Function at 0x401a90
Capabilities:
Create process on windows
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x674
mov eax, dword [0x4c32cc]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4d2afc], 0
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov ecx, 0x12
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects
lea edi, [ebp - 0x2c8]
rep movsd dword es:[edi], dword [esi]
mov edx, dword [0x4b18d8]
movsw word es:[edi], word [esi]
mov ecx, 0xc
mov esi, str.SOFTWAREMicrosoftInternet_ExplorerExtensions
lea edi, [ebp - 0x278]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0xb
mov esi, str.SOFTWAREMicrosoftInternet_ExplorerToolbar
lea edi, [ebp - 0x148]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [str.regsvr32__u__s]
mov dword [ebp - 0x668], eax
mov eax, dword [0x4b18dc]
mov dword [ebp - 0x14], ecx
mov ecx, dword [0x4b18e0]
movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
je 0x401b3f
mov edx, dword [0x4c6444]
mov eax, dword [0x4c6448]
mov dword [ebp - 0x674], edx
mov dword [ebp - 0x66c], eax
mov dword [0x4c6444], 0x20119
mov dword [0x4c6448], 0x20106
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x664], eax
mov dword [ebp - 0x670], ebx
cmp dword [0x4cd38c], eax
jle 0x4020df
lea esi, [ebp - 0x450]
mov edi, ebx
call fcn.0048fb30
mov ecx, dword [ebx*4 + 0x4cd390]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalLock]
push ecx
call edi
mov esi, eax
test esi, esi
je 0x401bc5
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
mov edx, 0x7ffffffe
lea ecx, [ebp - 0x348]
mov eax, 0x80
jne 0x401baa
push str.Title_Not_Found
call fcn.00401000
push str.Title_Not_Found
jmp 0x401bb1
push esi
call fcn.00401000
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [ebx*4 + 0x4cd390]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [ebp - 0x668]
lea eax, [ebp - 0x450]
push eax
push ecx
call fcn.00483b10
test eax, eax
jne 0x4020c0
mov ebx, dword [ebp + 0xc]
mov edx, dword [ebx*4 + 0x4cd390]
push edx
call edi
test eax, eax
je 0x401f81
mov esi, dword [eax + 0x288]
mov eax, dword [ebx*4 + 0x4cd390]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp esi, 0x386
jne 0x401d5f
lea ecx, [ebp - 0x278]
push ecx
mov edx, 0x7ffffffe
mov eax, 0xff
lea ecx, [ebp - 0x118]
call fcn.00401000
mov eax, 0xff
lea ecx, [ebp - 0x118]
lea esp, [esp]
cmp byte [ecx], 0
je 0x401c4b
inc ecx
dec eax
jne 0x401c40
jmp 0x401c73
test eax, eax
je 0x401c73
mov ecx, 0xff
sub ecx, eax
mov eax, 0xff
sub eax, ecx
push 0x4b17dc
lea ecx, [ebp + ecx - 0x118]
mov edx, 0x7fffffff
call fcn.00401000
lea esi, [ebp - 0x248]
mov edi, ebx
call fcn.0048fb30
mov edx, 0xff
lea eax, [ebp - 0x118]
jmp 0x401c90
cmp byte [eax], 0
je 0x401c9b
inc eax
dec edx
jne 0x401c90
jmp 0x401cc5
test edx, edx
je 0x401cc5
mov ecx, 0xff
sub ecx, edx
lea edx, [ebp - 0x248]
mov eax, 0xff
push edx
sub eax, ecx
mov edx, 0x7fffffff
lea ecx, [ebp + ecx - 0x118]
call fcn.00401000
cmp dword [0x4d2afc], 0
je 0x401f69
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.Advapi32.dll
call edi
mov esi, eax
test esi, esi
je 0x401d11
push str.RegDeleteKeyExA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401d0a
push 0
push 0x200
lea ecx, [ebp - 0x118]
push ecx
push 0x80000002
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [0x4d2afc], 0
je 0x401d53
push str.Advapi32.dll
call edi
mov esi, eax
test esi, esi
je 0x401d53
push str.RegDeleteKeyExA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401d4c
push 0
push 0x100
lea edx, [ebp - 0x118]
push edx
push 0x80000002
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x118]
push eax
jmp 0x401f70
cmp esi, 0x385
jne 0x401e8c
mov esi, dword [0x4c6448]
lea edx, [ebp - 0x148]
push edx
mov edx, 0x7ffffffe
mov eax, 0xff
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x66c], esi
call fcn.00401000
mov eax, 0xff
lea ecx, [ebp - 0x118]
mov edi, edi
cmp byte [ecx], 0
je 0x401dab
inc ecx
dec eax
jne 0x401da0
jmp 0x401dd3
test eax, eax
je 0x401dd3
mov ecx, 0xff
sub ecx, eax
mov eax, 0xff
sub eax, ecx
push 0x4b17dc
lea ecx, [ebp + ecx - 0x118]
mov edx, 0x7fffffff
call fcn.00401000
mov eax, dword [ebx*4 + 0x4cd390]
push eax
call edi
test eax, eax
je 0x401e2e
lea edi, [eax + 0x184]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
mov edx, 0x7ffffffe
lea ecx, [ebp - 0x248]
mov eax, 0x104
jne 0x401e13
push str.No_path_available
call fcn.00401000
push str.No_path_available
jmp 0x401e1a
push edi
call fcn.00401000
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebx*4 + 0x4cd390]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp dword [0x4d2afc], 0
lea eax, [ebp - 0x248]
lea edi, [ebp - 0x118]
mov ebx, 0x80000002
je 0x401e72
mov dword [0x4c6448], 0x20206
call fcn.0048e230
lea eax, [ebp - 0x248]
mov dword [0x4c6448], 0x20106
call fcn.0048e230
lea eax, [ebp - 0x248]
mov dword [0x4c6448], 0x20006
call fcn.0048e230
mov dword [0x4c6448], esi
jmp 0x401f7b
cmp esi, 0x384
jne 0x401f81
lea edx, [ebp - 0x2c8]
push edx
mov edx, 0x7ffffffe
mov eax, 0xff
lea ecx, [ebp - 0x118]
call fcn.00401000
mov eax, 0xff
lea ecx, [ebp - 0x118]
nop
cmp byte [ecx], 0
je 0x401ecb
inc ecx
dec eax
jne 0x401ec0
jmp 0x401ef3
test eax, eax
je 0x401ef3
mov ecx, 0xff
sub ecx, eax
mov eax, 0xff
sub eax, ecx
push 0x4b17dc
lea ecx, [ebp + ecx - 0x118]
mov edx, 0x7fffffff
call fcn.00401000
mov eax, dword [ebx*4 + 0x4cd390]
push eax
call edi
test eax, eax
je 0x401f4c
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [eax + 0x184]
push esi
call edi
test eax, eax
mov edx, 0x7ffffffe
lea ecx, [ebp - 0x248]
mov eax, 0x104
jne 0x401f35
push str.No_path_available
call fcn.00401000
push str.No_path_available
jmp 0x401f3c
push esi
call fcn.00401000
push esi
call edi
mov ecx, dword [ebx*4 + 0x4cd390]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, 0xff
lea eax, [ebp - 0x118]
cmp byte [eax], 0
je 0x401c9b
inc eax
dec edx
jne 0x401f57
jmp 0x401cc5
lea ecx, [ebp - 0x118]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
inc dword [ebp - 0x664]
lea edx, [ebp - 0x450]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x4020c0
lea eax, [ebp - 0x14]
push eax
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [ebp - 0x660]
call fcn.00401000
mov edx, 0x104
lea eax, [ebp - 0x660]
lea ebx, [ebx]
cmp byte [eax], 0
je 0x401fcb
inc eax
dec edx
jne 0x401fc0
jmp 0x401ff5
test edx, edx
je 0x401ff5
mov ecx, 0x104
sub ecx, edx
lea edx, [ebp - 0x450]
mov eax, 0x104
push edx
sub eax, ecx
lea ecx, [ebp + ecx - 0x660]
mov edx, 0x7fffffff
call fcn.00401000
push 5
lea eax, [ebp - 0x660]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, dword [ebp - 0x668]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x402074
mov ecx, dword [ebp - 0x668]
jmp 0x402020
cmp byte [eax + ecx], 0x5c
je 0x40202d
dec eax
test eax, eax
jg 0x402020
jmp 0x402074
lea ecx, [ebp - 0x558]
mov esi, ecx
sub eax, esi
mov esi, dword [ebp - 0x668]
mov edx, 0x104
lea esi, [eax + esi + 1]
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x40205f
mov al, byte [esi + ecx]
test al, al
je 0x40205f
mov byte [ecx], al
inc ecx
dec edx
jne 0x402046
jmp 0x402063
test edx, edx
jne 0x402064
dec ecx
mov byte [ecx], 0
lea ecx, [ebp - 0x558]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, dword [ebp - 0x668]
lea edx, [ebp - 0x118]
push edx
lea eax, [ebp - 0x558]
push edi
push eax
mov ecx, 3
mov edx, 0x384
call fcn.0048c740
add esp, 0xc
push str.Remove_BHO
lea esi, [ebp - 0x450]
call fcn.0047fb10
add esp, 4
push 7
mov edx, edi
lea ecx, [ebp - 0x348]
call fcn.0048c5e0
add esp, 4
mov ebx, dword [ebp - 0x670]
inc ebx
mov dword [ebp - 0x670], ebx
cmp ebx, dword [0x4cd38c]
jl 0x401b5b
mov eax, dword [ebp - 0x664]
cmp dword [0x4d2afc], 0
je 0x402100
mov ecx, dword [ebp - 0x674]
mov edx, dword [ebp - 0x66c]
mov dword [0x4c6444], ecx
mov dword [0x4c6448], edx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a01d6
mov esp, ebp
pop ebp
ret