Function at 0x403288
Capabilities:
Create process on windows
Delete registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x484f65
mov eax, dword fs:[0]
push eax
sub esp, 0x278
mov eax, dword [0x4a20b0]
xor eax, esp
mov dword [esp + 0x270], eax
push ebx
push esi
push edi
mov eax, dword [0x4a20b0]
xor eax, esp
push eax
lea eax, [esp + 0x288]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0x18], esi
cmp dword [esi + 0x4b4], ebx
jne 0x4032e6
push 0x10
push 0x4892c8
push 0x48980c
jmp 0x403321
push str.ruleCleaned
mov edi, 0x489038
push edi
call fcn.00412528
test eax, eax
je 0x40332f
push str.ruleCleaned
push edi
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push str.GlobalB9A7C12B_AB68_49ff_9A08_080F1B1E0200
call fcn.00401314
push 0x40
push 0x4892ac
push 0x489860
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x40353b
mov eax, esi
call fcn.0040326f
test al, al
je 0x40353b
push ebx
push ebx
lea eax, [esp + 0x44]
call fcn.0041fc92
sub esp, 0x18
mov dword [esp + 0x2a8], 2
mov esi, esp
mov dword [esp + 0x34], esp
push 0x48987c
call fcn.0041ec6e
lea eax, [esp + 0x54]
push eax
mov edx, str.cbe_details
mov byte [esp + 0x2ac], 3
call fcn.0041ff88
mov edi, eax
mov byte [esp + 0x2a8], 2
call fcn.0041ef48
push 0x48914c
lea esi, [esp + 0x5c]
call fcn.004045a2
mov eax, esi
push eax
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x298], 4
call fcn.004012d1
sub esp, 0x10
mov byte [esp + 0x2a8], 5
mov edx, eax
mov esi, esp
mov dword [esp + 0x34], esp
call fcn.0041ecf0
lea eax, [esp + 0x54]
push eax
mov edx, str.cbe_type
mov byte [esp + 0x2ac], 6
call fcn.0041ff88
mov edi, eax
mov byte [esp + 0x2a8], 5
call fcn.0041ef48
xor edi, edi
push ebx
inc edi
push edi
lea ecx, [esp + 0x28]
call fcn.0040488d
push ebx
push edi
lea esi, [esp + 0x60]
mov byte [esp + 0x298], 2
call fcn.0040498a
lea eax, [esp + 0x3c]
push eax
call fcn.00427b4b
lea ecx, [esp + 0x20]
call fcn.00414a71
cmp dword [eax + 0x18], 8
jb 0x40342d
mov eax, dword [eax + 4]
jmp 0x403430
add eax, 4
call fcn.00411498
push ebx
push edi
lea esi, [esp + 0x28]
call fcn.0040498a
lea ecx, [esp + 0x20]
call fcn.00414a71
cmp dword [eax + 0x18], 8
jb 0x403454
mov eax, dword [eax + 4]
jmp 0x403457
add eax, 4
push eax
call fcn.00411019
cmp eax, 2
jne 0x40346b
mov byte [esp + 0x17], 1
cmp edx, ebx
je 0x40346f
mov byte [esp + 0x17], bl
push ebx
push edi
lea esi, [esp + 0x28]
call fcn.0040498a
cmp byte [esp + 0x17], bl
je 0x4034c6
mov eax, dword [esp + 0x18]
push 0x40
push 0x4895f0
push 0x4898a8
push dword [eax + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
call fcn.004128b2
mov dword [esp], str.ruleupt
push 0x4890ac
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
jmp 0x40352a
xor eax, eax
push 0x206
mov word [esp + 0x78], ax
lea eax, [esp + 0x7a]
push ebx
push eax
call fcn.00469330
add esp, 0xc
push 0x104
lea eax, [esp + 0x78]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push edi
push ebx
push str._clearRules
lea eax, [esp + 0x80]
push eax
push str.runas
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x40352a
mov eax, dword [esp + 0x18]
push 0x10
push 0x4892c8
push 0x489928
push dword [eax + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
or dword [esp + 0x290], 0xffffffff
lea esi, [esp + 0x3c]
call fcn.0041eec5
mov ecx, dword [esp + 0x288]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x270]
xor ecx, esp
call fcn.004678b3
mov esp, ebp
pop ebp
ret