Function at 0x48b450
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x493c73
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x4ae248]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], ecx
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsIEXPLORE.EXE
push 0x80000002
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push eax
mov ecx, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
call fcn.0048c400
mov dword [ebp - 4], 0
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
call fcn.0048a320
movzx ecx, al
test ecx, ecx
jne 0x48b4e7
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
call fcn.0041f110
push eax
call fcn.0048bb80
add esp, 4
test eax, eax
je 0x48b4e7
mov edx, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
mov eax, dword [edx + 4]
or eax, 0x80000000
mov ecx, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
mov dword [ecx + 4], eax
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360se.exe
push 0x80000002
lea edx, [ebp - 0x64]
push edx
mov ecx, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
call fcn.0048c400
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x64]
call fcn.0048a320
movzx eax, al
test eax, eax
jne 0x48b542
lea ecx, [ebp - 0x64]
call fcn.0041f110
push eax
call fcn.0048bb80
add esp, 4
test eax, eax
je 0x48b542
mov ecx, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
mov edx, dword [ecx + 4]
or edx, 0x40000000
mov eax, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
mov dword [eax + 4], edx
push 0x495d1c
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall360se6
push 0x80000002
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
call fcn.0048c400
mov byte [ebp - 4], 2
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360se6.exe
push 0x80000002
lea edx, [ebp - 0xd4]
push edx
mov ecx, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
call fcn.0048c400
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c]
call fcn.0048a320
movzx eax, al
test eax, eax
je 0x48b5bf
lea ecx, [ebp - 0xd4]
call fcn.0048a320
movzx ecx, al
test ecx, ecx
jne 0x48b5d6
lea ecx, [ebp - 0xd4]
call fcn.0041f110
push eax
call fcn.0048bb80
add esp, 4
test eax, eax
je 0x48b5d6
mov edx, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
mov eax, dword [edx + 4]
or eax, 0x20000000
mov ecx, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
mov dword [ecx + 4], eax
push 0x495ee0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall360Chrome
push 0x80000002
lea edx, reloc.NETAPI32.dll_NetApiBufferFree
push edx
mov ecx, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
call fcn.0048c400
mov byte [ebp - 4], 4
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360chrome.exe
push 0x80000002
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push eax
mov ecx, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
call fcn.0048c400
mov byte [ebp - 4], 5
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
call fcn.0048a320
movzx ecx, al
test ecx, ecx
je 0x48b659
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
call fcn.0048a320
movzx edx, al
test edx, edx
jne 0x48b671
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
call fcn.0041f110
push eax
call fcn.0048bb80
add esp, 4
test eax, eax
je 0x48b671
mov eax, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
mov ecx, dword [eax + 4]
or ecx, 0x10000000
mov edx, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
mov dword [edx + 4], ecx
push 0x496024
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallSogouExplorer
push 0x80000002
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push eax
mov ecx, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
call fcn.0048c400
mov byte [ebp - 4], 6
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsSogouExplorer.exe
push 0x80000002
lea ecx, [ebp - 0xb8]
push ecx
mov ecx, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
call fcn.0048c400
mov byte [ebp - 4], 7
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
call fcn.0048a320
movzx edx, al
test edx, edx
je 0x48b6f4
lea ecx, [ebp - 0xb8]
call fcn.0048a320
movzx eax, al
test eax, eax
jne 0x48b70c
lea ecx, [ebp - 0xb8]
call fcn.0041f110
push eax
call fcn.0048bb80
add esp, 4
test eax, eax
je 0x48b70c
mov ecx, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
mov edx, dword [ecx + 4]
or edx, 0x8000000
mov eax, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
mov dword [eax + 4], edx
push 0x496194
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallliebao
push 0x80000002
lea ecx, [ebp - 0x9c]
push ecx
mov ecx, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
call fcn.0048c400
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x9c]
call fcn.0048a320
movzx edx, al
test edx, edx
jne 0x48b75b
mov eax, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
mov ecx, dword [eax + 4]
or ecx, 0x4000000
mov edx, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
mov dword [edx + 4], ecx
push 0x496248
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallQQBrowser
push 0x80000002
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push eax
mov ecx, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
call fcn.0048c400
mov byte [ebp - 4], 9
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsQQBrowser.exe
push 0x80000002
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
push ecx
mov ecx, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
call fcn.0048c400
mov byte [ebp - 4], 0xa
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
call fcn.0048a320
movzx edx, al
test edx, edx
je 0x48b7de
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
call fcn.0048a320
movzx eax, al
test eax, eax
jne 0x48b7f6
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
call fcn.0041f110
push eax
call fcn.0048bb80
add esp, 4
test eax, eax
je 0x48b7f6
mov ecx, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
mov edx, dword [ecx + 4]
or edx, 0x2000000
mov eax, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
mov dword [eax + 4], edx
push 0x49638c
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallGoogle_Chrome
push 0x80000002
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
push ecx
mov ecx, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
call fcn.0048c400
mov byte [ebp - 4], 0xb
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Pathschrome.exe
push 0x80000002
lea edx, reloc.NETAPI32.dll_NetApiBufferFree
push edx
mov ecx, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
call fcn.0048c400
mov byte [ebp - 4], 0xc
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
call fcn.0048a320
movzx eax, al
test eax, eax
je 0x48b879
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
call fcn.0048a320
movzx ecx, al
test ecx, ecx
jne 0x48b890
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
call fcn.0041f110
push eax
call fcn.0048bb80
add esp, 4
test eax, eax
je 0x48b890
mov edx, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
mov eax, dword [edx + 4]
or eax, 0x1000000
mov ecx, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
mov dword [ecx + 4], eax
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths_firefox.exe
push 0x80000002
lea edx, reloc.NETAPI32.dll_NetApiBufferFree
push edx
mov ecx, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
call fcn.0048c400
mov byte [ebp - 4], 0xd
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
call fcn.0048a320
movzx eax, al
test eax, eax
jne 0x48b8f4
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
call fcn.0041f110
push eax
call fcn.0048bb80
add esp, 4
test eax, eax
je 0x48b8f4
mov ecx, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
mov edx, dword [ecx + 4]
or edx, 0x800000
mov eax, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
mov dword [eax + 4], edx
push 0x496580
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallBaiduBrowser
push 0x80000002
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
push ecx
mov ecx, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
call fcn.0048c400
mov byte [ebp - 4], 0xe
push 0
push 0x496680
push 0x80000002
lea edx, reloc.NETAPI32.dll_NetApiBufferFree
push edx
mov ecx, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
call fcn.0048c400
mov byte [ebp - 4], 0xf
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
call fcn.0048a320
movzx eax, al
test eax, eax
je 0x48b977
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
call fcn.0048a320
movzx ecx, al
test ecx, ecx
jne 0x48b98e
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
call fcn.0041f110
push eax
call fcn.0048bb80
add esp, 4
test eax, eax
je 0x48b98e
mov edx, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
mov eax, dword [edx + 4]
or eax, 0x400000
mov ecx, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
mov dword [ecx + 4], eax
push 0x496624
push 0x496730
push 0x80000001
lea edx, [ebp - 0x48]
push edx
mov ecx, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
call fcn.0048c400
mov byte [ebp - 4], 0x10
push 0x49670c
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallHao123Browser
push 0x80000002
lea eax, [ebp - 0x80]
push eax
mov ecx, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
call fcn.0048c400
mov byte [ebp - 4], 0x11
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Pathshao123browser.exe
push 0x80000002
lea ecx, [ebp - 0xf0]
push ecx
mov ecx, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
call fcn.0048c400
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x48]
call fcn.0048a320
movzx edx, al
test edx, edx
je 0x48ba3c
lea ecx, [ebp - 0x80]
call fcn.0048a320
movzx eax, al
test eax, eax
je 0x48ba3c
lea ecx, [ebp - 0xf0]
call fcn.0048a320
movzx ecx, al
test ecx, ecx
jne 0x48ba53
lea ecx, [ebp - 0xf0]
call fcn.0041f110
push eax
call fcn.0048bb80
add esp, 4
test eax, eax
je 0x48ba53
mov edx, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
mov eax, dword [edx + 4]
or eax, 0x200000
mov ecx, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
mov dword [ecx + 4], eax
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0xf0]
call fcn.0041ec10
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x80]
call fcn.0041ec10
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x48]
call fcn.0041ec10
mov byte [ebp - 4], 0xe
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
call fcn.0041ec10
mov byte [ebp - 4], 0xd
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
call fcn.0041ec10
mov byte [ebp - 4], 0xc
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
call fcn.0041ec10
mov byte [ebp - 4], 0xb
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
call fcn.0041ec10
mov byte [ebp - 4], 0xa
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
call fcn.0041ec10
mov byte [ebp - 4], 9
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
call fcn.0041ec10
mov byte [ebp - 4], 8
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
call fcn.0041ec10
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x9c]
call fcn.0041ec10
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xb8]
call fcn.0041ec10
mov byte [ebp - 4], 5
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
call fcn.0041ec10
mov byte [ebp - 4], 4
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
call fcn.0041ec10
mov byte [ebp - 4], 3
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
call fcn.0041ec10
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xd4]
call fcn.0041ec10
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.0041ec10
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x64]
call fcn.0041ec10
mov dword [ebp - 4], reloc.NETAPI32.dll_NetApiBufferFree
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
call fcn.0041ec10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00492cee
mov esp, ebp
pop ebp
ret