Function at 0x41d7a0
Capabilities:
Check if file exists
Delete registry value
Get file attributes
Move file
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x616bf8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x360
mov eax, dword [0x6d22e8]
push ebx
push esi
xor ebx, ebx
push edi
cmp eax, ebx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x54], ecx
mov dword [ebp - 4], ebx
jne 0x41d7da
mov eax, 0x6d22ec
push str.idmmzcc.xpi
push eax
lea eax, [ebp - 0x36c]
push 0x6a2544
push eax
call fcn.005e8107
add esp, 0x10
lea ecx, [ebp - 0x36c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41dfe2
xor eax, eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x44], eax
mov word [ebp - 0x40], bx
mov esi, dword [0x6d2310]
mov byte [ebp - 4], 1
cmp esi, ebx
jne 0x41d829
mov esi, 0x6d2314
mov edx, str._s_scomponents2idmmzcc.dll
test edx, edx
je 0x41d931
cmp esi, ebx
je 0x41d931
mov ecx, str.idmmzcc5
test ecx, ecx
je 0x41d931
push edx
lea ecx, [ebp - 0x1c]
call fcn.00402380
push esi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.0040e580
push str.idmmzcc5
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 3
call fcn.0040e580
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 4
call fcn.00401070
mov edi, dword [ebp - 0x28]
cmp edi, ebx
jne 0x41d888
lea edi, [ebp - 0x24]
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x34]
call fcn.00402400
push eax
call fcn.005e71bf
mov edx, eax
push edi
mov dword [ebp - 0x58], edx
call fcn.005e71bf
mov edx, dword [ebp - 0x58]
add esi, edx
lea esi, [eax + esi + 3]
lea edi, [esi + esi]
push edi
call fcn.005ffe3f
mov edx, eax
add esp, 0xc
cmp edx, ebx
mov dword [ebp - 0x44], edx
je 0x41d90a
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x34]
call fcn.00402400
push eax
lea ecx, [ebp - 0x28]
call fcn.00402400
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402400
push eax
mov eax, dword [ebp - 0x44]
push esi
push eax
call fcn.005e714f
mov ecx, dword [ebp - 0x44]
push ecx
call fcn.005e71bf
add esp, 0x18
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 3
call fcn.00401070
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00401070
mov eax, dword [ebp - 0x44]
cmp eax, ebx
jne 0x41d938
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41dcd1
mov esi, dword [0x6d2310]
test esi, esi
jne 0x41d957
mov esi, 0x6d2314
mov edx, str._s_scomponents2idmcchandler2.dll
test edx, edx
je 0x41da5c
test esi, esi
je 0x41da5c
mov eax, str.idmmzcc5
test eax, eax
je 0x41da5c
push edx
lea ecx, [ebp - 0x1c]
call fcn.00402380
push esi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 5
call fcn.0040e580
mov bl, 6
push str.idmmzcc5
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.0040e580
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 7
call fcn.00401070
mov edi, dword [ebp - 0x28]
test edi, edi
jne 0x41d9b7
lea edi, [ebp - 0x24]
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x34]
call fcn.00402400
push eax
call fcn.005e71bf
mov edx, eax
push edi
mov dword [ebp - 0x58], edx
call fcn.005e71bf
mov ecx, dword [ebp - 0x58]
add esi, ecx
lea esi, [eax + esi + 3]
lea edi, [esi + esi]
push edi
call fcn.005ffe3f
mov edx, eax
add esp, 0xc
test edx, edx
mov dword [ebp - 0x44], edx
je 0x41da39
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x34]
call fcn.00402400
push eax
lea ecx, [ebp - 0x28]
call fcn.00402400
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402400
push eax
mov eax, dword [ebp - 0x44]
push esi
push eax
call fcn.005e714f
mov ecx, dword [ebp - 0x44]
push ecx
call fcn.005e71bf
add esp, 0x18
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.00401070
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 5
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00401070
mov eax, dword [ebp - 0x44]
test eax, eax
jne 0x41da66
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41dcd1
mov esi, dword [0x6d2310]
test esi, esi
jne 0x41da85
mov esi, 0x6d2314
mov edx, str._s_schromeidmmzcc.jar
test edx, edx
je 0x41db85
test esi, esi
je 0x41db85
mov eax, str.idmmzcc5
test eax, eax
je 0x41db85
push edx
lea ecx, [ebp - 0x1c]
call fcn.00402380
push esi
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 8
call fcn.0040e580
mov bl, 9
push str.idmmzcc5
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.0040e580
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0xa
call fcn.00401070
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
call fcn.00402400
push eax
call fcn.005e71bf
add esp, 4
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.00402400
push eax
call fcn.005e71bf
add esi, edi
lea esi, [eax + esi + 3]
lea edi, [esi + esi]
push edi
call fcn.005ffe3f
mov edx, eax
add esp, 8
test edx, edx
mov dword [ebp - 0x44], edx
je 0x41db62
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x28]
call fcn.00402400
push eax
lea ecx, [ebp - 0x34]
call fcn.00402400
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402400
push eax
mov eax, dword [ebp - 0x44]
push esi
push eax
call fcn.005e714f
mov ecx, dword [ebp - 0x44]
push ecx
call fcn.005e71bf
add esp, 0x18
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00401070
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 8
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00401070
mov eax, dword [ebp - 0x44]
test eax, eax
jne 0x41db8f
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41dcd1
mov esi, dword [0x6d2310]
test esi, esi
jne 0x41dbae
mov esi, 0x6d2314
mov edx, str._s_scomponents12idmmzcc.dll
test edx, edx
je 0x41dcae
test esi, esi
je 0x41dcae
mov eax, str.idmmzcc5
test eax, eax
je 0x41dcae
push edx
lea ecx, [ebp - 0x1c]
call fcn.00402380
push esi
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0xb
call fcn.0040e580
mov bl, 0xc
push str.idmmzcc5
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.0040e580
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0xd
call fcn.00401070
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
call fcn.00402400
push eax
call fcn.005e71bf
add esp, 4
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.00402400
push eax
call fcn.005e71bf
add esi, edi
lea esi, [eax + esi + 3]
lea edi, [esi + esi]
push edi
call fcn.005ffe3f
mov edx, eax
add esp, 8
test edx, edx
mov dword [ebp - 0x44], edx
je 0x41dc8b
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x28]
call fcn.00402400
push eax
lea ecx, [ebp - 0x34]
call fcn.00402400
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402400
push eax
mov eax, dword [ebp - 0x44]
push esi
push eax
call fcn.005e714f
mov ecx, dword [ebp - 0x44]
push ecx
call fcn.005e71bf
add esp, 0x18
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00401070
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0xb
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00401070
mov eax, dword [ebp - 0x44]
test eax, eax
jne 0x41dcb8
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41dcd1
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x41df29
jmp 0x41dcd4
mov ebx, dword [ebp + 8]
lea edx, [ebp - 0x36c]
mov dword [ebp + 8], 0
push edx
call fcn.005d4dc0
mov esi, eax
add esp, 4
test esi, esi
je 0x41dd3d
lea eax, [ebp - 0x60]
push eax
push esi
call fcn.005d5200
add esp, 8
xor edi, edi
cmp edi, dword [ebp - 0x60]
jae 0x41dd34
mov edx, dword [ebp - 0x54]
lea ecx, [ebp + 8]
push ecx
push edx
push str.idmmzcc5
push ebx
push esi
call fcn.0041c060
add esp, 0x14
test eax, eax
jne 0x41dd34
mov eax, dword [ebp - 0x60]
inc edi
cmp edi, eax
jae 0x41dd34
push esi
call fcn.005d5650
add esp, 4
test eax, eax
je 0x41dcff
push esi
call fcn.005d51c0
add esp, 4
mov eax, dword [ebp + 8]
test eax, eax
je 0x41ddde
test ebx, ebx
je 0x41ddde
mov eax, dword [0x6d2dc8]
mov ecx, dword [0x6d2ab8]
push 0x50035
push eax
push ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 4
jne 0x41ddde
lea edx, [ebp - 0x36c]
mov dword [ebp + 8], 0
push edx
call fcn.005d4dc0
mov edi, eax
add esp, 4
test edi, edi
je 0x41ddde
lea eax, [ebp - 0x60]
push eax
push edi
call fcn.005d5200
add esp, 8
test eax, eax
jne 0x41ddde
xor esi, esi
cmp esi, dword [ebp - 0x60]
jae 0x41ddd8
mov edx, dword [ebp - 0x54]
lea ecx, [ebp + 8]
push ecx
push edx
push str.idmmzcc5
push ebx
push edi
call fcn.0041c060
add esp, 0x14
test eax, eax
jne 0x41ddd8
mov eax, dword [ebp - 0x60]
inc esi
cmp esi, eax
jae 0x41ddd8
push edi
call fcn.005d5650
add esp, 4
test eax, eax
je 0x41dda3
push edi
jmp 0x41dd35
push str.idmmzcc5
call fcn.0041cf60
xor eax, eax
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
mov word [ebp - 0x18], ax
mov esi, dword [0x6d2310]
mov byte [ebp - 4], 0xe
cmp esi, eax
jne 0x41de0a
mov esi, 0x6d2314
mov ecx, 0x6a112c
test ecx, ecx
je 0x41df0d
test esi, esi
je 0x41df0d
mov edx, str.idmmzcc5
test edx, edx
je 0x41df0d
push ecx
lea ecx, [ebp - 0x64]
call fcn.00402380
push esi
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0xf
call fcn.0040e580
mov bl, 0x10
push str.idmmzcc5
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.0040e580
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x11
call fcn.00401070
mov esi, dword [ebp - 0x5c]
lea ecx, [ebp - 0x28]
call fcn.00402400
push eax
call fcn.005e71bf
add esp, 4
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.00402400
push eax
call fcn.005e71bf
add esi, edi
lea esi, [eax + esi + 3]
lea edi, [esi + esi]
push edi
call fcn.005ffe3f
mov edx, eax
add esp, 8
test edx, edx
mov dword [ebp - 0x1c], edx
je 0x41dee7
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x28]
call fcn.00402400
push eax
lea ecx, [ebp - 0x34]
call fcn.00402400
push eax
lea ecx, [ebp - 0x64]
call fcn.00402400
push eax
mov eax, dword [ebp - 0x1c]
push esi
push eax
call fcn.005e714f
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.005e71bf
add esp, 0x18
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00401070
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0xf
call fcn.00401070
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0xe
call fcn.00401070
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x41df14
lea eax, [ebp - 0x18]
push eax
call fcn.0041cee0
add esp, 4
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00401070
mov eax, dword [ebp + 0xc]
xor ebx, ebx
cmp eax, ebx
jne 0x41e003
lea edx, [ebp + 8]
push edx
push 0xf003f
push ebx
push str.SoftwareMozillaFirefoxExtensions
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x41dff7
lea eax, [ebp + 8]
push ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push eax
push ebx
push 0xf003f
push ebx
push 0x6d1c98
push ebx
push str.SoftwareMozilla
push reloc.WS2_32.dll_accept
call esi
test eax, eax
jne 0x41dfd6
mov ecx, dword [ebp + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call edi
lea edx, [ebp + 8]
push ebx
push edx
push ebx
push 0xf003f
push ebx
push 0x6d1c98
push ebx
push str.SoftwareMozillaFirefox
push reloc.WS2_32.dll_accept
call esi
test eax, eax
jne 0x41dfd6
mov eax, dword [ebp + 8]
push eax
call edi
lea ecx, [ebp + 8]
push ebx
push ecx
push ebx
push 0xf003f
push ebx
push 0x6d1c98
push ebx
push str.SoftwareMozillaFirefoxExtensions
push reloc.WS2_32.dll_accept
call esi
test eax, eax
je 0x41dffd
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0
call fcn.00401070
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp + 8]
push edx
call edi
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x48], ebx
mov word [ebp - 0x4c], bx
mov esi, dword [0x6d2310]
mov byte [ebp - 4], 0x12
cmp esi, ebx
jne 0x41e020
mov esi, 0x6d2314
mov eax, 0x6a112c
test eax, eax
je 0x41e120
test esi, esi
je 0x41e120
mov ecx, str.idmmzcc5
test ecx, ecx
je 0x41e120
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402380
push esi
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x13
call fcn.0040e580
mov bl, 0x14
push str.idmmzcc5
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.0040e580
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0x15
call fcn.00401070
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
call fcn.00402400
push eax
call fcn.005e71bf
add esp, 4
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.00402400
push eax
call fcn.005e71bf
add esi, edi
lea esi, [eax + esi + 3]
lea edi, [esi + esi]
push edi
call fcn.005ffe3f
mov edx, eax
add esp, 8
test edx, edx
mov dword [ebp - 0x50], edx
je 0x41e0fd
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x28]
call fcn.00402400
push eax
lea ecx, [ebp - 0x34]
call fcn.00402400
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402400
push eax
mov eax, dword [ebp - 0x50]
push esi
push eax
call fcn.005e714f
mov ecx, dword [ebp - 0x50]
push ecx
call fcn.005e71bf
add esp, 0x18
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00401070
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x13
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x12
call fcn.00401070
lea edx, [ebp - 0x100]
push 0x6a1dc4
push edx
call fcn.005e7389
lea eax, [ebp - 0x100]
push eax
call fcn.005e71bf
add esp, 0xc
xor ecx, ecx
cmp ecx, eax
jge 0x41e163
mov dx, word [ebp + ecx*2 - 0x100]
xor dx, 0x4d
sub edx, 0xff
mov word [ebp + ecx*2 - 0x100], dx
inc ecx
jmp 0x41e142
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x41e173
mov dword [ebp - 0x58], 1
jmp 0x41e17b
call fcn.00410380
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x68]
xor esi, esi
push eax
push 0x20019
push esi
xor ebx, ebx
push str.SOFTWAREMozillaSeaMonkey
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x54], ebx
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41e249
mov ecx, 0x19
lea edi, [ebp - 0x164]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x5c]
lea edx, [ebp - 0x164]
push ecx
push edx
push eax
push eax
mov eax, dword [ebp - 0x68]
push str.CurrentVersion
push eax
mov dword [ebp - 0x5c], 0x64
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41e23c
lea ecx, [ebp - 0x164]
mov ebx, 1
push 0x2e
push ecx
mov dword [ebp - 0x54], ebx
call fcn.005e71f0
mov esi, eax
add esp, 8
test esi, esi
je 0x41e23c
lea edx, [ebp - 0x164]
mov byte [esi], 0
push edx
call fcn.005e7473
add esp, 4
test eax, eax
je 0x41e216
mov dword [ebp + 8], eax
inc esi
push 0x6a3bc0
push esi
call fcn.005e8940
add esp, 8
test eax, eax
je 0x41e22c
mov byte [eax], 0
push esi
call fcn.005e7473
add esp, 4
test eax, eax
je 0x41e23c
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 0x68]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x38]
push ecx
push 0xf003f
push 0
push str.SoftwareMozillaSeaMonkeyExtensions
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x41e4a4
lea edx, [ebp - 0x38]
push 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push edx
push 0
push 0xf003f
push 0
push 0x6d1c98
push 0
push str.SoftwareMozillaSeaMonkey
push reloc.WS2_32.dll_accept
call esi
test eax, eax
jne 0x41e6ac
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x38]
push 0
push ecx
push 0
push 0xf003f
push 0
push 0x6d1c98
push 0
push str.SoftwareMozillaSeaMonkeyExtensions
push reloc.WS2_32.dll_accept
call esi
test eax, eax
jne 0x41e6ac
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x41e2fa
mov eax, dword [ebp + 8]
cmp eax, 2
jg 0x41e2e7
jne 0x41e2fa
cmp dword [ebp + 0xc], 0x26
jl 0x41e2fa
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x100]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x41e32f
mov eax, dword [ebp - 0x50]
test eax, eax
jne 0x41e481
lea eax, [ebp - 0x4c]
lea esi, [ebp - 0x4c]
push eax
call fcn.005e71bf
add esp, 4
lea ecx, [eax + eax + 2]
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x100]
push ecx
push esi
push 1
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, dword [0x6d22e8]
test esi, esi
jne 0x41e33e
mov esi, 0x6d22ec
mov ecx, 0x6a112c
test ecx, ecx
je 0x41e43e
test esi, esi
je 0x41e43e
mov edx, str.idmmzcc2.xpi
test edx, edx
je 0x41e43e
push ecx
lea ecx, [ebp - 0x1c]
call fcn.00402380
push esi
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x16
call fcn.0040e580
mov bl, 0x17
push str.idmmzcc2.xpi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.0040e580
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0x18
call fcn.00401070
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
call fcn.00402400
push eax
call fcn.005e71bf
add esp, 4
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.00402400
push eax
call fcn.005e71bf
add esi, edi
lea esi, [eax + esi + 3]
lea edi, [esi + esi]
push edi
call fcn.005ffe3f
mov edx, eax
add esp, 8
test edx, edx
mov dword [ebp - 0x50], edx
je 0x41e41b
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x28]
call fcn.00402400
push eax
lea ecx, [ebp - 0x34]
call fcn.00402400
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402400
push eax
mov eax, dword [ebp - 0x50]
push esi
push eax
call fcn.005e714f
mov ecx, dword [ebp - 0x50]
push ecx
call fcn.005e71bf
add esp, 0x18
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00401070
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x16
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x12
call fcn.00401070
lea edx, [ebp - 0x100]
push 0x6a1e14
push edx
call fcn.005e7389
lea eax, [ebp - 0x100]
push eax
call fcn.005e71bf
add esp, 0xc
xor ecx, ecx
cmp ecx, eax
jge 0x41e488
mov dx, word [ebp + ecx*2 - 0x100]
xor dx, 0x4d
sub edx, 0xff
mov word [ebp + ecx*2 - 0x100], dx
inc ecx
jmp 0x41e460
mov esi, eax
jmp 0x41e30b
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x41e66d
mov eax, dword [ebp + 8]
cmp eax, 2
jg 0x41e66d
jmp 0x41e665
test ebx, ebx
je 0x41e4c8
cmp esi, 2
jg 0x41e4b5
jne 0x41e4c8
cmp dword [ebp + 0xc], 0x26
jl 0x41e4c8
mov edx, dword [ebp - 0x38]
lea ecx, [ebp - 0x100]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x41e4fd
mov eax, dword [ebp - 0x50]
test eax, eax
jne 0x41e64f
lea eax, [ebp - 0x4c]
lea esi, [ebp - 0x4c]
push eax
call fcn.005e71bf
mov edx, dword [ebp - 0x38]
add esp, 4
lea eax, [eax + eax + 2]
lea ecx, [ebp - 0x100]
push eax
push esi
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, dword [0x6d22e8]
test esi, esi
jne 0x41e50c
mov esi, 0x6d22ec
mov eax, 0x6a112c
test eax, eax
je 0x41e60c
test esi, esi
je 0x41e60c
mov ecx, str.idmmzcc2.xpi
test ecx, ecx
je 0x41e60c
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402380
push esi
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x19
call fcn.0040e580
mov bl, 0x1a
push str.idmmzcc2.xpi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.0040e580
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0x1b
call fcn.00401070
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
call fcn.00402400
push eax
call fcn.005e71bf
add esp, 4
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.00402400
push eax
call fcn.005e71bf
add esi, edi
lea esi, [eax + esi + 3]
lea edi, [esi + esi]
push edi
call fcn.005ffe3f
mov edx, eax
add esp, 8
test edx, edx
mov dword [ebp - 0x50], edx
je 0x41e5e9
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x28]
call fcn.00402400
push eax
lea ecx, [ebp - 0x34]
call fcn.00402400
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402400
push eax
mov eax, dword [ebp - 0x50]
push esi
push eax
call fcn.005e714f
mov ecx, dword [ebp - 0x50]
push ecx
call fcn.005e71bf
add esp, 0x18
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00401070
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x19
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x12
call fcn.00401070
lea edx, [ebp - 0x100]
push 0x6a1e14
push edx
call fcn.005e7389
lea eax, [ebp - 0x100]
push eax
call fcn.005e71bf
add esp, 0xc
xor ecx, ecx
cmp ecx, eax
jge 0x41e656
mov dx, word [ebp + ecx*2 - 0x100]
xor dx, 0x4d
sub edx, 0xff
mov word [ebp + ecx*2 - 0x100], dx
inc ecx
jmp 0x41e62e
mov esi, eax
jmp 0x41e4d9
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x41e66d
mov eax, dword [ebp + 8]
cmp eax, 2
jg 0x41e66d
jne 0x41e6a2
cmp dword [ebp + 0xc], 0x26
jl 0x41e6a2
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x41e678
mov esi, eax
jmp 0x41e67e
lea eax, [ebp - 0x4c]
lea esi, [ebp - 0x4c]
push eax
call fcn.005e71bf
mov edx, dword [ebp - 0x38]
add esp, 4
lea eax, [eax + eax + 2]
lea ecx, [ebp - 0x100]
push eax
push esi
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x58]
xor esi, esi
cmp ebx, esi
je 0x41e863
mov eax, dword [ebp - 0x50]
cmp eax, esi
jne 0x41e6c3
lea eax, [ebp - 0x4c]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call edi
cmp eax, 0xffffffff
je 0x41e863
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x2c], esi
mov word [ebp - 0x30], si
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x5c], esi
mov word [ebp - 0x60], si
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], esi
mov word [ebp - 0x18], si
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], esi
mov word [ebp - 0x24], si
lea ecx, [ebp - 0x74]
call fcn.0041cab0
lea ecx, [ebp - 0x80]
call fcn.0041cab0
mov ecx, 0x6d2310
mov byte [ebp - 4], 0x21
call fcn.00402400
push eax
push str._sidmmzcc
lea ecx, [ebp - 0x34]
call fcn.0041aed0
mov ecx, 0x6d2310
call fcn.00402400
push eax
push str._sidmmzcc2
lea ecx, [ebp - 0x64]
call fcn.0041aed0
mov ecx, 0x6d2310
call fcn.00402400
push eax
push str._sidmmzcc3
lea ecx, [ebp - 0x1c]
call fcn.0041aed0
mov ecx, 0x6d2310
call fcn.00402400
push eax
push str._sidmmzcc01
lea ecx, [ebp - 0x28]
call fcn.0041aed0
mov ecx, 0x6d2310
call fcn.00402400
push eax
push str._sidmmzcc02
lea ecx, [ebp - 0x74]
call fcn.0041aed0
mov ecx, 0x6d2310
call fcn.00402400
push eax
push str._sidmmzcc03
lea ecx, [ebp - 0x80]
call fcn.0041aed0
lea ecx, [ebp - 0x34]
call fcn.00402400
push eax
call edi
cmp eax, 0xffffffff
je 0x41e7cd
lea ecx, [ebp - 0x28]
call fcn.00402400
push eax
lea ecx, [ebp - 0x34]
call fcn.00402400
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileW]
push eax
call esi
jmp 0x41e7d3
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [ebp - 0x64]
call fcn.00402400
push eax
call edi
cmp eax, 0xffffffff
je 0x41e7f7
lea ecx, [ebp - 0x74]
call fcn.00402400
push eax
lea ecx, [ebp - 0x64]
call fcn.00402400
push eax
call esi
lea ecx, [ebp - 0x1c]
call fcn.00402400
push eax
call edi
cmp eax, 0xffffffff
je 0x41e81b
lea ecx, [ebp - 0x80]
call fcn.00402400
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402400
push eax
call esi
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0x20
call fcn.00401070
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0x1f
call fcn.00401070
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x1e
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x1d
call fcn.00401070
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x1c
call fcn.00401070
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x12
call fcn.00401070
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 1
call fcn.00401070
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0
call fcn.00401070
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8