Function at 0x40eaa4
Capabilities:
Delete registry value
Enumerate process modules

Disassembly:
mov eax, 0x420631
call fcn.0041fac0
mov eax, 0x188c
call fcn.0041fa70
push ebx
push esi
mov ebx, ecx
xor esi, esi
mov dword [ebp - 0x24], ebx
cmp dword [ebx + 4], esi
je 0x40efdb
cmp dword [ebx + 8], esi
je 0x40efdb
push edi
call fcn.0040cf1f
mov eax, dword [eax + 8]
xor ecx, ecx
cmp eax, 1
sete cl
mov dword [ebp - 0x10], ecx
call fcn.0040cf1f
mov eax, dword [eax + 8]
xor ecx, ecx
cmp eax, 3
sete cl
mov dword [ebp - 0x20], ecx
call fcn.0040cf1f
mov eax, dword [eax + 8]
xor ecx, ecx
cmp eax, 2
push 0x1f
sete cl
mov dword [ebp - 0x14], ecx
pop ecx
xor eax, eax
lea edi, [ebp - 0xb2]
mov word [ebp - 0xb4], si
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov al, byte [ebp - 0x15]
lea ecx, [ebp - 0x34]
mov byte [ebp - 0x34], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Tidy_bool_]
cmp dword [ebp - 0x14], esi
mov dword [ebp - 4], esi
je 0x40ebd0
lea eax, [ebx + 0x10]
push eax
push 0x4260b8
lea eax, [ebp - 0xb4]
push 0x3f
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
lea eax, [ebx + 0x190]
add esp, 0x10
cmp word [eax], si
je 0x40eb6f
lea ecx, [ebp - 0x34]
push ecx
push esi
jmp 0x40ec4a
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x43a]
mov word [ebp - 0x43c], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x43c]
push 0x103
push eax
call fcn.004062cd
pop ecx
test eax, eax
pop ecx
je 0x40ec53
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x43c]
push esi
push eax
call fcn.00403642
add esp, 0xc
push str.biduid
push str.Softwarehao123JuziBrowser
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
jmp 0x40ec53
lea eax, [ebp - 0xb4]
push 0x3f
push eax
mov ecx, ebx
call fcn.004102a4
test eax, eax
jne 0x40ec10
call fcn.00410c4e
add eax, 0x38
mov eax, dword [eax + 4]
cmp eax, esi
jne 0x40ebf8
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
push eax
push 0x4260b8
lea eax, [ebp - 0xb4]
push 0x3f
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x43a]
mov word [ebp - 0x43c], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x43c]
push 0x103
push eax
call fcn.004062cd
pop ecx
test eax, eax
pop ecx
je 0x40ec53
lea eax, [ebp - 0x34]
push eax
push esi
lea eax, [ebp - 0x43c]
push eax
call fcn.00403642
add esp, 0xc
push 0x1f
xor eax, eax
pop ecx
lea edi, [ebp - 0x232]
mov word [ebp - 0x234], si
push 0x3f
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0xb4]
push eax
call fcn.00404974
push 0x1f
xor eax, eax
pop ecx
lea edi, [ebp - 0x132]
mov word [ebp - 0x134], si
push 0x3f
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.00404a28
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x84e]
mov word [ebp - 0x850], si
rep stosd dword es:[edi], eax
add esp, 0x18
mov ebx, 0x104
stosw word es:[edi], ax
lea eax, [ebp - 0x850]
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x1f
xor eax, eax
pop ecx
lea edi, [ebp - 0x1b2]
mov word [ebp - 0x1b4], si
push 0x3f
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x1b4]
push eax
lea eax, [ebp - 0x850]
push eax
call fcn.00401120
add esp, 0xc
cmp dword [ebp - 0x10], esi
jne 0x40ede2
cmp dword [ebp - 0x20], esi
jne 0x40ede2
cmp dword [ebp - 0x14], esi
je 0x40efcb
mov ecx, 0x411
xor eax, eax
lea edi, [ebp - 0x1896]
mov word [ebp - 0x1898], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [ebp - 0x30]
cmp edi, esi
jne 0x40ed46
mov edi, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
call fcn.00404c59
mov ecx, dword [ebp - 0x24]
push eax
lea eax, [ebp - 0x1b4]
push eax
push edi
call fcn.004105b8
movzx eax, al
push eax
lea eax, [ebp - 0x134]
push eax
push str.http:__tongji.juzi1234567.com_images_track.gif_pnjztn_sos_duuid_sversion_squeryunstallinterbar_dtypeclient
lea eax, [ebp - 0x1898]
push 0x823
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
push esi
mov edi, 0x1388
push esi
lea eax, [ebp - 0x1898]
push edi
push eax
call fcn.00401e78
add esp, 0x30
test eax, eax
jne 0x40efcb
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xbb8
call ebx
push esi
push esi
lea eax, [ebp - 0x1898]
push edi
push eax
call fcn.00401e78
add esp, 0x10
test eax, eax
jne 0x40efcb
push 0xbb8
call ebx
push esi
push esi
lea eax, [ebp - 0x1898]
push edi
push eax
call fcn.00401e78
add esp, 0x10
jmp 0x40efcb
call fcn.00410c4e
mov eax, dword [eax + 0x10]
cmp eax, esi
je 0x40ee7c
push eax
push esi
push 0x100410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, esi
mov dword [ebp - 0x14], eax
je 0x40ee7c
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], esi
push ecx
lea ecx, [ebp - 0x10]
push 4
push ecx
push eax
mov dword [ebp - 0x1c], esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x40ee73
mov ecx, 0x82
xor eax, eax
lea edi, [ebp - 0x646]
mov word [ebp - 0x648], si
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x648]
push ebx
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call sub.PSAPI.DLL_GetModuleFileNameExW
lea eax, [ebp - 0x648]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push str.hao123Juzi.exe
push eax
call dword [sym.imp.MSVCRT.dll__wcsicmp]
pop ecx
test eax, eax
pop ecx
jne 0x40ee73
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x20], esi
je 0x40ee8a
mov dword [ebp - 0x10], 1
jmp 0x40ee9d
call fcn.0040cf1f
mov eax, dword [eax + 0x10]
neg eax
sbb eax, eax
and al, 0xfe
inc eax
inc eax
mov dword [ebp - 0x10], eax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x43a]
mov word [ebp - 0x43c], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x43c]
push 0x103
push eax
xor ebx, ebx
call fcn.0040383d
pop ecx
test eax, eax
pop ecx
je 0x40eef0
lea eax, [ebp - 0x43c]
push str.hao123Juzi.exe
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
call dword [sym.imp.MSVCRT.dll__wcsicmp]
mov ebx, eax
pop ecx
neg ebx
sbb ebx, ebx
pop ecx
inc ebx
mov ecx, 0x411
xor eax, eax
lea edi, [ebp - 0x1896]
mov word [ebp - 0x1898], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [ebp - 0x30]
cmp edi, esi
jne 0x40ef15
mov edi, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
call fcn.00404c59
mov ecx, dword [ebp - 0x24]
push eax
push ebx
lea eax, [ebp - 0x1b4]
push dword [ebp - 0x10]
push eax
push edi
call fcn.004105b8
movzx eax, al
push eax
lea eax, [ebp - 0x134]
push eax
push str.http:__tongji.juzi1234567.com_images_track.gif_pnjztn_sos_duuid_sversion_squeryinstallinstall_dset_default_dinterbar_dtypeclient
lea eax, [ebp - 0x1898]
push 0x823
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
push esi
mov edi, 0x1388
push esi
lea eax, [ebp - 0x1898]
push edi
push eax
call fcn.00401e78
add esp, 0x38
test eax, eax
jne 0x40efcb
mov eax, dword [ebp - 0x20]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
neg eax
sbb eax, eax
and ax, 0xf830
add eax, 0xbb8
push eax
mov dword [ebp - 0x1c], eax
call ebx
push esi
push esi
lea eax, [ebp - 0x1898]
push edi
push eax
call fcn.00401e78
add esp, 0x10
test eax, eax
jne 0x40efcb
push dword [ebp - 0x1c]
call ebx
push esi
push esi
lea eax, [ebp - 0x1898]
push edi
push eax
call fcn.00401e78
add esp, 0x10
test eax, eax
jne 0x40efcb
push esi
lea eax, [ebp - 0x1898]
push 0x14
push eax
call fcn.00413cd0
add esp, 0xc
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x34]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Tidy_bool_]
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret