Function at 0x48e19f
Capabilities:
Delete registry value
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
xor edx, edx
push edi
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], esi
cmp dword [ebp + 0x14], edx
jne 0x48eb08
mov ecx, dword [ebx + 0x434]
cmp ecx, edx
je 0x48e1f2
cmp dword [ebx + 0x118], edx
je 0x48e1f2
lea edi, [esp + 0x14]
push edi
push dword [esp + 0x14]
mov dword [esp + 0x1c], edx
mov edx, dword [ecx]
push eax
push dword [ebp + 0xc]
call dword [edx + 0x28]
mov eax, dword [ebp + 0xc]
xor edi, edi
inc edi
cmp eax, 0x7d2
jne 0x48e23f
mov ecx, dword [ebx + 0x43c]
test ecx, ecx
je 0x48e28e
cmp dword [ebx + 0x128], 0
je 0x48e28e
and dword [esp + 0x1c], 0
mov eax, dword [ecx]
lea edx, [esp + 0x1c]
push edx
push dword [esp + 0x14]
push dword [esp + 0x14]
push 0x7d2
call dword [eax + 0x28]
push dword [esp + 0xc]
call fcn.004f2b13
mov eax, dword [ebp + 0xc]
pop ecx
mov ecx, 0x3ea
cmp eax, ecx
jne 0x48e262
push dword [esp + 0x10]
mov edi, dword [esp + 0x10]
push ecx
mov ecx, ebx
call fcn.0049d4d1
mov dword [esi], eax
xor eax, eax
inc eax
jmp 0x48eb0a
cmp eax, edi
jne 0x48e275
push ebx
call fcn.00490ee3
mov dword [esi], eax
mov eax, edi
jmp 0x48eb0a
cmp eax, 0x47
jne 0x48e28e
lea eax, [esp + 0x20]
push eax
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindowRect]
and dword [esi], 0
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebx + 0x2f4]
jne 0x48e2a3
push 0
mov ecx, ebx
call fcn.00496c5b
mov dword [esi], edi
jmp 0x48e26e
cmp eax, 2
jne 0x48e2f0
mov edi, ebx
mov dword [ebx + 0x108], 1
call fcn.00492843
and dword [esi], 0
cmp dword [ebx + 0x108], 0
jne 0x48e25a
mov esi, dword [ebx + 0x68]
add ebx, 0x30
cmp dword [ebp + 0xc], 0x2653
jne 0x48eafb
push dword [esp + 0xc]
push ebx
call fcn.0047f29b
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
xor eax, eax
inc eax
jmp 0x48eafd
cmp eax, 0x10
jne 0x48e317
push 0
push dword [ebx + 4]
mov dword [ebx + 0x108], edi
call dword [sym.imp.USER32.dll_ShowWindow]
and dword [esi], 0
cmp dword [ebx + 0x108], 0
je 0x48e2c5
jmp 0x48e26e
cmp eax, 0x46e
jne 0x48e33b
xor eax, eax
cmp dword [ebx + 0x2f0], eax
je 0x48e26c
push dword [esp + 0x10]
push ebx
call fcn.0049729d
jmp 0x48e26c
cmp eax, 0x113
jne 0x48e35d
push dword [esp + 0xc]
lea edx, [esp + 0x18]
push ebx
mov dword [esp + 0x1c], edi
call fcn.00495ab6
cmp dword [esp + 0x14], 0
mov dword [esi], eax
jmp 0x48e310
cmp eax, 0x4a
jne 0x48e37b
push dword [esp + 0x10]
mov edx, dword [esp + 0x10]
mov ecx, ebx
mov dword [ebx + 0x108], edi
call fcn.004933e3
mov dword [esi], eax
jmp 0x48e309
cmp eax, 0x7e
jne 0x48e390
mov dword [ebx + 0x108], edi
call fcn.0048fec5
jmp 0x48e306
cmp eax, 0x46f
jne 0x48e3aa
push dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
push ebx
call fcn.00497b2c
jmp 0x48e26c
cmp eax, 0x4f3
jne 0x48e3cb
push dword [esp + 0xc]
lea ecx, [ebx + 0x2f8]
mov dword [ebx + 0x108], edi
call fcn.004ac0a6
jmp 0x48e306
mov ecx, 0x507
cmp eax, ecx
jne 0x48e3e2
push ecx
mov dword [ebx + 0x108], edi
call fcn.00498eec
jmp 0x48e377
mov ecx, 0x4f0
cmp eax, ecx
je 0x48e3d4
mov ecx, 0x41c
cmp eax, ecx
jne 0x48e40d
push dword [esp + 0x10]
mov dword [ebx + 0x108], edi
push dword [esp + 0x10]
push ecx
call fcn.00498f07
jmp 0x48e377
mov ecx, 0x417
cmp eax, ecx
je 0x48e3f4
cmp eax, 0x470
jne 0x48e431
push dword [esp + 0xc]
mov dword [ebx + 0x108], edi
call fcn.00498f28
jmp 0x48e377
cmp eax, 0x47d
jne 0x48e44c
push dword [esp + 0xc]
mov dword [ebx + 0x108], edi
call fcn.00498fac
jmp 0x48e377
cmp eax, 0x473
jne 0x48e463
mov dword [ebx + 0x108], edi
call fcn.004c3143
jmp 0x48e306
cmp eax, 0x472
jne 0x48e48e
xor eax, eax
mov dword [ebx + 0x108], edi
cmp dword [ebx + 0x12c], eax
je 0x48e377
push dword [esp + 0xc]
mov eax, ebx
call fcn.00499f34
jmp 0x48e377
cmp eax, 0x506
jne 0x48e4ae
push dword [esp + 0x10]
mov eax, dword [esp + 0x10]
push ebx
mov dword [ebx + 0x108], edi
call fcn.00499265
jmp 0x48e377
cmp eax, 0x905
jne 0x48e502
xor eax, eax
cmp dword [esp + 0xc], 0x18
mov dword [ebx + 0x108], edi
jne 0x48e377
mov eax, dword [ebx + 0x24]
mov dword [esp + 0x1c], eax
call fcn.00449525
push eax
mov eax, dword [esp + 0x20]
lea ecx, [ebx + 0x24]
call dword [eax + 0x24]
test eax, eax
je 0x48e4fb
push str.true
push eax
call fcn.004f5171
pop ecx
pop ecx
test eax, eax
jne 0x48e4fb
mov eax, edi
jmp 0x48e377
xor eax, eax
jmp 0x48e377
mov ecx, 0x3cfe
cmp eax, ecx
jne 0x48e532
mov eax, dword [0x59376c]
mov dword [ebx + 0x108], edi
test eax, eax
je 0x48e306
push dword [esp + 0x10]
push dword [esp + 0x10]
push ecx
push eax
call fcn.0048b9de
jmp 0x48e306
cmp eax, 0x219
jne 0x48e553
push dword [esp + 0x10]
mov eax, ebx
push dword [esp + 0x10]
mov dword [ebx + 0x108], edi
call fcn.00499312
jmp 0x48e377
cmp eax, 0xbd0
jne 0x48e572
cmp dword [esp + 0xc], 0x64
mov dword [ebx + 0x108], edi
jne 0x48e4fb
push ebx
call fcn.00499075
jmp 0x48e377
cmp eax, 0xfb9
jne 0x48e589
mov dword [ebx + 0x108], edi
call fcn.00499145
jmp 0x48e377
mov ecx, 0x416
cmp eax, ecx
jne 0x48e5bc
push dword [esp + 0x10]
mov esi, dword [esp + 0x10]
lea edi, [ebx + 0x108]
push ecx
mov eax, ebx
mov dword [edi], 1
call fcn.004991c5
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
cmp dword [edi], 0
jmp 0x48e2c3
cmp eax, 0x474
jne 0x48e60b
cmp dword [ebx + 0x4c4], 0
mov dword [ebx + 0x108], edi
jne 0x48e306
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.0040df4f
pop ecx
test al, al
je 0x48e306
push 0
push 0xea60
mov dword [ebx + 0x4c4], edi
push 0x44f
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x48e306
cmp eax, 0x478
jne 0x48e62a
mov edi, ebx
mov dword [ebx + 0x108], 1
call fcn.0049cf5b
mov dword [esi], eax
jmp 0x48e2bc
cmp eax, 0x479
jne 0x48e647
mov edi, dword [esp + 0xc]
push ebx
mov dword [ebx + 0x108], 1
call fcn.0049cfb3
jmp 0x48e623
cmp eax, 0x47c
jne 0x48e66f
cmp dword [esp + 0xc], edi
push 0
sete al
push 0x12c
mov dword [ebx + 0x108], edi
mov byte [ebx + 0x6d4], al
push 0x640
jmp 0x48e5fd
cmp eax, 0xfba
jne 0x48e68b
push 0x593268
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
and dword [esi], 0
jmp 0x48e26e
cmp eax, 0x475
jne 0x48e69c
call fcn.0049a3e1
jmp 0x48e26c
cmp eax, 0x476
jne 0x48e6ad
call fcn.0049a4f7
jmp 0x48e26c
cmp eax, 0x477
jne 0x48e6be
call fcn.0049a637
jmp 0x48e26c
mov ecx, 0x880
cmp eax, ecx
jne 0x48e6e7
cmp dword [esp + 0xc], 0xff
je 0x48e6d8
xor eax, eax
jmp 0x48e26c
push dword [esp + 0x10]
push ecx
call fcn.0049a7a2
jmp 0x48e26c
mov ecx, 0x881
cmp eax, ecx
je 0x48e6c7
inc ecx
cmp eax, ecx
je 0x48e6c7
mov ecx, 0x883
cmp eax, ecx
je 0x48e6c7
cmp eax, 0x47a
jne 0x48e710
push ebx
call fcn.0049c92c
jmp 0x48e683
cmp eax, 0x13a0
jne 0x48e72b
push dword [esp + 0xc]
lea eax, [ebx + 0x6cc]
call fcn.00476455
jmp 0x48e683
cmp eax, 0x13a1
jne 0x48e774
cmp dword [esp + 0xc], 8
jne 0x48e683
mov eax, dword [esp + 0x10]
sub eax, 5
je 0x48e760
dec eax
jne 0x48e683
lea edi, [ebx + 0x6cc]
call fcn.00476a5b
xor edi, edi
inc edi
jmp 0x48e683
push 0x593d60
call fcn.0043c637
call fcn.00439a55
jmp 0x48e683
cmp eax, 0x13a2
jne 0x48e789
push dword [esp + 0xc]
call fcn.0049ca74
jmp 0x48e26c
cmp eax, 0x406
jne 0x48e79b
push ebx
call fcn.004a28e1
jmp 0x48e26c
cmp eax, 0x18aa3
jne 0x48e7b2
push dword [esp + 0xc]
mov ecx, ebx
call fcn.0049aced
jmp 0x48e26c
cmp eax, 0x788
jne 0x48e7c4
mov eax, dword [ebx + 0x52c]
jmp 0x48e26c
cmp eax, 0x702
jne 0x48e7e5
push dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov esi, ebx
call fcn.0049e078
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
jmp 0x48e25a
cmp eax, 0x111
jne 0x48e8ab
mov ecx, dword [esp + 0xc]
add eax, 0xffffffb9
mov edx, eax
cmp dx, cx
jne 0x48e810
push edi
push 0x7fff7f
push eax
push ebx
call fcn.00491d89
jmp 0x48e683
mov eax, 0xcf
cmp ax, cx
jne 0x48e831
cmp byte [0x594fbc], 1
je 0x48e6d1
call fcn.0049712b
jmp 0x48e26c
mov eax, 0xc9
cmp ax, cx
jne 0x48e84d
xor esi, esi
call fcn.004b289c
mov eax, dword [esp + 0x18]
and dword [eax], esi
jmp 0x48e25a
mov eax, 0xcd
cmp ax, cx
jne 0x48e866
mov edi, ebx
call fcn.004982fd
and dword [esi], 0
jmp 0x48e25a
mov eax, 0xd0
cmp ax, cx
jne 0x48e87e
push 0
mov ecx, ebx
call fcn.00498862
jmp 0x48e683
mov eax, 0x259
mov edx, eax
cmp dx, cx
jne 0x48e891
push 0
jmp 0x48e7ff
mov eax, 0xd5
cmp ax, cx
jne 0x48e2c5
mov ecx, ebx
call fcn.0049f2f0
jmp 0x48e26c
cmp eax, 0x401
jne 0x48e8d3
add ebx, 0x2e4
mov eax, dword [ebx]
test eax, eax
je 0x48e683
lea ecx, [eax + 0x2c]
mov eax, dword [ecx]
push edi
call dword [eax + 4]
and dword [ebx], 0
jmp 0x48e683
cmp eax, 0x16
jne 0x48e906
push str.YandexInstall
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebx + 0x108], edi
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push edi
push 0x7fff7f
push 0x64
push ebx
call fcn.00491d89
jmp 0x48e306
cmp eax, 0x218
jne 0x48e91d
push dword [esp + 0xc]
mov esi, ebx
call fcn.0049ee63
jmp 0x48e7da
cmp eax, 0x2b1
jne 0x48e94e
cmp dword [esp + 0xc], 8
jne 0x48e683
lea eax, [ebx + 0xd54]
cmp byte [eax], 0
je 0x48e683
push edi
mov ecx, ebx
mov byte [eax], 0
call fcn.0049f552
jmp 0x48e683
cmp eax, 0x727
jne 0x48e968
push dword [esp + 0x10]
push dword [esp + 0x10]
push ebx
call fcn.0049ef3f
jmp 0x48e26c
cmp eax, 0x4cc
jne 0x48e981
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.0049f1c9
jmp 0x48e26c
cmp eax, 0x101c
jne 0x48e997
push dword [esp + 0xc]
push ebx
call fcn.004a2317
jmp 0x48e26c
cmp eax, 0x101d
jne 0x48e9ad
push dword [esp + 0xc]
push ebx
call fcn.004a24b7
jmp 0x48e26c
cmp eax, 0x48b
jne 0x48e9d6
call fcn.00410ec2
cmp eax, edi
je 0x48e6d1
push 0
push ecx
call int.0040b2f7
add esp, 4
call fcn.0047795e
jmp 0x48e26c
cmp eax, 0x405
jne 0x48e9ed
push dword [esp + 0xc]
mov eax, ebx
call fcn.004a26ea
jmp 0x48e26c
cmp eax, 0x784
jne 0x48ea00
push edi
call fcn.0046a2c0
pop ecx
jmp 0x48e683
cmp eax, 0x407
jne 0x48ea13
mov edi, ebx
call fcn.0049d8f8
jmp 0x48e258
cmp eax, 0x408
jne 0x48ea25
push ebx
call fcn.0049e83d
jmp 0x48e26c
cmp eax, 0x409
jne 0x48ea37
push ebx
call fcn.004a0de6
jmp 0x48e26c
cmp eax, 0x40a
jne 0x48ea4a
mov ecx, ebx
call fcn.004a0f4b
jmp 0x48e26c
cmp eax, 0x40b
jne 0x48ea82
lea eax, [ebx + 0x2e4]
cmp dword [eax], 0
je 0x48e683
push ecx
mov ecx, esp
and dword [ecx], 0
push ecx
mov ecx, esp
and dword [ecx], 0
mov esi, dword [eax]
push dword [ebx + 4]
add esi, 0x2c
call fcn.0047a3b4
mov esi, dword [esp + 0x18]
jmp 0x48e758
mov ecx, 0x31d
cmp eax, ecx
jne 0x48eaa9
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
mov eax, ebx
push dword [esp + 0x14]
mov dword [esp + 0x20], edi
push ecx
call fcn.004a1025
jmp 0x48e354
mov ecx, 0x308
cmp eax, ecx
jne 0x48ead0
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
mov eax, ebx
push dword [esp + 0x14]
mov dword [esp + 0x20], edi
push ecx
call fcn.004a1025
jmp 0x48e354
mov ecx, 0x30d
cmp eax, ecx
jne 0x48e2c5
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
mov eax, ebx
push dword [esp + 0x14]
mov dword [esp + 0x20], edi
push ecx
call fcn.004a1025
jmp 0x48e354
xor eax, eax
mov dword [ebx + 0x38], esi
test eax, eax
jne 0x48e25a
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10