebp - 0x90], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.10107780
movzx eax, al
test eax, eax
jne 0x10105d49
push 0x30
push 0x101d8bb0
push 0x101d8bd0
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor al, al
jmp 0x10107161
mov byte [ebp - 0x59d], 0
push ecx
mov ecx, esp
mov dword [ebp - 0xed0], esp
push 0x101d8c58
call fcn.10005d80
mov dword [ebp - 0xf94], eax
mov ecx, dword [ebp - 0xf94]
mov dword [ebp - 0xf98], ecx
mov dword [ebp - 4], 0
push ecx
mov ecx, esp
mov dword [ebp - 0xed4], esp
push 0x101d8c5c
call fcn.10005d80
mov dword [ebp - 0xf9c], eax
mov edx, dword [ebp - 0xf9c]
mov dword [ebp - 0xfa0], edx
mov byte [ebp - 4], 1
push ecx
mov ecx, esp
mov dword [ebp - 0xed8], esp
push str.ContextMenuItem
call fcn.10005d80
mov dword [ebp - 0xfa4], eax
lea eax, [ebp - 0x594]
push eax
mov dword [ebp - 4], 0xffffffff
call fcn.100e0810
add esp, 0x10
mov dword [ebp - 0xfa8], eax
mov dword [ebp - 4], 2
push 0x101d8c80
lea ecx, [ebp - 0x594]
push ecx
call fcn.1000c4e0
add esp, 8
movzx edx, al
test edx, edx
je 0x10105e4e
lea ecx, [ebp - 0x5b0]
call fcn.10020e50
push 0x20006
push str.SoftwareMicrosoftInternet_ExplorerMenuExt
push SysReAllocString
lea ecx, [ebp - 0x5b0]
call fcn.100210a0
lea ecx, [ebp - 0x594]
call fcn.10004390
push eax
lea ecx, [ebp - 0x5b0]
call fcn.10020f10
lea ecx, [ebp - 0x5b0]
call fcn.10020fd0
lea ecx, [ebp - 0x5b0]
call fcn.10020e80
lea eax, [ebp - 0x59c]
push eax
call fcn.100aa3f0
add esp, 4
mov byte [ebp - 4], 3
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0xedc], esp
push 1
push ecx
call fcn.100e14d0
add esp, 8
mov dword [ebp - 0xfac], eax
call fcn.10108730
add esp, 8
push 0x178
call fcn.1017072e
add esp, 4
mov dword [ebp - 0xee4], eax
mov byte [ebp - 4], 4
cmp dword [ebp - 0xee4], 0
je 0x10105eba
push 0
mov ecx, dword [ebp - 0xee4]
call fcn.100b3210
mov dword [ebp - 0xfb0], eax
jmp 0x10105ec4
mov dword [ebp - 0xfb0], 0
mov edx, dword [ebp - 0xfb0]
mov dword [ebp - 0xee0], edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0xee0]
mov dword [ebp - 0x590], eax
push 1
push 0
push 0
push 0
push 0x101d8ce4
mov ecx, dword [ebp - 0x590]
push ecx
lea ecx, [ebp - 0x64]
call fcn.10151310
mov byte [ebp - 4], 5
push 0
lea ecx, [ebp - 0x59c]
call fcn.10004390
push eax
lea ecx, [ebp - 0x64]
call fcn.10151430
mov byte [ebp - 0x81], 0
lea ecx, [ebp - 0x64]
call fcn.100aa630
cmp eax, 0xffffff92
je 0x10105f43
lea ecx, [ebp - 0x64]
call fcn.100aa630
test eax, eax
je 0x10105f43
lea ecx, [ebp - 0x64]
call fcn.100aa630
cmp eax, 0xffffff96
jne 0x10105f5b
cmp dword [ebp - 0x590], 0
je 0x10105f5b
mov edx, dword [ebp - 0x590]
cmp dword [edx + 0x12c], 0
jne 0x10105f62
mov byte [ebp - 0x81], 1
cmp dword [ebp - 0x590], 0
je 0x10105fd5
mov ecx, dword [ebp - 0x590]
add ecx, 0x1c
call fcn.10004400
movzx eax, al
test eax, eax
jne 0x10105fd5
lea ecx, [ebp - 0x5b8]
call fcn.10020e50
push 0x20006
push 0x101d8cf4
push SysReAllocString
lea ecx, [ebp - 0x5b8]
call fcn.100210a0
mov ecx, dword [ebp - 0x590]
add ecx, 0x1c
call fcn.10004390
push eax
lea ecx, [ebp - 0x5b8]
call fcn.10020f10
lea ecx, [ebp - 0x5b8]
call fcn.10020fd0
lea ecx, [ebp - 0x5b8]
call fcn.10020e80
movzx ecx, byte [ebp - 0x81]
test ecx, ecx
jne 0x10105ffe
mov ecx, dword [ebp - 0x590]
add ecx, 0x2c
call fcn.10004400
movzx edx, al
neg edx
sbb edx, edx
add edx, 1
mov byte [ebp - 0x59d], dl
movzx eax, byte [ebp - 0x59d]
test eax, eax
jne 0x1010610c
push 1
lea ecx, [ebp - 0xa28]
push ecx
call fcn.100e14d0
add esp, 8
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xa24]
call fcn.100ac330
mov byte [ebp - 4], 7
push 0x101d8d08
lea edx, [ebp - 0xa28]
push edx
lea eax, [ebp - 0xee8]
push eax
call fcn.10090bb0
add esp, 0xc
mov dword [ebp - 0xfb4], eax
mov ecx, dword [ebp - 0xfb4]
mov dword [ebp - 0xfb8], ecx
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0xfb8]
call fcn.10004390
push eax
lea ecx, [ebp - 0xa24]
call fcn.100ac660
mov dword [ebp - 0xa2c], eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xee8]
call fcn.10005e00
cmp dword [ebp - 0xa2c], 0
je 0x101060e3
push 4
push 0
lea edx, [ebp - 0xeec]
push edx
lea ecx, [ebp - 0xa24]
call fcn.100ac390
mov dword [ebp - 0xfbc], eax
mov ecx, dword [ebp - 0xfbc]
call fcn.10004390
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [ebp - 0xeec]
call fcn.10005e00
lea ecx, [ebp - 0xa24]
call fcn.100ac820
mov dword [ebp - 0xa2c], eax
jmp 0x1010608e
lea ecx, [ebp - 0xa24]
call fcn.100ac880
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xa24]
call fcn.100ac370
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xa28]
call fcn.10005e00
lea ecx, [ebp - 0x78]
call fcn.10005d40
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x58c]
call fcn.10005d40
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x80]
call fcn.10005d40
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x88]
call fcn.10005d40
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x10]
call fcn.10005d40
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x74]
call fcn.10005d40
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x584]
call fcn.10111080
mov byte [ebp - 4], 0xf
movzx eax, byte [ebp - 0x81]
test eax, eax
jne 0x10106af1
mov ecx, dword [ebp - 0x590]
mov dword [ebp - 0x2ec], ecx
mov dword [ebp - 0xe98], 0
mov dword [ebp - 0xe98], 0
jmp 0x101061a9
mov edx, dword [ebp - 0xe98]
add edx, 1
mov dword [ebp - 0xe98], edx
mov eax, dword [ebp - 0x590]
mov ecx, dword [eax + 0x12c]
add ecx, 0x7c
call fcn.1003d030
cmp dword [ebp - 0xe98], eax
jae 0x1010622f
lea ecx, [ebp - 0x584]
test ecx, ecx
je 0x101061e3
lea edx, [ebp - 0x584]
add edx, 0xc4
mov dword [ebp - 0xfc0], edx
jmp 0x101061ed
mov dword [ebp - 0xfc0], 0
mov eax, dword [ebp - 0xe98]
push eax
mov ecx, dword [ebp - 0x590]
mov ecx, dword [ecx + 0x12c]
add ecx, 0x7c
call fcn.1003d050
mov edx, dword [eax]
mov dword [ebp - 0xfc4], edx
mov eax, dword [ebp - 0xfc0]
push eax
mov ecx, dword [ebp - 0xfc4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xfc4]
mov eax, dword [edx + 0x24]
call eax
jmp 0x1010619a
mov dword [ebp - 0xe98], 0
jmp 0x1010624a
mov ecx, dword [ebp - 0xe98]
add ecx, 1
mov dword [ebp - 0xe98], ecx
mov edx, dword [ebp - 0x590]
mov ecx, dword [edx + 0x12c]
add ecx, 0x64
call fcn.1003cf10
cmp dword [ebp - 0xe98], eax
jae 0x101062d0
lea eax, [ebp - 0x584]
test eax, eax
je 0x10106284
lea ecx, [ebp - 0x584]
add ecx, 0xc4
mov dword [ebp - 0xfc8], ecx
jmp 0x1010628e
mov dword [ebp - 0xfc8], 0
mov edx, dword [ebp - 0xe98]
push edx
mov eax, dword [ebp - 0x590]
mov ecx, dword [eax + 0x12c]
add ecx, 0x64
call fcn.1003cf30
mov ecx, dword [eax]
mov dword [ebp - 0xfcc], ecx
mov edx, dword [ebp - 0xfc8]
push edx
mov eax, dword [ebp - 0xfcc]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xfcc]
mov eax, dword [edx + 0x24]
call eax
jmp 0x1010623b
push ecx
mov ecx, esp
mov dword [ebp - 0xef0], esp
push 0x101d8d10
call fcn.10005d80
mov dword [ebp - 0xfd0], eax
lea ecx, [ebp - 0xef4]
push ecx
mov ecx, dword [ebp - 0x590]
call fcn.100b3770
mov dword [ebp - 0xfd4], eax
mov edx, dword [ebp - 0xfd4]
mov dword [ebp - 0xfd8], edx
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0xfd8]
push eax
lea ecx, [ebp - 0x58c]
call fcn.10003ea0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xef4]
call fcn.10005e00
push ecx
mov ecx, esp
mov dword [ebp - 0xef8], esp
push str.requestAfterUninstall
call fcn.10005d80
mov dword [ebp - 0xfdc], eax
lea ecx, [ebp - 0xefc]
push ecx
mov ecx, dword [ebp - 0x590]
call fcn.100b3770
mov dword [ebp - 0xfe0], eax
mov edx, dword [ebp - 0xfe0]
mov dword [ebp - 0xfe4], edx
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0xfe4]
push eax
lea ecx, [ebp - 0x80]
call fcn.10003ea0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xefc]
call fcn.10005e00
push ecx
mov ecx, esp
mov dword [ebp - 0xf00], esp
push 0x101d8d60
call fcn.10005d80
mov dword [ebp - 0xfe8], eax
mov ecx, dword [ebp - 0xfe8]
mov dword [ebp - 0xfec], ecx
mov byte [ebp - 4], 0x12
push ecx
mov ecx, esp
mov dword [ebp - 0xf04], esp
push str.afterUninstallMsg
call fcn.10005d80
mov dword [ebp - 0xff0], eax
lea edx, [ebp - 0xf08]
push edx
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x590]
call fcn.100b3990
mov dword [ebp - 0xff4], eax
mov eax, dword [ebp - 0xff4]
mov dword [ebp - 0xff8], eax
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0xff8]
push ecx
lea ecx, [ebp - 0x10]
call fcn.10003ea0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xf08]
call fcn.10005e00
push ecx
mov ecx, esp
mov dword [ebp - 0xf0c], esp
push 0x101d8d88
call fcn.10005d80
mov dword [ebp - 0xffc], eax
mov edx, dword [ebp - 0xffc]
mov dword [ebp - 0x1000], edx
mov byte [ebp - 4], 0x14
push ecx
mov ecx, esp
mov dword [ebp - 0xf10], esp
push 0x101d8d94
call fcn.10005d80
mov dword [ebp - 0x1004], eax
lea eax, [ebp - 0xf14]
push eax
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x590]
call fcn.100b3990
mov dword [ebp - 0x1008], eax
mov ecx, dword [ebp - 0x1008]
mov dword [ebp - 0x100c], ecx
mov byte [ebp - 4], 0x15
mov edx, dword [ebp - 0x100c]
push edx
lea ecx, [ebp - 0x88]
call fcn.10003ea0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xf14]
call fcn.10005e00
push ecx
mov ecx, esp
mov dword [ebp - 0xf18], esp
push 0x101d8da8
call fcn.10005d80
mov dword [ebp - 0x1010], eax
mov eax, dword [ebp - 0x1010]
mov dword [ebp - 0x1014], eax
mov byte [ebp - 4], 0x16
push ecx
mov ecx, esp
mov dword [ebp - 0xf1c], esp
push 0x101d8dac
call fcn.10005d80
mov dword [ebp - 0x1018], eax
mov ecx, dword [ebp - 0x1018]
mov dword [ebp - 0x101c], ecx
mov byte [ebp - 4], 0x17
push ecx
mov ecx, esp
mov dword [ebp - 0xf20], esp
push 0x101d8db0
call fcn.10005d80
mov dword [ebp - 0x1020], eax
lea edx, [ebp - 0xf24]
push edx
mov byte [ebp - 4], 0xf
call fcn.100e0810
add esp, 0x10
mov dword [ebp - 0x1024], eax
mov eax, dword [ebp - 0x1024]
mov dword [ebp - 0x1028], eax
mov byte [ebp - 4], 0x18
mov ecx, dword [ebp - 0x1028]
push ecx
lea ecx, [ebp - 0x74]
call fcn.10003ea0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xf24]
call fcn.10005e00
cmp dword [ebp - 0x590], 0
je 0x1010679c
mov edx, dword [ebp - 0x590]
cmp dword [edx + 0x12c], 0
je 0x1010679c
mov eax, dword [ebp - 0x590]
mov ecx, dword [eax + 0x12c]
cmp dword [ecx + 0x1c], 0
je 0x1010679c
lea ecx, [ebp - 0xeb0]
call fcn.10005d40
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0xeb4]
call fcn.10005d40
mov byte [ebp - 4], 0x1a
mov edx, dword [ebp - 0x590]
mov eax, dword [edx + 0x12c]
mov ecx, dword [eax + 0x1c]
add ecx, 0x10
push ecx
lea ecx, [ebp - 0xeb0]
call fcn.10003ea0
mov edx, dword [ebp - 0x590]
mov eax, dword [edx + 0x12c]
mov ecx, dword [eax + 0x1c]
add ecx, 0x14
push ecx
lea ecx, [ebp - 0xeb4]
call fcn.10003ea0
mov edx, dword [ebp - 0x590]
mov eax, dword [edx + 0x12c]
mov ecx, dword [eax + 0x1c]
mov edx, dword [ecx + 0x1c]
mov dword [ebp - 0xea4], edx
mov eax, dword [ebp - 0x590]
mov ecx, dword [eax + 0x12c]
mov edx, dword [ecx + 0x1c]
mov eax, dword [edx + 0x20]
mov dword [ebp - 0xeac], eax
lea ecx, [ebp - 0xea8]
call fcn.1010cfa0
mov byte [ebp - 4], 0x1b
push 0x17
push 0
push 0x101d4334
lea ecx, [ebp - 0xea8]
call fcn.1010d000
mov dword [ebp - 0xeb8], eax
cmp dword [ebp - 0xeb8], 0
jl 0x1010676f
lea ecx, [ebp - 0xebc]
call fcn.10092a80
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0xea8]
call fcn.1010cff0
mov dword [ebp - 0x102c], eax
lea ecx, [ebp - 0xebc]
call fcn.100987a0
push eax
mov ecx, dword [ebp - 0x102c]
push ecx
mov edx, dword [ebp - 0x102c]
mov eax, dword [edx]
mov ecx, dword [eax + 0x24]
call ecx
mov dword [ebp - 0xeb8], eax
cmp dword [ebp - 0xeb8], 0
jl 0x10106760
push 0
lea ecx, [ebp - 0xebc]
call fcn.100987b0
movzx edx, al
test edx, edx
je 0x10106760
lea ecx, [ebp - 0xebc]
call fcn.10014090
push eax
lea ecx, [ebp - 0xec0]
call fcn.1010d030
mov byte [ebp - 4], 0x1d
push 0
lea ecx, [ebp - 0xec0]
call fcn.100ae860
movzx eax, al
test eax, eax
je 0x10106751
lea ecx, [ebp - 0xec0]
call fcn.10090cd0
mov dword [ebp - 0x1030], eax
mov ecx, dword [ebp - 0xeac]
sub ecx, 1
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, 1
push ecx
mov edx, dword [ebp - 0xea4]
sub edx, 1
neg edx
sbb edx, edx
neg edx
sub edx, 1
push edx
lea ecx, [ebp - 0xeb4]
call fcn.100ce600
push eax
lea ecx, [ebp - 0xeb0]
call fcn.100ce600
push eax
mov eax, dword [ebp - 0x1030]
push eax
mov ecx, dword [ebp - 0x1030]
mov edx, dword [ecx]
mov eax, dword [edx + 0x2c]
call eax
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0xec0]
call fcn.10090b30
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0xebc]
call fcn.10012150
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0xea8]
call fcn.1010c180
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0xeb4]
call fcn.10005e00
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xeb0]
call fcn.10005e00
call fcn.100ad820
push ecx
mov ecx, esp
mov dword [ebp - 0xf28], esp
lea edx, [ebp - 0x58c]
push edx
call fcn.10005d60
mov dword [ebp - 0x1034], eax
lea eax, [ebp - 0xe9c]
push eax
call fcn.1011c470
add esp, 8
mov dword [ebp - 0x1038], eax
mov byte [ebp - 4], 0x1e
push 0xfde9
push 0xa
push ecx
mov ecx, esp
mov dword [ebp - 0xf2c], esp
lea edx, [ebp - 0xe9c]
push edx
call fcn.10005d60
mov dword [ebp - 0x103c], eax
lea eax, [ebp - 0xf30]
push eax
lea ecx, [ebp - 0x584]
call fcn.1011d720
mov dword [ebp - 0x1040], eax
mov ecx, dword [ebp - 0x1040]
mov dword [ebp - 0x1044], ecx
mov byte [ebp - 4], 0x1f
mov edx, dword [ebp - 0x1044]
push edx
lea ecx, [ebp - 0x58c]
call fcn.10003ea0
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0xf30]
call fcn.10005e00
push ecx
mov ecx, esp
mov dword [ebp - 0xf34], esp
lea eax, [ebp - 0x80]
push eax
call fcn.10005d60
mov dword [ebp - 0x1048], eax
lea ecx, [ebp - 0xf38]
push ecx
call fcn.1011c470
add esp, 8
mov dword [ebp - 0x104c], eax
mov edx, dword [ebp - 0x104c]
mov dword [ebp - 0x1050], edx
mov byte [ebp - 4], 0x20
mov eax, dword [ebp - 0x1050]
push eax
lea ecx, [ebp - 0xe9c]
call fcn.10003ea0
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0xf38]
call fcn.10005e00
push 0xfde9
push 0xa
push ecx
mov ecx, esp
mov dword [ebp - 0xf3c], esp
lea edx, [ebp - 0xe9c]
push edx
call fcn.10005d60
mov dword [ebp - 0x1054], eax
lea eax, [ebp - 0xf40]
push eax
lea ecx, [ebp - 0x584]
call fcn.1011d720
mov dword [ebp - 0x1058], eax
mov ecx, dword [ebp - 0x1058]
mov dword [ebp - 0x105c], ecx
mov byte [ebp - 4], 0x21
mov edx, dword [ebp - 0x105c]
push edx
lea ecx, [ebp - 0x80]
call fcn.10003ea0
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0xf40]
call fcn.10005e00
mov eax, dword [ebp - 0x590]
mov ecx, dword [eax + 0x12c]
add ecx, 0xc8
call fcn.10004400
movzx ecx, al
test ecx, ecx
jne 0x10106940
mov edx, dword [ebp - 0x590]
mov eax, dword [edx + 0x12c]
add eax, 0xc8
push eax
lea ecx, [ebp - 0x78]
call fcn.10003ea0
jmp 0x1010694d
push 0x1022ede0
lea ecx, [ebp - 0x78]
call fcn.10003ea0
lea ecx, [ebp - 0xe94]
call fcn.100ac330
mov byte [ebp - 4], 0x22
push 0x101d8e10
push 1
lea ecx, [ebp - 0xf44]
push ecx
call fcn.100e14d0
add esp, 8
mov dword [ebp - 0x1060], eax
mov edx, dword [ebp - 0x1060]
mov dword [ebp - 0x1064], edx
mov byte [ebp - 4], 0x23
mov eax, dword [ebp - 0x1064]
push eax
lea ecx, [ebp - 0xf48]
push ecx
call fcn.10090bb0
add esp, 0xc
mov dword [ebp - 0x1068], eax
mov edx, dword [ebp - 0x1068]
mov dword [ebp - 0x106c], edx
mov byte [ebp - 4], 0x24
mov ecx, dword [ebp - 0x106c]
call fcn.10004390
push eax
lea ecx, [ebp - 0xe94]
call fcn.100ac660
mov dword [ebp - 0xea0], eax
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0xf48]
call fcn.10005e00
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0xf44]
call fcn.10005e00
cmp dword [ebp - 0xea0], 0
je 0x10106ac6
mov dword [ebp - 0xec4], 0
lea eax, [ebp - 0xf4c]
push eax
lea ecx, [ebp - 0xe94]
call fcn.100ac390
mov dword [ebp - 0x1070], eax
mov ecx, dword [ebp - 0x1070]
call fcn.10004390
push eax
call fcn.100aa6f0
mov dword [ebp - 0xec8], eax
lea ecx, [ebp - 0xf4c]
call fcn.10005e00
cmp dword [ebp - 0xec8], 0
je 0x10106ab0
push str.PlugInvoke
mov ecx, dword [ebp - 0xec8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xec4], eax
cmp dword [ebp - 0xec4], 0
je 0x10106aa3
lea edx, [ebp - 0x584]
test edx, edx
je 0x10106a87
lea eax, [ebp - 0x584]
add eax, 0xc4
mov dword [ebp - 0x1074], eax
jmp 0x10106a91
mov dword [ebp - 0x1074], 0
mov ecx, dword [ebp - 0x1074]
push ecx
push str.UnRegistration2
call dword [ebp - 0xec4]
mov edx, dword [ebp - 0xec8]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp - 0xe94]
call fcn.100ac820
mov dword [ebp - 0xea0], eax
jmp 0x101069ef
lea ecx, [ebp - 0xe94]
call fcn.100ac880
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0xe94]
call fcn.100ac370
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xe9c]
call fcn.10005e00
jmp 0x10106afe
push 0x1022ede0
lea ecx, [ebp - 0x78]
call fcn.10003ea0
lea ecx, [ebp - 0x5a8]
call fcn.10020e50
mov byte [ebp - 4], 0x25
push 0
push 0
push 0x2001f
push 0
push 0
push 0x101d8e50
push SysReAllocString
lea ecx, [ebp - 0x5a8]
call fcn.10021020
mov dword [ebp - 0x598], eax
cmp dword [ebp - 0x598], 0
jne 0x10106b76
push 1
push 0x101d8e4c
push 0x101d8ec0
lea ecx, [ebp - 0x5a8]
call fcn.100217a0
mov ecx, 0x1022eddc
call fcn.100043a0
push eax
lea ecx, [ebp - 0x5a8]
call fcn.10020fa0
lea ecx, [ebp - 0x5a8]
call fcn.10020fd0
push 1
lea eax, [ebp - 0x588]
push eax
call fcn.100e14d0
add esp, 8
mov byte [ebp - 4], 0x26
mov dword [ebp - 0x8c], 1
movzx ecx, byte [ebp - 0x81]
test ecx, ecx
jne 0x10106be3
mov edx, dword [ebp - 0x590]
mov eax, dword [edx + 0x3c]
mov dword [ebp - 0x8c], eax
movzx ecx, byte [ebp - 0x59d]
test ecx, ecx
jne 0x10106be3
push 0
push 1
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0xf50], esp
lea edx, [ebp - 0x588]
push edx
call fcn.10005d60
mov dword [ebp - 0x1078], eax
call fcn.100a70c0
add esp, 0x10
call fcn.101079a0
push 0
call fcn.10107180
add esp, 4
movzx eax, byte [ebp - 0x81]
test eax, eax
jne 0x10106c07
mov dword [ebp - 0x2ec], 0
push ecx
mov ecx, esp
mov dword [ebp - 0xf54], esp
push 0x101d8f10
call fcn.10005d80
mov dword [ebp - 0x107c], eax
mov ecx, dword [ebp - 0x107c]
mov dword [ebp - 0x1080], ecx
mov byte [ebp - 4], 0x27
push ecx
mov ecx, esp
mov dword [ebp - 0xf58], esp
push 0x101d8f14
call fcn.10005d80
mov dword [ebp - 0x1084], eax
mov edx, dword [ebp - 0x1084]
mov dword [ebp - 0x1088], edx
mov byte [ebp - 4], 0x28
mov eax, dword [ebp - 0x590]
cmp dword [eax + 0x48], 1
sete cl
movzx edx, cl
push edx
push ecx
mov ecx, esp
mov dword [ebp - 0xf5c], esp
push 0x101d8f18
call fcn.10005d80
mov dword [ebp - 0x108c], eax
push 0
mov byte [ebp - 4], 0x26
call fcn.100e2e80
add esp, 0x14
lea ecx, [ebp - 0x70]
call fcn.10020e50
mov byte [ebp - 4], 0x29
lea eax, [ebp - 0x7c]
push eax
call fcn.1002dd30
add esp, 4
mov byte [ebp - 4], 0x2a
push 0
push 0
push 0x2001f
push 0
push 0
lea ecx, [ebp - 0x7c]
call fcn.100043a0
push eax
push SysReAllocString
lea ecx, [ebp - 0x70]
call fcn.10021020
cmp dword [ebp - 0x8c], 0
je 0x10106d00
lea ecx, [ebp - 0x78]
call fcn.100043a0
push eax
lea ecx, [ebp - 0x70]
call fcn.10021110
lea ecx, [ebp - 0x78]
call fcn.100043a0
push eax
lea ecx, [ebp - 0x70]
call fcn.10020f10
jmp 0x10106e32
push ecx
mov ecx, esp
mov dword [ebp - 0xf60], esp
push 0x101d8f1c
call fcn.10005d80
mov dword [ebp - 0x1090], eax
mov ecx, dword [ebp - 0x1090]
mov dword [ebp - 0x1094], ecx
mov byte [ebp - 4], 0x2b
push ecx
mov ecx, esp
mov dword [ebp - 0xf64], esp
push 0x101d8f20
call fcn.10005d80
mov dword [ebp - 0x1098], eax
mov edx, dword [ebp - 0x1098]
mov dword [ebp - 0x109c], edx
mov byte [ebp - 4], 0x2c
push ecx
mov ecx, esp
mov dword [ebp - 0xf68], esp
push 0x101d8f24
call fcn.10005d80
mov dword [ebp - 0x10a0], eax
lea eax, [ebp - 0xecc]
push eax
mov byte [ebp - 4], 0x2a
call fcn.100e0810
add esp, 0x10
mov dword [ebp - 0x10a4], eax
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x78]
call fcn.100043a0
push eax
lea ecx, [ebp - 0x70]
call fcn.10021110
lea ecx, [ebp - 0x78]
call fcn.100043a0
push eax
lea ecx, [ebp - 0x70]
call fcn.10020f10
push ecx
mov ecx, esp
mov dword [ebp - 0xf6c], esp
push 0x101d8f3c
call fcn.10005d80
mov dword [ebp - 0x10a8], eax
mov ecx, dword [ebp - 0x10a8]
mov dword [ebp - 0x10ac], ecx
mov byte [ebp - 4], 0x2e
push ecx
mov ecx, esp
mov dword [ebp - 0xf70], esp
lea edx, [ebp - 0xecc]
push edx
call fcn.10005d60
mov dword [ebp - 0x10b0], eax
mov eax, dword [ebp - 0x10b0]
mov dword [ebp - 0x10b4], eax
mov byte [ebp - 4], 0x2f
push ecx
mov ecx, esp
mov dword [ebp - 0xf74], esp
push 0x101d8f40
call fcn.10005d80
mov dword [ebp - 0x10b8], eax
mov byte [ebp - 4], 0x2d
call fcn.100e0b60
add esp, 0xc
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0xecc]
call fcn.10005e00
lea ecx, [ebp - 0x70]
call fcn.10020fd0
mov ecx, dword [ebp - 0x590]
mov dword [ebp - 0xf7c], ecx
mov edx, dword [ebp - 0xf7c]
mov dword [ebp - 0xf78], edx
cmp dword [ebp - 0xf78], 0
je 0x10106e78
push 1
mov eax, dword [ebp - 0xf78]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xf78]
mov eax, dword [edx + 8]
call eax
mov dword [ebp - 0x10bc], eax
jmp 0x10106e82
mov dword [ebp - 0x10bc], 0
movzx ecx, byte [ebp - 0x59d]
test ecx, ecx
jne 0x10106ecc
push 0
push 1
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0xf80], esp
lea edx, [ebp - 0x588]
push edx
call fcn.10005d60
mov dword [ebp - 0x10c0], eax
call fcn.100a70c0
add esp, 0x10
push 4
push 0
lea ecx, [ebp - 0x588]
call fcn.10004390
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 1
push 1
push 0
push ecx
mov eax, esp
mov dword [ebp - 0xf84], esp
push 0
push eax
call fcn.100e14d0
add esp, 8
mov dword [ebp - 0x10c4], eax
call fcn.100a70c0
add esp, 0x10
push 0
lea ecx, [ebp - 0x68]
push ecx
call fcn.100e14d0
add esp, 8
mov byte [ebp - 4], 0x30
push 0x5c
lea ecx, [ebp - 0x68]
call fcn.1009f6e0
push eax
push 0
lea edx, [ebp - 0xf88]
push edx
lea ecx, [ebp - 0x68]
call fcn.1000c400
mov dword [ebp - 0x10c8], eax
mov eax, dword [ebp - 0x10c8]
mov dword [ebp - 0x10cc], eax
mov byte [ebp - 4], 0x31
mov ecx, dword [ebp - 0x10cc]
push ecx
lea ecx, [ebp - 0x68]
call fcn.10003ea0
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0xf88]
call fcn.10005e00
push 0x5c
lea ecx, [ebp - 0x68]
call fcn.1009f6e0
push eax
push 0
lea edx, [ebp - 0xf8c]
push edx
lea ecx, [ebp - 0x68]
call fcn.1000c400
mov dword [ebp - 0x10d0], eax
mov eax, dword [ebp - 0x10d0]
mov dword [ebp - 0x10d4], eax
mov byte [ebp - 4], 0x32
mov ecx, dword [ebp - 0x10d4]
push ecx
lea ecx, [ebp - 0x68]
call fcn.10003ea0
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0xf8c]
call fcn.10005e00
lea ecx, [ebp - 0x68]
call fcn.10004390
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 4
push 0
lea ecx, [ebp - 0x68]
call fcn.10004390
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [ebp - 0x58c]
call fcn.10004400
movzx edx, al
test edx, edx
jne 0x10107035
push 0x101d8f58
lea eax, [ebp - 0x74]
push eax
call fcn.10004370
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x10107013
push 1
push 0
push 0
lea ecx, [ebp - 0x58c]
call fcn.100043a0
push eax
push 0x101d8f5c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x10107035
push 5
push 0
lea ecx, [ebp - 0x58c]
call fcn.100043a0
push eax
push 0x101d8f68
push 0x101d8f84
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x80]
call fcn.10004400
movzx edx, al
test edx, edx
jne 0x1010705a
push 0
push 0
push 0
lea ecx, [ebp - 0x80]
call fcn.10004390
push eax
push 0
call sub.urlmon.dll_URLDownloadToFileW
lea ecx, [ebp - 0x10]
call fcn.10004400
movzx eax, al
test eax, eax
jne 0x10107088
push 0x40
lea ecx, [ebp - 0x88]
call fcn.10004390
push eax
lea ecx, [ebp - 0x10]
call fcn.10004390
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov byte [ebp - 0xf8d], 1
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x68]
call fcn.10005e00
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x7c]
call fcn.10005e00
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x70]
call fcn.10020e80
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x588]
call fcn.10005e00
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x5a8]
call fcn.10020e80
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x584]
call fcn.10111ba0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x74]
call fcn.10005e00
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x10]
call fcn.10005e00
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x88]
call fcn.10005e00
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x80]
call fcn.10005e00
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x58c]
call fcn.10005e00
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x78]
call fcn.10005e00
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x64]
call fcn.101513f0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x59c]
call fcn.10005e00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x594]
call fcn.10005e00
mov al, byte [ebp - 0xf8d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x90]
xor ecx, ebp
call fcn.1016f6a2
mov esp, ebp
pop ebp
ret