Function at 0x4cb530
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x4f72bc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov ecx, 6
mov esi, str.http:__www.winpatrol.com_
lea edi, [ebp - 0x12c]
rep movsd dword es:[edi], dword [esi]
push 0x104
lea edx, [ebp - 0x110]
mov ecx, 0x27a
movsw word es:[edi], word [esi]
call fcn.004ca1e0
add esp, 4
push 0x4f3640
lea eax, [ebp - 0x110]
push eax
call fcn.00483650
test eax, eax
jne 0x4cb58e
mov byte [ebp - 0x110], al
jmp 0x4cb5d3
mov edx, 0x104
lea eax, [ebp - 0x110]
lea esp, [esp]
cmp byte [eax], 0
je 0x4cb5ab
inc eax
dec edx
jne 0x4cb5a0
jmp 0x4cb5d3
test edx, edx
je 0x4cb5d3
mov ecx, 0x104
sub ecx, edx
mov eax, 0x104
sub eax, ecx
push 0x4f3dd0
lea ecx, [ebp + ecx - 0x110]
mov edx, 0x7fffffff
call fcn.004010b0
mov eax, dword [ebp + 8]
add eax, 0xffffe876
cmp eax, 0x31
ja case.0x4cb5eb.6027
movzx ecx, byte [eax + 0x4cbbcc]
jmp dword [ecx*4 + 0x4cbb70]
mov edx, 0x104
lea eax, [ebp - 0x110]
lea ecx, [ecx]
cmp byte [eax], 0
je 0x4cb60e
inc eax
dec edx
jne 0x4cb600
jmp 0x4cba24
test edx, edx
je 0x4cba24
push str.reglock.html
jmp 0x4cba05
mov edx, 0x104
lea eax, [ebp - 0x110]
jmp 0x4cb630
cmp byte [eax], 0
je 0x4cb63e
inc eax
dec edx
jne 0x4cb630
jmp 0x4cba24
test edx, edx
je 0x4cba24
push str.startup.html
jmp 0x4cba05
mov edx, 0x104
lea eax, [ebp - 0x110]
jmp 0x4cb660
cmp byte [eax], 0
je 0x4cb66e
inc eax
dec edx
jne 0x4cb660
jmp 0x4cba24
test edx, edx
je 0x4cba24
push str.tasks.html
jmp 0x4cba05
mov edx, 0x104
lea eax, [ebp - 0x110]
jmp 0x4cb690
cmp byte [eax], 0
je 0x4cb69e
inc eax
dec edx
jne 0x4cb690
jmp 0x4cba24
test edx, edx
je 0x4cba24
push str.cookies.html
jmp 0x4cba05
mov edx, 0x104
lea eax, [ebp - 0x110]
jmp 0x4cb6c0
cmp byte [eax], 0
je 0x4cb6ce
inc eax
dec edx
jne 0x4cb6c0
jmp 0x4cba24
test edx, edx
je 0x4cba24
push str.options.html
jmp 0x4cba05
mov edx, 0x104
lea eax, [ebp - 0x110]
jmp 0x4cb6f0
cmp byte [eax], 0
je 0x4cb6fe
inc eax
dec edx
jne 0x4cb6f0
jmp 0x4cba24
test edx, edx
je 0x4cba24
push str.services.html
jmp 0x4cba05
mov edx, 0x104
lea eax, [ebp - 0x110]
jmp 0x4cb720
cmp byte [eax], 0
je 0x4cb72e
inc eax
dec edx
jne 0x4cb720
jmp 0x4cba24
test edx, edx
je 0x4cba24
push str.scheduler.html
jmp 0x4cba05
mov edx, 0x104
lea eax, [ebp - 0x110]
jmp 0x4cb750
cmp byte [eax], 0
je 0x4cb75e
inc eax
dec edx
jne 0x4cb750
jmp 0x4cba24
test edx, edx
je 0x4cba24
push str.bho.html
jmp 0x4cba05
mov edx, 0x104
lea eax, [ebp - 0x110]
jmp 0x4cb780
cmp byte [eax], 0
je 0x4cb78e
inc eax
dec edx
jne 0x4cb780
jmp 0x4cba24
test edx, edx
je 0x4cba24
push str.filetype.html
jmp 0x4cba05
mov edx, 0x104
lea eax, [ebp - 0x110]
jmp 0x4cb7b0
cmp byte [eax], 0
je 0x4cb7be
inc eax
dec edx
jne 0x4cb7b0
jmp 0x4cba24
test edx, edx
je 0x4cba24
push str.hidden.html
jmp 0x4cba05
mov edx, 0x104
lea eax, [ebp - 0x110]
jmp 0x4cb7e0
cmp byte [eax], 0
je 0x4cb7ee
inc eax
dec edx
jne 0x4cb7e0
jmp 0x4cba24
test edx, edx
je 0x4cba24
push str.helpme.html
jmp 0x4cba05
mov edx, 0x104
lea eax, [ebp - 0x110]
jmp 0x4cb810
cmp byte [eax], 0
je 0x4cb81e
inc eax
dec edx
jne 0x4cb810
jmp 0x4cba24
test edx, edx
je 0x4cba24
push str.delay.html
jmp 0x4cba05
mov edx, 0x104
lea eax, [ebp - 0x110]
jmp 0x4cb840
cmp byte [eax], 0
je 0x4cb84e
inc eax
dec edx
jne 0x4cb840
jmp 0x4cba24
test edx, edx
je 0x4cba24
push str.activex.html
jmp 0x4cba05
mov edx, 0x104
lea eax, [ebp - 0x110]
jmp 0x4cb870
cmp byte [eax], 0
je 0x4cb87e
inc eax
dec edx
jne 0x4cb870
jmp 0x4cba24
test edx, edx
je 0x4cba24
push str.recent.html
jmp 0x4cba05
mov edx, 0x104
lea eax, [ebp - 0x110]
jmp 0x4cb8a0
cmp byte [eax], 0
je 0x4cb8ae
inc eax
dec edx
jne 0x4cb8a0
jmp 0x4cba24
test edx, edx
je 0x4cba24
push str.reset.html
jmp 0x4cba05
mov edx, 0x104
lea eax, [ebp - 0x110]
jmp 0x4cb8d0
cmp byte [eax], 0
je 0x4cb9fc
inc eax
dec edx
jne 0x4cb8d0
jmp 0x4cba24
mov edx, 0x104
lea eax, [ebp - 0x110]
lea ecx, [ecx]
cmp byte [eax], 0
je 0x4cb8fe
inc eax
dec edx
jne 0x4cb8f0
jmp 0x4cba24
test edx, edx
je 0x4cba24
push str.defaultpage.htmlstart
jmp 0x4cba05
mov edx, 0x104
lea eax, [ebp - 0x110]
jmp 0x4cb920
cmp byte [eax], 0
je 0x4cb92e
inc eax
dec edx
jne 0x4cb920
jmp 0x4cba24
test edx, edx
je 0x4cba24
push str.defaultpage.htmlsearch
jmp 0x4cba05
mov edx, 0x104
lea eax, [ebp - 0x110]
jmp 0x4cb950
cmp byte [eax], 0
je 0x4cb95e
inc eax
dec edx
jne 0x4cb950
jmp 0x4cba24
test edx, edx
je 0x4cba24
push str.defaultpage.htmldesktop
jmp 0x4cba05
mov edx, 0x104
lea eax, [ebp - 0x110]
jmp 0x4cb980
cmp byte [eax], 0
je 0x4cb98e
inc eax
dec edx
jne 0x4cb980
jmp 0x4cba24
test edx, edx
je 0x4cba24
push str.abort.html
jmp 0x4cba05
mov edx, 0x104
lea eax, [ebp - 0x110]
cmp byte [eax], 0
je 0x4cb9b3
inc eax
dec edx
jne 0x4cb9a8
jmp 0x4cba24
test edx, edx
je 0x4cba24
push str.alert.html
jmp 0x4cba05
mov edx, 0x104
lea eax, [ebp - 0x110]
lea esp, [esp]
cmp byte [eax], 0
je 0x4cb9db
inc eax
dec edx
jne 0x4cb9d0
jmp 0x4cba24
test edx, edx
je 0x4cba24
push str.filesizemonitor.html
jmp 0x4cba05
mov edx, 0x104
lea eax, [ebp - 0x110]
cmp byte [eax], 0
je 0x4cb9fc
inc eax
dec edx
jne 0x4cb9f1
jmp 0x4cba24
test edx, edx
je 0x4cba24
push str.features.html
mov ecx, 0x104
sub ecx, edx
mov eax, 0x104
sub eax, ecx
mov edx, 0x7fffffff
lea ecx, [ebp + ecx - 0x110]
call fcn.004010b0
lea edi, [ebp - 0x238]
call fcn.0047c070
mov edx, 0x104
mov eax, edi
cmp byte [eax], 0
je 0x4cba41
inc eax
dec edx
jne 0x4cba36
jmp 0x4cba69
test edx, edx
je 0x4cba69
mov ecx, 0x104
sub ecx, edx
mov eax, 0x104
sub eax, ecx
push 0x4e28bc
lea ecx, [ebp + ecx - 0x238]
mov edx, 0x7fffffff
call fcn.004010b0
mov edx, 0x104
lea eax, [ebp - 0x238]
cmp byte [eax], 0
je 0x4cba7f
inc eax
dec edx
jne 0x4cba74
jmp 0x4cbaa9
test edx, edx
je 0x4cbaa9
mov ecx, 0x104
sub ecx, edx
lea edx, [ebp - 0x110]
mov eax, 0x104
push edx
sub eax, ecx
lea ecx, [ebp + ecx - 0x238]
mov edx, 0x7fffffff
call fcn.004010b0
lea ecx, [ebp - 0x238]
call fcn.0047af20
test eax, eax
je 0x4cbad9
mov ecx, dword [0x4fbdcc]
push 1
push 0x4e27f8
push 0x4e27f8
lea eax, [ebp - 0x238]
push eax
push str.open
push ecx
jmp 0x4cbb54
lea edx, [ebp - 0x12c]
push edx
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [ebp - 0x238]
call fcn.004010b0
mov edx, 0x104
lea eax, [ebp - 0x238]
cmp byte [eax], 0
je 0x4cbb0b
inc eax
dec edx
jne 0x4cbb00
jmp 0x4cbb35
test edx, edx
je 0x4cbb35
lea eax, [ebp - 0x110]
push eax
mov ecx, 0x104
sub ecx, edx
mov eax, 0x104
sub eax, ecx
lea ecx, [ebp + ecx - 0x238]
mov edx, 0x7fffffff
call fcn.004010b0
mov edx, dword [0x4fbdcc]
push 1
push 0x4e27f8
push 0x4e27f8
lea ecx, [ebp - 0x238]
push ecx
push str.open
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.004cf2b6
mov esp, ebp
pop ebp
ret