Function at 0x41300b
Capabilities:
Delete file
Move file
Persist via run registry key
Query environment variable

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x463e00]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x40
mov eax, 0x44abbd
call fcn.004346a6
mov eax, dword [ebp + 0x218]
mov edi, ecx
push 0
mov ebx, 0xbbb
push ebx
mov esi, edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x34], eax
call fcn.0041408d
mov eax, dword [ebp + 0x214]
push 0x2e
mov ecx, edi
call fcn.004052ba
mov esi, eax
call fcn.00403c00
push eax
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebp + 0x214]
mov ecx, edi
call fcn.004052ba
mov ecx, eax
call fcn.00414224
and dword [ebp - 4], 0
push dword [ebp - 0x34]
lea ecx, [ebp - 0x48]
call fcn.00401553
mov byte [ebp - 4], 1
push str..msi
lea ecx, [ebp - 0x40]
call fcn.00402435
test eax, eax
jne 0x4130cd
mov eax, dword [ebp + 0x214]
mov ecx, edi
call fcn.004052ba
mov eax, dword [eax]
mov ecx, dword [edi + 0x44]
push eax
push ecx
call fcn.00414b6b
test eax, eax
jne 0x4136b1
lea esi, [edi + 0x24]
call fcn.004069cb
jmp 0x4136b1
push 0x45614c
lea ecx, [ebp - 0x48]
call fcn.00402435
test eax, eax
jne 0x413182
push 0x19
push ebx
mov esi, edi
call fcn.0041408d
mov eax, dword [0x468870]
push 0
push str.BackupInstalled
call fcn.00409d56
pop ecx
pop ecx
lea ecx, [ebp - 0x14]
call fcn.00401b10
mov byte [ebp - 4], 2
lea eax, [ebp - 0x34]
push eax
push 0x468878
call fcn.0040a8f6
mov byte [ebp - 4], 3
mov esi, dword [eax]
mov eax, dword [ebp + 0x214]
mov ecx, edi
call fcn.004052ba
mov eax, dword [eax]
push esi
push eax
lea eax, [ebp - 0x14]
push str.__1___S__productmypcbackup__hash_2__tidmpbcpl__popup_delay1200000
push eax
call fcn.00406f5e
add esp, 0x10
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x34]
call fcn.00409dbd
lea eax, [ebp - 0x14]
push eax
call fcn.0040be75
pop ecx
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 4
test eax, eax
jne 0x413167
call fcn.0040d46c
mov byte [ebp - 4], 2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x1c], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
jmp 0x4136ac
push str..exe
lea ecx, [ebp - 0x40]
call fcn.00402435
test eax, eax
jne 0x4136fe
push 0x19
push ebx
mov esi, edi
call fcn.0041408d
lea ecx, [ebp - 0x3c]
call fcn.00401b10
mov byte [ebp - 4], 5
lea eax, [ebp - 0x3c]
push eax
mov ebx, 0x454ec4
mov ecx, 0x46888c
call fcn.0040aa1e
test al, al
mov esi, 0x468838
jne 0x4131de
lea eax, [ebp - 0x3c]
push eax
push ebx
mov ecx, esi
call fcn.00423e36
test eax, eax
jne 0x4131de
call fcn.00424348
lea ecx, [ebp - 0x38]
call fcn.00401b10
mov byte [ebp - 4], 6
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 0x452188
push 0x46881c
call fcn.00403c38
test byte [ebp - 0x10], 1
je 0x413214
push str.__INSTALL
lea ecx, [ebp - 0x38]
call fcn.00405295
test byte [ebp - 0x10], 2
je 0x413227
push str.__ENABLEDSP
lea ecx, [ebp - 0x38]
call fcn.00405295
test byte [ebp - 0x10], 4
je 0x41323a
push str.__ENABLEHOMEPAGE
lea ecx, [ebp - 0x38]
call fcn.00405295
lea ecx, [ebp - 0x34]
call fcn.00401b10
mov byte [ebp - 4], 7
lea eax, [ebp - 0x34]
push eax
push 0x456240
mov ecx, esi
call fcn.00423e36
test eax, eax
lea ecx, [ebp - 0x28]
je 0x41347b
call fcn.00401b10
mov byte [ebp - 4], 8
lea eax, [ebp - 0x28]
push eax
push 0x452bdc
mov ecx, esi
call fcn.00423e36
test eax, eax
je 0x41346a
lea ecx, [ebp - 0x10]
call fcn.00401b10
mov byte [ebp - 4], 9
mov esi, dword [ebp - 0x28]
mov eax, 0x3fff
push eax
push eax
lea ecx, [ebp - 0x10]
call fcn.00403df4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0x5c
push dword [ebp - 0x10]
call fcn.004306ec
test eax, eax
pop ecx
pop ecx
jne 0x4132bd
or eax, 0xffffffff
jmp 0x4132c2
sub eax, dword [ebp - 0x10]
sar eax, 1
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
call fcn.00403cef
mov byte [ebp - 4], 0xa
push str._avgtoolbar.exe
lea ecx, [ebp - 0x18]
call fcn.00405295
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp + 0x214]
mov esi, dword [ebp - 0x18]
mov ecx, edi
call fcn.004052ba
mov eax, dword [eax]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x413452
lea ecx, [ebp - 0x20]
call fcn.00401b10
mov byte [ebp - 4], 0xb
push 0x468640
call fcn.00405671
push eax
lea eax, [ebp - 0x30]
push eax
push 0x468878
call fcn.0040a94a
mov esi, eax
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x1c]
push eax
call fcn.0040beec
mov byte [ebp - 4], 0xd
mov esi, dword [esi]
mov eax, dword [eax]
push esi
push eax
push dword [ebp - 0x3c]
lea eax, [ebp - 0x20]
push str.TB38GF9P66
push dword [ebp - 0x38]
push str._1__PASSWORD_2__SILENT__DISTRIBUTIONSOURCE_3__LOCAL_4__PROFILESATB__BROWSER_5
push eax
call fcn.00406f5e
add esp, 0x20
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x1c]
call fcn.00409dbd
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x30]
call fcn.00409dbd
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
lea ecx, [ebp - 0x24]
call fcn.00401553
mov byte [ebp - 4], 0xe
and dword [ebp - 0x14], 0
mov byte [ebp - 4], 0xf
call fcn.0040c62f
neg al
lea edi, [ebp - 0x14]
sbb eax, eax
and eax, 0x100
add eax, 0x20006
push eax
push dword [ebp - 0x24]
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00403ecd
test eax, eax
jne 0x41342b
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x18]
call fcn.004141ac
mov byte [ebp - 4], 0x10
mov dword [esp], 0x4563ac
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00409181
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x20]
push ecx
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00414155
add esp, 0x18
mov byte [ebp - 4], 0x12
push dword [eax]
mov eax, edi
push 0x4563b8
push eax
call fcn.00403e93
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x30]
call fcn.00409dbd
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x1c]
call fcn.00409dbd
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x2c]
call fcn.00409dbd
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x14]
call fcn.00403e7c
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x24]
call fcn.00409dbd
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x20]
call fcn.00409dbd
mov edi, dword [ebp - 0x44]
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x18]
call fcn.00409dbd
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x10]
call fcn.00409dbd
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x28]
call fcn.00409dbd
jmp 0x41368d
call fcn.00401b10
mov byte [ebp - 4], 0x13
push 0x468640
call fcn.00405671
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x468878
call fcn.0040a94a
mov esi, eax
mov byte [ebp - 4], 0x14
lea eax, [ebp - 0x30]
push eax
call fcn.0040beec
pop ecx
mov byte [ebp - 4], 0x15
mov edi, dword [eax]
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x44]
mov esi, dword [esi]
mov ebx, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x214]
call fcn.004052ba
mov eax, dword [eax]
push esi
push edi
push ebx
push str.TB38GF9P66
push dword [ebp - 0x2c]
push eax
lea eax, [ebp - 0x28]
push str.__1___2__PASSWORD_3__SILENT__DISTRIBUTIONSOURCE_4__LOCAL_5__PROFILESATB__BROWSER_6
push eax
call fcn.00406f5e
add esp, 0x20
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x30]
call fcn.00409dbd
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x1c]
call fcn.00409dbd
lea eax, [ebp - 0x28]
push eax
call fcn.0040be75
pop ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 0x16
xor esi, esi
cmp eax, esi
je 0x413162
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [0x468780], 1
mov dword [ebp - 0x18], 0x2710
lea ecx, [ebp - 0x10]
call fcn.00401b10
mov byte [ebp - 4], 0x17
push str.AVG_Secure_Search
lea eax, [ebp - 0x10]
push str.SOFTWARE_s
push eax
call fcn.004026c6
add esp, 0xc
call fcn.0040c62f
neg al
mov dword [ebp - 0x14], esi
sbb eax, eax
and eax, 0x200
add eax, 0x20019
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 0x18
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 0x24], esi
push esi
push dword [ebp - 0x10]
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
cmp eax, esi
jne 0x4135c4
lea ecx, [ebp - 0x14]
call fcn.00403e7c
cmp eax, esi
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x14], ecx
jne 0x4135c4
push str._machine_id
lea eax, [ebp - 0x14]
push eax
lea esi, [ebp - 0x2c]
lea edi, [ebp]
mov dword [ebp - 0x2c], 0x104
call fcn.00403e15
test eax, eax
jne 0x4135c4
and dword [ebp - 0x18], eax
push str.AVG_SafeGuard_toolbar
lea eax, [ebp - 0x10]
push str.SOFTWARE_s
push eax
call fcn.004026c6
xor esi, esi
add esp, 0xc
mov dword [ebp - 0x20], esi
mov byte [ebp - 4], 0x19
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 0x24], esi
push esi
push dword [ebp - 0x10]
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
cmp eax, esi
jne 0x413630
lea ecx, [ebp - 0x20]
call fcn.00403e7c
cmp eax, esi
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x20], ecx
jne 0x413630
push str._machine_id
lea eax, [ebp - 0x20]
push eax
lea esi, [ebp - 0x2c]
lea edi, [ebp]
mov dword [ebp - 0x2c], 0x104
call fcn.00403e15
test eax, eax
jne 0x413630
and dword [ebp - 0x18], eax
mov eax, 0x1f4
sub dword [ebp - 0x18], eax
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x20]
call fcn.00403e7c
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x14]
call fcn.00403e7c
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x10]
call fcn.00409dbd
xor esi, esi
cmp dword [ebp - 0x18], esi
jg 0x413538
mov byte [ebp - 4], 0x13
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x4c], esi
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x28]
call fcn.00409dbd
mov edi, dword [ebp - 0x44]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x34]
call fcn.00409dbd
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x38]
call fcn.00409dbd
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x3c]
call fcn.00409dbd
mov ecx, edi
call fcn.00413fdf
mov esi, eax
neg esi
sbb esi, esi
inc esi
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.00409dbd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00409dbd
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0043013e
add ebp, 0x20c
leave
ret 8
call fcn.00424d37
int3