Function at 0x4170f0
Capabilities:
Check if file exists
Delete registry value
Get file attributes
Get installed programs
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f5eef
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1f0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], esp
xor ebx, ebx
push str.IEXPLORE
lea ecx, [edi + 4]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], ebx
call fcn.0040c3c0
mov ecx, dword [edi + 0x1c]
mov dword [edi + 0x34], eax
cmp ecx, ebx
je 0x417139
push 1
jmp 0x41713a
push ebx
push eax
mov ecx, edi
call fcn.00415460
lea eax, [ebp - 0x24]
mov ecx, edi
push eax
mov dword [ebp - 0x24], ebx
call fcn.0040f510
cmp eax, ebx
jne 0x417373
xor esi, esi
call fcn.00441af0
cmp eax, ebx
je 0x417173
mov ecx, edi
call fcn.0040fb20
cmp eax, ebx
je 0x417173
mov esi, 1
mov ecx, edi
call fcn.0040fea0
cmp eax, ebx
jne 0x417186
cmp esi, ebx
je 0x417373
cmp dword [ebp - 0x24], ebx
je 0x4171c5
push 0x6a3ef4
call fcn.00418560
add esp, 4
cmp eax, ebx
je 0x417373
mov ecx, dword [0x6d1a78]
mov edx, dword [0x6d1764]
push 0x50040
push ecx
push edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x417373
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallGoogle_Chrome
push reloc.WS2_32.dll_bind
call esi
test eax, eax
jne 0x417246
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x12c]
push ecx
push edx
push eax
push eax
mov eax, dword [ebp - 0x14]
push str.DisplayIcon
push eax
mov dword [ebp - 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41723c
lea ecx, [ebp - 0x12c]
push 0x2c
push ecx
call fcn.005c72c0
add esp, 8
test eax, eax
je 0x41723c
lea edx, [ebp - 0x12c]
mov byte [eax], 0
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x41723c
mov ebx, 1
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00441af0
test eax, eax
je 0x4172cc
lea ecx, [ebp - 0x14]
push ecx
push 0x20119
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallGoogle_Chrome
push reloc.WS2_32.dll_bind
call esi
test eax, eax
jne 0x4172cc
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x12c]
push edx
push eax
push 0
push 0
push str.DisplayIcon
push ecx
mov dword [ebp - 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4172c2
lea edx, [ebp - 0x12c]
push 0x2c
push edx
call fcn.005c72c0
add esp, 8
test eax, eax
je 0x4172c2
mov byte [eax], 0
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4172c2
mov ebx, 1
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x4172e5
push 0x6a3ef4
call fcn.00418560
add esp, 4
test eax, eax
je 0x417373
mov edx, dword [edi + 0x48]
push 0
mov al, byte [edx + 0x3a]
test al, al
je 0x417305
push 0
push 0
push 0
push 0
push 0x416f60
call fcn.005e3eb7
jmp 0x417373
lea ecx, [ebp - 0x17c]
call fcn.0048ade0
lea ecx, [ebp - 0x17c]
mov byte [ebp - 4], 1
call fcn.005df8b6
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 6
call fcn.004f5940
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 5
call fcn.005eb3c5
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 4
call fcn.005eb3c5
lea ecx, [ebp - 0xe4]
mov byte [ebp - 4], 3
call fcn.005eb3c5
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 2
call fcn.005eb3fd
lea ecx, [ebp - 0x17c]
mov byte [ebp - 4], 0
call fcn.005df4f7
mov edx, dword [0x6d116c]
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x20]
push eax
push ecx
push 0
push 0
push str.mzcc_vers
push edx
mov esi, 1
mov dword [ebp - 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4173b0
mov eax, dword [ebp - 0x20]
mov ecx, dword [0x6d0f94]
cmp eax, ecx
jb 0x4173b0
xor esi, esi
call fcn.0040dc70
mov edi, eax
push edi
mov dword [ebp - 0x14], edi
call fcn.0040e2e0
add esp, 4
cmp edi, 0x1a
mov ebx, eax
jle 0x4173d5
mov ecx, dword [ebp - 0x1c]
push esi
call fcn.0041bda0
jmp 0x4173e0
mov ecx, dword [ebp - 0x1c]
push 0
push esi
call fcn.0041c2c0
test esi, esi
mov edi, eax
je 0x41740a
mov eax, dword [0x6d116c]
mov ecx, dword [0x6d0f94]
lea edx, [ebp - 0x20]
push 4
push edx
push 4
push 0
push str.mzcc_vers
push eax
mov dword [ebp - 0x20], ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.0040e2e0
add esp, 4
test eax, eax
jne 0x41742b
push eax
push eax
push eax
push eax
push eax
push 0x40f190
call fcn.005e3eb7
jmp 0x417475
test ebx, ebx
jne 0x417475
test edi, edi
je 0x417521
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x48]
mov cl, byte [eax + 0x3a]
test cl, cl
je 0x417455
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x4170c0
call fcn.005e3eb7
jmp 0x417475
mov ecx, dword [0x6d1a78]
mov edx, dword [0x6d1a44]
push 0x50040
push ecx
push edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
test edi, edi
je 0x417521
mov edi, dword [ebp - 0x14]
cmp edi, 0x1a
jle 0x417521
mov ebx, dword [ebp - 0x1c]
push 1
push esi
mov ecx, ebx
call fcn.0041c2c0
call fcn.0040dfa0
cmp eax, 0x1a
jle 0x417532
lea eax, [ebp - 0x18]
push eax
push 0xf003f
push 0
push str.SoftwareMozillaFirefoxExtensions
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x417521
lea ecx, [ebp - 0x1fc]
push 0x6a2ce4
push ecx
call fcn.005c742a
lea edx, [ebp - 0x1fc]
push edx
call fcn.005c7292
add esp, 0xc
xor ecx, ecx
cmp ecx, eax
jge 0x417506
mov dx, word [ebp + ecx*2 - 0x1fc]
xor dx, 0x4d
sub edx, 0xff
mov word [ebp + ecx*2 - 0x1fc], dx
inc ecx
jmp 0x4174e5
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x1fc]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, edi
je 0x417521
push 0
push esi
mov ecx, ebx
call fcn.0041c2c0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret