Function at 0x4473b1
Capabilities:
Delete file
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
xor ebx, ebx
push edi
push ebx
push ebx
push ebx
push 1
pop edi
push edi
push 0xab
call fcn.00424a93
pop ecx
push eax
mov ecx, 0x475a08
call fcn.00415cb4
push SysReAllocString
lea eax, [ebp - 0x108]
push 0x104
push eax
push 0x40ae1c
push ebx
call fcn.00424191
add esp, 0x14
test eax, eax
je 0x4476de
push esi
mov esi, 0x40eda8
lea eax, [ebp - 0x108]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x447430
test cl, cl
je 0x44742c
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x447430
inc eax
inc eax
inc esi
inc esi
test cl, cl
jne 0x44740e
xor eax, eax
jmp 0x447435
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jge 0x447486
push 4
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
pop ebx
lea eax, [ebp - 4]
push ebx
mov dword [ebp - 4], edi
push eax
push ebx
mov edi, 0x40ed64
push 0x40ed5c
push edi
push SysReAllocString
call esi
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push 0x40ed54
push edi
push SysReAllocString
mov dword [ebp - 4], 3
call esi
xor eax, eax
push eax
push eax
push 0x27
push eax
call dword [sym.imp.WININET.dll_InternetSetOptionA]
xor ebx, ebx
mov esi, 0x40ed4c
lea eax, [ebp - 0x108]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4474b3
test cl, cl
je 0x4474af
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4474b3
inc eax
inc eax
inc esi
inc esi
test cl, cl
jne 0x447491
xor eax, eax
jmp 0x4474b8
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jge 0x4474c2
mov dword [0x473b50], ebx
mov esi, 0x40ed44
lea eax, [ebp - 0x108]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4474ef
test cl, cl
je 0x4474eb
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4474ef
inc eax
inc eax
inc esi
inc esi
test cl, cl
jne 0x4474cd
xor eax, eax
jmp 0x4474f4
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jge 0x44750d
push 2
mov dword [0x4736b8], 0x16
pop ebx
mov dword [0x4736bc], ebx
jmp 0x447510
push 2
pop ebx
mov esi, 0x40ed3c
lea eax, [ebp - 0x108]
mov edi, esi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [edi]
jne 0x44753f
test cl, cl
je 0x44753b
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [edi + 1]
jne 0x44753f
add eax, ebx
add edi, ebx
test cl, cl
jne 0x44751d
xor eax, eax
jmp 0x447544
sbb eax, eax
sbb eax, 0xffffffff
xor edi, edi
cmp eax, edi
jge 0x44756f
push edi
push edi
push 0x14e
mov ecx, 0x497684
call fcn.0045c0a7
push SysReAllocString
push edi
push 0x40ed34
push edi
call fcn.0042462b
add esp, 0x10
lea eax, [ebp - 0x108]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x447597
test cl, cl
je 0x447593
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x447597
add eax, ebx
add esi, ebx
test cl, cl
jne 0x447575
xor eax, eax
jmp 0x44759c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jge 0x4475aa
mov dword [0x473b50], 1
mov esi, 0x40ed2c
lea eax, [ebp - 0x108]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4475d7
test cl, cl
je 0x4475d3
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4475d7
add eax, ebx
add esi, ebx
test cl, cl
jne 0x4475b5
xor eax, eax
jmp 0x4475dc
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jge 0x4475f1
push SysReAllocString
push 0x40a61c
call fcn.00423cb6
pop ecx
pop ecx
mov esi, 0x40ed24
lea eax, [ebp - 0x108]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x44761e
test cl, cl
je 0x44761a
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x44761e
add eax, ebx
add esi, ebx
test cl, cl
jne 0x4475fc
xor eax, eax
jmp 0x447623
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jge 0x44764b
push 0xba
call fcn.00424a93
pop ecx
push eax
push 0x40a158
push 0xfff
push 0x471e58
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
mov esi, 0x40ed1c
lea eax, [ebp - 0x108]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x447678
test cl, cl
je 0x447674
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x447678
add eax, ebx
add esi, ebx
test cl, cl
jne 0x447656
xor eax, eax
jmp 0x44767d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
pop esi
jge 0x4476de
and byte [ebp - 0x20c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x20b]
and dword [0x473b64], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40b3dc
lea eax, [ebp - 0x20c]
push 0x103
push eax
push dword [0x532da0]
call fcn.00425ffa
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004260d1
add esp, 0x18
test eax, eax
je 0x4476de
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call sub.KERNEL32.dll_GetACP
call fcn.00426ee3
pop edi
pop ebx
test eax, eax
jne 0x44770a
push 0x30
push 0x40a37c
push 0x78
call fcn.00424a93
pop ecx
push eax
push dword [0x532504]
call dword [sym.imp.USER32.dll_MessageBoxA]
leave
ret