Function at 0x411d60
Capabilities:
Check if file exists
Get file attributes
Move file
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57c263
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x534
push ebx
push esi
push edi
lea eax, [ebp - 0x138]
mov dword [ebp - 0x10], esp
xor edi, edi
push 0x104
push eax
mov dword [ebp - 0x1c], ecx
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x411e16
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x240]
mov esi, eax
call fcn.0046f750
mov ecx, dword [0x639ad4]
mov dword [ebp - 0x28], ecx
push esi
lea edx, [ebp - 0x28]
push str.Err__ld_GetMdlFN_in_InstMzExt15_n
push edx
mov byte [ebp - 4], 2
call fcn.00562ecb
mov eax, dword [ebp - 0x28]
add esp, 0xc
lea ecx, [ebp - 0x240]
push 1
push eax
call fcn.0046f830
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0056a100
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0
call fcn.0046f820
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x440]
lea edx, [ebp - 0x540]
push ecx
lea eax, [ebp - 0x340]
push edx
lea ecx, [ebp - 0x34]
push eax
lea edx, [ebp - 0x138]
push ecx
push edx
call fcn.0054ea7c
add esp, 0x14
lea eax, [ebp - 0x340]
lea ecx, [ebp - 0x34]
lea edx, [ebp - 0x138]
push str.idmmzcc.xpi
push eax
push ecx
push 0x6168c4
push edx
call fcn.0054ea2a
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
add esp, 0x14
lea eax, [ebp - 0x138]
push eax
call esi
cmp eax, 0xffffffff
je 0x411e01
mov ecx, dword [0x639ad4]
mov dword [ebp - 0x14], ecx
mov edx, dword [0x63e500]
push str.idmmzcc3
push edx
lea eax, [ebp - 0x14]
push str._s_scomponentsidmmzcc.dll
push eax
mov byte [ebp - 4], 3
call fcn.00562ecb
mov ecx, dword [ebp - 0x14]
add esp, 0x10
push ecx
call esi
cmp eax, 0xffffffff
je 0x411f30
mov edx, dword [0x63e500]
push str.idmmzcc3
push edx
lea eax, [ebp - 0x14]
push str._s_scomponentsiIDMMzCC.xpt
push eax
call fcn.00562ecb
mov ecx, dword [ebp - 0x14]
add esp, 0x10
push ecx
call esi
cmp eax, 0xffffffff
je 0x411f30
mov edx, dword [0x63e500]
push str.idmmzcc3
push edx
lea eax, [ebp - 0x14]
push str._s_schromeidmmzcc.jar
push eax
call fcn.00562ecb
mov ecx, dword [ebp - 0x14]
add esp, 0x10
push ecx
call esi
cmp eax, 0xffffffff
je 0x411f30
mov edx, dword [0x63e500]
push str.idmmzcc3
push edx
lea eax, [ebp - 0x14]
push str._s_schrome.manifest
push eax
call fcn.00562ecb
mov ecx, dword [ebp - 0x14]
add esp, 0x10
push ecx
call esi
cmp eax, 0xffffffff
je 0x411f30
mov ebx, dword [ebp + 8]
cmp ebx, edi
je 0x411f8a
jmp 0x411f33
mov ebx, dword [ebp + 8]
lea edx, [ebp - 0x138]
push edx
call fcn.0053ceb0
mov esi, eax
add esp, 4
cmp esi, edi
je 0x411f8a
lea eax, [ebp - 0x30]
push eax
push esi
call fcn.0053d2b0
add esp, 8
cmp edi, dword [ebp - 0x30]
jae 0x411f81
mov ecx, dword [ebp - 0x1c]
push ecx
push ebx
push esi
call fcn.00411550
add esp, 0xc
test eax, eax
jne 0x411f81
mov eax, dword [ebp - 0x30]
inc edi
cmp edi, eax
jae 0x411f81
push esi
call fcn.0053d700
add esp, 4
test eax, eax
je 0x411f55
push esi
call fcn.0053dcb0
add esp, 4
lea edx, [ebp - 0x18]
push edx
push 0xf003f
push 0
push str.SoftwareMozillaFirefoxExtensions
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x412048
lea eax, [ebp - 0x18]
push 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push eax
push 0
push 0xf003f
push 0
push 0x63e040
push 0
push str.SoftwareMozilla
push reloc.WSOCK32.dll_accept
call esi
test eax, eax
jne 0x412037
mov ecx, dword [ebp - 0x18]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call ebx
lea edx, [ebp - 0x18]
push 0
push edx
push 0
push 0xf003f
push 0
push 0x63e040
push 0
push str.SoftwareMozillaFirefox
push reloc.WSOCK32.dll_accept
call esi
test eax, eax
jne 0x412037
mov eax, dword [ebp - 0x18]
push eax
call ebx
lea ecx, [ebp - 0x18]
push 0
push ecx
push 0
push 0xf003f
push 0
push 0x63e040
push 0
push str.SoftwareMozillaFirefoxExtensions
push reloc.WSOCK32.dll_accept
call esi
test eax, eax
je 0x41204e
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.0056a100
jmp 0x411e01
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [0x639ad4]
xor esi, esi
mov dword [ebp - 0x24], edx
mov eax, dword [0x63e500]
push str.idmmzcc3
push eax
lea ecx, [ebp - 0x24]
push 0x615f14
push ecx
mov byte [ebp - 4], 4
call fcn.00562ecb
mov edx, dword [ebp - 0x24]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [ebp - 0x18]
push 1
push eax
push str.mozilla_cc_internetdownloadmanager.com
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x4120a4
mov esi, 1
mov eax, dword [ebp - 0x18]
push eax
call ebx
test esi, esi
je 0x41219d
mov ecx, dword [ebp - 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push ecx
call edi
cmp eax, 0xffffffff
je 0x41219d
mov eax, dword [0x639ad4]
mov dword [ebp - 0x20], eax
mov dword [ebp + 8], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], eax
mov edx, dword [0x63e500]
lea eax, [ebp - 0x20]
push edx
push str._sidmmzcc
push eax
mov byte [ebp - 4], 8
call fcn.00562ecb
mov ecx, dword [0x63e500]
add esp, 0xc
lea edx, [ebp + 8]
push ecx
push str._sidmmzcc2
push edx
call fcn.00562ecb
mov eax, dword [0x63e500]
add esp, 0xc
lea ecx, [ebp - 0x1c]
push eax
push str._sidmmzcc01
push ecx
call fcn.00562ecb
mov edx, dword [0x63e500]
add esp, 0xc
lea eax, [ebp - 0x2c]
push edx
push str._sidmmzcc02
push eax
call fcn.00562ecb
mov ecx, dword [ebp - 0x20]
add esp, 0xc
push ecx
call edi
cmp eax, 0xffffffff
je 0x412154
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov ecx, dword [ebp + 8]
push ecx
call edi
cmp eax, 0xffffffff
je 0x41216d
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp + 8]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 7
call fcn.0056a100
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 6
call fcn.0056a100
lea ecx, [ebp + 8]
mov byte [ebp - 4], 5
call fcn.0056a100
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 4
call fcn.0056a100
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 3
call fcn.0056a100
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.0056a100
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4