Function at 0x49a780
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x4c32cc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov ecx, 6
mov esi, str.http:__www.winpatrol.com_
lea edi, [ebp - 0x12c]
rep movsd dword es:[edi], dword [esi]
push 0x104
lea edx, [ebp - 0x110]
mov ecx, 0x27a
movsw word es:[edi], word [esi]
call fcn.00499890
add esp, 4
push 0x4bf63c
lea eax, [ebp - 0x110]
push eax
call fcn.00483b10
test eax, eax
jne 0x49a7de
mov byte [ebp - 0x110], al
jmp 0x49a823
mov edx, 0x104
lea eax, [ebp - 0x110]
lea esp, [esp]
cmp byte [eax], 0
je 0x49a7fb
inc eax
dec edx
jne 0x49a7f0
jmp 0x49a823
test edx, edx
je 0x49a823
mov ecx, 0x104
sub ecx, edx
mov eax, 0x104
sub eax, ecx
push 0x4bfebc
lea ecx, [ebp + ecx - 0x110]
mov edx, 0x7fffffff
call fcn.00401000
mov eax, dword [ebp + 8]
add eax, 0xffffe876
cmp eax, 0x31
ja case.0x49a83b.6027
movzx ecx, byte [eax + 0x49ae1c]
jmp dword [ecx*4 + 0x49adc0]
mov edx, 0x104
lea eax, [ebp - 0x110]
lea ecx, [ecx]
cmp byte [eax], 0
je 0x49a85e
inc eax
dec edx
jne 0x49a850
jmp 0x49ac74
test edx, edx
je 0x49ac74
push str.reglock.html
jmp 0x49ac55
mov edx, 0x104
lea eax, [ebp - 0x110]
jmp 0x49a880
cmp byte [eax], 0
je 0x49a88e
inc eax
dec edx
jne 0x49a880
jmp 0x49ac74
test edx, edx
je 0x49ac74
push str.startup.html
jmp 0x49ac55
mov edx, 0x104
lea eax, [ebp - 0x110]
jmp 0x49a8b0
cmp byte [eax], 0
je 0x49a8be
inc eax
dec edx
jne 0x49a8b0
jmp 0x49ac74
test edx, edx
je 0x49ac74
push str.tasks.html
jmp 0x49ac55
mov edx, 0x104
lea eax, [ebp - 0x110]
jmp 0x49a8e0
cmp byte [eax], 0
je 0x49a8ee
inc eax
dec edx
jne 0x49a8e0
jmp 0x49ac74
test edx, edx
je 0x49ac74
push str.cookies.html
jmp 0x49ac55
mov edx, 0x104
lea eax, [ebp - 0x110]
jmp 0x49a910
cmp byte [eax], 0
je 0x49a91e
inc eax
dec edx
jne 0x49a910
jmp 0x49ac74
test edx, edx
je 0x49ac74
push str.options.html
jmp 0x49ac55
mov edx, 0x104
lea eax, [ebp - 0x110]
jmp 0x49a940
cmp byte [eax], 0
je 0x49a94e
inc eax
dec edx
jne 0x49a940
jmp 0x49ac74
test edx, edx
je 0x49ac74
push str.services.html
jmp 0x49ac55
mov edx, 0x104
lea eax, [ebp - 0x110]
jmp 0x49a970
cmp byte [eax], 0
je 0x49a97e
inc eax
dec edx
jne 0x49a970
jmp 0x49ac74
test edx, edx
je 0x49ac74
push str.scheduler.html
jmp 0x49ac55
mov edx, 0x104
lea eax, [ebp - 0x110]
jmp 0x49a9a0
cmp byte [eax], 0
je 0x49a9ae
inc eax
dec edx
jne 0x49a9a0
jmp 0x49ac74
test edx, edx
je 0x49ac74
push str.bho.html
jmp 0x49ac55
mov edx, 0x104
lea eax, [ebp - 0x110]
jmp 0x49a9d0
cmp byte [eax], 0
je 0x49a9de
inc eax
dec edx
jne 0x49a9d0
jmp 0x49ac74
test edx, edx
je 0x49ac74
push str.filetype.html
jmp 0x49ac55
mov edx, 0x104
lea eax, [ebp - 0x110]
jmp 0x49aa00
cmp byte [eax], 0
je 0x49aa0e
inc eax
dec edx
jne 0x49aa00
jmp 0x49ac74
test edx, edx
je 0x49ac74
push str.hidden.html
jmp 0x49ac55
mov edx, 0x104
lea eax, [ebp - 0x110]
jmp 0x49aa30
cmp byte [eax], 0
je 0x49aa3e
inc eax
dec edx
jne 0x49aa30
jmp 0x49ac74
test edx, edx
je 0x49ac74
push str.helpme.html
jmp 0x49ac55
mov edx, 0x104
lea eax, [ebp - 0x110]
jmp 0x49aa60
cmp byte [eax], 0
je 0x49aa6e
inc eax
dec edx
jne 0x49aa60
jmp 0x49ac74
test edx, edx
je 0x49ac74
push str.delay.html
jmp 0x49ac55
mov edx, 0x104
lea eax, [ebp - 0x110]
jmp 0x49aa90
cmp byte [eax], 0
je 0x49aa9e
inc eax
dec edx
jne 0x49aa90
jmp 0x49ac74
test edx, edx
je 0x49ac74
push str.activex.html
jmp 0x49ac55
mov edx, 0x104
lea eax, [ebp - 0x110]
jmp 0x49aac0
cmp byte [eax], 0
je 0x49aace
inc eax
dec edx
jne 0x49aac0
jmp 0x49ac74
test edx, edx
je 0x49ac74
push str.recent.html
jmp 0x49ac55
mov edx, 0x104
lea eax, [ebp - 0x110]
jmp 0x49aaf0
cmp byte [eax], 0
je 0x49aafe
inc eax
dec edx
jne 0x49aaf0
jmp 0x49ac74
test edx, edx
je 0x49ac74
push str.reset.html
jmp 0x49ac55
mov edx, 0x104
lea eax, [ebp - 0x110]
jmp 0x49ab20
cmp byte [eax], 0
je 0x49ac4c
inc eax
dec edx
jne 0x49ab20
jmp 0x49ac74
mov edx, 0x104
lea eax, [ebp - 0x110]
lea ecx, [ecx]
cmp byte [eax], 0
je 0x49ab4e
inc eax
dec edx
jne 0x49ab40
jmp 0x49ac74
test edx, edx
je 0x49ac74
push str.defaultpage.htmlstart
jmp 0x49ac55
mov edx, 0x104
lea eax, [ebp - 0x110]
jmp 0x49ab70
cmp byte [eax], 0
je 0x49ab7e
inc eax
dec edx
jne 0x49ab70
jmp 0x49ac74
test edx, edx
je 0x49ac74
push str.defaultpage.htmlsearch
jmp 0x49ac55
mov edx, 0x104
lea eax, [ebp - 0x110]
jmp 0x49aba0
cmp byte [eax], 0
je 0x49abae
inc eax
dec edx
jne 0x49aba0
jmp 0x49ac74
test edx, edx
je 0x49ac74
push str.defaultpage.htmldesktop
jmp 0x49ac55
mov edx, 0x104
lea eax, [ebp - 0x110]
jmp 0x49abd0
cmp byte [eax], 0
je 0x49abde
inc eax
dec edx
jne 0x49abd0
jmp 0x49ac74
test edx, edx
je 0x49ac74
push str.abort.html
jmp 0x49ac55
mov edx, 0x104
lea eax, [ebp - 0x110]
cmp byte [eax], 0
je 0x49ac03
inc eax
dec edx
jne 0x49abf8
jmp 0x49ac74
test edx, edx
je 0x49ac74
push str.alert.html
jmp 0x49ac55
mov edx, 0x104
lea eax, [ebp - 0x110]
lea esp, [esp]
cmp byte [eax], 0
je 0x49ac2b
inc eax
dec edx
jne 0x49ac20
jmp 0x49ac74
test edx, edx
je 0x49ac74
push str.filesizemonitor.html
jmp 0x49ac55
mov edx, 0x104
lea eax, [ebp - 0x110]
cmp byte [eax], 0
je 0x49ac4c
inc eax
dec edx
jne 0x49ac41
jmp 0x49ac74
test edx, edx
je 0x49ac74
push str.features.html
mov ecx, 0x104
sub ecx, edx
mov eax, 0x104
sub eax, ecx
mov edx, 0x7fffffff
lea ecx, [ebp + ecx - 0x110]
call fcn.00401000
lea edi, [ebp - 0x238]
call fcn.0047e3e0
mov edx, 0x104
mov eax, edi
cmp byte [eax], 0
je 0x49ac91
inc eax
dec edx
jne 0x49ac86
jmp 0x49acb9
test edx, edx
je 0x49acb9
mov ecx, 0x104
sub ecx, edx
mov eax, 0x104
sub eax, ecx
push 0x4b17dc
lea ecx, [ebp + ecx - 0x238]
mov edx, 0x7fffffff
call fcn.00401000
mov edx, 0x104
lea eax, [ebp - 0x238]
cmp byte [eax], 0
je 0x49accf
inc eax
dec edx
jne 0x49acc4
jmp 0x49acf9
test edx, edx
je 0x49acf9
mov ecx, 0x104
sub ecx, edx
lea edx, [ebp - 0x110]
mov eax, 0x104
push edx
sub eax, ecx
lea ecx, [ebp + ecx - 0x238]
mov edx, 0x7fffffff
call fcn.00401000
lea ecx, [ebp - 0x238]
call fcn.0047d280
test eax, eax
je 0x49ad29
mov ecx, dword [0x4c78c4]
push 1
push 0x4b17de
push 0x4b17de
lea eax, [ebp - 0x238]
push eax
push str.open
push ecx
jmp 0x49ada4
lea edx, [ebp - 0x12c]
push edx
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [ebp - 0x238]
call fcn.00401000
mov edx, 0x104
lea eax, [ebp - 0x238]
cmp byte [eax], 0
je 0x49ad5b
inc eax
dec edx
jne 0x49ad50
jmp 0x49ad85
test edx, edx
je 0x49ad85
lea eax, [ebp - 0x110]
push eax
mov ecx, 0x104
sub ecx, edx
mov eax, 0x104
sub eax, ecx
lea ecx, [ebp + ecx - 0x238]
mov edx, 0x7fffffff
call fcn.00401000
mov edx, dword [0x4c78c4]
push 1
push 0x4b17de
push 0x4b17de
lea ecx, [ebp - 0x238]
push ecx
push str.open
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.004a01d6
mov esp, ebp
pop ebp
ret