Function at 0x4012e0
Capabilities:
Check if file exists
Delete file
Enumerate processes
Get common file path
Get file size
Move file
Query environment variable
Read file on windows
Terminate process
Terminate process by name
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x107d4
call fcn.0040a1d0
mov eax, dword [0x411034]
xor eax, esp
mov dword [esp + 0x107d0], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
push str._silent
push esi
mov dword [esp + 0x20], esi
call fcn.004036e3
add esp, 8
test eax, eax
je 0x4013a2
push str._silentnoiekill
push esi
call fcn.004036e3
add esp, 8
test eax, eax
je 0x4013a2
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov ecx, 0x412
cmp ax, cx
jne 0x40136a
push str._uninstall
push esi
call fcn.004036e3
add esp, 8
push 0x40001
push 0x40ebe7
test eax, eax
jne 0x401363
push 0x40ec18
jmp 0x401379
push 0x40ec70
jmp 0x401379
push 0x40001
push 0x40ebe7
push str.All_browsers_should_be_shut_down._When_you_click_OK__All_browsers_should_be_closed.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 1
je 0x4013a2
mov eax, 0xffffff9c
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x107d0]
xor ecx, esp
call fcn.00402f18
mov esp, ebp
pop ebp
ret 0x10
call fcn.00402e40
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.c:Program_FilesTerutenWebCubeAgentCubeU_.exe
call esi
push str.c:Program_FilesTerutenWebCubeAgentCubeU64_.exe
call esi
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU_.exe
call esi
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU64_.exe
call esi
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileA]
push str.c:Program_FilesTerutenWebCubeAgentCubeU_.exe
push str.c:Program_FilesTerutenWebCubeAgentCubeU.exe
call esi
push str.c:Program_FilesTerutenWebCubeAgentCubeU64_.exe
push str.c:Program_FilesTerutenWebCubeAgentCubeU64.exe
call esi
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU_.exe
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU.exe
call esi
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU64_.exe
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU64.exe
call esi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [esp + 0xc], esi
cmp esi, 0xffffffff
jne 0x40142d
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x107d0]
xor ecx, esp
call fcn.00402f18
mov esp, ebp
pop ebp
ret 0x10
lea edx, [esp + 0x38]
push edx
push esi
mov dword [esp + 0x40], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x401470
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xfffffffe
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x107d0]
xor ecx, esp
call fcn.00402f18
mov esp, ebp
pop ebp
ret 0x10
lea eax, [esp + 0x5c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], 0
mov byte [esp + 0x20], 0
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401490
sub eax, edx
push eax
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x24]
call fcn.00402750
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x20]
cmp edx, 0x10
jb 0x401bae
mov esi, ecx
mov dword [esp + 0x14], esi
test ecx, ecx
je 0x4014e7
mov eax, ecx
cmp edx, 0x10
jae 0x4014ce
lea eax, [esp + 0x20]
cmp eax, esi
ja 0x4014e7
mov eax, ecx
cmp edx, 0x10
jae 0x4014dd
lea eax, [esp + 0x20]
mov ebx, dword [esp + 0x30]
add eax, ebx
cmp esi, eax
jbe 0x4014f8
call fcn.00403449
mov edx, dword [esp + 0x34]
mov ebx, dword [esp + 0x30]
mov ecx, dword [esp + 0x20]
mov eax, ecx
cmp edx, 0x10
jae 0x401503
lea eax, [esp + 0x20]
lea edi, [ebx + eax]
test edi, edi
je 0x40152a
mov eax, ecx
cmp edx, 0x10
jae 0x401515
lea eax, [esp + 0x20]
cmp eax, edi
ja 0x40152a
mov eax, ecx
cmp edx, 0x10
jae 0x401524
lea eax, [esp + 0x20]
add eax, ebx
cmp edi, eax
jbe 0x40153b
call fcn.00403449
mov edx, dword [esp + 0x34]
mov ebx, dword [esp + 0x30]
mov ecx, dword [esp + 0x20]
cmp edx, 0x10
jb 0x401bbb
mov esi, ecx
test ecx, ecx
je 0x40156a
mov eax, ecx
cmp edx, 0x10
jae 0x401555
lea eax, [esp + 0x20]
cmp eax, esi
ja 0x40156a
mov eax, ecx
cmp edx, 0x10
jae 0x401564
lea eax, [esp + 0x20]
add ebx, eax
cmp esi, ebx
jbe 0x40156f
call fcn.00403449
mov ecx, dword [esp + 0x14]
push ecx
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x20]
mov byte [esp + 0x18], 0
mov edx, dword [esp + 0x18]
push edx
push eax
push edi
lea ecx, [esp + 0x3f4]
push esi
push ecx
call fcn.00402db0
add esp, 0x1c
push 0xf
push str.tuctlsystem.exe
lea edx, [esp + 0x24]
push edx
call fcn.00402860
cmp eax, 0xffffffff
je 0x4015d1
mov eax, dword [esp + 0x40]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x34], 0x10
jb 0x4015e5
mov ecx, dword [esp + 0x20]
push ecx
call fcn.00403049
add esp, 4
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x38]
push edx
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x401470
push eax
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [esp + 0xc], esi
cmp esi, 0xffffffff
je 0x401413
lea ecx, [esp + 0x38]
push ecx
push esi
mov dword [esp + 0x40], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x401444
mov edi, edi
lea eax, [esp + 0x5c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], 0
mov byte [esp + 0x20], 0
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401650
sub eax, edx
push eax
lea edx, [esp + 0x60]
push edx
lea eax, [esp + 0x24]
call fcn.00402750
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x20]
cmp edx, 0x10
jb 0x401bc4
mov dword [esp + 0x14], ecx
test ecx, ecx
je 0x4016a9
mov eax, ecx
cmp edx, 0x10
jae 0x40168c
lea eax, [esp + 0x20]
cmp eax, dword [esp + 0x14]
ja 0x4016a9
mov eax, ecx
cmp edx, 0x10
jae 0x40169d
lea eax, [esp + 0x20]
mov ebx, dword [esp + 0x30]
add eax, ebx
cmp dword [esp + 0x14], eax
jbe 0x4016ba
call fcn.00403449
mov edx, dword [esp + 0x34]
mov ebx, dword [esp + 0x30]
mov ecx, dword [esp + 0x20]
mov eax, ecx
cmp edx, 0x10
jae 0x4016c5
lea eax, [esp + 0x20]
lea edi, [ebx + eax]
test edi, edi
je 0x4016ec
mov eax, ecx
cmp edx, 0x10
jae 0x4016d7
lea eax, [esp + 0x20]
cmp eax, edi
ja 0x4016ec
mov eax, ecx
cmp edx, 0x10
jae 0x4016e6
lea eax, [esp + 0x20]
add eax, ebx
cmp edi, eax
jbe 0x4016fd
call fcn.00403449
mov edx, dword [esp + 0x34]
mov ebx, dword [esp + 0x30]
mov ecx, dword [esp + 0x20]
cmp edx, 0x10
jb 0x401bd1
mov esi, ecx
test ecx, ecx
je 0x40172c
mov eax, ecx
cmp edx, 0x10
jae 0x401717
lea eax, [esp + 0x20]
cmp eax, esi
ja 0x40172c
mov eax, ecx
cmp edx, 0x10
jae 0x401726
lea eax, [esp + 0x20]
add ebx, eax
cmp esi, ebx
jbe 0x401731
call fcn.00403449
mov ecx, dword [esp + 0x14]
push ecx
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x20]
mov byte [esp + 0x18], 0
mov edx, dword [esp + 0x18]
push edx
push eax
push edi
lea ecx, [esp + 0x3f4]
push esi
push ecx
call fcn.00402db0
add esp, 0x1c
push 0xa
push str.chrome.exe
lea edx, [esp + 0x24]
push edx
call fcn.00402860
cmp eax, 0xffffffff
jne 0x401926
push 0xb
push str.firefox.exe
lea eax, [esp + 0x24]
push eax
call fcn.00402860
cmp eax, 0xffffffff
jne 0x401926
push 9
push str.opera.exe
lea ecx, [esp + 0x24]
push ecx
call fcn.00402860
cmp eax, 0xffffffff
jne 0x401926
push 0xa
push str.safari.exe
lea edx, [esp + 0x24]
push edx
call fcn.00402860
cmp eax, 0xffffffff
jne 0x401926
lea eax, [esp + 0x1c]
push eax
mov edx, str.cubee.exe
call fcn.00402730
cmp eax, 0xffffffff
jne 0x401926
lea ecx, [esp + 0x1c]
push ecx
mov edx, str.cubeu.exe
call fcn.00402730
cmp eax, 0xffffffff
jne 0x401926
lea edx, [esp + 0x1c]
push edx
mov edx, str.cubeu64.exe
call fcn.00402730
cmp eax, 0xffffffff
jne 0x401926
lea eax, [esp + 0x1c]
push eax
mov edx, str.iexplore.exe
call fcn.00402730
cmp eax, 0xffffffff
je 0x40183a
mov ecx, dword [esp + 0x18]
push str._silentnoiekill
push ecx
call fcn.004036e3
add esp, 8
test eax, eax
jne 0x401926
lea edx, [esp + 0x1c]
push edx
mov edx, str.tmw.exe
call fcn.00402730
cmp eax, 0xffffffff
jne 0x401926
lea eax, [esp + 0x1c]
push eax
mov edx, str.tmw64.exe
call fcn.00402730
cmp eax, 0xffffffff
jne 0x401926
lea ecx, [esp + 0x1c]
push ecx
mov edx, str.webcubeagent.exe
call fcn.00402730
cmp eax, 0xffffffff
jne 0x401926
lea edx, [esp + 0x1c]
push edx
mov edx, str.turound.exe
call fcn.00402730
cmp eax, 0xffffffff
jne 0x401926
lea eax, [esp + 0x1c]
push eax
mov edx, str.turound64.exe
call fcn.00402730
cmp eax, 0xffffffff
jne 0x401926
lea ecx, [esp + 0x1c]
push ecx
mov edx, str.texe.exe
call fcn.00402730
cmp eax, 0xffffffff
jne 0x401926
lea edx, [esp + 0x1c]
push edx
mov edx, str.texe64.exe
call fcn.00402730
cmp eax, 0xffffffff
jne 0x401926
lea eax, [esp + 0x1c]
push eax
mov edx, str.tremote_server.exe
call fcn.00402730
cmp eax, 0xffffffff
jne 0x401926
lea ecx, [esp + 0x1c]
push ecx
mov edx, str.microsoftedge.exe
call fcn.00402730
cmp eax, 0xffffffff
jne 0x401926
lea edx, [esp + 0x1c]
push edx
mov edx, str.microsoftedgecp.exe
call fcn.00402730
cmp eax, 0xffffffff
jne 0x401926
lea eax, [esp + 0x1c]
push eax
mov edx, str.w_browser.exe
call fcn.00402730
cmp eax, 0xffffffff
je 0x401947
mov ecx, dword [esp + 0x40]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x34], 0x10
jb 0x40195b
mov edx, dword [esp + 0x20]
push edx
call fcn.00403049
add esp, 4
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x38]
push eax
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x401630
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.c:Program_FilesTerutenWebCubeAgentCubeU_.exe
call esi
push str.c:Program_FilesTerutenWebCubeAgentCubeU64_.exe
call esi
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU_.exe
call esi
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU64_.exe
call esi
push 0x103
lea eax, [esp + 0x6d5]
push 0
push eax
mov byte [esp + 0x6dc], 0
call fcn.00403cc0
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
add esp, 0xc
push 0
push 0x1c
lea ecx, [esp + 0x6d8]
push ecx
push 0
call esi
push str.MicrosoftInternet_ExplorerRecovery
lea edx, [esp + 0x6d4]
push 0x104
push edx
call fcn.004034c1
lea eax, [esp + 0x6dc]
add esp, 0xc
push eax
call fcn.00401160
add esp, 4
push 0
push 0x1c
lea ecx, [esp + 0x7e0]
push ecx
push 0
call esi
push str.GoogleChromeUser_DataDefaultPreferences
lea edx, [esp + 0x7dc]
push 0x7fff
push edx
call fcn.004034c1
add esp, 0xc
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea eax, [esp + 0x7f0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x401bf6
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
add ebx, 0x3e8
push ebx
call fcn.0040388a
add esp, 4
push 0
lea ecx, [esp + 0x14]
push ecx
push ebx
mov esi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 0x10]
push edx
push esi
mov edx, str.exit_type
call fcn.004010c0
mov ebx, eax
mov eax, dword [esp + 0x18]
push eax
push esi
mov edx, str._exit_type_:_Crashed_
call fcn.004010c0
add esp, 0x10
cmp eax, 0xffffffff
je 0x401bda
mov ecx, dword [esp + 0x10]
sub ecx, ebx
push ecx
lea edx, [ebx + esi]
push edx
mov edx, str._exit_type_:_Crashed_
call fcn.004010c0
mov edx, dword [0x40f06c]
mov ecx, dword [0x40f068]
add esp, 8
add ebx, eax
mov eax, dword [str._exit_type_:_Normal_]
mov dword [esp + 0x3e0], eax
mov eax, dword [0x40f070]
mov dword [esp + 0x3e8], edx
mov dl, byte [0x40f078]
mov dword [esp + 0x3e4], ecx
mov ecx, dword [0x40f074]
mov dword [esp + 0x3ec], eax
lea eax, [esp + 0x3e0]
mov byte [esp + 0x3f4], dl
mov dword [esp + 0x3f0], ecx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401b27
sub eax, edx
mov ecx, eax
lea eax, [ebx + 1]
cmp eax, dword [esp + 0x10]
jge 0x401b4e
jmp 0x401b40
mov dl, byte [eax + esi]
mov byte [eax + esi - 1], dl
inc eax
cmp eax, dword [esp + 0x10]
jl 0x401b40
mov byte [eax + esi - 1], 0
push ecx
lea eax, [esp + 0x3e4]
push eax
add ebx, esi
push ebx
call fcn.00403d40
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0xc
push edi
call ebx
push 0
push 0
push 5
push 0
push 0
push 0x40000000
lea ecx, [esp + 0x7f0]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x401be1
mov eax, dword [esp + 0x10]
push 0
lea edx, [esp + 0x14]
push edx
dec eax
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call ebx
jmp 0x401be1
lea esi, [esp + 0x20]
mov dword [esp + 0x14], esi
jmp 0x4014c3
lea esi, [esp + 0x20]
jmp 0x40154a
lea eax, [esp + 0x20]
mov dword [esp + 0x14], eax
jmp 0x401681
lea esi, [esp + 0x20]
jmp 0x40170c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.0040318d
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
add esp, 4
push 0
push 0x1c
lea ecx, [esp + 0x448]
push ecx
push 0
call esi
push str.GoogleChromeUser_DataDefaultCurrent_Session
lea edx, [esp + 0x444]
push 0x104
push edx
call fcn.004034c1
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0xc
lea eax, [esp + 0x440]
push eax
call edi
push 0x40ebe7
lea ecx, [esp + 0x444]
push 0x104
push ecx
call fcn.00403459
add esp, 0xc
push 0
push 0x1c
lea edx, [esp + 0x448]
push edx
push 0
call esi
push str.GoogleChromeUser_DataDefaultCookies
lea eax, [esp + 0x444]
push 0x104
push eax
call fcn.004034c1
add esp, 0xc
lea ecx, [esp + 0x440]
push ecx
call edi
xor edi, edi
lea edx, [esp + 0x548]
push edx
lea eax, [esp + 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x401cbd
push 0x12c
call ebx
lea ecx, [esp + 0x440]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x12c
call ebx
inc edi
cmp edi, 5
jl 0x401c80
mov edx, dword [esp + 0x18]
push str._uninstall
push edx
call fcn.004036e3
add esp, 8
test eax, eax
je 0x4026da
push 0
push 0x1c
lea eax, [esp + 0x87e0]
push eax
push 0
call esi
push str.GoogleChromeUser_DataLocal_State
lea ecx, [esp + 0x87dc]
push 0x7fff
push ecx
call fcn.004034c1
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
add esp, 0xc
push 0
push 0
push 3
push 0
push 0
push 0x80000000
lea edx, [esp + 0x87f0]
push edx
call edi
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x401f82
push 0
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
add esi, 0x3e8
push esi
call fcn.0040388a
add esp, 4
push 0
mov ebx, eax
lea eax, [esp + 0x18]
push eax
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, dword [esp + 0x14]
push edi
push ebx
mov edx, str.protocol_handler
call fcn.004010c0
mov esi, eax
add esp, 8
cmp esi, 0xffffffff
jne 0x401dce
mov ecx, 0x10
mov esi, str._protocol_handler_:___excluded_schemes_:___webcube_:false___
lea edi, [esp + 0x3f8]
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x3f8]
movsb byte es:[edi], byte [esi]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401d93
sub eax, edx
mov edi, eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], edi
cmp eax, 1
jb 0x401dbc
lea esi, [edi + ebx]
mov edi, edi
mov cl, byte [eax + ebx]
mov byte [esi + eax], cl
dec eax
cmp eax, 1
jae 0x401db0
push edi
lea edx, [esp + 0x3fc]
push edx
lea eax, [ebx + 1]
push eax
jmp 0x401f1d
mov eax, edi
sub eax, esi
lea ecx, [esi + ebx]
push eax
push ecx
mov edx, str._webcube_:true
mov dword [esp + 0x20], eax
call fcn.004010c0
mov ecx, dword [esp + 0x20]
add esp, 8
cmp eax, 0xffffffff
push ecx
lea eax, [esi + ebx]
push eax
je 0x401e7d
call fcn.004010c0
mov edx, dword [str._webcube_:false]
mov ecx, dword [0x40f174]
add esp, 8
add esi, eax
mov eax, dword [0x40f170]
mov dword [esp + 0x3e0], edx
mov edx, dword [0x40f178]
mov dword [esp + 0x3e4], eax
lea eax, [esp + 0x3e0]
mov dword [esp + 0x3ec], edx
mov dword [esp + 0x3e8], ecx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401e41
sub eax, edx
cmp edi, esi
jle 0x401e5f
lea ecx, [edi + ebx + 1]
sub edi, esi
mov dl, byte [ecx - 1]
mov byte [ecx], dl
dec ecx
sub edi, 1
jne 0x401e54
push eax
lea eax, [esp + 0x3e4]
push eax
add esi, ebx
push esi
call fcn.00403d40
mov dword [esp + 0x18], 1
jmp 0x401f22
mov edx, str.excluded_schemes
call fcn.004010c0
add esi, eax
add esp, 8
cmp byte [esi + ebx], 0x7b
je 0x401e99
inc esi
cmp byte [esi + ebx], 0x7b
jne 0x401e92
mov eax, dword [0x40f194]
mov edx, dword [str._webcube_:false_]
mov ecx, dword [0x40f198]
mov dword [esp + 0x3e4], eax
mov al, byte [0x40f1a0]
mov dword [esp + 0x3e0], edx
mov edx, dword [0x40f19c]
mov byte [esp + 0x3f0], al
lea eax, [esp + 0x3e0]
mov dword [esp + 0x3ec], edx
mov dword [esp + 0x3e8], ecx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401ee2
sub eax, edx
cmp edi, esi
mov ecx, eax
mov dword [esp + 0xc], ecx
mov eax, edi
jle 0x401f0b
lea edi, [ecx + ebx]
lea ebx, [ebx]
mov cl, byte [eax + ebx]
mov byte [edi + eax], cl
dec eax
cmp eax, esi
jg 0x401f00
mov edx, dword [esp + 0xc]
push edx
lea eax, [esp + 0x3e4]
push eax
lea ecx, [esi + ebx + 1]
push ecx
call fcn.00403d40
mov edx, dword [esp + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0xc
push edx
call edi
push 0
push 0
push 5
push 0
push 0
push 0x40000000
lea eax, [esp + 0x87f0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x401f73
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
push 0
lea ecx, [esp + 0x18]
push ecx
add eax, edx
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call edi
push ebx
call fcn.0040318d
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
add esp, 4
push 0x7fff
lea ecx, [esp + 0x87dc]
push ecx
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push str.Opera_SoftwareOpera_StableLocal_State
lea edx, [esp + 0x87dc]
push 0x7fff
push edx
call fcn.004034c1
add esp, 0xc
push 0
push 0
push 3
push 0
push 0
push 0x80000000
lea eax, [esp + 0x87f0]
push eax
call edi
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x40224a
push 0
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
add esi, 0x3e8
push esi
call fcn.0040388a
add esp, 4
push 0
lea ecx, [esp + 0x18]
push ecx
push esi
mov ebx, eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, dword [esp + 0x14]
push edi
push ebx
mov edx, str.protocol_handler
call fcn.004010c0
mov esi, eax
add esp, 8
cmp esi, 0xffffffff
jne 0x40207c
mov ecx, 0x10
mov esi, str._protocol_handler_:___excluded_schemes_:___webcube_:_false___
lea edi, [esp + 0x3f8]
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x3f8]
movsw word es:[edi], word [esi]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402041
sub eax, edx
mov edi, eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], edi
cmp eax, 1
jb 0x40206c
lea esi, [edi + ebx]
lea esp, [esp]
mov dl, byte [eax + ebx]
mov byte [esi + eax], dl
dec eax
cmp eax, 1
jae 0x402060
push edi
lea eax, [esp + 0x3fc]
lea ecx, [ebx + 1]
jmp 0x4021e3
mov eax, edi
sub eax, esi
lea ecx, [esi + ebx]
push eax
push ecx
mov edx, str._webcube_:_true
mov dword [esp + 0x20], eax
call fcn.004010c0
add esp, 8
cmp eax, 0xffffffff
lea eax, [esi + ebx]
je 0x40213c
mov edx, dword [esp + 0x18]
push edx
push eax
mov edx, str._webcube_:_true
call fcn.004010c0
mov ecx, dword [0x40f230]
mov edx, dword [0x40f234]
add esp, 8
add esi, eax
mov eax, dword [str._webcube_:_false]
mov dword [esp + 0x3e0], eax
mov eax, dword [0x40f238]
mov dword [esp + 0x3e4], ecx
mov cl, byte [0x40f23c]
mov dword [esp + 0x3ec], eax
lea eax, [esp + 0x3e0]
mov dword [esp + 0x3e8], edx
mov byte [esp + 0x3f0], cl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402100
sub eax, edx
cmp edi, esi
jle 0x40211e
lea ecx, [edi + ebx + 1]
sub edi, esi
mov dl, byte [ecx - 1]
mov byte [ecx], dl
dec ecx
sub edi, 1
jne 0x402113
push eax
lea eax, [esp + 0x3e4]
push eax
add esi, ebx
push esi
call fcn.00403d40
mov dword [esp + 0x18], 1
jmp 0x4021ea
mov ecx, dword [esp + 0x18]
push ecx
push eax
mov edx, str.excluded_schemes
call fcn.004010c0
add esi, eax
add esp, 8
cmp byte [esi + ebx], 0x7b
je 0x40215e
inc esi
cmp byte [esi + ebx], 0x7b
jne 0x402157
mov eax, dword [0x40f244]
mov edx, dword [str._webcube_:_false_]
mov ecx, dword [0x40f248]
mov dword [esp + 0x3e4], eax
mov ax, word [0x40f250]
mov dword [esp + 0x3e0], edx
mov edx, dword [0x40f24c]
mov word [esp + 0x3f0], ax
lea eax, [esp + 0x3e0]
mov dword [esp + 0x3ec], edx
mov dword [esp + 0x3e8], ecx
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4021b0
sub eax, edx
cmp edi, esi
mov ecx, eax
mov dword [esp + 0xc], ecx
mov eax, edi
jle 0x4021d3
lea edi, [ecx + ebx]
mov cl, byte [eax + ebx]
mov byte [edi + eax], cl
dec eax
cmp eax, esi
jg 0x4021c8
mov edx, dword [esp + 0xc]
push edx
lea eax, [esp + 0x3e4]
lea ecx, [esi + ebx + 1]
push eax
push ecx
call fcn.00403d40
mov edx, dword [esp + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0xc
push edx
call edi
push 0
push 0
push 5
push 0
push 0
push 0x40000000
lea eax, [esp + 0x87f0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40223b
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
push 0
lea ecx, [esp + 0x18]
push ecx
add eax, edx
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call edi
push ebx
call fcn.0040318d
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
add esp, 4
push 0x7fff
lea ecx, [esp + 0x87dc]
push ecx
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push str.MozillaFirefoxProfilesdefault
lea edx, [esp + 0x87dc]
push 0x7fff
push edx
call fcn.004034c1
add esp, 0xc
lea eax, [esp + 0x2a0]
push eax
lea ecx, [esp + 0x87dc]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x4024ae
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x87d8]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4022b0
sub eax, edx
cmp byte [esp + eax + 0x87d7], 0x5c
je 0x4022d7
lea ecx, [esp + 0x87d8]
dec ecx
jmp 0x4022d0
dec eax
cmp byte [eax + ecx], 0x5c
jne 0x4022d0
lea edx, [esp + 0x2cc]
push edx
mov ecx, 0x7fff
sub ecx, eax
push ecx
lea edx, [esp + eax + 0x87e0]
push edx
call fcn.00403459
add esp, 0xc
push str.mimeTypes.rdf
lea eax, [esp + 0x87dc]
push 0x7fff
push eax
call fcn.004034c1
add esp, 0xc
push 0
push 0
push 3
push 0
push 0
push 0x80000000
lea ecx, [esp + 0x87f0]
push ecx
call edi
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x4024ae
push 0
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
add ebx, 0x3e8
push ebx
call fcn.0040388a
add esp, 4
push 0
lea edx, [esp + 0x18]
push edx
mov esi, eax
push ebx
push esi
push edi
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
push eax
push esi
mov edx, str._RDF:Description
call fcn.004010c0
add esp, 8
cmp eax, 0xffffffff
jne 0x4023ee
mov ecx, 0x61
mov esi, str.__xml_version_1.0____RDF:RDF_xmlns:NC_http:__home.netscape.com_NC_rdf__xmlns:RDF_http:__www.w3.org_1999_02_22_rdf_syntax_ns___RDF:Description_RDF:about_urn:scheme:webcube__NC:value_webcube___NC:handlerProp_RDF:resource_urn:scheme:handler:webcube_____RDF:Description__RDF:Description_RDF:about_urn:scheme:handler:webcube__NC:useSystemDefault_true__NC:alwaysAsk_false______RDF:RDF_
lea edi, [esp + 0x548]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [esp + 0x548]
movsb byte es:[edi], byte [esi]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4023a1
sub eax, edx
mov edi, eax
lea esi, [edi + 1]
cmp ebx, esi
jae 0x4023cd
mov ecx, dword [esp + 0xc]
push ecx
call fcn.0040318d
add esp, 4
push esi
call fcn.0040388a
add esp, 4
mov ebx, eax
jmp 0x4023d1
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x548]
push edx
push esi
push ebx
mov dword [esp + 0x20], 0
call fcn.00403459
mov byte [edi + ebx], 0
jmp 0x402450
mov ecx, 0x3e
mov esi, str._RDF:Description_RDF:about_urn:scheme:webcube__NC:value_webcube___NC:handlerProp_RDF:resource_urn:scheme:handler:webcube_____RDF:Description__RDF:Description_RDF:about_urn:scheme:handler:webcube__NC:useSystemDefault_true__NC:alwaysAsk_false____
lea edi, [esp + 0x548]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea ecx, [esp + 0x548]
movsb byte es:[edi], byte [esi]
lea esi, [ecx + 1]
mov edi, edi
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x402410
sub ecx, esi
mov esi, dword [esp + 0xc]
mov edi, ecx
mov ecx, dword [esp + 0x14]
cmp ecx, eax
jl 0x40243b
lea edx, [edi + esi]
lea ebx, [ebx]
mov bl, byte [ecx + esi]
mov byte [edx + ecx], bl
dec ecx
cmp ecx, eax
jge 0x402430
push edi
lea ecx, [esp + 0x54c]
push ecx
add eax, esi
push eax
call fcn.00403d40
mov ebx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
add esp, 0xc
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 5
push 0
push 0
push 0x40000000
lea eax, [esp + 0x87f0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40249f
mov edx, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x18]
push ecx
add edi, edx
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.0040318d
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
add esp, 4
push 0x7fff
lea eax, [esp + 0x87dc]
push eax
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push str.MozillaFirefoxProfilesdefault
lea ecx, [esp + 0x87dc]
push 0x7fff
push ecx
call fcn.004034c1
add esp, 0xc
lea edx, [esp + 0x160]
push edx
lea eax, [esp + 0x87dc]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x4026da
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x87d8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402510
sub eax, edx
cmp byte [esp + eax + 0x87d7], 0x5c
je 0x402537
lea ecx, [esp + 0x87d8]
dec ecx
jmp 0x402530
dec eax
cmp byte [eax + ecx], 0x5c
jne 0x402530
lea ecx, [esp + 0x18c]
push ecx
mov edx, 0x7fff
sub edx, eax
push edx
lea eax, [esp + eax + 0x87e0]
push eax
call fcn.00403459
add esp, 0xc
push str.cert_override.txt
lea ecx, [esp + 0x87dc]
push 0x7fff
push ecx
call fcn.004034c1
add esp, 0xc
push 0
push 0
push 3
push 0
push 0
push 0x80000000
lea edx, [esp + 0x87f0]
push edx
call edi
mov esi, eax
mov dword [esp + 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x4025ba
push 0
push 0
push 1
push 0
push 0
push 0x40000000
lea eax, [esp + 0x87f0]
push eax
call edi
mov esi, eax
mov dword [esp + 0x10], eax
cmp esi, 0xffffffff
je 0x4026da
mov edi, dword [esp + 0x10]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
add esi, 0x3e8
push esi
mov dword [esp + 0x1c], esi
call fcn.0040388a
add esp, 4
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
mov ebx, eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 0xc]
mov byte [edx + ebx], 0
mov eax, dword [esp + 0xc]
mov ecx, 0x53
mov esi, str._r_n127.0.0.1:4568_tOID.2.16.840.1.101.3.4.2.1_tB1:09:04:20:17:5C:7E:B3:DF:2B:BC:BE:E5:47:3C:B5:96:D6:38:DD:A1:E3:9F:ED:29:C8:CA:EA:2A:C1:F5:89_tU_tAAAAAAAAAAAAAAAJAAAAdgD39_8l_kErOzB0MQswCQYDVQQGEwJLUjEOMAwGA1UECAwFU2VvdWwxDjAMBgNVBAcMBVNlb3VsMRAwDgYDVQQKDAdUZXJ1dGVuMRIwEAYDVQQDDAkxMjcuMC4wLjExHzAdBgkqhkiG9w0BCQEWEGN1YmVAdGVydXRlbi5jb20
lea edi, [esp + 0x548]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push eax
push ebx
lea edx, [esp + 0x550]
movsb byte es:[edi], byte [esi]
call fcn.004010c0
add esp, 8
cmp eax, 0xffffffff
jne 0x4026d1
mov edi, edx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x402638
mov esi, dword [esp + 0x18]
sub edi, ecx
lea ecx, [edi + 1]
cmp esi, ecx
jae 0x402668
push ebx
call fcn.0040318d
mov edx, dword [esp + 0x10]
lea eax, [edi + edx + 1]
add esp, 4
push eax
call fcn.0040388a
add esp, 4
mov ebx, eax
lea ecx, [esp + 0x548]
push ecx
push esi
push ebx
call fcn.004034c1
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
add esp, 0xc
lea eax, [edi + edx]
push ecx
mov byte [eax + ebx], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 5
push 0
push 0
push 0x40000000
lea edx, [esp + 0x87f0]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4026d1
mov ecx, dword [esp + 0xc]
push 0
lea eax, [esp + 0x10]
push eax
add edi, ecx
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.0040318d
add esp, 4
mov ecx, dword [esp + 0x107dc]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00402f18
mov esp, ebp
pop ebp
ret 0x10