Function at 0x44bec0
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
sub esp, 0x698
lea ebp, [esp - 4]
mov eax, dword [0x59d300]
xor eax, ebp
mov dword [ebp + 0x698], eax
push 0xd8
mov eax, 0x5291fc
call fcn.00506664
mov eax, dword [ebp + 0x6a4]
mov dword [ebp - 0x1c], eax
call fcn.0040dbda
mov al, byte [eax]
xor ebx, ebx
cmp al, bl
jne 0x44bf92
lea eax, [ebp - 0xc8]
push eax
call fcn.0040d9e1
push dword [ebp - 0x1c]
lea esi, [ebp - 0x38]
mov dword [ebp - 4], ebx
call fcn.0040b812
push eax
push 0x543368
lea eax, [ebp - 0xc0]
push str.XpiUnInstaller.cpp:_fnProfilesXpiUnInstaller__folder_name
push eax
mov byte [ebp - 4], 1
call fcn.0040c0a0
pop ecx
pop ecx
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push eax
call fcn.0040b612
pop ecx
pop ecx
push ebx
push 1
mov byte [ebp - 4], bl
call fcn.0040dac5
lea eax, [ebp + 0x26c]
push eax
lea ecx, [ebp - 0xc8]
call fcn.0040bf31
lea edi, [ebp + 0x26c]
mov byte [ebp - 4], 2
call fcn.0040ba4e
push ebx
push 1
mov esi, edi
call fcn.0040dac5
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0xc8]
call fcn.0040c22b
jmp 0x44c0e5
lea eax, [ebp - 0xc0]
push eax
mov dword [ebp - 4], 3
call fcn.0040b935
push dword [ebp - 0x1c]
lea esi, [ebp + 0x26c]
mov byte [ebp - 4], 4
call fcn.0040b812
mov edi, eax
mov byte [ebp - 4], 5
call fcn.0040dbda
lea ecx, [ebp - 0x38]
call fcn.0040b84b
mov byte [ebp - 4], 6
cmp dword [eax + 0x18], 8
jb 0x44bfd9
mov esi, dword [eax + 4]
jmp 0x44bfdc
lea esi, [eax + 4]
lea eax, [ebp - 0xc0]
push 0x54331c
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push esi
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543314
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push str.XpiUnInstaller.cpp:_fnProfilesXpiUnInstaller__folder_name
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543368
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push edi
push eax
call fcn.0040b612
pop ecx
pop ecx
push ebx
push 1
lea esi, [ebp - 0x38]
call fcn.0040dac5
push ebx
push 1
lea esi, [ebp + 0x26c]
mov byte [ebp - 4], 4
call fcn.0040dac5
lea eax, [ebp - 0x18]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 7
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
cmp al, bl
je 0x44c094
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0xc0]
call fcn.0040b831
push 0x50
push str..XpiUnInstaller.cpp
push eax
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 8
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push ebx
push 1
lea esi, [ebp - 0x38]
call fcn.0040dac5
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 4
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0xc0]
mov byte [ebp - 4], 3
call fcn.0040b8a0
or dword [ebp - 4], 0xffffffff
jmp 0x44c0e5
push 0xffffffffffffffff
push str.firefox.exe
call fcn.0041ca99
pop ecx
pop ecx
lea ecx, [ebp + 0x288]
call fcn.0044b186
cmp eax, ebx
ja 0x44c28b
call fcn.0040dbda
cmp byte [eax], bl
jne 0x44c177
lea eax, [ebp - 0xc8]
push eax
call fcn.0040d9e1
lea eax, [ebp - 0xc0]
push str.XpiUnInstaller.cpp:_fnProfilesXpiUnInstaller__DetermineFFProfilesDir_failed.
push eax
mov dword [ebp - 4], 0xb
call fcn.0040c0a0
pop ecx
pop ecx
lea eax, [ebp + 0x26c]
push eax
lea ecx, [ebp - 0xc8]
call fcn.0040bf31
lea edi, [ebp + 0x26c]
mov byte [ebp - 4], 0xc
call fcn.0040ba4e
push ebx
push 1
mov esi, edi
call fcn.0040dac5
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0xc8]
call fcn.0040c22b
push 3
pop eax
jmp 0x44c637
lea eax, [ebp - 0xc0]
push eax
mov dword [ebp - 4], 0xd
call fcn.0040b935
mov byte [ebp - 4], 0xe
call fcn.0040dbda
lea ecx, [ebp - 0x38]
call fcn.0040b84b
mov byte [ebp - 4], 0xf
cmp dword [eax + 0x18], 8
jb 0x44c1aa
mov esi, dword [eax + 4]
jmp 0x44c1ad
lea esi, [eax + 4]
lea eax, [ebp - 0xc0]
push 0x54331c
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push esi
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543314
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push str.XpiUnInstaller.cpp:_fnProfilesXpiUnInstaller__DetermineFFProfilesDir_failed.
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push ebx
push 1
lea esi, [ebp - 0x38]
mov byte [ebp - 4], 0xe
call fcn.0040dac5
lea eax, [ebp - 0x18]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x10
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
cmp al, bl
je 0x44c241
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0xc0]
call fcn.0040b831
push 0x58
push str..XpiUnInstaller.cpp
push eax
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x11
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push ebx
push 1
lea esi, [ebp - 0x38]
call fcn.0040dac5
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0xe
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0xc0]
mov byte [ebp - 4], 0xd
call fcn.0040b8a0
jmp 0x44c16f
lea edi, [ebp + 0x288]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
cmp ax, bx
jne 0x44c293
lea eax, [ebp]
push eax
lea eax, [ebp + 0x288]
mov esi, 0x548724
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x288]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x44c2c1
sub eax, edx
sar eax, 1
xor ecx, ecx
cmp dword [ebp - 0x14], 0xffffffff
mov word [ebp + eax*2 + 0x286], cx
je 0x44c635
cmp word [ebp + 0x2c], 0x2e
je 0x44c616
test byte [ebp], 0x10
je 0x44c616
xor eax, eax
movzx ecx, word [ebp + eax + 0x288]
mov word [ebp + eax + 0x490], cx
inc eax
inc eax
cmp cx, bx
jne 0x44c2fa
lea eax, [ebp + 0x2c]
mov edx, eax
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x44c316
sub eax, edx
lea edi, [ebp + 0x490]
dec edi
dec edi
mov cx, word [edi + 2]
inc edi
inc edi
cmp cx, bx
jne 0x44c32a
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp + 0x490]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
cmp ax, bx
jne 0x44c34d
mov eax, dword [ebp - 0x1c]
push 6
pop ecx
mov esi, str.extensions_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edx, eax
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x44c369
sub eax, edx
lea edi, [ebp + 0x490]
dec edi
dec edi
mov cx, word [edi + 2]
inc edi
inc edi
cmp cx, bx
jne 0x44c37d
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0040dbda
cmp byte [eax], bl
jne 0x44c43f
lea eax, [ebp - 0xc8]
push eax
call fcn.0040d9e1
lea eax, [ebp + 0x490]
push eax
lea esi, [ebp - 0x38]
mov dword [ebp - 4], 0x14
call fcn.0040b812
push eax
push 0x543368
lea eax, [ebp - 0xc0]
push str.XpiUnInstaller.cpp:_fnProfilesXpiUnInstaller__about_to_remove
push eax
mov byte [ebp - 4], 0x15
call fcn.0040c0a0
pop ecx
pop ecx
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push eax
call fcn.0040b612
pop ecx
pop ecx
push ebx
push 1
mov byte [ebp - 4], 0x14
call fcn.0040dac5
lea eax, [ebp + 0x26c]
push eax
lea ecx, [ebp - 0xc8]
call fcn.0040bf31
lea edi, [ebp + 0x26c]
mov byte [ebp - 4], 0x16
call fcn.0040ba4e
push ebx
push 1
mov esi, edi
call fcn.0040dac5
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0xc8]
call fcn.0040c22b
jmp 0x44c596
lea eax, [ebp - 0xc0]
push eax
mov dword [ebp - 4], 0x17
call fcn.0040b935
lea eax, [ebp + 0x490]
push eax
lea esi, [ebp + 0x26c]
mov byte [ebp - 4], 0x18
call fcn.0040b812
mov edi, eax
mov byte [ebp - 4], 0x19
call fcn.0040dbda
lea ecx, [ebp - 0x38]
call fcn.0040b84b
mov byte [ebp - 4], 0x1a
cmp dword [eax + 0x18], 8
jb 0x44c48a
mov esi, dword [eax + 4]
jmp 0x44c48d
lea esi, [eax + 4]
lea eax, [ebp - 0xc0]
push 0x54331c
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push esi
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543314
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push str.XpiUnInstaller.cpp:_fnProfilesXpiUnInstaller__about_to_remove
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543368
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push edi
push eax
call fcn.0040b612
pop ecx
pop ecx
push ebx
push 1
lea esi, [ebp - 0x38]
call fcn.0040dac5
push ebx
push 1
lea esi, [ebp + 0x26c]
mov byte [ebp - 4], 0x18
call fcn.0040dac5
lea eax, [ebp - 0x40]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x1b
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
cmp al, bl
je 0x44c545
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0xc0]
call fcn.0040b831
push 0x6c
push str..XpiUnInstaller.cpp
push eax
push esi
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x1c
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push ebx
push 1
lea esi, [ebp - 0x38]
call fcn.0040dac5
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x18
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0xc0]
mov byte [ebp - 4], 0x17
call fcn.0040b8a0
or dword [ebp - 4], 0xffffffff
jmp 0x44c596
lea eax, [ebp + 0x490]
push eax
lea esi, [ebp - 0xe4]
call fcn.0040b812
mov ecx, eax
mov dword [ebp - 4], 0x1f
call fcn.0044b6a2
or dword [ebp - 4], 0xffffffff
push ebx
push 1
call fcn.0040dac5
lea eax, [ebp + 0x490]
push eax
lea esi, [ebp + 0x250]
call fcn.0040b812
push str..xpi
mov eax, esi
push eax
mov dword [ebp - 4], 0x20
call fcn.0040b547
cmp dword [ebp + 0x268], 8
mov eax, dword [ebp + 0x254]
jae 0x44c5fd
lea eax, [ebp + 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea esi, [ebp + 0x250]
call fcn.0040dac5
lea eax, [ebp]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, 1
je 0x44c2e3
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x698]
xor ecx, ebp
call fcn.004ffa47
add ebp, 0x69c
leave
ret