Function at 0x100a3e60
Capabilities:
Copy file
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1019f802
mov eax, dword fs:[0]
push eax
sub esp, 0xae4
mov eax, dword [0x10222354]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 2
push 1
lea eax, [ebp - 0x18]
push eax
call fcn.100de0f0
add esp, 8
mov byte [ebp - 4], 3
push 0x101bc630
push 0
lea ecx, [ebp - 0xa40]
push ecx
call fcn.100de0f0
add esp, 8
mov dword [ebp - 0xa88], eax
mov edx, dword [ebp - 0xa88]
mov dword [ebp - 0xa8c], edx
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0xa8c]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.1008d070
add esp, 0xc
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xa40]
call fcn.1000ba80
lea ecx, [ebp - 0x228]
call fcn.1000b9c0
mov byte [ebp - 4], 7
mov dx, word [0x101bc63c]
mov word [ebp - 0x224], dx
push 0x206
push 0
lea eax, [ebp - 0x222]
push eax
call fcn.10166680
add esp, 0xc
lea ecx, [ebp - 0x224]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [ebp - 0x224]
push edx
lea ecx, [ebp - 0x228]
call fcn.1000baa0
push 0x104
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x228]
call fcn.10007fa0
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
jb 0x100a3f7d
lea ecx, [ebp - 0x224]
push ecx
lea ecx, [ebp - 0x228]
call fcn.1000baa0
lea ecx, [ebp + 0x10]
call fcn.10007f90
push eax
lea ecx, [ebp - 0x22c]
call fcn.100a8b30
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x22c]
call fcn.100a8b60
lea ecx, [ebp - 0x22c]
call fcn.100a8b50
push eax
lea ecx, [ebp - 0x10]
call fcn.1000b9e0
mov byte [ebp - 4], 9
mov ecx, dword [ebp + 0x14]
call fcn.10122830
push str..msi
lea ecx, [ebp - 0xa48]
call fcn.1000ba00
mov dword [ebp - 0xa90], eax
mov edx, dword [ebp - 0xa90]
mov dword [ebp - 0xa94], edx
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0xa94]
push eax
push 4
lea ecx, [ebp - 0xa4c]
push ecx
lea ecx, [ebp + 8]
call fcn.100a80a0
mov dword [ebp - 0xa98], eax
mov edx, dword [ebp - 0xa98]
push edx
call fcn.10007f50
add esp, 8
mov byte [ebp - 0xa41], al
lea ecx, [ebp - 0xa4c]
call fcn.1000ba80
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xa48]
call fcn.1000ba80
movzx eax, byte [ebp - 0xa41]
test eax, eax
je 0x100a4155
lea ecx, [ebp - 0x230]
call fcn.1000b9c0
mov byte [ebp - 4], 0xb
push str.___passive
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x14]
push edx
push str.__i__
lea eax, [ebp - 0xa50]
push eax
call fcn.1001e050
add esp, 0xc
mov dword [ebp - 0xa9c], eax
mov ecx, dword [ebp - 0xa9c]
mov dword [ebp - 0xaa0], ecx
mov byte [ebp - 4], 0xc
mov edx, dword [ebp - 0xaa0]
push edx
lea eax, [ebp - 0xa54]
push eax
call fcn.10007ea0
add esp, 0xc
mov dword [ebp - 0xaa4], eax
mov ecx, dword [ebp - 0xaa4]
mov dword [ebp - 0xaa8], ecx
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0xaa8]
push edx
lea eax, [ebp - 0xa58]
push eax
call fcn.1008d070
add esp, 0xc
mov dword [ebp - 0xaac], eax
mov ecx, dword [ebp - 0xaac]
mov dword [ebp - 0xab0], ecx
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0xab0]
push edx
lea ecx, [ebp - 0x230]
call fcn.10007b80
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xa58]
call fcn.1000ba80
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xa54]
call fcn.1000ba80
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xa50]
call fcn.1000ba80
push 5
push 0
lea ecx, [ebp - 0x230]
call fcn.10007f90
push eax
push 0x101bc670
push 0x101bc688
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x230]
call fcn.1000ba80
jmp 0x100a4470
push 0
push 0x101bc694
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0xa5c]
push ecx
call fcn.1008d070
add esp, 0xc
mov dword [ebp - 0xab4], eax
mov edx, dword [ebp - 0xab4]
mov dword [ebp - 0xab8], edx
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0xab8]
call fcn.10007f90
push eax
push 0x101bc6ac
push 1
lea eax, [ebp - 0xa60]
push eax
call fcn.100de0f0
add esp, 8
mov dword [ebp - 0xabc], eax
mov ecx, dword [ebp - 0xabc]
mov dword [ebp - 0xac0], ecx
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0xac0]
push edx
lea eax, [ebp - 0xa64]
push eax
call fcn.1008d070
add esp, 0xc
mov dword [ebp - 0xac4], eax
mov ecx, dword [ebp - 0xac4]
call fcn.10007f90
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [ebp - 0xa64]
call fcn.1000ba80
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xa60]
call fcn.1000ba80
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xa5c]
call fcn.1000ba80
push str.Please_choose_Run_or_Allow_in_system_dialogs_if_asked_to_update_your_Toolbar_properly
push str.chooseRunOrAllow
mov ecx, dword [ebp + 0x14]
add ecx, 0xc4
mov edx, dword [ebp + 0x14]
mov eax, dword [edx + 0xc4]
mov edx, dword [eax + 0xb4]
call edx
push eax
lea ecx, [ebp - 0xa38]
call fcn.1000ba00
mov byte [ebp - 4], 0x11
push str.Please_close_all_IE_windows_manually_and_click_OK_to_continue_r_n_or_click_cancel_to_cancel_update
push str.closeIEManually
mov ecx, dword [ebp + 0x14]
add ecx, 0xc4
mov eax, dword [ebp + 0x14]
mov edx, dword [eax + 0xc4]
mov eax, dword [edx + 0xb4]
call eax
push eax
lea ecx, [ebp - 0xa3c]
call fcn.1000ba00
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0xa3c]
push ecx
lea edx, [ebp + 0xc]
push edx
push 1
lea eax, [ebp - 0xa68]
push eax
call fcn.100de0f0
add esp, 8
mov dword [ebp - 0xac8], eax
mov ecx, dword [ebp - 0xac8]
mov dword [ebp - 0xacc], ecx
mov byte [ebp - 4], 0x13
mov edx, dword [ebp - 0xacc]
push edx
lea eax, [ebp - 0xa6c]
push eax
call fcn.10007ea0
add esp, 0xc
mov dword [ebp - 0xad0], eax
mov ecx, dword [ebp - 0xad0]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push str.__s___s___s____s_
push 0x400
lea edx, [ebp - 0xa34]
push edx
call fcn.1016a1f2
add esp, 0x1c
lea ecx, [ebp - 0xa6c]
call fcn.1000ba80
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0xa68]
call fcn.1000ba80
push 0x101bc8a8
push ecx
mov ecx, esp
mov dword [ebp - 0xa74], esp
push 0x101bc8ac
call fcn.1000ba00
mov dword [ebp - 0xad4], eax
mov eax, dword [ebp - 0xad4]
mov dword [ebp - 0xad8], eax
mov byte [ebp - 4], 0x14
push ecx
mov ecx, esp
mov dword [ebp - 0xa78], esp
push 0x101bc8b0
call fcn.1000ba00
mov dword [ebp - 0xadc], eax
mov ecx, dword [ebp - 0xadc]
mov dword [ebp - 0xae0], ecx
mov byte [ebp - 4], 0x15
push ecx
mov ecx, esp
mov dword [ebp - 0xa7c], esp
push 0x101bc8b4
call fcn.1000ba00
mov dword [ebp - 0xae4], eax
lea edx, [ebp - 0xa80]
push edx
mov byte [ebp - 4], 0x12
call fcn.100dd430
add esp, 0x10
mov dword [ebp - 0xae8], eax
mov eax, dword [ebp - 0xae8]
mov dword [ebp - 0xaec], eax
mov ecx, dword [ebp - 0xaec]
push ecx
call fcn.100110d0
add esp, 8
mov byte [ebp - 0xa6d], al
lea ecx, [ebp - 0xa80]
call fcn.1000ba80
movzx edx, byte [ebp - 0xa6d]
test edx, edx
je 0x100a43f8
call fcn.101466e0
movzx eax, al
test eax, eax
je 0x100a43f8
push 0x30
push 0x101bc8dc
lea ecx, [ebp - 0xa38]
call fcn.10007f90
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 5
lea ecx, [ebp - 0x228]
call fcn.10007f90
push eax
lea ecx, [ebp - 0xa34]
push ecx
push 0x101bc8ec
lea edx, [ebp - 0x228]
push edx
lea eax, [ebp - 0xa84]
push eax
call fcn.1008d070
add esp, 0xc
mov dword [ebp - 0xaf0], eax
mov ecx, dword [ebp - 0xaf0]
call fcn.10007f90
push eax
push 0x101bc904
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0xa84]
call fcn.1000ba80
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0xa3c]
call fcn.1000ba80
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xa38]
call fcn.1000ba80
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x10]
call fcn.1000ba80
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x22c]
call fcn.100a6ca0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x228]
call fcn.1000ba80
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14]
call fcn.1000ba80
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.1000ba80
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.1000ba80
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.1000ba80
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.1000ba80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10165d18
mov esp, ebp
pop ebp
ret