Function at 0x411586
Capabilities:
Delete file
Move file
Persist via run registry key
Query environment variable

Disassembly:
push 0x254
mov eax, 0x448f62
call fcn.00432c29
mov eax, dword [ebp + 0xc]
push 0
mov ebx, ecx
mov edi, 0xbbb
push edi
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x248], eax
call fcn.00412652
mov eax, dword [ebp + 8]
push 0x2e
mov ecx, ebx
call fcn.00404d22
mov esi, eax
call fcn.00403ef0
mov esi, dword [ebp + 8]
push eax
lea eax, [ebp - 0x258]
push eax
mov eax, esi
mov ecx, ebx
call fcn.00404d22
mov ecx, eax
call fcn.004127ad
and dword [ebp - 4], 0
push dword [ebp - 0x248]
lea ecx, [ebp - 0x25c]
call fcn.0040153f
mov byte [ebp - 4], 1
push str..msi
lea ecx, [ebp - 0x258]
call fcn.004025e1
test eax, eax
jne 0x41163b
mov eax, esi
mov ecx, ebx
call fcn.00404d22
push dword [eax]
push dword [ebx + 0x1c]
call fcn.0041312c
test eax, eax
jne 0x411d9d
mov eax, dword [ebx + 0x1c]
mov dword [eax + 0x108], 1
jmp 0x411d9d
push 0x45339c
lea ecx, [ebp - 0x25c]
call fcn.004025e1
test eax, eax
jne 0x4116d5
push 0x19
push edi
mov ecx, ebx
call fcn.00412652
mov eax, dword [0x464630]
push 0
push str.BackupInstalled
call fcn.00408a1a
pop ecx
pop ecx
lea ecx, [ebp - 0x238]
call fcn.00408a81
mov byte [ebp - 4], 2
mov eax, esi
mov ecx, ebx
call fcn.00404d22
push dword [eax]
lea eax, [ebp - 0x238]
push str.__1___S__productmypcbackup__hash92e094e6__tidmpbcpl__popup_delay1200000
push eax
call fcn.00405d73
lea eax, [ebp - 0x238]
add esp, 0xc
push eax
call fcn.00409e1d
pop ecx
mov dword [ebp - 0x248], eax
mov byte [ebp - 4], 3
test eax, eax
jne 0x4116be
call fcn.0040b3f1
mov byte [ebp - 4], 2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x248], 0
jmp 0x411d8e
push str..exe
lea ecx, [ebp - 0x258]
call fcn.004025e1
test eax, eax
jne 0x411dd7
push 0x19
push edi
mov ecx, ebx
call fcn.00412652
lea ecx, [ebp - 0x238]
call fcn.00408a81
mov byte [ebp - 4], 4
lea eax, [ebp - 0x238]
push eax
mov edi, 0x4645f8
push 0x45344c
mov ecx, edi
call fcn.004226c2
test eax, eax
jne 0x411727
call fcn.00422bd4
lea ecx, [ebp - 0x250]
call fcn.00408a81
mov byte [ebp - 4], 5
and dword [ebp - 0x220], 0
lea eax, [ebp - 0x220]
push eax
push 0x44fb18
push 0x4645dc
call fcn.00403f28
test byte [ebp - 0x220], 1
je 0x41176c
push str.__INSTALL
lea ecx, [ebp - 0x250]
call fcn.0040b37b
test byte [ebp - 0x220], 2
je 0x411785
push str.__ENABLEDSP
lea ecx, [ebp - 0x250]
call fcn.0040b37b
test byte [ebp - 0x220], 4
je 0x41179e
push str.__ENABLEHOMEPAGE
lea ecx, [ebp - 0x250]
call fcn.0040b37b
lea ecx, [ebp - 0x248]
call fcn.00408a81
mov byte [ebp - 4], 6
lea eax, [ebp - 0x248]
push eax
push str.DelayToolbarInstall
mov ecx, edi
call fcn.004226c2
test eax, eax
lea ecx, [ebp - 0x240]
je 0x411ad9
call fcn.00408a81
mov byte [ebp - 4], 7
lea eax, [ebp - 0x240]
push eax
push 0x4505a8
mov ecx, edi
call fcn.004226c2
test eax, eax
je 0x411ac5
lea ecx, [ebp - 0x220]
call fcn.00408a81
mov byte [ebp - 4], 8
mov edi, dword [ebp - 0x240]
mov eax, 0x3fff
push eax
push eax
lea ecx, [ebp - 0x220]
call fcn.004040e4
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0x5c
push dword [ebp - 0x220]
call fcn.0042e87c
test eax, eax
pop ecx
pop ecx
jne 0x411839
or eax, 0xffffffff
jmp 0x411841
sub eax, dword [ebp - 0x220]
sar eax, 1
push eax
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x220]
call fcn.00403fdf
mov byte [ebp - 4], 9
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x224]
call fcn.00403f52
mov byte [ebp - 4], 0xa
push str._tbmon.exe
lea ecx, [ebp - 0x224]
call fcn.0040b37b
mov eax, dword [ebx + 8]
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [esi + 1]
cmp eax, ecx
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 0x22d], 0
jle 0x4118d0
push dword [ebp - 0x224]
call esi
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp + 8]
inc eax
mov ecx, ebx
call fcn.00404d22
push dword [ebp - 0x23c]
mov eax, dword [eax]
push eax
call edi
test eax, eax
je 0x4118d0
mov byte [ebp - 0x22d], 1
push str._avgtoolbar.exe
lea ecx, [ebp - 0x22c]
call fcn.0040b37b
push dword [ebp - 0x22c]
call esi
mov eax, dword [ebp + 8]
mov esi, dword [ebp - 0x22c]
mov ecx, ebx
call fcn.00404d22
mov eax, dword [eax]
push esi
push eax
call edi
test eax, eax
je 0x411a98
lea ecx, [ebp - 0x24c]
call fcn.00408a81
mov byte [ebp - 4], 0xb
push 0x4644a0
call fcn.00405097
test eax, eax
mov esi, 0x453514
jne 0x41192d
mov esi, str.DEFAULT
lea eax, [ebp - 0x23c]
push eax
call fcn.00409e94
pop ecx
mov byte [ebp - 4], 0xc
mov eax, dword [eax]
push esi
push eax
push dword [ebp - 0x238]
lea eax, [ebp - 0x24c]
push str.TB38GF9P66
push dword [ebp - 0x250]
push str._1__PASSWORD_2__SILENT__DISTRIBUTIONSOURCE_3__LOCAL_4__PROFILESATB__BROWSER_5
push eax
call fcn.00405d73
add esp, 0x1c
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x23c]
call fcn.00408aab
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
lea ecx, [ebp - 0x228]
call fcn.0040153f
mov byte [ebp - 4], 0xd
and dword [ebp - 0x234], 0
mov byte [ebp - 4], 0xe
call fcn.0040a4f1
neg al
lea edi, [ebp - 0x234]
sbb eax, eax
and eax, 0x100
add eax, 0x20006
push eax
push dword [ebp - 0x228]
push Ordinal_4
call fcn.004041a6
test eax, eax
jne 0x411a6b
lea eax, [ebp - 0x244]
push eax
lea ecx, [ebp - 0x22c]
call fcn.00412746
mov byte [ebp - 4], 0xf
mov dword [esp], 0x453654
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.00407e65
add esp, 0xc
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x24c]
push ecx
push eax
lea eax, [ebp - 0x23c]
push eax
call fcn.004126ef
add esp, 0xc
mov byte [ebp - 4], 0x11
push dword [eax]
mov eax, edi
push 0x453660
push eax
call fcn.0040416c
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x23c]
call fcn.00408aab
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x254]
call fcn.00408aab
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x244]
call fcn.00408aab
cmp byte [ebp - 0x22d], 0
je 0x411a6b
push dword [ebp - 0x224]
mov eax, edi
push str.TBMon
push eax
call fcn.0040416c
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x234]
call fcn.0040329c
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x228]
call fcn.00408aab
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x24c]
call fcn.00408aab
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x224]
call fcn.00408aab
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x22c]
call fcn.00408aab
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x220]
call fcn.00408aab
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x240]
call fcn.00408aab
jmp 0x411d70
call fcn.00408a81
mov byte [ebp - 4], 0x12
push 0x4644a0
call fcn.00405097
test eax, eax
mov dword [ebp - 0x228], 0x453514
jne 0x411b04
mov dword [ebp - 0x228], str.DEFAULT
lea eax, [ebp - 0x244]
push eax
call fcn.00409e94
pop ecx
mov byte [ebp - 4], 0x13
mov esi, dword [eax]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x23c]
mov edi, dword [ebp - 0x238]
mov ebx, dword [ebp - 0x250]
call fcn.00404d22
push dword [ebp - 0x228]
mov eax, dword [eax]
push esi
push edi
push str.TB38GF9P66
push ebx
push eax
lea eax, [ebp - 0x240]
push str.__1___2__PASSWORD_3__SILENT__DISTRIBUTIONSOURCE_4__LOCAL_5__PROFILESATB__BROWSER_6
push eax
call fcn.00405d73
add esp, 0x20
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x244]
call fcn.00408aab
lea eax, [ebp - 0x240]
push eax
call fcn.00409e1d
pop ecx
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x260], eax
mov byte [ebp - 4], 0x14
xor esi, esi
cmp eax, esi
je 0x4116b9
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [0x464560], 1
mov dword [ebp - 0x224], 0x2710
lea ecx, [ebp - 0x220]
call fcn.00408a81
mov byte [ebp - 4], 0x15
push str.AVG_Secure_Search
lea eax, [ebp - 0x220]
push str.SOFTWARE_s
push eax
call fcn.00402828
add esp, 0xc
call fcn.0040a4f1
neg al
mov dword [ebp - 0x22c], esi
sbb eax, eax
and eax, 0x200
add eax, 0x20019
mov dword [ebp - 0x24c], eax
mov byte [ebp - 4], 0x16
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x24c]
mov dword [ebp - 0x228], esi
push esi
push dword [ebp - 0x220]
push Ordinal_4
call ebx
cmp eax, esi
jne 0x411c62
lea ecx, [ebp - 0x22c]
call fcn.0040329c
cmp eax, esi
mov ecx, dword [ebp - 0x228]
mov dword [ebp - 0x22c], ecx
jne 0x411c62
push str._machine_id
lea eax, [ebp - 0x22c]
push eax
lea esi, [ebp - 0x244]
lea edi, [ebp - 0x21c]
mov dword [ebp - 0x244], 0x104
call fcn.00404105
test eax, eax
jne 0x411c62
and dword [ebp - 0x224], eax
push str.AVG_SafeGuard_toolbar
lea eax, [ebp - 0x220]
push str.SOFTWARE_s
push eax
call fcn.00402828
xor esi, esi
add esp, 0xc
mov dword [ebp - 0x234], esi
mov byte [ebp - 4], 0x17
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x24c]
mov dword [ebp - 0x228], esi
push esi
push dword [ebp - 0x220]
push Ordinal_4
call ebx
cmp eax, esi
jne 0x411cf8
lea ecx, [ebp - 0x234]
call fcn.0040329c
cmp eax, esi
mov ecx, dword [ebp - 0x228]
mov dword [ebp - 0x234], ecx
jne 0x411cf8
push str._machine_id
lea eax, [ebp - 0x234]
push eax
lea esi, [ebp - 0x244]
lea edi, [ebp - 0x21c]
mov dword [ebp - 0x244], 0x104
call fcn.00404105
test eax, eax
jne 0x411cf8
and dword [ebp - 0x224], eax
mov eax, 0x1f4
sub dword [ebp - 0x224], eax
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x234]
call fcn.0040329c
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x22c]
call fcn.0040329c
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x220]
call fcn.00408aab
xor esi, esi
cmp dword [ebp - 0x224], esi
jg 0x411ba6
mov byte [ebp - 4], 0x12
push dword [ebp - 0x254]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x260], esi
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x240]
call fcn.00408aab
mov ebx, dword [ebp - 0x23c]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x248]
call fcn.00408aab
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x250]
call fcn.00408aab
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x238]
call fcn.00408aab
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x108]
xor ecx, ecx
test eax, eax
sete cl
mov esi, ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x25c]
call fcn.00408aab
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x258]
call fcn.00408aab
mov eax, esi
call fcn.00432cac
ret 8
call fcn.0041bb55
int3