Function at 0x436e00
Capabilities:
Check os version
Create process on windows
Delete registry key
Get common file path
Query or enumerate registry key
Resolve function by parsing pe exports
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x53a650
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c8
push ebx
push ebp
push esi
push edi
mov edi, ecx
push reloc.FGBTCORE.dll_Ordinal_2
lea ecx, [esp + 0x24]
mov dword [esp + 0x40], edi
call fcn.004d37e0
mov ebx, dword [esp + 0x5e8]
xor ebp, ebp
cmp ebx, 1
mov dword [esp + 0x5e0], ebp
je 0x436e4d
cmp ebx, 2
jne 0x436ea0
push str.jccatch.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, ebp
je 0x436e82
cmp ebx, 1
mov eax, str.DllRegisterServer
je 0x436e6d
mov eax, str.DllUnregisterServer
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebp
je 0x436e7b
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push str.SoftwareMicrosoftInternet_ExplorerMenuExtDownload_All_by_JetCar
push reloc.FGBTCORE.dll_Ordinal_1
call esi
push str.SoftwareMicrosoftInternet_ExplorerMenuExtDownload_using_JetCar
push reloc.FGBTCORE.dll_Ordinal_1
call esi
cmp ebx, 1
jg 0x437843
jne 0x437367
mov ecx, 0x24
xor eax, eax
lea edi, [esp + 0x94]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x90]
mov dword [esp + 0x90], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
mov ebx, 3
je 0x437065
cmp dword [esp + 0x94], 5
jne 0x437065
cmp dword [esp + 0x98], 1
jne 0x437065
cmp dword [esp + 0xa0], 2
jne 0x437065
lea ecx, [esp + 0x394]
push 0x104
xor ebp, ebp
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
or ecx, 0xffffffff
mov edi, str.firewall_add_allowedprogram__
xor eax, eax
lea edx, [esp + 0x190]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x100
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x194]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, ebx
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x398]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x194]
and ecx, ebx
rep movsb byte es:[edi], byte [esi]
mov edi, str.__Flashget_enable
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x298]
and ecx, ebx
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str._netsh.EXE
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x294]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, ebx
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x498]
lea ecx, [esp + 0x294]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x43705c
mov ecx, 0xe
xor eax, eax
lea edi, [esp + 0x58]
lea edx, [esp + 0x190]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x54]
mov dword [esp + 0x54], 0x3c
push eax
mov dword [esp + 0x5c], 0x440
mov dword [esp + 0x60], ebp
mov dword [esp + 0x64], ebp
mov dword [esp + 0x68], str.netsh.EXE
mov dword [esp + 0x6c], edx
mov dword [esp + 0x70], ebp
mov dword [esp + 0x74], ebp
mov dword [esp + 0x78], ebp
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x437067
xor ebp, ebp
push str.SoftwareMicrosoftInternet_ExplorerExtensionsD6E814A0_E0C5_11d4_8D29_0050BA6940E3
push reloc.FGBTCORE.dll_Ordinal_2
lea ecx, [esp + 0x28]
call fcn.004d3990
test eax, eax
je 0x43726d
mov eax, dword [0x591288]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
mov byte [esp + 0x5e0], 2
call fcn.0042eff0
mov ecx, eax
call fcn.0043d090
test eax, eax
je 0x4370bc
push 0x58ab58
lea ecx, [esp + 0x1c]
call fcn.0050d586
push 0x58ae50
jmp 0x4370cf
push 0x589d5c
lea ecx, [esp + 0x1c]
call fcn.0050d586
push 0x589d5c
lea ecx, [esp + 0x18]
call fcn.0050d586
mov ecx, dword [esp + 0x14]
push ecx
push str.ButtonText
lea ecx, [esp + 0x28]
call fcn.004d3c70
push 0x58ae40
push str.Default_Visible
lea ecx, [esp + 0x28]
call fcn.004d3c70
mov esi, dword [esp + 0x3c]
push 0x596660
push str.AppPath
lea edx, [esp + 0x24]
push 0x588a34
push edx
mov ecx, esi
call fcn.0052be1f
mov eax, dword [esp + 0x1c]
mov byte [esp + 0x5e0], bl
cmp dword [eax - 8], ebp
je 0x4371f6
mov ecx, dword [0x591288]
mov dword [esp + 0x10], ecx
push eax
push str.Exec
lea ecx, [esp + 0x28]
mov byte [esp + 0x5e8], 4
call fcn.004d3c70
lea edx, [esp + 0x1c]
push str._128
lea eax, [esp + 0x3c]
push edx
push eax
call fcn.0050d692
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x5e4], 5
call fcn.0050d536
lea ecx, [esp + 0x38]
mov byte [esp + 0x5e0], 4
call fcn.0050d3fd
mov ecx, dword [esp + 0x10]
push ecx
push str.HotIcon
lea ecx, [esp + 0x28]
call fcn.004d3c70
lea edx, [esp + 0x1c]
push str._128
lea eax, [esp + 0x3c]
push edx
push eax
call fcn.0050d692
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x5e4], 6
call fcn.0050d536
lea ecx, [esp + 0x38]
mov byte [esp + 0x5e0], 4
call fcn.0050d3fd
mov ecx, dword [esp + 0x10]
push ecx
push str.Icon
lea ecx, [esp + 0x28]
call fcn.004d3c70
lea ecx, [esp + 0x10]
mov byte [esp + 0x5e0], bl
call fcn.0050d3fd
push str.1FBA04EE_3024_11d2_8F1F_0000F87ABD16
push str.CLSID
lea ecx, [esp + 0x28]
call fcn.004d3c70
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x20]
push edx
push str.MenuStatusBar
call fcn.004d3c70
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x20]
push eax
push str.MenuText
call fcn.004d3c70
lea ecx, [esp + 0x20]
call fcn.004d3be0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x5e0], 2
call fcn.0050d3fd
lea ecx, [esp + 0x14]
mov byte [esp + 0x5e0], 1
call fcn.0050d3fd
lea ecx, [esp + 0x18]
mov byte [esp + 0x5e0], 0
call fcn.0050d3fd
jmp 0x437271
mov esi, dword [esp + 0x3c]
push 0x64
push str.FtpSearchMinSize
push 0x588a34
mov ecx, esi
call fcn.0051d77d
push 1
push str.Flags2
push str.Main_Menu
call fcn.0042eff0
mov ecx, eax
call fcn.0051d77d
push 1
push str.Flags4
push str.Main_Menu
call fcn.0042eff0
mov ecx, eax
call fcn.0051d77d
push ebp
push str.InstallDate
push 0x588a34
call fcn.0042eff0
mov ecx, eax
call fcn.0052bdb3
cmp eax, ebp
jne 0x43731f
lea ecx, [esp + 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov eax, dword [esp + 0x40]
and eax, 0xffff
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
mov eax, dword [esp + 0x42]
and eax, 0xffff
lea eax, [eax + edx*4]
mov edx, dword [esp + 0x46]
and edx, 0xffff
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
lea eax, [edx + ecx*4]
push eax
push str.InstallDate
push 0x588a34
call fcn.0042eff0
mov ecx, eax
call fcn.0051d77d
mov eax, dword [esp + 0x5f0]
mov ecx, esi
push eax
push str.install
call fcn.00436310
push ebp
push str.Flags5
push str.Main_Menu
call fcn.0042eff0
mov ecx, eax
call fcn.0052bdb3
cmp eax, ebp
je 0x43735c
mov ecx, dword [esp + 0x3c]
push 0x3e8
call fcn.00435cb0
mov edi, dword [esp + 0x3c]
mov ebx, dword [esp + 0x5e8]
mov eax, dword [edi + 0x2fc]
mov esi, dword [esp + 0x5ec]
test al, 8
je 0x4375f9
test ah, 1
je 0x437472
push str.SoftwareMicrosoftWindowsCurrentVersionexplorerBrowser_Helper_Objects_
lea ecx, [esp + 0x14]
call fcn.0050d46b
push str.2F364306_AA45_47B5_9F9D_39A8B94E7EF7
lea ecx, [esp + 0x14]
mov byte [esp + 0x5e4], 7
call fcn.0050d7d9
mov ecx, dword [esp + 0x10]
push ecx
push reloc.FGBTCORE.dll_Ordinal_2
lea ecx, [esp + 0x28]
call fcn.004d3990
test eax, eax
je 0x4373c9
lea ecx, [esp + 0x20]
call fcn.004d3be0
push str.SoftwareStilesoftNetCaptorCurrentVersionBrowser_Helper_Objects_
lea ecx, [esp + 0x14]
call fcn.0050d586
push str.2F364306_AA45_47B5_9F9D_39A8B94E7EF7
lea ecx, [esp + 0x14]
call fcn.0050d7d9
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x20]
push edx
push reloc.FGBTCORE.dll_Ordinal_1
call fcn.004d3990
test eax, eax
je 0x437405
lea ecx, [esp + 0x20]
call fcn.004d3be0
push str.PROTOCOLSName_Space_HandlerhttpJetCarIEClickCatcher
push SysReAllocStringLen
lea ecx, [esp + 0x28]
call fcn.004d4b40
push str.PROTOCOLSName_Space_Handler_ftpJetCarIEClickCatcher
push SysReAllocStringLen
lea ecx, [esp + 0x28]
call fcn.004d4b40
push str.SoftwareMicrosoftWindowsCurrentVersionexplorerBrowser_Helper_Objects_
lea ecx, [esp + 0x14]
call fcn.0050d586
push str.A5366673_E8CA_11D3_9CD9_0090271D075B
lea ecx, [esp + 0x14]
call fcn.0050d7d9
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x20]
push eax
push reloc.FGBTCORE.dll_Ordinal_2
call fcn.004d4b40
mov ecx, edi
call fcn.00435980
mov byte [esp + 0x5e0], 0
lea ecx, [esp + 0x10]
jmp 0x4376f7
push str.PROTOCOLSName_Space_HandlerhttpJetCarIEClickCatcher
push SysReAllocStringLen
lea ecx, [esp + 0x28]
call fcn.004d3990
test eax, eax
je 0x4374cb
push str.JetCar_Browser_Click_Catcher
push 0x596660
lea ecx, [esp + 0x28]
call fcn.004d3c70
push str.FB5DA722_162B_11D3_8B9B_AA70B4B0B524
push str.CLSID
lea ecx, [esp + 0x28]
call fcn.004d3c70
push 0x596660
push str.Pattern1
lea ecx, [esp + 0x28]
call fcn.004d3c70
lea ecx, [esp + 0x20]
call fcn.004d3be0
push str.PROTOCOLSName_Space_Handler_ftpJetCarIEClickCatcher
push SysReAllocStringLen
lea ecx, [esp + 0x28]
call fcn.004d3990
test eax, eax
je 0x437524
push str.JetCar_Browser_Click_Catcher
push 0x596660
lea ecx, [esp + 0x28]
call fcn.004d3c70
push str.FB5DA722_162B_11D3_8B9B_AA70B4B0B524
push str.CLSID
lea ecx, [esp + 0x28]
call fcn.004d3c70
push 0x596660
push str.Pattern1
lea ecx, [esp + 0x28]
call fcn.004d3c70
lea ecx, [esp + 0x20]
call fcn.004d3be0
push str.SoftwareMicrosoftWindowsCurrentVersionexplorerBrowser_Helper_Objects_
lea ecx, [esp + 0x14]
call fcn.0050d46b
push str.A5366673_E8CA_11D3_9CD9_0090271D075B
lea ecx, [esp + 0x14]
mov byte [esp + 0x5e4], 8
call fcn.0050d7d9
mov ecx, dword [esp + 0x10]
push ecx
push reloc.FGBTCORE.dll_Ordinal_2
lea ecx, [esp + 0x28]
call fcn.004d4b40
push str.SoftwareMicrosoftWindowsCurrentVersionexplorerBrowser_Helper_Objects_
lea ecx, [esp + 0x14]
call fcn.0050d586
push str.2F364306_AA45_47B5_9F9D_39A8B94E7EF7
lea ecx, [esp + 0x14]
call fcn.0050d7d9
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x20]
push edx
push reloc.FGBTCORE.dll_Ordinal_2
call fcn.004d4b40
push str.SoftwareStilesoftNetCaptorCurrentVersionBrowser_Helper_Objects_
lea ecx, [esp + 0x14]
call fcn.0050d586
push str.A5366673_E8CA_11D3_9CD9_0090271D075B
lea ecx, [esp + 0x14]
call fcn.0050d7d9
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x20]
push eax
push reloc.FGBTCORE.dll_Ordinal_1
call fcn.004d4b40
push str.SoftwareStilesoftNetCaptorCurrentVersionBrowser_Helper_Objects_
lea ecx, [esp + 0x14]
call fcn.0050d586
push str.2F364306_AA45_47B5_9F9D_39A8B94E7EF7
lea ecx, [esp + 0x14]
call fcn.0050d7d9
mov ecx, dword [esp + 0x10]
push ecx
push reloc.FGBTCORE.dll_Ordinal_1
lea ecx, [esp + 0x28]
call fcn.004d4b40
mov byte [esp + 0x5e0], 0
lea ecx, [esp + 0x10]
jmp 0x4376f7
test esi, esi
jne 0x4376fc
push str.PROTOCOLSName_Space_HandlerhttpJetCarIEClickCatcher
push SysReAllocStringLen
lea ecx, [esp + 0x28]
call fcn.004d4b40
push str.PROTOCOLSName_Space_Handler_ftpJetCarIEClickCatcher
push SysReAllocStringLen
lea ecx, [esp + 0x28]
call fcn.004d4b40
push str.SoftwareMicrosoftWindowsCurrentVersionexplorerBrowser_Helper_Objects_
lea ecx, [esp + 0x14]
call fcn.0050d46b
push str.A5366673_E8CA_11D3_9CD9_0090271D075B
lea ecx, [esp + 0x14]
mov byte [esp + 0x5e4], 9
call fcn.0050d7d9
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x20]
push edx
push reloc.FGBTCORE.dll_Ordinal_2
call fcn.004d4b40
push str.SoftwareMicrosoftWindowsCurrentVersionexplorerBrowser_Helper_Objects_
lea ecx, [esp + 0x14]
call fcn.0050d586
push str.2F364306_AA45_47B5_9F9D_39A8B94E7EF7
lea ecx, [esp + 0x14]
call fcn.0050d7d9
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x20]
push eax
push reloc.FGBTCORE.dll_Ordinal_2
call fcn.004d4b40
push str.SoftwareStilesoftNetCaptorCurrentVersionBrowser_Helper_Objects_
lea ecx, [esp + 0x14]
call fcn.0050d586
push str.A5366673_E8CA_11D3_9CD9_0090271D075B
lea ecx, [esp + 0x14]
call fcn.0050d7d9
mov ecx, dword [esp + 0x10]
push ecx
push reloc.FGBTCORE.dll_Ordinal_1
lea ecx, [esp + 0x28]
call fcn.004d4b40
push str.SoftwareStilesoftNetCaptorCurrentVersionBrowser_Helper_Objects_
lea ecx, [esp + 0x14]
call fcn.0050d586
push str.2F364306_AA45_47B5_9F9D_39A8B94E7EF7
lea ecx, [esp + 0x14]
call fcn.0050d7d9
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x20]
push edx
push reloc.FGBTCORE.dll_Ordinal_1
call fcn.004d4b40
mov byte [esp + 0x5e0], 0
lea ecx, [esp + 0x10]
call fcn.0050d3fd
test byte [edi + 0x2fc], 4
je 0x43782a
lea ecx, [esp + 0x40]
call fcn.004b2e80
mov bl, 0xa
push str.Netscape_Navigator
push str.Netscape
lea ecx, [esp + 0x48]
mov byte [esp + 0x5e8], bl
call fcn.004b3150
push str.JetCar.Netscape
push 0x58ac50
push str.Automation_Protocols
lea ecx, [esp + 0x4c]
call fcn.004b2f80
push str.JetCar.Netscape
push str.http
push str.Automation_Protocols
lea ecx, [esp + 0x4c]
call fcn.004b2f80
push str.SoftwareNetscapeNetscape_NavigatorAutomation_Protocols
push reloc.FGBTCORE.dll_Ordinal_1
lea ecx, [esp + 0x28]
call fcn.004d3940
test eax, eax
je 0x4377da
mov eax, dword [0x591288]
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x5e0], 0xb
push ecx
push 0x596660
lea ecx, [esp + 0x28]
call fcn.004d43e0
test eax, eax
je 0x4377c1
mov edx, dword [esp + 0x14]
push str.JetCar_Browser_Click_Catcher
push edx
call fcn.004eea90
add esp, 8
test eax, eax
jne 0x4377c1
push 0x596660
lea ecx, [esp + 0x24]
call fcn.004d4b10
lea ecx, [esp + 0x20]
call fcn.004d3be0
lea ecx, [esp + 0x14]
mov byte [esp + 0x5e0], bl
call fcn.0050d3fd
lea ecx, [esp + 0x40]
mov byte [esp + 0x5e0], 0
call fcn.004b2ec0
mov ebx, dword [esp + 0x5e8]
test esi, esi
je 0x4377ff
push 0
mov ecx, edi
call fcn.00437ff0
push esi
push ebx
mov ecx, edi
call fcn.0043df90
push 0x209
mov ecx, edi
call fcn.0042f3e0
test eax, eax
je 0x437b5e
push esi
push ebx
mov ecx, edi
call fcn.00445310
jmp 0x437b5e
test esi, esi
jne 0x4377f6
push str.SoftwareNetscapeNetscape_NavigatorAutomation_Protocols
push reloc.FGBTCORE.dll_Ordinal_1
lea ecx, [esp + 0x28]
call fcn.004d4b40
jmp 0x4377ff
mov eax, dword [esp + 0x5f0]
mov ecx, edi
push eax
push str.uninstall
call fcn.00436310
push str.SoftwareJetCarJetCar
lea ecx, [esp + 0x1c]
call fcn.0050d46b
push str.PROTOCOLSName_Space_HandlerhttpJetCarIEClickCatcher
push SysReAllocStringLen
lea ecx, [esp + 0x28]
mov byte [esp + 0x5e8], 0xc
call fcn.004d4b40
push str.PROTOCOLSName_Space_Handler_ftpJetCarIEClickCatcher
push SysReAllocStringLen
lea ecx, [esp + 0x28]
call fcn.004d4b40
push str.SoftwareNetscapeNetscape_NavigatorAutomation_Protocols
push reloc.FGBTCORE.dll_Ordinal_1
lea ecx, [esp + 0x28]
call fcn.004d4b40
mov ecx, edi
call fcn.004352d0
cmp ax, 3
jge 0x4378cb
mov ecx, dword [esp + 0x18]
push ecx
push reloc.FGBTCORE.dll_Ordinal_1
lea ecx, [esp + 0x28]
call fcn.004d4b40
jmp 0x437a26
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ebx, 0xff
mov edx, dword [0x591288]
mov dword [esp + 0x1c], edx
test ebp, ebp
mov byte [esp + 0x5e0], 0xd
jne 0x437925
lea eax, [esp + 0x18]
push 0x58abd4
lea ecx, [esp + 0x54]
push eax
push ecx
call fcn.0050d692
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x5e4], 0xe
call fcn.0050d536
lea ecx, [esp + 0x50]
mov byte [esp + 0x5e0], 0xd
call fcn.0050d3fd
jmp 0x437933
lea edx, [esp + 0x18]
lea ecx, [esp + 0x1c]
push edx
call fcn.0050d536
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x14]
push eax
push 0xf003f
push 0
push ecx
push reloc.FGBTCORE.dll_Ordinal_1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4379f1
mov ecx, 0x3f
lea edi, [esp + 0x90]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x40]
lea ecx, [esp + 0x90]
push edx
mov edx, dword [esp + 0x18]
stosb byte es:[edi], al
push 0
push 0
lea eax, [esp + 0x44]
push 0
push eax
push ecx
push 0
push edx
mov dword [esp + 0x58], ebx
call esi
test eax, eax
jne 0x4379e2
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x90]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x4379e2
mov ecx, 0x3f
lea edi, [esp + 0x90]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x40]
lea ecx, [esp + 0x90]
push edx
mov edx, dword [esp + 0x18]
stosb byte es:[edi], al
push 0
push 0
lea eax, [esp + 0x44]
push 0
push eax
push ecx
push 0
push edx
mov dword [esp + 0x58], ebx
call esi
test eax, eax
je 0x437991
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [esp + 0x3c]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x5e0], 0xc
call fcn.0050d3fd
inc ebp
cmp ebp, 2
jl 0x4378d6
mov ecx, dword [esp + 0x18]
push ecx
push reloc.FGBTCORE.dll_Ordinal_1
lea ecx, [esp + 0x28]
call fcn.004d4b40
mov ebx, dword [esp + 0x5e8]
push str.SoftwareMicrosoftWindowsCurrentVersionexplorerBrowser_Helper_Objects_
lea ecx, [esp + 0x14]
call fcn.0050d46b
push str.A5366673_E8CA_11D3_9CD9_0090271D075B
lea ecx, [esp + 0x14]
mov byte [esp + 0x5e4], 0xf
call fcn.0050d7d9
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x20]
push edx
push reloc.FGBTCORE.dll_Ordinal_2
call fcn.004d4b40
push str.SoftwareMicrosoftWindowsCurrentVersionexplorerBrowser_Helper_Objects_
lea ecx, [esp + 0x14]
call fcn.0050d586
push str.2F364306_AA45_47B5_9F9D_39A8B94E7EF7
lea ecx, [esp + 0x14]
call fcn.0050d7d9
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x20]
push eax
push reloc.FGBTCORE.dll_Ordinal_2
call fcn.004d4b40
push str.SoftwareStilesoftNetCaptorCurrentVersionBrowser_Helper_Objects_
lea ecx, [esp + 0x14]
call fcn.0050d586
push str.A5366673_E8CA_11D3_9CD9_0090271D075B
lea ecx, [esp + 0x14]
call fcn.0050d7d9
mov ecx, dword [esp + 0x10]
push ecx
push reloc.FGBTCORE.dll_Ordinal_1
lea ecx, [esp + 0x28]
call fcn.004d4b40
push str.SoftwareStilesoftNetCaptorCurrentVersionBrowser_Helper_Objects_
lea ecx, [esp + 0x14]
call fcn.0050d586
push str.2F364306_AA45_47B5_9F9D_39A8B94E7EF7
lea ecx, [esp + 0x14]
call fcn.0050d7d9
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x20]
push edx
push reloc.FGBTCORE.dll_Ordinal_1
call fcn.004d4b40
push 1
mov ecx, edi
call fcn.00437ff0
push str.FlashGet.Document
push SysReAllocStringLen
lea ecx, [esp + 0x28]
call fcn.004d4b40
push 0x58abb8
push SysReAllocStringLen
lea ecx, [esp + 0x28]
call fcn.004d4b40
push str.SoftwareMicrosoftInternet_ExplorerExtensionsD6E814A0_E0C5_11d4_8D29_0050BA6940E3
push reloc.FGBTCORE.dll_Ordinal_2
lea ecx, [esp + 0x28]
call fcn.004d4b40
mov eax, dword [esp + 0x5ec]
mov ecx, edi
push eax
push ebx
call fcn.00445310
lea ecx, [esp + 0x10]
mov byte [esp + 0x5e0], 0xc
call fcn.0050d3fd
lea ecx, [esp + 0x18]
mov byte [esp + 0x5e0], 0
call fcn.0050d3fd
lea ecx, [esp + 0x20]
mov dword [esp + 0x5e0], 0xffffffff
call fcn.004d3820
mov ecx, dword [esp + 0x5d8]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x5d4
ret 0xc