Function at 0x411b20
Capabilities:
Delete file
Delete registry value
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4ca578]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x40c], 0
jne 0x411e33
cmp dword [esi + 0x474], 0
mov dword [esi + 0x40c], 1
je 0x411b76
push str.MuteApplication
push dword [0x50f094]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x411b76
push 0
push 0
push 0
call eax
add esp, 0xc
push str.Starting_DisableSecurity
push dword [0x504e50]
call fcn.00440eb0
mov eax, dword [0x5420dc]
add esp, 8
test eax, eax
je 0x411c1f
cmp dword [0x504e50], 0
je 0x411c1b
mov ecx, 0x504e40
call fcn.00407f10
mov ecx, 0x504e40
call fcn.00407f30
push str.Before_killOnQuit
push dword [0x504e50]
call fcn.00440eb0
push dword [esi + 0x9990]
push dword [0x504e50]
call fcn.00440ad0
push str.After_killOnQuit
push dword [0x504e50]
call fcn.00440eb0
push dword [esi + 0x9980]
push dword [esi + 0x998c]
push dword [0x504e50]
call fcn.00440bd0
add esp, 0x24
push 3
push 0
push 0
push 0
push 0
push 0
push dword [esi + 0x9990]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [0x5420dc]
test eax, eax
jne 0x411c35
push dword [esi + 0x998c]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 0x998c], 0
push str.Finished_DisableSecurity
push dword [0x504e50]
call fcn.00440eb0
add esp, 8
mov dword [ebp - 0x218], 0
lea eax, [ebp - 0x218]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_BROWSER_EMULATION
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esi + 0x9a5c]
push eax
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x4981a8
call fcn.0040edd0
mov ecx, 0x4981a8
call fcn.0040ee20
mov ecx, 0x4981a8
call fcn.0040ee70
push dword [0x504e50]
call fcn.00440a60
add esp, 4
test eax, eax
je 0x411cd3
mov ecx, 0x4981a8
call fcn.0040ee20
mov ecx, 0x4981a8
call fcn.0040ed80
cmp dword [esi + 0x400], 0
je 0x411cfb
push 4
lea eax, [esi + 0x9984]
mov dword [eax], 0
push eax
push 0x2a
push 0
call dword [sym.imp.WININET.dll_InternetSetOptionA]
mov dword [esi + 0x4b8], eax
push edi
push dword [0x51d838]
lea eax, [ebp - 0xc]
push 0x46f680
push 5
push eax
call fcn.0041a140
add esp, 0x10
cmp dword [0x51d730], 0
je 0x411d72
push 0x51d734
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 2
push 4
push 0
push 2
push 0xc0000000
push 0x51d734
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
test edi, edi
je 0x411d64
push 0
lea eax, [ebp - 0x218]
push eax
push 0x64
push 0
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0xc]
push eax
push 0x51d734
jmp 0x411e12
lea eax, [ebp - 0x214]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x411e20
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x110]
push 0x104
push eax
call fcn.0044a958
push str.ITSExitCode.log
lea eax, [ebp - 0x110]
push 0x104
push eax
call fcn.0044a9b2
add esp, 0x18
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 2
push 4
push 0
push 2
push 0xc0000000
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
test edi, edi
je 0x411e07
push 0
lea eax, [ebp - 0x218]
push eax
push 0x64
push 0
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x110]
push eax
push dword [0x504e50]
call fcn.00440ee0
add esp, 0xc
push 0
push 0
push 0x10
push dword [esi + 0x9990]
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00444ab5
mov esp, ebp
pop ebp
ret