Function at 0x10094386
Capabilities:
Delete file

Disassembly:
push 0x1c
mov eax, 0x101875b0
call fcn.10145d80
call fcn.1011ae31
call fcn.10093661
lea eax, [ebp - 0x1c]
mov ebx, 0x101f84e8
push eax
mov ecx, ebx
call fcn.1005158c
lea ecx, [ebp - 0x1c]
call fcn.10003b75
mov eax, dword [0x101f3028]
mov dword [ebp - 0x14], eax
and dword [ebp - 4], 0
push 0x6b
lea ecx, [ebp - 0x14]
call fcn.100045b9
test eax, eax
jne 0x100943db
push 0x101ac058
lea ecx, [ebp - 0x14]
call fcn.1000425b
push dword [ebp - 0x14]
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallBaiduBarX
push str.DisplayName
push edi
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call fcn.1011f852
mov eax, dword [0x101f3028]
add esp, 0x10
mov dword [ebp - 0x10], eax
mov eax, 0x80
push eax
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.1000401e
push eax
push 0x1000
push dword [0x101f9aa8]
call dword [sym.imp.USER32.dll_LoadStringW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.100041f7
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], 0
jne 0x10094444
push 0x101ac038
lea ecx, [ebp - 0x10]
call fcn.1000425b
push dword [ebp - 0x10]
push str.DisplayVersion
push edi
push esi
call fcn.1011f852
push 0x101ac00c
push str.Publisher
push edi
push esi
call fcn.1011f852
push str.http:__www.baidu.com_search_sobar.html
push str.HelpLink
push edi
push esi
call fcn.1011f852
push str.http:__toolbar.baidu.com_
push str.URLUpdateInfo
push edi
push esi
call fcn.1011f852
add esp, 0x40
push 0x101abf38
push str.Enable_Browser_Extensions
push str.SoftwareMicrosoftInternet_ExplorerMain
push SysReAllocString
call fcn.1011f852
lea eax, [ebp - 0x20]
push eax
call fcn.1011e282
add esp, 0x14
push 0x5c
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call fcn.10024557
push dword [ebp - 0x20]
push str.InstallLocation
push edi
push esi
call fcn.1011f852
lea eax, [ebp - 0x1c]
push eax
call fcn.1011e282
push dword [eax]
mov byte [ebp - 4], 3
call fcn.1011e738
shr eax, 0xa
add esp, 0x18
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 2
call fcn.10003b75
cmp dword [ebp - 0x18], 0
jne 0x10094501
mov dword [ebp - 0x18], 0x800
push dword [ebp - 0x18]
push str.EstimatedSize
push edi
push esi
call fcn.1011f80c
mov eax, dword [0x101f3028]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 4], 4
call fcn.1011e282
add esp, 0x14
push str.rc.dll
push eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 5
call fcn.10007b6e
push 0
push dword [eax]
lea eax, [ebp - 0x1c]
push str.__s___d
push eax
mov byte [ebp - 4], 6
call fcn.10004662
add esp, 0x10
lea ecx, [ebp - 0x18]
call fcn.10003b75
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 4
call fcn.10003b75
push dword [ebp - 0x1c]
push str.DisplayIcon
push edi
push esi
call fcn.1011f852
mov eax, dword [0x101f3028]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 7
call fcn.1011e282
add esp, 0x14
push str.BarBroker.exe
push eax
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 4], 8
call fcn.10007b6e
push 0x101aae08
push str.runasAdmin
push dword [eax]
lea eax, [ebp - 0x18]
push str.__s____s___s
push eax
mov byte [ebp - 4], 9
call fcn.10004662
add esp, 0x14
lea ecx, [ebp - 0x24]
call fcn.10003b75
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 7
call fcn.10003b75
push dword [ebp - 0x18]
push str.UninstallString
push edi
push esi
call fcn.1011f852
add esp, 0x10
push 0
push str.AllVoice_State
mov edi, str.software_baiduBaiduToolbarNoAD
mov esi, 0x101f8c08
push edi
mov ecx, esi
call fcn.10016a41
push eax
call fcn.1011f80c
add esp, 0x10
push 0
push str.AllFlash_State
push edi
mov ecx, esi
call fcn.10016a41
push eax
call fcn.1011f80c
add esp, 0x10
push 0
push str.AllPic_State
push edi
mov ecx, esi
call fcn.10016a41
push eax
call fcn.1011f80c
add esp, 0x10
push str..hao123.com
push 0x101abd2c
mov edi, str.software_baiduBaiduToolbarNoADPage_Allow
push edi
mov ecx, esi
call fcn.10016a41
push eax
call fcn.1011f852
add esp, 0x10
push str..baidu.com
push 0x101abd08
push edi
mov ecx, esi
call fcn.10016a41
push eax
call fcn.1011f852
add esp, 0x10
push str..youa.com
push 0x101abce8
push edi
mov ecx, esi
call fcn.10016a41
push eax
call fcn.1011f852
add esp, 0x10
push str..skycn.com
push 0x101abcc4
push edi
mov ecx, esi
call fcn.10016a41
push eax
call fcn.1011f852
add esp, 0x10
push str..skycn.net
push 0x101a33d0
push edi
mov ecx, esi
call fcn.10016a41
push eax
call fcn.1011f852
add esp, 0x10
push str..baifubao.com
push 0x101abc80
push edi
mov ecx, esi
call fcn.10016a41
push eax
call fcn.1011f852
add esp, 0x10
push str._ad.
push 0x101a2f08
mov edi, str.software_baiduBaiduToolbarNoADPage_Block
push edi
mov ecx, esi
call fcn.10016a41
push eax
call fcn.1011f852
add esp, 0x10
push str.http:__ad_0_9_.
push 0x101a2f0c
push edi
mov ecx, esi
call fcn.10016a41
push eax
call fcn.1011f852
add esp, 0x10
push str.http:__ads.
push 0x101a6f48
push edi
mov ecx, esi
call fcn.10016a41
push eax
call fcn.1011f852
add esp, 0x10
push str.banner.
push 0x101a71ec
push edi
mov ecx, esi
call fcn.10016a41
push eax
call fcn.1011f852
add esp, 0x10
push str._advpic
push 0x101a8074
push edi
mov ecx, esi
call fcn.10016a41
push eax
call fcn.1011f852
add esp, 0x10
push 0x101abb90
push 0x101abb8c
push edi
mov ecx, esi
call fcn.10016a41
push eax
call fcn.1011f852
add esp, 0x10
push 0x101abb7c
push 0x101abb78
push edi
mov ecx, esi
call fcn.10016a41
push eax
call fcn.1011f852
add esp, 0x10
push str._banner_img_
push 0x101a927c
push edi
mov ecx, esi
call fcn.10016a41
push eax
call fcn.1011f852
add esp, 0x10
push 0x101abb3c
push 0x101abb38
push edi
mov ecx, esi
call fcn.10016a41
push eax
call fcn.1011f852
add esp, 0x10
push 0x101abb10
push 0x101abb0c
push edi
mov ecx, esi
call fcn.10016a41
push eax
call fcn.1011f852
add esp, 0x10
push str._adv_
push 0x101abaf4
push edi
mov ecx, esi
call fcn.10016a41
push eax
call fcn.1011f852
add esp, 0x10
push str._images_ad_
push 0x101abad0
push edi
mov ecx, esi
call fcn.10016a41
push eax
call fcn.1011f852
add esp, 0x10
push str._ads_
push 0x101a1e38
push edi
mov ecx, esi
call fcn.10016a41
push eax
call fcn.1011f852
add esp, 0x10
push str._advlink_
push 0x101abaa0
push edi
mov ecx, esi
call fcn.10016a41
push eax
call fcn.1011f852
add esp, 0x10
push str._banner
push 0x101aba84
push edi
mov ecx, esi
call fcn.10016a41
push eax
call fcn.1011f852
add esp, 0x10
push str.http:__ad.
push 0x101aba64
push edi
mov ecx, esi
call fcn.10016a41
push eax
call fcn.1011f852
add esp, 0x10
push str._adImages_
push 0x101aba40
push edi
mov ecx, esi
call fcn.10016a41
push eax
call fcn.1011f852
add esp, 0x10
push str..swf_a_z_
push 0x101aba20
push edi
mov ecx, esi
call fcn.10016a41
push eax
call fcn.1011f852
add esp, 0x10
push str.images.sohu.com_cs_button_
push 0x101ab9dc
push edi
mov ecx, esi
call fcn.10016a41
push eax
call fcn.1011f852
add esp, 0x10
mov ecx, ebx
call fcn.10051340
test eax, eax
je 0x100948f8
call sym.BaiduBarX.DLL_SetDefSearch
mov ecx, ebx
call fcn.100513a1
test eax, eax
je 0x10094908
call sym.BaiduBarX.DLL_SetHomePageToBaidu
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.B580CF65_E151_49C3_B73F_70B13FCA8E86
call fcn.10007b11
call fcn.101248a4
mov ecx, esp
mov dword [ebp - 0x28], esp
mov edi, str.77FEF28E_EB96_44FF_B511_3185DEA48697
push edi
call fcn.10007b11
call fcn.101248a4
pop ecx
push 1
mov ecx, ebx
call fcn.100519ef
lea eax, [ebp - 0x24]
push eax
call fcn.1011de11
mov dword [esp], str.iexp_log.txt
push eax
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 0xa
call fcn.10007b6e
push dword [eax]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
call esi
lea ecx, [ebp - 0x28]
call fcn.10003b75
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 7
call fcn.10003b75
lea eax, [ebp - 0x24]
push eax
call fcn.1011de11
mov dword [esp], str.medialog.dat
push eax
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 0xb
call fcn.10007b6e
push dword [eax]
call esi
lea ecx, [ebp - 0x28]
call fcn.10003b75
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 7
call fcn.10003b75
push str.RegServer
call fcn.10095dea
pop ecx
call fcn.10093b4d
call fcn.10093cc6
mov ecx, ebx
call fcn.1004e1c6
test eax, eax
jne 0x100949dd
push eax
call fcn.10146fd5
pop ecx
push eax
mov ecx, ebx
call fcn.1004e261
push 1
mov ecx, ebx
call fcn.10053328
call fcn.1011c4cf
fcomp qword [0x1019fcf0]
fnstsw ax
test ah, 1
jne 0x10094a23
mov esi, 0x101a2f0c
push esi
push str.B580CF65_E151_49C3_B73F_70B13FCA8E86
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExtCLSID
mov ebx, SysReAllocString
push ebx
call fcn.1011f852
push esi
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExtCLSID
push ebx
call fcn.1011f852
add esp, 0x20
lea ecx, [ebp - 0x18]
call fcn.10003b75
lea ecx, [ebp - 0x1c]
call fcn.10003b75
lea ecx, [ebp - 0x20]
call fcn.10003b75
lea ecx, [ebp - 0x10]
call fcn.10003b75
lea ecx, [ebp - 0x14]
call fcn.10003b75
xor eax, eax
inc eax
call fcn.10145e58
ret