Function at 0x401b50
Capabilities:
Create process on windows
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x674
mov eax, dword [0x4f72bc]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x506e0c], 0
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov ecx, 0x12
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects
lea edi, [ebp - 0x348]
rep movsd dword es:[edi], dword [esi]
mov edx, dword [0x4e28fc]
movsw word es:[edi], word [esi]
mov ecx, 0xc
mov esi, str.SOFTWAREMicrosoftInternet_ExplorerExtensions
lea edi, [ebp - 0x178]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0xb
mov esi, str.SOFTWAREMicrosoftInternet_ExplorerToolbar
lea edi, [ebp - 0x148]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [str.regsvr32__u__s]
mov dword [ebp - 0x668], eax
mov eax, dword [0x4e2900]
mov dword [ebp - 0x14], ecx
mov ecx, dword [0x4e2904]
movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
je 0x401bff
mov edx, dword [0x4f8b78]
mov eax, dword [0x4f8b7c]
mov dword [ebp - 0x674], edx
mov dword [ebp - 0x670], eax
mov dword [0x4f8b78], 0x20119
mov dword [0x4f8b7c], 0x20106
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x664], eax
mov dword [ebp - 0x66c], ebx
cmp dword [0x505890], eax
jle 0x4021ed
jmp 0x401c20
lea edi, [ebp - 0x450]
call fcn.004c22f0
mov ecx, dword [ebx*4 + 0x501878]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalLock]
push ecx
call edi
mov ebx, eax
test ebx, ebx
je 0x401c9f
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebx
call esi
test eax, eax
mov edx, 0x7ffffffe
lea ecx, [ebp - 0x2f8]
mov eax, 0x80
jne 0x401c6f
push str.Title_Not_Found
call fcn.004010b0
push str.Title_Not_Found
jmp 0x401c76
push ebx
call fcn.004010b0
push ebx
call esi
push str.Title
lea esi, [ebp - 0x2f8]
call fcn.0047da70
mov edx, dword [ebp - 0x66c]
mov eax, dword [edx*4 + 0x501878]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [ebp - 0x668]
lea ecx, [ebp - 0x450]
push ecx
push edx
call fcn.00483650
test eax, eax
jne 0x4021ce
mov esi, dword [ebp + 0xc]
mov eax, dword [esi*4 + 0x501878]
push eax
call edi
test eax, eax
je 0x402091
mov ecx, dword [esi*4 + 0x501878]
mov ebx, dword [eax + 0x288]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp ebx, 0x386
jne 0x401e3d
lea edx, [ebp - 0x178]
push edx
mov edx, 0x7ffffffe
mov eax, 0xff
lea ecx, [ebp - 0x118]
call fcn.004010b0
mov eax, 0xff
lea ecx, [ebp - 0x118]
cmp byte [ecx], 0
je 0x401d21
inc ecx
dec eax
jne 0x401d16
jmp 0x401d49
test eax, eax
je 0x401d49
mov ecx, 0xff
sub ecx, eax
mov eax, 0xff
sub eax, ecx
push 0x4e28bc
lea ecx, [ebp + ecx - 0x118]
mov edx, 0x7fffffff
call fcn.004010b0
lea edi, [ebp - 0x278]
mov ebx, esi
call fcn.004c22f0
mov edx, 0xff
lea eax, [ebp - 0x118]
cmp byte [eax], 0
je 0x401d6c
inc eax
dec edx
jne 0x401d61
jmp 0x401d96
test edx, edx
je 0x401d96
lea eax, [ebp - 0x278]
push eax
mov ecx, 0xff
sub ecx, edx
mov eax, 0xff
sub eax, ecx
lea ecx, [ebp + ecx - 0x118]
mov edx, 0x7fffffff
call fcn.004010b0
cmp dword [0x506e0c], 0
je 0x402079
cmp dword [0x506e0c], 0
je 0x401e31
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.Advapi32.dll
call ebx
mov edi, eax
test edi, edi
je 0x401def
push str.RegDeleteKeyExA
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401de8
push 0
push 0x200
lea ecx, [ebp - 0x118]
push ecx
push CreateStatusWindowA
call eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [0x506e0c], 0
je 0x401e31
push str.Advapi32.dll
call ebx
mov edi, eax
test edi, edi
je 0x401e31
push str.RegDeleteKeyExA
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401e2a
push 0
push 0x100
lea edx, [ebp - 0x118]
push edx
push CreateStatusWindowA
call eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x118]
push eax
jmp 0x402080
cmp ebx, 0x385
jne 0x401f1f
mov esi, dword [0x4f8b7c]
lea edx, [ebp - 0x148]
push edx
mov edx, 0x7ffffffe
mov eax, 0xff
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x670], esi
call fcn.004010b0
mov eax, 0xff
lea ecx, [ebp - 0x118]
lea esp, [esp]
cmp byte [ecx], 0
je 0x401e8b
inc ecx
dec eax
jne 0x401e80
jmp 0x401eb3
test eax, eax
je 0x401eb3
mov ecx, 0xff
sub ecx, eax
mov eax, 0xff
sub eax, ecx
push 0x4e28bc
lea ecx, [ebp + ecx - 0x118]
mov edx, 0x7fffffff
call fcn.004010b0
mov eax, dword [ebp + 0xc]
push eax
lea ebx, [ebp - 0x278]
call fcn.004c23e0
add esp, 4
cmp dword [0x506e0c], 0
mov eax, ebx
lea edi, [ebp - 0x118]
mov ebx, CreateStatusWindowA
je 0x401f05
mov dword [0x4f8b7c], 0x20206
call fcn.004c00f0
lea eax, [ebp - 0x278]
mov dword [0x4f8b7c], 0x20106
call fcn.004c00f0
lea eax, [ebp - 0x278]
mov dword [0x4f8b7c], 0x20006
call fcn.004c00f0
mov dword [0x4f8b7c], esi
jmp 0x40208b
cmp ebx, 0x384
jne 0x402091
lea ecx, [ebp - 0x348]
push ecx
mov edx, 0x7ffffffe
mov eax, 0xff
lea ecx, [ebp - 0x118]
call fcn.004010b0
mov eax, 0xff
lea ecx, [ebp - 0x118]
cmp byte [ecx], 0
je 0x401f5d
inc ecx
dec eax
jne 0x401f52
jmp 0x401f85
test eax, eax
je 0x401f85
mov ecx, 0xff
sub ecx, eax
mov eax, 0xff
sub eax, ecx
push 0x4e28bc
lea ecx, [ebp + ecx - 0x118]
mov edx, 0x7fffffff
call fcn.004010b0
push esi
lea ebx, [ebp - 0x278]
call fcn.004c23e0
add esp, 4
mov edx, 0xff
lea eax, [ebp - 0x118]
nop
cmp byte [eax], 0
je 0x401fab
inc eax
dec edx
jne 0x401fa0
jmp 0x401fd5
test edx, edx
je 0x401fd5
mov ecx, 0xff
sub ecx, edx
lea edx, [ebp - 0x278]
mov eax, 0xff
push edx
sub eax, ecx
lea ecx, [ebp + ecx - 0x118]
mov edx, 0x7fffffff
call fcn.004010b0
cmp dword [0x506e0c], 0
je 0x402079
cmp dword [0x506e0c], 0
je 0x402070
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.Advapi32.dll
call edi
mov ebx, eax
test ebx, ebx
je 0x40202e
push str.RegDeleteKeyExA
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x402027
push 0
push 0x200
lea ecx, [ebp - 0x118]
push ecx
push CreateStatusWindowA
call eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [0x506e0c], 0
je 0x402070
push str.Advapi32.dll
call edi
mov ebx, eax
test ebx, ebx
je 0x402070
push str.RegDeleteKeyExA
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x402069
push 0
push 0x100
lea edx, [ebp - 0x118]
push edx
push CreateStatusWindowA
call eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x118]
push eax
jmp 0x402080
lea ecx, [ebp - 0x118]
push ecx
push CreateStatusWindowA
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
inc dword [ebp - 0x664]
lea edx, [ebp - 0x450]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x4021ce
lea eax, [ebp - 0x14]
push eax
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [ebp - 0x660]
call fcn.004010b0
mov edx, 0x104
lea eax, [ebp - 0x660]
lea ebx, [ebx]
cmp byte [eax], 0
je 0x4020db
inc eax
dec edx
jne 0x4020d0
jmp 0x402105
test edx, edx
je 0x402105
mov ecx, 0x104
sub ecx, edx
lea edx, [ebp - 0x450]
mov eax, 0x104
push edx
sub eax, ecx
lea ecx, [ebp + ecx - 0x660]
mov edx, 0x7fffffff
call fcn.004010b0
push 5
lea eax, [ebp - 0x660]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, dword [ebp - 0x668]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x40217e
cmp byte [eax + esi], 0x5c
je 0x402132
dec eax
test eax, eax
jg 0x402125
jmp 0x40217e
lea ecx, [ebp - 0x558]
mov esi, ecx
sub eax, esi
mov esi, dword [ebp - 0x668]
mov edx, 0x104
lea ebx, [eax + esi + 1]
jmp 0x402150
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x402169
mov al, byte [ecx + ebx]
test al, al
je 0x402169
mov byte [ecx], al
inc ecx
dec edx
jne 0x402150
jmp 0x40216d
test edx, edx
jne 0x40216e
dec ecx
mov byte [ecx], 0
lea ecx, [ebp - 0x558]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov eax, dword [ebp - 0x668]
lea edx, [ebp - 0x118]
push edx
push eax
lea ecx, [ebp - 0x558]
push ecx
mov ecx, 3
mov edx, 0x384
call fcn.0048cb90
add esp, 0xc
push str.Remove_BHO
lea esi, [ebp - 0x450]
call fcn.0047da70
mov edx, dword [ebp - 0x668]
add esp, 4
push 7
lea ecx, [ebp - 0x2f8]
call fcn.0048ca30
add esp, 4
mov ebx, dword [ebp - 0x66c]
inc ebx
mov dword [ebp - 0x66c], ebx
cmp ebx, dword [0x505890]
jl 0x401c20
mov eax, dword [ebp - 0x664]
cmp dword [0x506e0c], 0
je 0x40220e
mov edx, dword [ebp - 0x674]
mov ecx, dword [ebp - 0x670]
mov dword [0x4f8b78], edx
mov dword [0x4f8b7c], ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004cf2b6
mov esp, ebp
pop ebp
ret