Function at 0x100af020
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Delete registry key
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017aa81
mov eax, dword fs:[0]
push eax
mov eax, 0x11b4
call fcn.10141130
mov eax, dword [0x101e8118]
xor eax, ebp
mov dword [ebp - 0x20], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
push 0
mov ecx, 0x101ea5f0
call fcn.10005f10
push str.XBTB03021.XBTB03021
lea ecx, [ebp - 0x3c]
call fcn.1000acc0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x3c]
call fcn.1000ad60
push eax
lea ecx, [ebp - 0x18]
call fcn.10015fd0
mov byte [ebp - 4], 2
push 0x10196850
lea ecx, [ebp - 0x1024]
call fcn.10004780
mov byte [ebp - 4], 3
lea eax, [ebp - 0x1024]
push eax
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x18]
call fcn.100b11d0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1024]
call fcn.10004820
movzx edx, byte [ebp + 8]
test edx, edx
je 0x100af3c8
lea ecx, [ebp - 0x818]
call fcn.10013cc0
mov byte [ebp - 4], 6
push 0
push 0
push 0x2001f
push 0
push 0
lea ecx, [ebp - 0x40]
call fcn.10016300
push eax
push SysReAllocString
lea ecx, [ebp - 0x818]
call fcn.10014140
push 0
lea ecx, [ebp + 0xc]
call fcn.10005a00
push eax
push 0x10196858
lea ecx, [ebp - 0x818]
call fcn.100b0df0
push 0
push 0
mov ecx, 0x101ea5f0
call fcn.10005f10
push eax
push 0x1019685c
lea ecx, [ebp - 0x818]
call fcn.100b0df0
lea ecx, [ebp - 0x818]
call fcn.10013d10
push 0
push 0
push 0x2001f
push 0
push 0
lea ecx, [ebp - 0x18]
call fcn.10016300
push eax
push SysReAllocString
lea ecx, [ebp - 0x818]
call fcn.10014140
push 0
lea ecx, [ebp + 0xc]
call fcn.10005a00
push eax
push 0x10196868
lea ecx, [ebp - 0x818]
call fcn.100b0df0
push 0
push 0
mov ecx, 0x101ea5f0
call fcn.10005f10
push eax
push 0x1019686c
lea ecx, [ebp - 0x818]
call fcn.100b0df0
push 0
lea ecx, [ebp - 0x40]
call fcn.10016300
push eax
push str.CurVer
lea ecx, [ebp - 0x818]
call fcn.100b0df0
lea ecx, [ebp - 0x818]
call fcn.10013d10
push 0
push 0
push 0x2001f
push 0
push 0
push 0x10196888
push SysReAllocString
lea ecx, [ebp - 0x818]
call fcn.10014140
push 0
lea ecx, [ebp + 0xc]
call fcn.10005a00
push eax
push 0
mov ecx, 0x101ea5f0
call fcn.10005f10
push eax
lea ecx, [ebp - 0x818]
call fcn.100b0df0
lea ecx, [ebp - 0x818]
call fcn.10013d10
push 0x10196894
lea ecx, [ebp - 0x81c]
call fcn.10004780
mov byte [ebp - 4], 7
push 0
mov ecx, 0x101ea5f0
call fcn.10005f10
push eax
lea ecx, [ebp - 0x1028]
call fcn.10004780
mov byte [ebp - 4], 8
lea eax, [ebp - 0x1028]
push eax
lea ecx, [ebp - 0x81c]
call fcn.10016120
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1028]
call fcn.10004820
push 0
push 0
push 0x2001f
push 0
push 0
lea ecx, [ebp - 0x81c]
call fcn.10016300
push eax
push SysReAllocString
lea ecx, [ebp - 0x818]
call fcn.10014140
push 0
lea ecx, [ebp - 0x40]
call fcn.10016300
push eax
push str.ProgID
lea ecx, [ebp - 0x818]
call fcn.100b0df0
push 0
lea ecx, [ebp - 0x18]
call fcn.10016300
push eax
push str.VersionIndependentProgID
lea ecx, [ebp - 0x818]
call fcn.100b0df0
push 0
push str.77AA25E8_6083_4949_A831_9CB11861DC10
push 0x10196938
lea ecx, [ebp - 0x818]
call fcn.100b0df0
push 0x3e8
lea ecx, [ebp - 0x814]
push ecx
mov ecx, 0x101ea630
call fcn.10086950
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x814]
push edx
lea ecx, [ebp - 0x820]
call fcn.100057d0
mov byte [ebp - 4], 9
push 0
push 0
lea ecx, [ebp - 0x820]
call fcn.10005f10
push eax
push 0x10196948
lea ecx, [ebp - 0x818]
call fcn.100b0df0
push str.ThreadingModel
push str.Apartment
push str.InprocServer32
lea ecx, [ebp - 0x818]
call fcn.100b0df0
lea ecx, [ebp - 0x818]
call fcn.10013d10
push 0
push 0
push 0x2001f
push 0
push 0
push str.SYSTEMCurrentControlSetControlSession_Manager_
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x818]
call fcn.10014140
push str.PendingFileRenameOperations
lea ecx, [ebp - 0x818]
call fcn.100b0dc0
lea ecx, [ebp - 0x818]
call fcn.10013d10
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x820]
call fcn.10006030
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x81c]
call fcn.10004820
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x818]
call fcn.10013ce0
jmp 0x100af50c
lea ecx, [ebp - 0x824]
call fcn.10013cc0
mov byte [ebp - 4], 0xa
push 0
push 0
push 0x2001f
push 0
push 0
push 0x10196a5c
push SysReAllocString
lea ecx, [ebp - 0x824]
call fcn.10014140
push 0
mov ecx, 0x101ea5f0
call fcn.10005f10
push eax
lea ecx, [ebp - 0x824]
call fcn.10013f80
push 0
mov ecx, 0x101ea5f0
call fcn.10005f10
push eax
lea ecx, [ebp - 0x824]
call fcn.100140c0
lea ecx, [ebp - 0x824]
call fcn.10013d10
push 0x2001f
push 0
push SysReAllocString
lea ecx, [ebp - 0x824]
call fcn.10013d50
lea ecx, [ebp - 0x40]
call fcn.10016300
push eax
lea ecx, [ebp - 0x824]
call fcn.10013f80
lea ecx, [ebp - 0x40]
call fcn.10016300
push eax
lea ecx, [ebp - 0x824]
call fcn.100140c0
lea ecx, [ebp - 0x824]
call fcn.10013d10
push 0x2001f
push 0
push SysReAllocString
lea ecx, [ebp - 0x824]
call fcn.10013d50
lea ecx, [ebp - 0x18]
call fcn.10016300
push eax
lea ecx, [ebp - 0x824]
call fcn.10013f80
lea ecx, [ebp - 0x18]
call fcn.10016300
push eax
lea ecx, [ebp - 0x824]
call fcn.100140c0
lea ecx, [ebp - 0x824]
call fcn.10013d10
push 0x2001f
push 0x10196a70
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x824]
call fcn.10013d50
push 0x10196b1c
lea ecx, [ebp - 0x824]
call fcn.100b0dc0
lea ecx, [ebp - 0x824]
call fcn.10013d10
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x824]
call fcn.10013ce0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_LOCALMACHINE_LOCKDOWN
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [ebp - 0x1c], 0
je 0x100af575
movzx ecx, byte [ebp + 8]
test ecx, ecx
je 0x100af566
push 4
lea edx, [ebp - 0x14]
push edx
push 4
push 0
push 0x10196bd0
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x100af575
push 0x10196bec
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push 0x10196c08
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
movzx ecx, byte [ebp + 8]
test ecx, ecx
je 0x100af5d7
mov byte [ebp - 0x825], 0
push 1
lea edx, [ebp - 0x825]
push edx
push 3
push 0
push 0
mov ecx, 0x101ea5f0
call fcn.10005f10
push eax
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x100af5ee
push 0
mov ecx, 0x101ea5f0
call fcn.10005f10
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, byte [ebp + 8]
test eax, eax
jne 0x100afad9
lea ecx, [ebp - 0x830]
call fcn.10013cc0
mov byte [ebp - 4], 0xb
push 0x2001f
push str.SoftwareMicrosoftInternet_ExplorerSearch
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x830]
call fcn.10013d50
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x82c], 0
jne 0x100af714
push ecx
mov ecx, esp
mov dword [ebp - 0x102c], esp
push 0x10196cc0
call fcn.100057d0
mov dword [ebp - 0x10bc], eax
mov ecx, dword [ebp - 0x10bc]
mov dword [ebp - 0x10c0], ecx
mov byte [ebp - 4], 0xc
push ecx
mov ecx, esp
mov dword [ebp - 0x1030], esp
push 0x10196cc4
call fcn.100057d0
mov dword [ebp - 0x10c4], eax
mov edx, dword [ebp - 0x10c4]
mov dword [ebp - 0x10c8], edx
mov byte [ebp - 4], 0xd
push ecx
mov ecx, esp
mov dword [ebp - 0x1034], esp
push str.OldAssitant1
call fcn.100057d0
mov dword [ebp - 0x10cc], eax
mov eax, dword [ebp - 0x10cc]
mov dword [ebp - 0x10d0], eax
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x834]
push ecx
mov byte [ebp - 4], 0xb
call fcn.100ad100
add esp, 0x10
mov dword [ebp - 0x10d4], eax
mov byte [ebp - 4], 0xf
push 0xffffffffffffffff
push 0
push 0x10196ce4
push 0
lea ecx, [ebp - 0x834]
call fcn.10005f10
push eax
lea ecx, [ebp - 0x830]
call fcn.10014540
lea ecx, [ebp - 0x830]
call fcn.10013d10
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x834]
call fcn.10006030
push 0x2001f
push 0x10196d08
push SysReAllocString
lea ecx, [ebp - 0x830]
call fcn.10013d50
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x82c], 0
jne 0x100afaca
push ecx
mov ecx, esp
mov dword [ebp - 0x1038], esp
push 0x10196d04
call fcn.100057d0
mov dword [ebp - 0x10d8], eax
mov edx, dword [ebp - 0x10d8]
mov dword [ebp - 0x10dc], edx
mov byte [ebp - 4], 0x10
push ecx
mov ecx, esp
mov dword [ebp - 0x103c], esp
push 0x10196d5c
call fcn.100057d0
mov dword [ebp - 0x10e0], eax
mov eax, dword [ebp - 0x10e0]
mov dword [ebp - 0x10e4], eax
mov byte [ebp - 4], 0x11
push ecx
mov ecx, esp
mov dword [ebp - 0x1040], esp
push str.OldAssitant5
call fcn.100057d0
mov dword [ebp - 0x10e8], eax
mov ecx, dword [ebp - 0x10e8]
mov dword [ebp - 0x10ec], ecx
mov byte [ebp - 4], 0x12
lea edx, [ebp - 0x838]
push edx
mov byte [ebp - 4], 0xb
call fcn.100ad100
add esp, 0x10
mov dword [ebp - 0x10f0], eax
mov byte [ebp - 4], 0x13
push 0xffffffffffffffff
push 0
push str.Use_Search_Asst
push 0
lea ecx, [ebp - 0x838]
call fcn.10005f10
push eax
lea ecx, [ebp - 0x830]
call fcn.10014540
push ecx
mov ecx, esp
mov dword [ebp - 0x1044], esp
push 0x10196d9c
call fcn.100057d0
mov dword [ebp - 0x10f4], eax
mov eax, dword [ebp - 0x10f4]
mov dword [ebp - 0x10f8], eax
mov byte [ebp - 4], 0x14
push ecx
mov ecx, esp
mov dword [ebp - 0x1048], esp
push 0x10196da0
call fcn.100057d0
mov dword [ebp - 0x10fc], eax
mov ecx, dword [ebp - 0x10fc]
mov dword [ebp - 0x1100], ecx
mov byte [ebp - 4], 0x15
push ecx
mov ecx, esp
mov dword [ebp - 0x104c], esp
push str.OldAssitant2
call fcn.100057d0
mov dword [ebp - 0x1104], eax
mov edx, dword [ebp - 0x1104]
mov dword [ebp - 0x1108], edx
mov byte [ebp - 4], 0x16
lea eax, [ebp - 0x1050]
push eax
mov byte [ebp - 4], 0x13
call fcn.100ad100
add esp, 0x10
mov dword [ebp - 0x110c], eax
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x1110], ecx
mov byte [ebp - 4], 0x17
mov edx, dword [ebp - 0x1110]
push edx
lea ecx, [ebp - 0x838]
call fcn.10005a10
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x1050]
call fcn.10006030
push 0xffffffffffffffff
push 0
push str.Search_Page
push 0
lea ecx, [ebp - 0x838]
call fcn.10005f10
push eax
lea ecx, [ebp - 0x830]
call fcn.10014540
push ecx
mov ecx, esp
mov dword [ebp - 0x1054], esp
push 0x10196dd8
call fcn.100057d0
mov dword [ebp - 0x1114], eax
mov eax, dword [ebp - 0x1114]
mov dword [ebp - 0x1118], eax
mov byte [ebp - 4], 0x18
push ecx
mov ecx, esp
mov dword [ebp - 0x1058], esp
push 0x10196ddc
call fcn.100057d0
mov dword [ebp - 0x111c], eax
mov ecx, dword [ebp - 0x111c]
mov dword [ebp - 0x1120], ecx
mov byte [ebp - 4], 0x19
push ecx
mov ecx, esp
mov dword [ebp - 0x105c], esp
push str.OldAssitant3
call fcn.100057d0
mov dword [ebp - 0x1124], eax
mov edx, dword [ebp - 0x1124]
mov dword [ebp - 0x1128], edx
mov byte [ebp - 4], 0x1a
lea eax, [ebp - 0x1060]
push eax
mov byte [ebp - 4], 0x13
call fcn.100ad100
add esp, 0x10
mov dword [ebp - 0x112c], eax
mov ecx, dword [ebp - 0x112c]
mov dword [ebp - 0x1130], ecx
mov byte [ebp - 4], 0x1b
mov edx, dword [ebp - 0x1130]
push edx
lea ecx, [ebp - 0x838]
call fcn.10005a10
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x1060]
call fcn.10006030
push 0xffffffffffffffff
push 0
push str.Search_Bar
push 0
lea ecx, [ebp - 0x838]
call fcn.10005f10
push eax
lea ecx, [ebp - 0x830]
call fcn.10014540
push ecx
mov ecx, esp
mov dword [ebp - 0x1064], esp
push 0x10196e14
call fcn.100057d0
mov dword [ebp - 0x1134], eax
mov eax, dword [ebp - 0x1134]
mov dword [ebp - 0x1138], eax
mov byte [ebp - 4], 0x1c
push ecx
mov ecx, esp
mov dword [ebp - 0x1068], esp
push 0x10196e18
call fcn.100057d0
mov dword [ebp - 0x113c], eax
mov ecx, dword [ebp - 0x113c]
mov dword [ebp - 0x1140], ecx
mov byte [ebp - 4], 0x1d
push ecx
mov ecx, esp
mov dword [ebp - 0x106c], esp
push str.OldAssitant4
call fcn.100057d0
mov dword [ebp - 0x1144], eax
mov edx, dword [ebp - 0x1144]
mov dword [ebp - 0x1148], edx
mov byte [ebp - 4], 0x1e
lea eax, [ebp - 0x1070]
push eax
mov byte [ebp - 4], 0x13
call fcn.100ad100
add esp, 0x10
mov dword [ebp - 0x114c], eax
mov ecx, dword [ebp - 0x114c]
mov dword [ebp - 0x1150], ecx
mov byte [ebp - 4], 0x1f
mov edx, dword [ebp - 0x1150]
push edx
lea ecx, [ebp - 0x838]
call fcn.10005a10
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x1070]
call fcn.10006030
push 0xffffffffffffffff
push 0
push str.SearchAssistant
push 0
lea ecx, [ebp - 0x838]
call fcn.10005f10
push eax
lea ecx, [ebp - 0x830]
call fcn.10014540
lea ecx, [ebp - 0x830]
call fcn.10013d10
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x838]
call fcn.10006030
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x830]
call fcn.10013ce0
push 0x10196ec4
lea ecx, [ebp - 0x1078]
call fcn.10004780
mov byte [ebp - 4], 0x20
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
push 0x20006
push 0
push 0
push 0
lea ecx, [ebp - 0x1078]
push ecx
lea edx, [ebp - 0x107c]
push edx
lea eax, [ebp - 0x18]
push eax
push 0x10196e58
lea ecx, [ebp - 0x1074]
push ecx
call fcn.100b12e0
add esp, 0xc
mov dword [ebp - 0x1154], eax
mov edx, dword [ebp - 0x1154]
mov dword [ebp - 0x1158], edx
mov byte [ebp - 4], 0x21
mov ecx, dword [ebp - 0x1158]
call fcn.100b11d0
mov dword [ebp - 0x115c], eax
mov eax, dword [ebp - 0x115c]
mov dword [ebp - 0x1160], eax
mov byte [ebp - 4], 0x22
mov ecx, dword [ebp - 0x1160]
call fcn.10016300
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x107c]
call fcn.10004820
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x1074]
call fcn.10004820
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1078]
call fcn.10004820
movzx ecx, byte [ebp + 8]
test ecx, ecx
je 0x100afd46
push 0x3e8
lea edx, [ebp - 0x100c]
push edx
mov ecx, 0x101ea630
call fcn.10086950
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x100c]
push eax
lea ecx, [ebp - 0x1018]
call fcn.100057d0
mov byte [ebp - 4], 0x23
push str.Freeze.com_Toolbar
lea ecx, [ebp - 0x1010]
call fcn.10028570
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x1010]
call fcn.100059c0
shl eax, 1
push eax
push 0
lea ecx, [ebp - 0x1010]
call fcn.10005f10
push eax
push 1
push 0
push 0x10196ee8
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x10196f14
lea ecx, [ebp - 0x1088]
call fcn.10015fd0
mov byte [ebp - 4], 0x25
lea edx, [ebp - 0x1088]
push edx
lea eax, [ebp - 0x1014]
push eax
push 0
lea ecx, [ebp - 0x1018]
call fcn.10005f10
push eax
lea ecx, [ebp - 0x1080]
call fcn.10004780
mov dword [ebp - 0x1164], eax
mov ecx, dword [ebp - 0x1164]
mov dword [ebp - 0x1168], ecx
mov byte [ebp - 4], 0x26
mov edx, dword [ebp - 0x1168]
push edx
push str.regsvr32__u__s__
lea eax, [ebp - 0x1084]
push eax
call fcn.100b1260
add esp, 0xc
mov dword [ebp - 0x116c], eax
mov ecx, dword [ebp - 0x116c]
mov dword [ebp - 0x1170], ecx
mov byte [ebp - 4], 0x27
mov ecx, dword [ebp - 0x1170]
call fcn.100b11d0
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x1084]
call fcn.10004820
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x1080]
call fcn.10004820
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x1088]
call fcn.10004820
lea ecx, [ebp - 0x1014]
call fcn.10016470
shl eax, 1
push eax
lea ecx, [ebp - 0x1014]
call fcn.10016300
push eax
push 1
push 0
push 0x10196f18
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x1014]
call fcn.10004820
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x1010]
call fcn.10006030
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1018]
call fcn.10006030
jmp 0x100afe23
push str.DisplayName
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.UninstallString
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10196fdc
lea ecx, [ebp - 0x1090]
call fcn.10004780
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x1090]
push ecx
lea edx, [ebp - 0x1094]
push edx
lea eax, [ebp - 0x18]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
lea ecx, [ebp - 0x108c]
push ecx
call fcn.100b12e0
add esp, 0xc
mov dword [ebp - 0x1174], eax
mov edx, dword [ebp - 0x1174]
mov dword [ebp - 0x1178], edx
mov byte [ebp - 4], 0x2d
mov ecx, dword [ebp - 0x1178]
call fcn.100b11d0
mov dword [ebp - 0x117c], eax
mov eax, dword [ebp - 0x117c]
mov dword [ebp - 0x1180], eax
mov byte [ebp - 4], 0x2e
mov ecx, dword [ebp - 0x1180]
call fcn.10016300
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x1094]
call fcn.10004820
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x108c]
call fcn.10004820
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1090]
call fcn.10004820
lea ecx, [ebp - 0x10]
call fcn.10013cc0
mov byte [ebp - 4], 0x2f
movzx ecx, byte [ebp + 8]
test ecx, ecx
je 0x100b0098
push str.favicon.ico
lea ecx, [ebp - 0x1098]
call fcn.10028570
mov byte [ebp - 4], 0x30
lea edx, [ebp - 0x1098]
push edx
push 0
lea eax, [ebp - 0x109c]
push eax
call fcn.100addf0
add esp, 8
mov dword [ebp - 0x1184], eax
mov ecx, dword [ebp - 0x1184]
mov dword [ebp - 0x1188], ecx
mov byte [ebp - 4], 0x31
mov edx, dword [ebp - 0x1188]
push edx
lea eax, [ebp - 0x10a0]
push eax
call fcn.10019590
mov dword [ebp - 0x118c], eax
mov ecx, dword [ebp - 0x118c]
mov dword [ebp - 0x1190], ecx
mov byte [ebp - 4], 0x32
mov ecx, dword [ebp - 0x1190]
call fcn.10005a00
push eax
lea ecx, [ebp - 0x101c]
call fcn.10004780
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x10a0]
call fcn.10006030
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x109c]
call fcn.10006030
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x1098]
call fcn.10006030
lea ecx, [ebp - 0x101c]
call fcn.10016300
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100b0084
push 0
push 0
push 0x2001f
push 0
push 0
push 0
mov ecx, 0x101ea5f0
call fcn.10005f10
push eax
push str.SOFTWAREMicrosoftInternet_ExplorerExtensions_
lea ecx, [ebp - 0x10a4]
call fcn.100057d0
mov dword [ebp - 0x1194], eax
mov edx, dword [ebp - 0x1194]
mov dword [ebp - 0x1198], edx
mov byte [ebp - 4], 0x37
mov eax, dword [ebp - 0x1198]
push eax
lea ecx, [ebp - 0x10a8]
push ecx
call fcn.10019630
mov dword [ebp - 0x119c], eax
mov edx, dword [ebp - 0x119c]
mov dword [ebp - 0x11a0], edx
mov byte [ebp - 4], 0x38
mov ecx, dword [ebp - 0x11a0]
call fcn.10005a00
push eax
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x10]
call fcn.10014140
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x10a8]
call fcn.10006030
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x10a4]
call fcn.10006030
push 0xffffffffffffffff
push 0
push str.ButtonText
push 0
lea ecx, [ebp + 0xc]
call fcn.10005f10
push eax
lea ecx, [ebp - 0x10]
call fcn.10014540
push 0xffffffffffffffff
push 0
push 0x10197074
push str.1FBA04EE_3024_11d2_8F1F_0000F87ABD16
lea ecx, [ebp - 0x10]
call fcn.10014540
push 0xffffffffffffffff
push 0
push str.Default_Visible
push 0x101970f0
lea ecx, [ebp - 0x10]
call fcn.10014540
push 0xffffffffffffffff
push 0
push str.HotIcon
lea ecx, [ebp - 0x101c]
call fcn.10016300
push eax
lea ecx, [ebp - 0x10]
call fcn.10014540
push 0xffffffffffffffff
push 0
push str.Icon
lea ecx, [ebp - 0x101c]
call fcn.10016300
push eax
lea ecx, [ebp - 0x10]
call fcn.10014540
push 0xffffffffffffffff
push 0
push str.MenuStatusBar
push 0
lea ecx, [ebp + 0xc]
call fcn.10005f10
push eax
lea ecx, [ebp - 0x10]
call fcn.10014540
push 0xffffffffffffffff
push 0
push str.MenuText
push 0
lea ecx, [ebp + 0xc]
call fcn.10005f10
push eax
lea ecx, [ebp - 0x10]
call fcn.10014540
push 0xffffffffffffffff
push 0
push str.ClsidExtension
push 0
mov ecx, 0x101ea5f0
call fcn.10005f10
push eax
lea ecx, [ebp - 0x10]
call fcn.10014540
lea ecx, [ebp - 0x10]
call fcn.10013d10
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x101c]
call fcn.10004820
jmp 0x100b020a
push 0
push 0
push 0x2001f
push 0
push 0
push str.SOFTWAREMicrosoftInternet_ExplorerExtensions
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x10]
call fcn.10014140
push 0
mov ecx, 0x101ea5f0
call fcn.10005f10
push eax
lea ecx, [ebp - 0x10]
call fcn.100140c0
lea ecx, [ebp - 0x10]
call fcn.10013d10
push 0
push 0
push 0x2001f
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionInternet_SettingsUser_AgentPost_Platform
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x10]
call fcn.10014140
push 0x10197274
lea ecx, [ebp - 0x1020]
call fcn.100057d0
mov byte [ebp - 4], 0x39
push ecx
mov ecx, esp
mov dword [ebp - 0x10ac], esp
push 0x10197278
call fcn.100057d0
mov dword [ebp - 0x11a4], eax
mov eax, dword [ebp - 0x11a4]
mov dword [ebp - 0x11a8], eax
mov byte [ebp - 4], 0x3a
push ecx
mov ecx, esp
mov dword [ebp - 0x10b0], esp
lea edx, [ebp - 0x1020]
push edx
call fcn.10005780
mov dword [ebp - 0x11ac], eax
mov eax, dword [ebp - 0x11ac]
mov dword [ebp - 0x11b0], eax
mov byte [ebp - 4], 0x3b
push ecx
mov ecx, esp
mov dword [ebp - 0x10b4], esp
push str.UserAgent
call fcn.100057d0
mov dword [ebp - 0x11b4], eax
mov ecx, dword [ebp - 0x11b4]
mov dword [ebp - 0x11b8], ecx
mov byte [ebp - 4], 0x3c
lea edx, [ebp - 0x10b8]
push edx
mov byte [ebp - 4], 0x39
call fcn.100ad100
add esp, 0x10
mov dword [ebp - 0x11bc], eax
mov eax, dword [ebp - 0x11bc]
mov dword [ebp - 0x11c0], eax
mov byte [ebp - 4], 0x3d
mov ecx, dword [ebp - 0x11c0]
push ecx
lea ecx, [ebp - 0x1020]
call fcn.10005a10
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x10b8]
call fcn.10006030
lea ecx, [ebp - 0x1020]
call fcn.100059e0
test eax, eax
jne 0x100b01f3
push 0
lea ecx, [ebp - 0x1020]
call fcn.10005f10
push eax
lea ecx, [ebp - 0x10]
call fcn.100b0dc0
lea ecx, [ebp - 0x10]
call fcn.10013d10
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x1020]
call fcn.10006030
movzx edx, byte [ebp + 8]
test edx, edx
jne 0x100b0217
call fcn.100b0270
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x10]
call fcn.10013ce0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x40]
call fcn.10004820
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.10004820
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3c]
call fcn.1000ad40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.10006030
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.1013a297
mov esp, ebp
pop ebp
ret