Function at 0x4202f0
Capabilities:
Check if file exists
Delete registry value
Get file attributes
Move file
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x639ae8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x360
mov eax, dword [0x6fca20]
push ebx
push esi
xor ebx, ebx
push edi
cmp eax, ebx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x54], ecx
mov dword [ebp - 4], ebx
jne 0x42032a
mov eax, 0x6fca24
push str.idmmzcc.xpi
push eax
lea eax, [ebp - 0x36c]
push 0x6ca5f0
push eax
call fcn.0060aac7
add esp, 0x10
lea ecx, [ebp - 0x36c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x420b73
xor ecx, ecx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x44], ecx
mov word [ebp - 0x40], bx
mov eax, dword [0x6fca48]
mov byte [ebp - 4], 1
cmp eax, ebx
mov esi, eax
jne 0x42037a
mov esi, 0x6fca4c
mov edx, str._s_scomponents2idmmzcc.dll
test edx, edx
je 0x420488
cmp esi, ebx
je 0x420488
mov eax, str.idmmzcc5
test eax, eax
je 0x420488
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
mov word [ebp - 0x18], bx
push ebx
push edx
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.004027e0
push esi
lea ecx, [ebp - 0x34]
call fcn.00401ee0
push str.idmmzcc5
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.00401ee0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 4
call fcn.00401070
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
call fcn.00401f10
push eax
call fcn.00609a4e
add esp, 4
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.00401f10
push eax
call fcn.00609a4e
add esi, edi
lea esi, [eax + esi + 3]
lea edi, [esi + esi]
push edi
call fcn.00622acb
mov edx, eax
add esp, 8
cmp edx, ebx
mov dword [ebp - 0x44], edx
je 0x420461
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x28]
call fcn.00401f10
push eax
lea ecx, [ebp - 0x34]
call fcn.00401f10
push eax
lea ecx, [ebp - 0x1c]
call fcn.00401f10
push eax
mov eax, dword [ebp - 0x44]
push esi
push eax
call fcn.006099de
mov ecx, dword [ebp - 0x44]
push ecx
call fcn.00609a4e
add esp, 0x18
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.00401070
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 2
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00401070
mov ecx, dword [ebp - 0x44]
cmp ecx, ebx
mov eax, ecx
jne 0x420491
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x420854
mov esi, dword [0x6fca48]
test esi, esi
jne 0x4204b0
mov esi, 0x6fca4c
mov edx, str._s_scomponents2idmcchandler2.dll
test edx, edx
je 0x4205c3
test esi, esi
je 0x4205c3
mov eax, str.idmmzcc5
test eax, eax
je 0x4205c3
lea ecx, [ebp - 0x34]
call fcn.004027c0
push 0
push str._s_scomponents2idmcchandler2.dll
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 5
call fcn.004027e0
push esi
lea ecx, [ebp - 0x1c]
call fcn.00401ee0
mov bl, 6
push str.idmmzcc5
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00401ee0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 7
call fcn.00401070
mov edi, dword [ebp - 0x1c]
test edi, edi
jne 0x42051e
lea edi, [ebp - 0x18]
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
call fcn.00401f10
push eax
call fcn.00609a4e
mov edx, eax
push edi
mov dword [ebp - 0x64], edx
call fcn.00609a4e
mov ecx, dword [ebp - 0x64]
add esi, ecx
lea esi, [eax + esi + 3]
lea edi, [esi + esi]
push edi
call fcn.00622acb
mov edx, eax
add esp, 0xc
test edx, edx
mov dword [ebp - 0x44], edx
je 0x4205a0
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x28]
call fcn.00401f10
push eax
lea ecx, [ebp - 0x1c]
call fcn.00401f10
push eax
lea ecx, [ebp - 0x34]
call fcn.00401f10
push eax
mov eax, dword [ebp - 0x44]
push esi
push eax
call fcn.006099de
mov ecx, dword [ebp - 0x44]
push ecx
call fcn.00609a4e
add esp, 0x18
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 5
call fcn.00401070
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 1
call fcn.00401070
mov eax, dword [ebp - 0x44]
test eax, eax
jne 0x4205cd
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x420854
mov esi, dword [0x6fca48]
test esi, esi
jne 0x4205ec
mov esi, 0x6fca4c
mov edx, str._s_schromeidmmzcc.jar
test edx, edx
je 0x4206fa
test esi, esi
je 0x4206fa
mov eax, str.idmmzcc5
test eax, eax
je 0x4206fa
lea ecx, [ebp - 0x1c]
call fcn.004027c0
push 0
push str._s_schromeidmmzcc.jar
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 8
call fcn.004027e0
push esi
lea ecx, [ebp - 0x34]
call fcn.00401ee0
mov bl, 9
push str.idmmzcc5
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00401ee0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0xa
call fcn.00401070
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
call fcn.00401f10
push eax
call fcn.00609a4e
add esp, 4
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.00401f10
push eax
call fcn.00609a4e
add esi, edi
lea esi, [eax + esi + 3]
lea edi, [esi + esi]
push edi
call fcn.00622acb
mov edx, eax
add esp, 8
test edx, edx
mov dword [ebp - 0x44], edx
je 0x4206d7
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x28]
call fcn.00401f10
push eax
lea ecx, [ebp - 0x34]
call fcn.00401f10
push eax
lea ecx, [ebp - 0x1c]
call fcn.00401f10
push eax
mov eax, dword [ebp - 0x44]
push esi
push eax
call fcn.006099de
mov ecx, dword [ebp - 0x44]
push ecx
call fcn.00609a4e
add esp, 0x18
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00401070
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 8
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00401070
mov eax, dword [ebp - 0x44]
test eax, eax
jne 0x420704
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x420854
mov esi, dword [0x6fca48]
test esi, esi
jne 0x420723
mov esi, 0x6fca4c
mov edx, str._s_scomponents12idmmzcc.dll
test edx, edx
je 0x420831
test esi, esi
je 0x420831
mov eax, str.idmmzcc5
test eax, eax
je 0x420831
lea ecx, [ebp - 0x1c]
call fcn.004027c0
push 0
push str._s_scomponents12idmmzcc.dll
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xb
call fcn.004027e0
push esi
lea ecx, [ebp - 0x34]
call fcn.00401ee0
mov bl, 0xc
push str.idmmzcc5
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00401ee0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0xd
call fcn.00401070
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
call fcn.00401f10
push eax
call fcn.00609a4e
add esp, 4
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.00401f10
push eax
call fcn.00609a4e
add esi, edi
lea esi, [eax + esi + 3]
lea edi, [esi + esi]
push edi
call fcn.00622acb
mov edx, eax
add esp, 8
test edx, edx
mov dword [ebp - 0x44], edx
je 0x42080e
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x28]
call fcn.00401f10
push eax
lea ecx, [ebp - 0x34]
call fcn.00401f10
push eax
lea ecx, [ebp - 0x1c]
call fcn.00401f10
push eax
mov eax, dword [ebp - 0x44]
push esi
push eax
call fcn.006099de
mov ecx, dword [ebp - 0x44]
push ecx
call fcn.00609a4e
add esp, 0x18
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00401070
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0xb
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00401070
mov eax, dword [ebp - 0x44]
test eax, eax
jne 0x42083b
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x420854
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x420aba
jmp 0x420857
mov ebx, dword [ebp + 8]
lea edx, [ebp - 0x36c]
mov dword [ebp + 8], 0
push edx
call fcn.005f73f0
mov esi, eax
add esp, 4
test esi, esi
je 0x4208c0
lea eax, [ebp - 0x30]
push eax
push esi
call fcn.005f7830
add esp, 8
xor edi, edi
cmp edi, dword [ebp - 0x30]
jae 0x4208b7
mov edx, dword [ebp - 0x54]
lea ecx, [ebp + 8]
push ecx
push edx
push str.idmmzcc5
push ebx
push esi
call fcn.0041eca0
add esp, 0x14
test eax, eax
jne 0x4208b7
mov eax, dword [ebp - 0x30]
inc edi
cmp edi, eax
jae 0x4208b7
push esi
call fcn.005f7c80
add esp, 4
test eax, eax
je 0x420882
push esi
call fcn.005f77f0
add esp, 4
mov eax, dword [ebp + 8]
test eax, eax
je 0x420963
test ebx, ebx
je 0x420963
mov eax, dword [0x6fd630]
mov ecx, dword [0x6fd320]
push 0x50035
push eax
push ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call fcn.00457010
add esp, 0x10
cmp eax, 4
jne 0x420963
lea edx, [ebp - 0x36c]
mov dword [ebp + 8], 0
push edx
call fcn.005f73f0
mov edi, eax
add esp, 4
test edi, edi
je 0x420963
lea eax, [ebp - 0x30]
push eax
push edi
call fcn.005f7830
add esp, 8
test eax, eax
jne 0x420963
xor esi, esi
cmp esi, dword [ebp - 0x30]
jae 0x42095d
mov edx, dword [ebp - 0x54]
lea ecx, [ebp + 8]
push ecx
push edx
push str.idmmzcc5
push ebx
push edi
call fcn.0041eca0
add esp, 0x14
test eax, eax
jne 0x42095d
mov eax, dword [ebp - 0x30]
inc esi
cmp esi, eax
jae 0x42095d
push edi
call fcn.005f7c80
add esp, 4
test eax, eax
je 0x420928
push edi
jmp 0x4208b8
push str.idmmzcc5
call fcn.0041fab0
xor eax, eax
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
mov word [ebp - 0x18], ax
mov ecx, dword [0x6fca48]
cmp ecx, eax
mov esi, ecx
jne 0x42098d
mov esi, 0x6fca4c
mov ecx, 0x6c900c
test ecx, ecx
je 0x420a9e
test esi, esi
je 0x420a9e
mov edx, str.idmmzcc5
test edx, edx
je 0x420a9e
lea ecx, [ebp - 0x34]
call fcn.004027c0
push 0
push 0x6c900c
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0xf
call fcn.004027e0
push esi
lea ecx, [ebp - 0x60]
call fcn.00401ee0
mov bl, 0x10
push str.idmmzcc5
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00401ee0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x11
call fcn.00401070
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
call fcn.00401f10
push eax
call fcn.00609a4e
add esp, 4
lea ecx, [ebp - 0x60]
mov edi, eax
call fcn.00401f10
push eax
call fcn.00609a4e
add esi, edi
lea esi, [eax + esi + 3]
lea edi, [esi + esi]
push edi
call fcn.00622acb
mov edx, eax
add esp, 8
test edx, edx
mov dword [ebp - 0x1c], edx
je 0x420a78
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x28]
call fcn.00401f10
push eax
lea ecx, [ebp - 0x60]
call fcn.00401f10
push eax
lea ecx, [ebp - 0x34]
call fcn.00401f10
push eax
mov eax, dword [ebp - 0x1c]
push esi
push eax
call fcn.006099de
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00609a4e
add esp, 0x18
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00401070
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0xf
call fcn.00401070
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0xe
call fcn.00401070
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x420aa5
lea eax, [ebp - 0x18]
push eax
call fcn.0041fa30
add esp, 4
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00401070
mov eax, dword [ebp + 0xc]
xor ebx, ebx
cmp eax, ebx
jne 0x420b94
lea edx, [ebp + 8]
push edx
push 0xf003f
push ebx
push str.SoftwareMozillaFirefoxExtensions
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x420b88
lea eax, [ebp + 8]
push ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push eax
push ebx
push 0xf003f
push ebx
push 0x6fc418
push ebx
push str.SoftwareMozilla
push 0x80000001
call esi
test eax, eax
jne 0x420b67
mov ecx, dword [ebp + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call edi
lea edx, [ebp + 8]
push ebx
push edx
push ebx
push 0xf003f
push ebx
push 0x6fc418
push ebx
push str.SoftwareMozillaFirefox
push 0x80000001
call esi
test eax, eax
jne 0x420b67
mov eax, dword [ebp + 8]
push eax
call edi
lea ecx, [ebp + 8]
push ebx
push ecx
push ebx
push 0xf003f
push ebx
push 0x6fc418
push ebx
push str.SoftwareMozillaFirefoxExtensions
push 0x80000001
call esi
test eax, eax
je 0x420b8e
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0
call fcn.00401070
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp + 8]
push edx
call edi
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x48], ebx
mov word [ebp - 0x4c], bx
mov eax, dword [0x6fca48]
mov byte [ebp - 4], 0x12
cmp eax, ebx
mov esi, eax
jne 0x420bb2
mov esi, 0x6fca4c
mov eax, 0x6c900c
test eax, eax
je 0x420cc0
test esi, esi
je 0x420cc0
mov ecx, str.idmmzcc5
test ecx, ecx
je 0x420cc0
lea ecx, [ebp - 0x1c]
call fcn.004027c0
push 0
push 0x6c900c
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x13
call fcn.004027e0
push esi
lea ecx, [ebp - 0x28]
call fcn.00401ee0
mov bl, 0x14
push str.idmmzcc5
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], bl
call fcn.00401ee0
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0x15
call fcn.00401070
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x60]
call fcn.00401f10
push eax
call fcn.00609a4e
add esp, 4
lea ecx, [ebp - 0x28]
mov edi, eax
call fcn.00401f10
push eax
call fcn.00609a4e
add esi, edi
lea esi, [eax + esi + 3]
lea edi, [esi + esi]
push edi
call fcn.00622acb
mov edx, eax
add esp, 8
test edx, edx
mov dword [ebp - 0x50], edx
je 0x420c9d
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x60]
call fcn.00401f10
push eax
lea ecx, [ebp - 0x28]
call fcn.00401f10
push eax
lea ecx, [ebp - 0x1c]
call fcn.00401f10
push eax
mov eax, dword [ebp - 0x50]
push esi
push eax
call fcn.006099de
mov ecx, dword [ebp - 0x50]
push ecx
call fcn.00609a4e
add esp, 0x18
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], bl
call fcn.00401070
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x13
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x12
call fcn.00401070
lea edx, [ebp - 0x100]
push 0x6c9e40
push edx
call fcn.00609a95
lea eax, [ebp - 0x100]
push eax
call fcn.00609a4e
add esp, 0xc
xor ecx, ecx
cmp ecx, eax
jge 0x420d03
mov dx, word [ebp + ecx*2 - 0x100]
xor dx, 0x4d
sub edx, 0xff
mov word [ebp + ecx*2 - 0x100], dx
inc ecx
jmp 0x420ce2
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x420d13
mov dword [ebp - 0x64], 1
jmp 0x420d1b
call fcn.004115a0
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x68]
xor esi, esi
push eax
push 0x20019
push esi
xor ebx, ebx
push str.SOFTWAREMozillaSeaMonkey
push 0x80000002
mov dword [ebp - 0x54], ebx
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x420de9
mov ecx, 0x19
lea edi, [ebp - 0x164]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x2c]
lea edx, [ebp - 0x164]
push ecx
push edx
push eax
push eax
mov eax, dword [ebp - 0x68]
push str.CurrentVersion
push eax
mov dword [ebp - 0x2c], 0x64
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x420ddc
lea ecx, [ebp - 0x164]
mov ebx, 1
push 0x2e
push ecx
mov dword [ebp - 0x54], ebx
call fcn.00609c00
mov esi, eax
add esp, 8
test esi, esi
je 0x420ddc
lea edx, [ebp - 0x164]
mov byte [esi], 0
push edx
call fcn.00609e33
add esp, 4
test eax, eax
je 0x420db6
mov dword [ebp + 8], eax
inc esi
push 0x6cc01c
push esi
call fcn.0060b360
add esp, 8
test eax, eax
je 0x420dcc
mov byte [eax], 0
push esi
call fcn.00609e33
add esp, 4
test eax, eax
je 0x420ddc
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 0x68]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x38]
push ecx
push 0xf003f
push 0
push str.SoftwareMozillaSeaMonkeyExtensions
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x421052
lea edx, [ebp - 0x38]
push 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push edx
push 0
push 0xf003f
push 0
push 0x6fc418
push 0
push str.SoftwareMozillaSeaMonkey
push 0x80000001
call esi
test eax, eax
jne 0x421268
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x38]
push 0
push ecx
push 0
push 0xf003f
push 0
push 0x6fc418
push 0
push str.SoftwareMozillaSeaMonkeyExtensions
push 0x80000001
call esi
test eax, eax
jne 0x421268
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x420e9a
mov eax, dword [ebp + 8]
cmp eax, 2
jg 0x420e87
jne 0x420e9a
cmp dword [ebp + 0xc], 0x26
jl 0x420e9a
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x100]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x420ecf
mov eax, dword [ebp - 0x50]
test eax, eax
jne 0x42102f
lea eax, [ebp - 0x4c]
lea esi, [ebp - 0x4c]
push eax
call fcn.00609a4e
add esp, 4
lea ecx, [eax + eax + 2]
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x100]
push ecx
push esi
push 1
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, dword [0x6fca20]
test esi, esi
jne 0x420ede
mov esi, 0x6fca24
mov ecx, 0x6c900c
test ecx, ecx
je 0x420fec
test esi, esi
je 0x420fec
mov edx, str.idmmzcc2.xpi
test edx, edx
je 0x420fec
lea ecx, [ebp - 0x1c]
call fcn.004027c0
push 0
push 0x6c900c
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x16
call fcn.004027e0
push esi
lea ecx, [ebp - 0x28]
call fcn.00401ee0
mov bl, 0x17
push str.idmmzcc2.xpi
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], bl
call fcn.00401ee0
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0x18
call fcn.00401070
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x60]
call fcn.00401f10
push eax
call fcn.00609a4e
add esp, 4
lea ecx, [ebp - 0x28]
mov edi, eax
call fcn.00401f10
push eax
call fcn.00609a4e
add esi, edi
lea esi, [eax + esi + 3]
lea edi, [esi + esi]
push edi
call fcn.00622acb
mov edx, eax
add esp, 8
test edx, edx
mov dword [ebp - 0x50], edx
je 0x420fc9
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x60]
call fcn.00401f10
push eax
lea ecx, [ebp - 0x28]
call fcn.00401f10
push eax
lea ecx, [ebp - 0x1c]
call fcn.00401f10
push eax
mov eax, dword [ebp - 0x50]
push esi
push eax
call fcn.006099de
mov ecx, dword [ebp - 0x50]
push ecx
call fcn.00609a4e
add esp, 0x18
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], bl
call fcn.00401070
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x16
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x12
call fcn.00401070
lea edx, [ebp - 0x100]
push 0x6c9e90
push edx
call fcn.00609a95
lea eax, [ebp - 0x100]
push eax
call fcn.00609a4e
add esp, 0xc
xor ecx, ecx
cmp ecx, eax
jge 0x421036
mov dx, word [ebp + ecx*2 - 0x100]
xor dx, 0x4d
sub edx, 0xff
mov word [ebp + ecx*2 - 0x100], dx
inc ecx
jmp 0x42100e
mov esi, eax
jmp 0x420eab
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x421229
mov eax, dword [ebp + 8]
cmp eax, 2
jg 0x421229
jmp 0x421221
test ebx, ebx
je 0x421076
cmp esi, 2
jg 0x421063
jne 0x421076
cmp dword [ebp + 0xc], 0x26
jl 0x421076
mov edx, dword [ebp - 0x38]
lea ecx, [ebp - 0x100]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x4210ab
mov eax, dword [ebp - 0x50]
test eax, eax
jne 0x42120b
lea eax, [ebp - 0x4c]
lea esi, [ebp - 0x4c]
push eax
call fcn.00609a4e
mov edx, dword [ebp - 0x38]
add esp, 4
lea eax, [eax + eax + 2]
lea ecx, [ebp - 0x100]
push eax
push esi
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, dword [0x6fca20]
test esi, esi
jne 0x4210ba
mov esi, 0x6fca24
mov eax, 0x6c900c
test eax, eax
je 0x4211c8
test esi, esi
je 0x4211c8
mov ecx, str.idmmzcc2.xpi
test ecx, ecx
je 0x4211c8
lea ecx, [ebp - 0x1c]
call fcn.004027c0
push 0
push 0x6c900c
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x19
call fcn.004027e0
push esi
lea ecx, [ebp - 0x28]
call fcn.00401ee0
mov bl, 0x1a
push str.idmmzcc2.xpi
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], bl
call fcn.00401ee0
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0x1b
call fcn.00401070
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x60]
call fcn.00401f10
push eax
call fcn.00609a4e
add esp, 4
lea ecx, [ebp - 0x28]
mov edi, eax
call fcn.00401f10
push eax
call fcn.00609a4e
add esi, edi
lea esi, [eax + esi + 3]
lea edi, [esi + esi]
push edi
call fcn.00622acb
mov edx, eax
add esp, 8
test edx, edx
mov dword [ebp - 0x50], edx
je 0x4211a5
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x60]
call fcn.00401f10
push eax
lea ecx, [ebp - 0x28]
call fcn.00401f10
push eax
lea ecx, [ebp - 0x1c]
call fcn.00401f10
push eax
mov eax, dword [ebp - 0x50]
push esi
push eax
call fcn.006099de
mov ecx, dword [ebp - 0x50]
push ecx
call fcn.00609a4e
add esp, 0x18
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], bl
call fcn.00401070
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x19
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x12
call fcn.00401070
lea edx, [ebp - 0x100]
push 0x6c9e90
push edx
call fcn.00609a95
lea eax, [ebp - 0x100]
push eax
call fcn.00609a4e
add esp, 0xc
xor ecx, ecx
cmp ecx, eax
jge 0x421212
mov dx, word [ebp + ecx*2 - 0x100]
xor dx, 0x4d
sub edx, 0xff
mov word [ebp + ecx*2 - 0x100], dx
inc ecx
jmp 0x4211ea
mov esi, eax
jmp 0x421087
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x421229
mov eax, dword [ebp + 8]
cmp eax, 2
jg 0x421229
jne 0x42125e
cmp dword [ebp + 0xc], 0x26
jl 0x42125e
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x421234
mov esi, eax
jmp 0x42123a
lea eax, [ebp - 0x4c]
lea esi, [ebp - 0x4c]
push eax
call fcn.00609a4e
mov edx, dword [ebp - 0x38]
add esp, 4
lea eax, [eax + eax + 2]
lea ecx, [ebp - 0x100]
push eax
push esi
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x64]
xor esi, esi
cmp ebx, esi
je 0x421421
mov eax, dword [ebp - 0x50]
cmp eax, esi
jne 0x42127f
lea eax, [ebp - 0x4c]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call edi
cmp eax, 0xffffffff
je 0x421421
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x2c], esi
mov word [ebp - 0x30], si
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], esi
mov word [ebp - 0x18], si
lea ecx, [ebp - 0x28]
call fcn.004027c0
lea ecx, [ebp - 0x74]
call fcn.004027c0
lea ecx, [ebp - 0x80]
call fcn.004027c0
lea ecx, [ebp - 0x60]
call fcn.004027c0
push esi
mov ecx, 0x6fca48
mov byte [ebp - 4], 0x21
call fcn.00401f10
push eax
push str._sidmmzcc
lea ecx, [ebp - 0x34]
call fcn.0041da80
push esi
mov ecx, 0x6fca48
call fcn.00401f10
push eax
push str._sidmmzcc2
lea ecx, [ebp - 0x1c]
call fcn.0041da80
push esi
mov ecx, 0x6fca48
call fcn.00401f10
push eax
push str._sidmmzcc3
lea ecx, [ebp - 0x28]
call fcn.0041da80
push esi
mov ecx, 0x6fca48
call fcn.00401f10
push eax
push str._sidmmzcc01
lea ecx, [ebp - 0x74]
call fcn.0041da80
push esi
mov ecx, 0x6fca48
call fcn.00401f10
push eax
push str._sidmmzcc02
lea ecx, [ebp - 0x80]
call fcn.0041da80
push esi
mov ecx, 0x6fca48
call fcn.00401f10
push eax
push str._sidmmzcc03
lea ecx, [ebp - 0x60]
call fcn.0041da80
lea ecx, [ebp - 0x34]
call fcn.00401f10
push eax
call edi
cmp eax, 0xffffffff
je 0x42138b
lea ecx, [ebp - 0x74]
call fcn.00401f10
push eax
lea ecx, [ebp - 0x34]
call fcn.00401f10
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileW]
push eax
call esi
jmp 0x421391
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [ebp - 0x1c]
call fcn.00401f10
push eax
call edi
cmp eax, 0xffffffff
je 0x4213b5
lea ecx, [ebp - 0x80]
call fcn.00401f10
push eax
lea ecx, [ebp - 0x1c]
call fcn.00401f10
push eax
call esi
lea ecx, [ebp - 0x28]
call fcn.00401f10
push eax
call edi
cmp eax, 0xffffffff
je 0x4213d9
lea ecx, [ebp - 0x60]
call fcn.00401f10
push eax
lea ecx, [ebp - 0x28]
call fcn.00401f10
push eax
call esi
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0x20
call fcn.00401070
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0x1f
call fcn.00401070
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0x1e
call fcn.00401070
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x1d
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x1c
call fcn.00401070
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x12
call fcn.00401070
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 1
call fcn.00401070
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0
call fcn.00401070
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8