Function at 0x411334
Capabilities:
Delete file
Move file
Persist via run registry key
Query environment variable

Disassembly:
push 0x254
mov eax, 0x448d4f
call fcn.00432a39
mov eax, dword [ebp + 0xc]
push 0
mov ebx, ecx
mov edi, 0xbbb
push edi
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x248], eax
call fcn.0041242e
mov eax, dword [ebp + 8]
push 0x2e
mov ecx, ebx
call fcn.00404d0f
mov esi, eax
call fcn.00403eef
mov esi, dword [ebp + 8]
push eax
lea eax, [ebp - 0x258]
push eax
mov eax, esi
mov ecx, ebx
call fcn.00404d0f
mov ecx, eax
call fcn.0041259a
and dword [ebp - 4], 0
push dword [ebp - 0x248]
lea ecx, [ebp - 0x25c]
call fcn.0040153f
mov byte [ebp - 4], 1
push str..msi
lea ecx, [ebp - 0x258]
call fcn.00402497
test eax, eax
jne 0x4113e9
mov eax, esi
mov ecx, ebx
call fcn.00404d0f
push dword [eax]
push dword [ebx + 0x1c]
call fcn.00412f19
test eax, eax
jne 0x411b4b
mov eax, dword [ebx + 0x1c]
mov dword [eax + 0x108], 1
jmp 0x411b4b
push 0x453344
lea ecx, [ebp - 0x25c]
call fcn.00402497
test eax, eax
jne 0x411483
push 0x19
push edi
mov ecx, ebx
call fcn.0041242e
mov eax, dword [0x464630]
push 0
push str.BackupInstalled
call fcn.00408871
pop ecx
pop ecx
lea ecx, [ebp - 0x238]
call fcn.00401b04
mov byte [ebp - 4], 2
mov eax, esi
mov ecx, ebx
call fcn.00404d0f
push dword [eax]
lea eax, [ebp - 0x238]
push str.__1___S__productmypcbackup__hash92e094e6__tidmpbcpl__popup_delay1200000
push eax
call fcn.00405df6
lea eax, [ebp - 0x238]
add esp, 0xc
push eax
call fcn.00409cca
pop ecx
mov dword [ebp - 0x248], eax
mov byte [ebp - 4], 3
test eax, eax
jne 0x41146c
call fcn.0040b229
mov byte [ebp - 4], 2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x248], 0
jmp 0x411b3c
push str..exe
lea ecx, [ebp - 0x258]
call fcn.00402497
test eax, eax
jne 0x411b85
push 0x19
push edi
mov ecx, ebx
call fcn.0041242e
lea ecx, [ebp - 0x238]
call fcn.00401b04
mov byte [ebp - 4], 4
lea eax, [ebp - 0x238]
push eax
mov edi, 0x4645f8
push 0x4533f4
mov ecx, edi
call fcn.00422487
test eax, eax
jne 0x4114d5
call fcn.00422999
lea ecx, [ebp - 0x250]
call fcn.00401b04
mov byte [ebp - 4], 5
and dword [ebp - 0x220], 0
lea eax, [ebp - 0x220]
push eax
push 0x44fb18
push 0x4645dc
call fcn.00403f27
test byte [ebp - 0x220], 1
je 0x41151a
push str.__INSTALL
lea ecx, [ebp - 0x250]
call fcn.0040b1b3
test byte [ebp - 0x220], 2
je 0x411533
push str.__ENABLEDSP
lea ecx, [ebp - 0x250]
call fcn.0040b1b3
test byte [ebp - 0x220], 4
je 0x41154c
push str.__ENABLEHOMEPAGE
lea ecx, [ebp - 0x250]
call fcn.0040b1b3
lea ecx, [ebp - 0x248]
call fcn.00401b04
mov byte [ebp - 4], 6
lea eax, [ebp - 0x248]
push eax
push 0x45345c
mov ecx, edi
call fcn.00422487
test eax, eax
lea ecx, [ebp - 0x240]
je 0x411887
call fcn.00401b04
mov byte [ebp - 4], 7
lea eax, [ebp - 0x240]
push eax
push 0x4505a8
mov ecx, edi
call fcn.00422487
test eax, eax
je 0x411873
lea ecx, [ebp - 0x220]
call fcn.00401b04
mov byte [ebp - 4], 8
mov edi, dword [ebp - 0x240]
mov eax, 0x3fff
push eax
push eax
lea ecx, [ebp - 0x220]
call fcn.004040e3
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0x5c
push dword [ebp - 0x220]
call fcn.0042e68c
test eax, eax
pop ecx
pop ecx
jne 0x4115e7
or eax, 0xffffffff
jmp 0x4115ef
sub eax, dword [ebp - 0x220]
sar eax, 1
push eax
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x220]
call fcn.00403fde
mov byte [ebp - 4], 9
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x224]
call fcn.00403f51
mov byte [ebp - 4], 0xa
push str._tbmon.exe
lea ecx, [ebp - 0x224]
call fcn.0040b1b3
mov eax, dword [ebx + 8]
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [esi + 1]
cmp eax, ecx
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 0x22d], 0
jle 0x41167e
push dword [ebp - 0x224]
call esi
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp + 8]
inc eax
mov ecx, ebx
call fcn.00404d0f
push dword [ebp - 0x23c]
mov eax, dword [eax]
push eax
call edi
test eax, eax
je 0x41167e
mov byte [ebp - 0x22d], 1
push str._avgtoolbar.exe
lea ecx, [ebp - 0x22c]
call fcn.0040b1b3
push dword [ebp - 0x22c]
call esi
mov eax, dword [ebp + 8]
mov esi, dword [ebp - 0x22c]
mov ecx, ebx
call fcn.00404d0f
mov eax, dword [eax]
push esi
push eax
call edi
test eax, eax
je 0x411846
lea ecx, [ebp - 0x24c]
call fcn.00401b04
mov byte [ebp - 4], 0xb
push 0x4644a0
call fcn.00405084
test eax, eax
mov esi, 0x4534bc
jne 0x4116db
mov esi, str.DEFAULT
lea eax, [ebp - 0x23c]
push eax
call fcn.00409d41
pop ecx
mov byte [ebp - 4], 0xc
mov eax, dword [eax]
push esi
push eax
push dword [ebp - 0x238]
lea eax, [ebp - 0x24c]
push str.TB38GF9P66
push dword [ebp - 0x250]
push str._1__PASSWORD_2__SILENT__DISTRIBUTIONSOURCE_3__LOCAL_4__PROFILESATB__BROWSER_5
push eax
call fcn.00405df6
add esp, 0x1c
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x23c]
call fcn.004088d8
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
lea ecx, [ebp - 0x228]
call fcn.0040153f
mov byte [ebp - 4], 0xd
and dword [ebp - 0x234], 0
mov byte [ebp - 4], 0xe
call fcn.0040a39e
neg al
lea edi, [ebp - 0x234]
sbb eax, eax
and eax, 0x100
add eax, 0x20006
push eax
push dword [ebp - 0x228]
push Ordinal_4
call fcn.004041a5
test eax, eax
jne 0x411819
lea eax, [ebp - 0x244]
push eax
lea ecx, [ebp - 0x22c]
call fcn.00412522
mov byte [ebp - 4], 0xf
mov dword [esp], 0x4535fc
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.00407cbc
add esp, 0xc
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x24c]
push ecx
push eax
lea eax, [ebp - 0x23c]
push eax
call fcn.004124cb
add esp, 0xc
mov byte [ebp - 4], 0x11
push dword [eax]
mov eax, edi
push 0x453608
push eax
call fcn.0040416b
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x23c]
call fcn.004088d8
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x254]
call fcn.004088d8
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x244]
call fcn.004088d8
cmp byte [ebp - 0x22d], 0
je 0x411819
push dword [ebp - 0x224]
mov eax, edi
push str.TBMon
push eax
call fcn.0040416b
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x234]
call fcn.0040329b
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x228]
call fcn.004088d8
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x24c]
call fcn.004088d8
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x224]
call fcn.004088d8
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x22c]
call fcn.004088d8
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x220]
call fcn.004088d8
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x240]
call fcn.004088d8
jmp 0x411b1e
call fcn.00401b04
mov byte [ebp - 4], 0x12
push 0x4644a0
call fcn.00405084
test eax, eax
mov dword [ebp - 0x228], 0x4534bc
jne 0x4118b2
mov dword [ebp - 0x228], str.DEFAULT
lea eax, [ebp - 0x244]
push eax
call fcn.00409d41
pop ecx
mov byte [ebp - 4], 0x13
mov esi, dword [eax]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x23c]
mov edi, dword [ebp - 0x238]
mov ebx, dword [ebp - 0x250]
call fcn.00404d0f
push dword [ebp - 0x228]
mov eax, dword [eax]
push esi
push edi
push str.TB38GF9P66
push ebx
push eax
lea eax, [ebp - 0x240]
push str.__1___2__PASSWORD_3__SILENT__DISTRIBUTIONSOURCE_4__LOCAL_5__PROFILESATB__BROWSER_6
push eax
call fcn.00405df6
add esp, 0x20
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x244]
call fcn.004088d8
lea eax, [ebp - 0x240]
push eax
call fcn.00409cca
pop ecx
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x260], eax
mov byte [ebp - 4], 0x14
xor esi, esi
cmp eax, esi
je 0x411467
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [0x464560], 1
mov dword [ebp - 0x224], 0x2710
lea ecx, [ebp - 0x220]
call fcn.00401b04
mov byte [ebp - 4], 0x15
push str.AVG_Secure_Search
lea eax, [ebp - 0x220]
push str.SOFTWARE_s
push eax
call fcn.004026de
add esp, 0xc
call fcn.0040a39e
neg al
mov dword [ebp - 0x22c], esi
sbb eax, eax
and eax, 0x200
add eax, 0x20019
mov dword [ebp - 0x24c], eax
mov byte [ebp - 4], 0x16
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x24c]
mov dword [ebp - 0x228], esi
push esi
push dword [ebp - 0x220]
push Ordinal_4
call ebx
cmp eax, esi
jne 0x411a10
lea ecx, [ebp - 0x22c]
call fcn.0040329b
cmp eax, esi
mov ecx, dword [ebp - 0x228]
mov dword [ebp - 0x22c], ecx
jne 0x411a10
push str._machine_id
lea eax, [ebp - 0x22c]
push eax
lea esi, [ebp - 0x244]
lea edi, [ebp - 0x21c]
mov dword [ebp - 0x244], 0x104
call fcn.00404104
test eax, eax
jne 0x411a10
and dword [ebp - 0x224], eax
push str.AVG_SafeGuard_toolbar
lea eax, [ebp - 0x220]
push str.SOFTWARE_s
push eax
call fcn.004026de
xor esi, esi
add esp, 0xc
mov dword [ebp - 0x234], esi
mov byte [ebp - 4], 0x17
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x24c]
mov dword [ebp - 0x228], esi
push esi
push dword [ebp - 0x220]
push Ordinal_4
call ebx
cmp eax, esi
jne 0x411aa6
lea ecx, [ebp - 0x234]
call fcn.0040329b
cmp eax, esi
mov ecx, dword [ebp - 0x228]
mov dword [ebp - 0x234], ecx
jne 0x411aa6
push str._machine_id
lea eax, [ebp - 0x234]
push eax
lea esi, [ebp - 0x244]
lea edi, [ebp - 0x21c]
mov dword [ebp - 0x244], 0x104
call fcn.00404104
test eax, eax
jne 0x411aa6
and dword [ebp - 0x224], eax
mov eax, 0x1f4
sub dword [ebp - 0x224], eax
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x234]
call fcn.0040329b
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x22c]
call fcn.0040329b
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x220]
call fcn.004088d8
xor esi, esi
cmp dword [ebp - 0x224], esi
jg 0x411954
mov byte [ebp - 4], 0x12
push dword [ebp - 0x254]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x260], esi
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x240]
call fcn.004088d8
mov ebx, dword [ebp - 0x23c]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x248]
call fcn.004088d8
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x250]
call fcn.004088d8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x238]
call fcn.004088d8
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x108]
xor ecx, ecx
test eax, eax
sete cl
mov esi, ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x25c]
call fcn.004088d8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x258]
call fcn.004088d8
mov eax, esi
call fcn.00432abc
ret 8
call fcn.0041b965
int3