Function at 0x403204
Capabilities:
Create process on windows
Delete registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x481d4b
mov eax, dword fs:[0]
push eax
sub esp, 0x278
mov eax, dword [0x49e0b0]
xor eax, esp
mov dword [esp + 0x270], eax
push ebx
push esi
push edi
mov eax, dword [0x49e0b0]
xor eax, esp
push eax
lea eax, [esp + 0x288]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0x18], esi
cmp dword [esi + 0x4b4], ebx
jne 0x403262
push 0x10
push 0x486298
push 0x4867d4
jmp 0x40329d
push str.ruleCleaned
mov edi, 0x486008
push edi
call fcn.004114af
test eax, eax
je 0x4032ab
push str.ruleCleaned
push edi
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push str.GlobalB9A7C12B_AB68_49ff_9A08_080F1B1E0200
call fcn.00401336
push 0x40
push 0x48627c
push 0x486828
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4034b7
mov eax, esi
call fcn.004031eb
test al, al
je 0x4034b7
push ebx
push ebx
lea eax, [esp + 0x44]
call fcn.0041ebf1
sub esp, 0x18
mov dword [esp + 0x2a8], 2
mov esi, esp
mov dword [esp + 0x34], esp
push 0x486844
call fcn.0041dbcd
lea eax, [esp + 0x54]
push eax
mov edx, str.cbe_details
mov byte [esp + 0x2ac], 3
call fcn.0041eee7
mov edi, eax
mov byte [esp + 0x2a8], 2
call fcn.0041dea7
push 0x48611c
lea esi, [esp + 0x5c]
call fcn.00404522
mov eax, esi
push eax
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x298], 4
call fcn.004012f3
sub esp, 0x10
mov byte [esp + 0x2a8], 5
mov edx, eax
mov esi, esp
mov dword [esp + 0x34], esp
call fcn.0041dc4f
lea eax, [esp + 0x54]
push eax
mov edx, str.cbe_type
mov byte [esp + 0x2ac], 6
call fcn.0041eee7
mov edi, eax
mov byte [esp + 0x2a8], 5
call fcn.0041dea7
xor edi, edi
push ebx
inc edi
push edi
lea ecx, [esp + 0x28]
call fcn.00404863
push ebx
push edi
lea esi, [esp + 0x60]
mov byte [esp + 0x298], 2
call fcn.00404960
lea eax, [esp + 0x3c]
push eax
call fcn.00426c2c
lea ecx, [esp + 0x20]
call fcn.004139f4
cmp dword [eax + 0x18], 8
jb 0x4033a9
mov eax, dword [eax + 4]
jmp 0x4033ac
add eax, 4
call fcn.00410467
push ebx
push edi
lea esi, [esp + 0x28]
call fcn.00404960
lea ecx, [esp + 0x20]
call fcn.004139f4
cmp dword [eax + 0x18], 8
jb 0x4033d0
mov eax, dword [eax + 4]
jmp 0x4033d3
add eax, 4
push eax
call fcn.0040ffe8
cmp eax, 2
jne 0x4033e7
mov byte [esp + 0x17], 1
cmp edx, ebx
je 0x4033eb
mov byte [esp + 0x17], bl
push ebx
push edi
lea esi, [esp + 0x28]
call fcn.00404960
cmp byte [esp + 0x17], bl
je 0x403442
mov eax, dword [esp + 0x18]
push 0x40
push 0x4865b8
push 0x486870
push dword [eax + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
call fcn.00411839
mov dword [esp], str.ruleupt
push 0x48607c
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
jmp 0x4034a6
xor eax, eax
push 0x206
mov word [esp + 0x78], ax
lea eax, [esp + 0x7a]
push ebx
push eax
call fcn.004667e0
add esp, 0xc
push 0x104
lea eax, [esp + 0x78]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push edi
push ebx
push str._clearRules
lea eax, [esp + 0x80]
push eax
push str.runas
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x4034a6
mov eax, dword [esp + 0x18]
push 0x10
push 0x486298
push 0x4868f0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
or dword [esp + 0x290], 0xffffffff
lea esi, [esp + 0x3c]
call fcn.0041de24
mov ecx, dword [esp + 0x288]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x270]
xor ecx, esp
call fcn.00464d54
mov esp, ebp
pop ebp
ret