Function at 0x411177
Capabilities:
Delete file
Move file
Persist via run registry key
Query environment variable

Disassembly:
push 0x254
mov eax, 0x448b06
call fcn.00432829
mov eax, dword [ebp + 0xc]
push 0
mov ebx, ecx
mov edi, 0xbbb
push edi
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x248], eax
call fcn.00412218
mov eax, dword [ebp + 8]
push 0x2e
mov ecx, ebx
call fcn.00404b43
mov esi, eax
call fcn.00403d7f
mov esi, dword [ebp + 8]
push eax
lea eax, [ebp - 0x258]
push eax
mov eax, esi
mov ecx, ebx
call fcn.00404b43
mov ecx, eax
call fcn.00412384
and dword [ebp - 4], 0
push dword [ebp - 0x248]
lea ecx, [ebp - 0x25c]
call fcn.0040153f
mov byte [ebp - 4], 1
push str..msi
lea ecx, [ebp - 0x258]
call fcn.00402483
test eax, eax
jne 0x41122c
mov eax, esi
mov ecx, ebx
call fcn.00404b43
push dword [eax]
push dword [ebx + 0x1c]
call fcn.00412d03
test eax, eax
jne 0x41198e
mov eax, dword [ebx + 0x1c]
mov dword [eax + 0x108], 1
jmp 0x41198e
push 0x45337c
lea ecx, [ebp - 0x25c]
call fcn.00402483
test eax, eax
jne 0x4112c6
push 0x19
push edi
mov ecx, ebx
call fcn.00412218
mov eax, dword [0x464630]
push 0
push str.BackupInstalled
call fcn.0040889e
pop ecx
pop ecx
lea ecx, [ebp - 0x238]
call fcn.00401ae0
mov byte [ebp - 4], 2
mov eax, esi
mov ecx, ebx
call fcn.00404b43
push dword [eax]
lea eax, [ebp - 0x238]
push str.__1___S
push eax
call fcn.00405c2a
lea eax, [ebp - 0x238]
add esp, 0xc
push eax
call fcn.00409abe
pop ecx
mov dword [ebp - 0x248], eax
mov byte [ebp - 4], 3
test eax, eax
jne 0x4112af
call fcn.0040b067
mov byte [ebp - 4], 2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x248], 0
jmp 0x41197f
push str..exe
lea ecx, [ebp - 0x258]
call fcn.00402483
test eax, eax
jne 0x4119c8
push 0x19
push edi
mov ecx, ebx
call fcn.00412218
lea ecx, [ebp - 0x238]
call fcn.00401ae0
mov byte [ebp - 4], 4
lea eax, [ebp - 0x238]
push eax
mov edi, 0x4645f8
push 0x4533a0
mov ecx, edi
call fcn.004222c2
test eax, eax
jne 0x411318
call fcn.004227d4
lea ecx, [ebp - 0x250]
call fcn.00401ae0
mov byte [ebp - 4], 5
and dword [ebp - 0x220], 0
lea eax, [ebp - 0x220]
push eax
push 0x44fb08
push 0x4645dc
call fcn.00403db7
test byte [ebp - 0x220], 1
je 0x41135d
push str.__INSTALL
lea ecx, [ebp - 0x250]
call fcn.0040aff1
test byte [ebp - 0x220], 2
je 0x411376
push str.__ENABLEDSP
lea ecx, [ebp - 0x250]
call fcn.0040aff1
test byte [ebp - 0x220], 4
je 0x41138f
push str.__ENABLEHOMEPAGE
lea ecx, [ebp - 0x250]
call fcn.0040aff1
lea ecx, [ebp - 0x248]
call fcn.00401ae0
mov byte [ebp - 4], 6
lea eax, [ebp - 0x248]
push eax
push str.DelayToolbarInstall
mov ecx, edi
call fcn.004222c2
test eax, eax
lea ecx, [ebp - 0x240]
je 0x4116ca
call fcn.00401ae0
mov byte [ebp - 4], 7
lea eax, [ebp - 0x240]
push eax
push 0x450574
mov ecx, edi
call fcn.004222c2
test eax, eax
je 0x4116b6
lea ecx, [ebp - 0x220]
call fcn.00401ae0
mov byte [ebp - 4], 8
mov edi, dword [ebp - 0x240]
mov eax, 0x3fff
push eax
push eax
lea ecx, [ebp - 0x220]
call fcn.00403f73
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0x5c
push dword [ebp - 0x220]
call fcn.0042e47c
test eax, eax
pop ecx
pop ecx
jne 0x41142a
or eax, 0xffffffff
jmp 0x411432
sub eax, dword [ebp - 0x220]
sar eax, 1
push eax
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x220]
call fcn.00403e6e
mov byte [ebp - 4], 9
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x224]
call fcn.00403de1
mov byte [ebp - 4], 0xa
push str._tbmon.exe
lea ecx, [ebp - 0x224]
call fcn.0040aff1
mov eax, dword [ebx + 8]
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [esi + 1]
cmp eax, ecx
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 0x22d], 0
jle 0x4114c1
push dword [ebp - 0x224]
call esi
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp + 8]
inc eax
mov ecx, ebx
call fcn.00404b43
push dword [ebp - 0x23c]
mov eax, dword [eax]
push eax
call edi
test eax, eax
je 0x4114c1
mov byte [ebp - 0x22d], 1
push str._avgtoolbar.exe
lea ecx, [ebp - 0x22c]
call fcn.0040aff1
push dword [ebp - 0x22c]
call esi
mov eax, dword [ebp + 8]
mov esi, dword [ebp - 0x22c]
mov ecx, ebx
call fcn.00404b43
mov eax, dword [eax]
push esi
push eax
call edi
test eax, eax
je 0x411689
lea ecx, [ebp - 0x24c]
call fcn.00401ae0
mov byte [ebp - 4], 0xb
push 0x4644a0
call fcn.00404eb8
test eax, eax
mov esi, 0x453468
jne 0x41151e
mov esi, str.DEFAULT
lea eax, [ebp - 0x23c]
push eax
call fcn.00409b35
pop ecx
mov byte [ebp - 4], 0xc
mov eax, dword [eax]
push esi
push eax
push dword [ebp - 0x238]
lea eax, [ebp - 0x24c]
push str.TB38GF9P66
push dword [ebp - 0x250]
push str._1__PASSWORD_2__SILENT__DISTRIBUTIONSOURCE_3__LOCAL_4__PROFILESATB__BROWSER_5
push eax
call fcn.00405c2a
add esp, 0x1c
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x23c]
call fcn.00401b17
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
lea ecx, [ebp - 0x228]
call fcn.0040153f
mov byte [ebp - 4], 0xd
and dword [ebp - 0x234], 0
mov byte [ebp - 4], 0xe
call fcn.0040a192
neg al
lea edi, [ebp - 0x234]
sbb eax, eax
and eax, 0x100
add eax, 0x20006
push eax
push dword [ebp - 0x228]
push Ordinal_4
call fcn.00404035
test eax, eax
jne 0x41165c
lea eax, [ebp - 0x244]
push eax
lea ecx, [ebp - 0x22c]
call fcn.0041230c
mov byte [ebp - 4], 0xf
mov dword [esp], 0x4535a4
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.00407ce9
add esp, 0xc
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x24c]
push ecx
push eax
lea eax, [ebp - 0x23c]
push eax
call fcn.004122b5
add esp, 0xc
mov byte [ebp - 4], 0x11
push dword [eax]
mov eax, edi
push 0x4535b0
push eax
call fcn.00403ffb
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x23c]
call fcn.00401b17
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x254]
call fcn.00401b17
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x244]
call fcn.00401b17
cmp byte [ebp - 0x22d], 0
je 0x41165c
push dword [ebp - 0x224]
mov eax, edi
push str.TBMon
push eax
call fcn.00403ffb
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x234]
call fcn.004032a4
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x228]
call fcn.00401b17
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x24c]
call fcn.00401b17
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x224]
call fcn.00401b17
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x22c]
call fcn.00401b17
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x220]
call fcn.00401b17
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x240]
call fcn.00401b17
jmp 0x411961
call fcn.00401ae0
mov byte [ebp - 4], 0x12
push 0x4644a0
call fcn.00404eb8
test eax, eax
mov dword [ebp - 0x228], 0x453468
jne 0x4116f5
mov dword [ebp - 0x228], str.DEFAULT
lea eax, [ebp - 0x244]
push eax
call fcn.00409b35
pop ecx
mov byte [ebp - 4], 0x13
mov esi, dword [eax]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x23c]
mov edi, dword [ebp - 0x238]
mov ebx, dword [ebp - 0x250]
call fcn.00404b43
push dword [ebp - 0x228]
mov eax, dword [eax]
push esi
push edi
push str.TB38GF9P66
push ebx
push eax
lea eax, [ebp - 0x240]
push str.__1___2__PASSWORD_3__SILENT__DISTRIBUTIONSOURCE_4__LOCAL_5__PROFILESATB__BROWSER_6
push eax
call fcn.00405c2a
add esp, 0x20
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x244]
call fcn.00401b17
lea eax, [ebp - 0x240]
push eax
call fcn.00409abe
pop ecx
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x260], eax
mov byte [ebp - 4], 0x14
xor esi, esi
cmp eax, esi
je 0x4112aa
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [0x464560], 1
mov dword [ebp - 0x224], 0x2710
lea ecx, [ebp - 0x220]
call fcn.00401ae0
mov byte [ebp - 4], 0x15
push str.AVG_Secure_Search
lea eax, [ebp - 0x220]
push str.SOFTWARE_s
push eax
call fcn.004026ca
add esp, 0xc
call fcn.0040a192
neg al
mov dword [ebp - 0x22c], esi
sbb eax, eax
and eax, 0x200
add eax, 0x20019
mov dword [ebp - 0x24c], eax
mov byte [ebp - 4], 0x16
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x24c]
mov dword [ebp - 0x228], esi
push esi
push dword [ebp - 0x220]
push Ordinal_4
call ebx
cmp eax, esi
jne 0x411853
lea ecx, [ebp - 0x22c]
call fcn.004032a4
cmp eax, esi
mov ecx, dword [ebp - 0x228]
mov dword [ebp - 0x22c], ecx
jne 0x411853
push str._machine_id
lea eax, [ebp - 0x22c]
push eax
lea esi, [ebp - 0x244]
lea edi, [ebp - 0x21c]
mov dword [ebp - 0x244], 0x104
call fcn.00403f94
test eax, eax
jne 0x411853
and dword [ebp - 0x224], eax
push str.AVG_SafeGuard_toolbar
lea eax, [ebp - 0x220]
push str.SOFTWARE_s
push eax
call fcn.004026ca
xor esi, esi
add esp, 0xc
mov dword [ebp - 0x234], esi
mov byte [ebp - 4], 0x17
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x24c]
mov dword [ebp - 0x228], esi
push esi
push dword [ebp - 0x220]
push Ordinal_4
call ebx
cmp eax, esi
jne 0x4118e9
lea ecx, [ebp - 0x234]
call fcn.004032a4
cmp eax, esi
mov ecx, dword [ebp - 0x228]
mov dword [ebp - 0x234], ecx
jne 0x4118e9
push str._machine_id
lea eax, [ebp - 0x234]
push eax
lea esi, [ebp - 0x244]
lea edi, [ebp - 0x21c]
mov dword [ebp - 0x244], 0x104
call fcn.00403f94
test eax, eax
jne 0x4118e9
and dword [ebp - 0x224], eax
mov eax, 0x1f4
sub dword [ebp - 0x224], eax
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x234]
call fcn.004032a4
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x22c]
call fcn.004032a4
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x220]
call fcn.00401b17
xor esi, esi
cmp dword [ebp - 0x224], esi
jg 0x411797
mov byte [ebp - 4], 0x12
push dword [ebp - 0x254]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x260], esi
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x240]
call fcn.00401b17
mov ebx, dword [ebp - 0x23c]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x248]
call fcn.00401b17
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x250]
call fcn.00401b17
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x238]
call fcn.00401b17
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x108]
xor ecx, ecx
test eax, eax
sete cl
mov esi, ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x25c]
call fcn.00401b17
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x258]
call fcn.00401b17
mov eax, esi
call fcn.004328ac
ret 8
call fcn.0041b755
int3