Function at 0x404b80
Capabilities:
Create process on windows
Create process suspended
Create thread
Delete file
Delete registry value
Get common file path
Get geographical location
Get startup folder
Persist via run registry key
Query environment variable
Set registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x41a031
push eax
mov dword fs:[0], esp
sub esp, 0xb88
xor eax, eax
push ebx
push ebp
push esi
mov ebp, ecx
push edi
mov ecx, 0x80
lea edi, [esp + 0x598]
push 4
rep stosd dword es:[edi], eax
lea eax, [esp + 0x24]
push eax
push str.Debug
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov eax, dword [ebp + 0x304]
mov ebx, dword [sym.imp.USER32.dll_MessageBoxA]
mov edi, dword [eax]
cmp edi, eax
je 0x404d55
mov esi, dword [edi + 8]
lea ecx, [esp + 0x20]
push 0x421990
push ecx
call fcn.0040c0d6
add esp, 8
test eax, eax
jne 0x404c56
mov eax, dword [esi + 0x180]
lea edx, [esi + 0x284]
push edx
lea ecx, [esi + 0x140]
push eax
lea edx, [esi + 0x100]
push ecx
lea eax, [esi + 0xc0]
push edx
lea ecx, [esi + 0x80]
push eax
lea edx, [esi + 0x40]
push ecx
push edx
push esi
lea eax, [esp + 0x3b8]
push str.Partner:__s_nModel:__s_nChannel:__s_nCycle_Id:__s_nOfferlocale:__s_nTouchPoint:__s_nMemory:__u_nPromo:__s
push eax
call fcn.0040c6b2
lea ecx, [esp + 0x3c0]
push ecx
call fcn.0040cd82
add esp, 0x2c
lea edx, [esp + 0x398]
push 0
push str.CreditsDebug
push edx
push 0
call ebx
lea eax, [ebp + 0x224]
push esi
push eax
call fcn.0040c0d6
add esp, 8
test eax, eax
jne 0x404cfd
lea eax, [esi + 0x40]
lea ecx, [ebp + 0x288]
push eax
push ecx
call fcn.0040c0d6
add esp, 8
test eax, eax
jne 0x404cfd
lea edx, [esi + 0x80]
lea eax, [ebp + 0x2c8]
push edx
push eax
call fcn.0040c0d6
add esp, 8
test eax, eax
jne 0x404cfd
lea ecx, [esi + 0xc0]
lea edx, [ebp + 0x204]
push ecx
push edx
call fcn.0040c0d6
add esp, 8
test eax, eax
jne 0x404cfd
lea eax, [esi + 0x100]
lea ecx, [ebp + 0x264]
push eax
push ecx
call fcn.0040c0d6
add esp, 8
test eax, eax
jne 0x404cfd
lea edx, [esi + 0x140]
lea eax, [ebp + 0x244]
push edx
push eax
call fcn.0040c0d6
add esp, 8
test eax, eax
jne 0x404cfd
mov ecx, dword [ebp + 0x2e8]
mov eax, dword [esi + 0x180]
cmp ecx, eax
jae 0x404d0f
mov edi, dword [edi]
mov eax, dword [ebp + 0x304]
cmp edi, eax
jne 0x404bd9
jmp 0x404d55
lea edi, [esi + 0x184]
add esi, 0x284
push esi
push edi
lea edx, [esp + 0x5a0]
push str._s__s
push edx
call fcn.0040c6b2
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
lea edx, [ebp + 0x30c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x20]
push 0x421990
push ecx
call fcn.0040c0d6
add esp, 8
test eax, eax
jne 0x404dd8
mov edx, dword [ebp + 0x284]
mov eax, dword [ebp + 0x2e8]
push edx
lea ecx, [ebp + 0x244]
push eax
lea edx, [ebp + 0x264]
push ecx
lea eax, [ebp + 0x204]
push edx
lea ecx, [ebp + 0x2c8]
push eax
lea edx, [ebp + 0x288]
push ecx
lea eax, [ebp + 0x224]
push edx
push eax
lea ecx, [esp + 0x3b8]
push str.Partner:__s_nModel:__s_nChannel:__s_nCycle_Id:__s_nOfferlocale:__s_nTouchPoint:__s_nMemory:__u_nCountry_Id:__u
push ecx
call fcn.0040c6b2
lea edx, [esp + 0x3c0]
push edx
call fcn.0040cd82
add esp, 0x2c
lea eax, [esp + 0x398]
push 0
push str.Debug
push eax
push 0
call ebx
lea ecx, [ebp + 0x264]
push 0x424bf0
push ecx
call fcn.0040c0d6
add esp, 8
test eax, eax
je 0x405219
lea edi, [esp + 0x598]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x405167
xor edx, edx
mov ecx, 0x11
mov dword [esp + 0x28], edx
lea edi, [esp + 0x4c]
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], edx
rep stosd dword es:[edi], eax
mov dword [esp + 0x34], edx
mov dword [esp + 0x4c], 0x44
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
mov ecx, ebp
call fcn.00404670
push str.AOLDial.exe
call sub.faultrep.DLL_AddERExcludedApplicationA
lea edi, [esp + 0x598]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x194]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x198]
push ecx
call fcn.0040c26b
add esp, 8
mov byte [eax], 0
lea edx, [esp + 0x28]
lea eax, [esp + 0x4c]
push edx
lea ecx, [esp + 0x198]
push eax
xor esi, esi
push ecx
push esi
push esi
push esi
push esi
lea edx, [esp + 0x5b4]
push esi
push edx
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x405155
mov dword [esp + 0x18], esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x10]
push eax
push 0xf003f
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push SysStringLen
mov dword [esp + 0xbb4], esi
mov dword [esp + 0x24], esi
call ebx
test eax, eax
jne 0x404f5c
mov esi, dword [esp + 0x10]
mov ecx, 0x41
lea edi, [esp + 0x90]
lea edx, [ebp + 0x510]
rep stosd dword es:[edi], eax
lea ecx, [ebp + 0x30c]
lea eax, [esp + 0x90]
push ecx
push edx
push str.__s__Cleanup__s
push eax
mov dword [esp + 0x28], esi
call fcn.0040c6b2
add esp, 0x10
lea ecx, [esp + 0x90]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
lea edx, [esp + 0x90]
push eax
push edx
push 1
push 0
push str.InstallAol
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test esi, esi
je 0x404f5c
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x18], 0
xor edi, edi
push str.InstallAolDoneEvent
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push eax
mov dword [0x424bd8], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [esp + 0x48]
push eax
push edi
push edi
push 0x404720
push 0x100000
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov dword [ebp + 0x614], eax
call esi
mov edx, dword [esp + 0x28]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x28]
push eax
call esi
mov ecx, ebp
call fcn.00404790
mov ecx, dword [0x424bd8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, dword [0x421a04]
mov dword [esp + 0x14], edx
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push edi
lea eax, [esp + 0x99c]
push 0x19
push eax
push edi
call esi
push edi
lea ecx, [esp + 0x79c]
push edi
push ecx
push edi
call esi
push edi
push edi
push 0x421894
push str.c:Program_FilesAOL_Companioncompanion.exe
push edi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor esi, esi
mov dword [esp + 0x1c], esi
lea edx, [esp + 0x10]
mov byte [esp + 0xba0], 2
push edx
push 0xf003f
push edi
push str.SoftwareAmerica_OnlineAOL_Companion
push SysReAllocStringLen
mov dword [esp + 0x24], edi
call ebx
cmp eax, edi
jne 0x40506b
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x10]
push 4
push eax
push 4
push edi
push str.AutoStartup
push esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp esi, edi
je 0x40506b
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov dword [esp + 0x1c], esi
lea ecx, [esp + 0x298]
push ecx
push edi
push edi
push 0x18
push edi
mov edi, dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
call edi
lea edx, [esp + 0x298]
lea ecx, [esp + 0x14]
push edx
call fcn.004151e7
lea eax, [esp + 0x14]
push str.Aol_Companion.lnk
lea ecx, [esp + 0x14]
push eax
push ecx
call fcn.0041524c
mov eax, dword [eax]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push eax
call ebx
lea ecx, [esp + 0x10]
call fcn.00415190
lea edx, [esp + 0x298]
push edx
push 0
push 0
push 0x19
push 0
call edi
lea eax, [esp + 0x798]
lea ecx, [esp + 0x14]
push eax
call fcn.004151e7
lea ecx, [esp + 0x14]
push str.Spyware_Protection_from_AOL.lnk
lea edx, [esp + 0x14]
push ecx
push edx
call fcn.0041524c
mov eax, dword [eax]
push eax
call ebx
lea ecx, [esp + 0x10]
call fcn.00415190
push 0x4217f4
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx800
push SysStringLen
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
lea eax, [ebp + 0x30c]
mov ecx, ebp
push eax
call fcn.00404450
test esi, esi
je 0x40512c
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x14]
mov byte [esp + 0xba0], 0
call fcn.00415190
mov eax, dword [esp + 0x18]
test eax, eax
je 0x405229
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x405229
push 0x10
push 0x4217b8
push str.No_AOL_Installer_Download_from_AOL
push esi
jmp 0x405227
push 0x10
call dword [sym.imp.KERNEL32.dll_GetUserGeoID]
push 0
lea ecx, [esp + 0x3c]
push 0x400
push ecx
push 6
push eax
call dword [sym.imp.KERNEL32.dll_GetGeoInfoA]
lea edx, [esp + 0x38]
push 0x421790
push edx
mov byte [esp + 0x42], 0
call fcn.0040c0d6
add esp, 8
test eax, eax
jne 0x4051ad
push 0x30
push 0x4217b8
push str.No_AOL_Service_in_your_region
jmp 0x405225
lea eax, [esp + 0x38]
push 0x4212e0
push eax
call fcn.0040c0d6
add esp, 8
test eax, eax
jne 0x4051d1
push 0x30
push 0x4217b8
push str.El_servicio_de_AOL_no_esta_disponible_en_su_regi
jmp 0x405225
lea ecx, [esp + 0x38]
push 0x421344
push ecx
call fcn.0040c0d6
add esp, 8
test eax, eax
jne 0x4051f5
push 0x30
push 0x4217b8
push str.Le_service_AOL_nest_pas_disponible_dans_votre_r
jmp 0x405225
lea edx, [esp + 0x38]
push 0x421330
push edx
call fcn.0040c0d6
add esp, 8
test eax, eax
jne 0x405229
push 0x30
push 0x4217b8
push str.Keine_AOL_Dienste_in_Ihrem_Gebiet
jmp 0x405225
push 0
push 0x4217b8
push str.Thanks_for_your_interest_in_AOL
push 0
call ebx
mov ecx, dword [esp + 0xb98]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xb94
ret