Function at 0x411335
Capabilities:
Delete file
Move file
Persist via run registry key
Query environment variable

Disassembly:
push 0x254
mov eax, 0x448cdf
call fcn.004329c9
mov eax, dword [ebp + 0xc]
push 0
mov ebx, ecx
mov edi, 0xbbb
push edi
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x248], eax
call fcn.004123ce
mov eax, dword [ebp + 8]
push 0x2e
mov ecx, ebx
call fcn.00404d2e
mov esi, eax
call fcn.00403f0f
mov esi, dword [ebp + 8]
push eax
lea eax, [ebp - 0x258]
push eax
mov eax, esi
mov ecx, ebx
call fcn.00404d2e
mov ecx, eax
call fcn.00412529
and dword [ebp - 4], 0
push dword [ebp - 0x248]
lea ecx, [ebp - 0x25c]
call fcn.0040153f
mov byte [ebp - 4], 1
push str..msi
lea ecx, [ebp - 0x258]
call fcn.004024de
test eax, eax
jne 0x4113ea
mov eax, esi
mov ecx, ebx
call fcn.00404d2e
push dword [eax]
push dword [ebx + 0x1c]
call fcn.00412ea8
test eax, eax
jne 0x411b4c
mov eax, dword [ebx + 0x1c]
mov dword [eax + 0x108], 1
jmp 0x411b4c
push 0x453364
lea ecx, [ebp - 0x25c]
call fcn.004024de
test eax, eax
jne 0x411484
push 0x19
push edi
mov ecx, ebx
call fcn.004123ce
mov eax, dword [0x464630]
push 0
push str.BackupInstalled
call fcn.00408912
pop ecx
pop ecx
lea ecx, [ebp - 0x238]
call fcn.00408979
mov byte [ebp - 4], 2
mov eax, esi
mov ecx, ebx
call fcn.00404d2e
push dword [eax]
lea eax, [ebp - 0x238]
push str.__1___S__productmypcbackup__hash2a5a1408__tidmpbcpl__popup_delay1200000
push eax
call fcn.00405e18
lea eax, [ebp - 0x238]
add esp, 0xc
push eax
call fcn.00409cb5
pop ecx
mov dword [ebp - 0x248], eax
mov byte [ebp - 4], 3
test eax, eax
jne 0x41146d
call fcn.0040b214
mov byte [ebp - 4], 2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x248], 0
jmp 0x411b3d
push str..exe
lea ecx, [ebp - 0x258]
call fcn.004024de
test eax, eax
jne 0x411b86
push 0x19
push edi
mov ecx, ebx
call fcn.004123ce
lea ecx, [ebp - 0x238]
call fcn.00408979
mov byte [ebp - 4], 4
lea eax, [ebp - 0x238]
push eax
mov edi, 0x4645f8
push 0x453414
mov ecx, edi
call fcn.004223e9
test eax, eax
jne 0x4114d6
call fcn.004228fb
lea ecx, [ebp - 0x250]
call fcn.00408979
mov byte [ebp - 4], 5
and dword [ebp - 0x220], 0
lea eax, [ebp - 0x220]
push eax
push 0x44fb18
push 0x4645dc
call fcn.00403f47
test byte [ebp - 0x220], 1
je 0x41151b
push str.__INSTALL
lea ecx, [ebp - 0x250]
call fcn.0040b19e
test byte [ebp - 0x220], 2
je 0x411534
push str.__ENABLEDSP
lea ecx, [ebp - 0x250]
call fcn.0040b19e
test byte [ebp - 0x220], 4
je 0x41154d
push str.__ENABLEHOMEPAGE
lea ecx, [ebp - 0x250]
call fcn.0040b19e
lea ecx, [ebp - 0x248]
call fcn.00408979
mov byte [ebp - 4], 6
lea eax, [ebp - 0x248]
push eax
push 0x45347c
mov ecx, edi
call fcn.004223e9
test eax, eax
lea ecx, [ebp - 0x240]
je 0x411888
call fcn.00408979
mov byte [ebp - 4], 7
lea eax, [ebp - 0x240]
push eax
push 0x4505a8
mov ecx, edi
call fcn.004223e9
test eax, eax
je 0x411874
lea ecx, [ebp - 0x220]
call fcn.00408979
mov byte [ebp - 4], 8
mov edi, dword [ebp - 0x240]
mov eax, 0x3fff
push eax
push eax
lea ecx, [ebp - 0x220]
call fcn.00404103
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0x5c
push dword [ebp - 0x220]
call fcn.0042e61c
test eax, eax
pop ecx
pop ecx
jne 0x4115e8
or eax, 0xffffffff
jmp 0x4115f0
sub eax, dword [ebp - 0x220]
sar eax, 1
push eax
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x220]
call fcn.00403ffe
mov byte [ebp - 4], 9
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x224]
call fcn.00403f71
mov byte [ebp - 4], 0xa
push str._tbmon.exe
lea ecx, [ebp - 0x224]
call fcn.0040b19e
mov eax, dword [ebx + 8]
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [esi + 1]
cmp eax, ecx
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 0x22d], 0
jle 0x41167f
push dword [ebp - 0x224]
call esi
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp + 8]
inc eax
mov ecx, ebx
call fcn.00404d2e
push dword [ebp - 0x23c]
mov eax, dword [eax]
push eax
call edi
test eax, eax
je 0x41167f
mov byte [ebp - 0x22d], 1
push str._avgtoolbar.exe
lea ecx, [ebp - 0x22c]
call fcn.0040b19e
push dword [ebp - 0x22c]
call esi
mov eax, dword [ebp + 8]
mov esi, dword [ebp - 0x22c]
mov ecx, ebx
call fcn.00404d2e
mov eax, dword [eax]
push esi
push eax
call edi
test eax, eax
je 0x411847
lea ecx, [ebp - 0x24c]
call fcn.00408979
mov byte [ebp - 4], 0xb
push 0x4644a0
call fcn.004050a3
test eax, eax
mov esi, 0x4534dc
jne 0x4116dc
mov esi, str.DEFAULT
lea eax, [ebp - 0x23c]
push eax
call fcn.00409d2c
pop ecx
mov byte [ebp - 4], 0xc
mov eax, dword [eax]
push esi
push eax
push dword [ebp - 0x238]
lea eax, [ebp - 0x24c]
push str.TB38GF9P66
push dword [ebp - 0x250]
push str._1__PASSWORD_2__SILENT__DISTRIBUTIONSOURCE_3__LOCAL_4__PROFILESATB__BROWSER_5
push eax
call fcn.00405e18
add esp, 0x1c
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x23c]
call fcn.004089a3
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
lea ecx, [ebp - 0x228]
call fcn.0040153f
mov byte [ebp - 4], 0xd
and dword [ebp - 0x234], 0
mov byte [ebp - 4], 0xe
call fcn.0040a389
neg al
lea edi, [ebp - 0x234]
sbb eax, eax
and eax, 0x100
add eax, 0x20006
push eax
push dword [ebp - 0x228]
push Ordinal_4
call fcn.004041c5
test eax, eax
jne 0x41181a
lea eax, [ebp - 0x244]
push eax
lea ecx, [ebp - 0x22c]
call fcn.004124c2
mov byte [ebp - 4], 0xf
mov dword [esp], 0x45361c
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.00407d5d
add esp, 0xc
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x24c]
push ecx
push eax
lea eax, [ebp - 0x23c]
push eax
call fcn.0041246b
add esp, 0xc
mov byte [ebp - 4], 0x11
push dword [eax]
mov eax, edi
push 0x453628
push eax
call fcn.0040418b
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x23c]
call fcn.004089a3
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x254]
call fcn.004089a3
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x244]
call fcn.004089a3
cmp byte [ebp - 0x22d], 0
je 0x41181a
push dword [ebp - 0x224]
mov eax, edi
push str.TBMon
push eax
call fcn.0040418b
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x234]
call fcn.004032bb
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x228]
call fcn.004089a3
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x24c]
call fcn.004089a3
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x224]
call fcn.004089a3
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x22c]
call fcn.004089a3
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x220]
call fcn.004089a3
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x240]
call fcn.004089a3
jmp 0x411b1f
call fcn.00408979
mov byte [ebp - 4], 0x12
push 0x4644a0
call fcn.004050a3
test eax, eax
mov dword [ebp - 0x228], 0x4534dc
jne 0x4118b3
mov dword [ebp - 0x228], str.DEFAULT
lea eax, [ebp - 0x244]
push eax
call fcn.00409d2c
pop ecx
mov byte [ebp - 4], 0x13
mov esi, dword [eax]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x23c]
mov edi, dword [ebp - 0x238]
mov ebx, dword [ebp - 0x250]
call fcn.00404d2e
push dword [ebp - 0x228]
mov eax, dword [eax]
push esi
push edi
push str.TB38GF9P66
push ebx
push eax
lea eax, [ebp - 0x240]
push str.__1___2__PASSWORD_3__SILENT__DISTRIBUTIONSOURCE_4__LOCAL_5__PROFILESATB__BROWSER_6
push eax
call fcn.00405e18
add esp, 0x20
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x244]
call fcn.004089a3
lea eax, [ebp - 0x240]
push eax
call fcn.00409cb5
pop ecx
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x260], eax
mov byte [ebp - 4], 0x14
xor esi, esi
cmp eax, esi
je 0x411468
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [0x464560], 1
mov dword [ebp - 0x224], 0x2710
lea ecx, [ebp - 0x220]
call fcn.00408979
mov byte [ebp - 4], 0x15
push str.AVG_Secure_Search
lea eax, [ebp - 0x220]
push str.SOFTWARE_s
push eax
call fcn.0040276f
add esp, 0xc
call fcn.0040a389
neg al
mov dword [ebp - 0x22c], esi
sbb eax, eax
and eax, 0x200
add eax, 0x20019
mov dword [ebp - 0x24c], eax
mov byte [ebp - 4], 0x16
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x24c]
mov dword [ebp - 0x228], esi
push esi
push dword [ebp - 0x220]
push Ordinal_4
call ebx
cmp eax, esi
jne 0x411a11
lea ecx, [ebp - 0x22c]
call fcn.004032bb
cmp eax, esi
mov ecx, dword [ebp - 0x228]
mov dword [ebp - 0x22c], ecx
jne 0x411a11
push str._machine_id
lea eax, [ebp - 0x22c]
push eax
lea esi, [ebp - 0x244]
lea edi, [ebp - 0x21c]
mov dword [ebp - 0x244], 0x104
call fcn.00404124
test eax, eax
jne 0x411a11
and dword [ebp - 0x224], eax
push str.AVG_SafeGuard_toolbar
lea eax, [ebp - 0x220]
push str.SOFTWARE_s
push eax
call fcn.0040276f
xor esi, esi
add esp, 0xc
mov dword [ebp - 0x234], esi
mov byte [ebp - 4], 0x17
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x24c]
mov dword [ebp - 0x228], esi
push esi
push dword [ebp - 0x220]
push Ordinal_4
call ebx
cmp eax, esi
jne 0x411aa7
lea ecx, [ebp - 0x234]
call fcn.004032bb
cmp eax, esi
mov ecx, dword [ebp - 0x228]
mov dword [ebp - 0x234], ecx
jne 0x411aa7
push str._machine_id
lea eax, [ebp - 0x234]
push eax
lea esi, [ebp - 0x244]
lea edi, [ebp - 0x21c]
mov dword [ebp - 0x244], 0x104
call fcn.00404124
test eax, eax
jne 0x411aa7
and dword [ebp - 0x224], eax
mov eax, 0x1f4
sub dword [ebp - 0x224], eax
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x234]
call fcn.004032bb
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x22c]
call fcn.004032bb
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x220]
call fcn.004089a3
xor esi, esi
cmp dword [ebp - 0x224], esi
jg 0x411955
mov byte [ebp - 4], 0x12
push dword [ebp - 0x254]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x260], esi
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x240]
call fcn.004089a3
mov ebx, dword [ebp - 0x23c]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x248]
call fcn.004089a3
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x250]
call fcn.004089a3
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x238]
call fcn.004089a3
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x108]
xor ecx, ecx
test eax, eax
sete cl
mov esi, ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x25c]
call fcn.004089a3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x258]
call fcn.004089a3
mov eax, esi
call fcn.00432a4c
ret 8
call fcn.0041b8f5
int3