Function at 0x41d8b0
Capabilities:
Check if file exists
Delete registry value
Get file attributes
Move file
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x614a38
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x360
mov eax, dword [0x6f62f8]
push ebx
push esi
xor ebx, ebx
push edi
cmp eax, ebx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x54], ecx
mov dword [ebp - 4], ebx
jne 0x41d8ea
mov eax, 0x6f62fc
push str.idmmzcc.xpi
push eax
lea eax, [ebp - 0x36c]
push 0x6c653c
push eax
call fcn.005e60ec
add esp, 0x10
lea ecx, [ebp - 0x36c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41e0f2
xor eax, eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x44], eax
mov word [ebp - 0x40], bx
mov esi, dword [0x6f6320]
mov byte [ebp - 4], 1
cmp esi, ebx
jne 0x41d939
mov esi, 0x6f6324
mov edx, str._s_scomponents2idmmzcc.dll
test edx, edx
je 0x41da41
cmp esi, ebx
je 0x41da41
mov ecx, str.idmmzcc5
test ecx, ecx
je 0x41da41
push edx
lea ecx, [ebp - 0x1c]
call fcn.00402330
push esi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.0040e5b0
push str.idmmzcc5
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 3
call fcn.0040e5b0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 4
call fcn.00401070
mov edi, dword [ebp - 0x28]
cmp edi, ebx
jne 0x41d998
lea edi, [ebp - 0x24]
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x34]
call fcn.004023b0
push eax
call fcn.005e519b
mov edx, eax
push edi
mov dword [ebp - 0x58], edx
call fcn.005e519b
mov edx, dword [ebp - 0x58]
add esi, edx
lea esi, [eax + esi + 3]
lea edi, [esi + esi]
push edi
call fcn.005fdccd
mov edx, eax
add esp, 0xc
cmp edx, ebx
mov dword [ebp - 0x44], edx
je 0x41da1a
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x34]
call fcn.004023b0
push eax
lea ecx, [ebp - 0x28]
call fcn.004023b0
push eax
lea ecx, [ebp - 0x1c]
call fcn.004023b0
push eax
mov eax, dword [ebp - 0x44]
push esi
push eax
call fcn.005e512b
mov ecx, dword [ebp - 0x44]
push ecx
call fcn.005e519b
add esp, 0x18
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 3
call fcn.00401070
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00401070
mov eax, dword [ebp - 0x44]
cmp eax, ebx
jne 0x41da48
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41dde1
mov esi, dword [0x6f6320]
test esi, esi
jne 0x41da67
mov esi, 0x6f6324
mov edx, str._s_scomponents2idmcchandler2.dll
test edx, edx
je 0x41db6c
test esi, esi
je 0x41db6c
mov eax, str.idmmzcc5
test eax, eax
je 0x41db6c
push edx
lea ecx, [ebp - 0x1c]
call fcn.00402330
push esi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 5
call fcn.0040e5b0
mov bl, 6
push str.idmmzcc5
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.0040e5b0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 7
call fcn.00401070
mov edi, dword [ebp - 0x28]
test edi, edi
jne 0x41dac7
lea edi, [ebp - 0x24]
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x34]
call fcn.004023b0
push eax
call fcn.005e519b
mov edx, eax
push edi
mov dword [ebp - 0x58], edx
call fcn.005e519b
mov ecx, dword [ebp - 0x58]
add esi, ecx
lea esi, [eax + esi + 3]
lea edi, [esi + esi]
push edi
call fcn.005fdccd
mov edx, eax
add esp, 0xc
test edx, edx
mov dword [ebp - 0x44], edx
je 0x41db49
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x34]
call fcn.004023b0
push eax
lea ecx, [ebp - 0x28]
call fcn.004023b0
push eax
lea ecx, [ebp - 0x1c]
call fcn.004023b0
push eax
mov eax, dword [ebp - 0x44]
push esi
push eax
call fcn.005e512b
mov ecx, dword [ebp - 0x44]
push ecx
call fcn.005e519b
add esp, 0x18
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.00401070
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 5
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00401070
mov eax, dword [ebp - 0x44]
test eax, eax
jne 0x41db76
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41dde1
mov esi, dword [0x6f6320]
test esi, esi
jne 0x41db95
mov esi, 0x6f6324
mov edx, str._s_schromeidmmzcc.jar
test edx, edx
je 0x41dc95
test esi, esi
je 0x41dc95
mov eax, str.idmmzcc5
test eax, eax
je 0x41dc95
push edx
lea ecx, [ebp - 0x1c]
call fcn.00402330
push esi
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 8
call fcn.0040e5b0
mov bl, 9
push str.idmmzcc5
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.0040e5b0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0xa
call fcn.00401070
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
call fcn.004023b0
push eax
call fcn.005e519b
add esp, 4
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.004023b0
push eax
call fcn.005e519b
add esi, edi
lea esi, [eax + esi + 3]
lea edi, [esi + esi]
push edi
call fcn.005fdccd
mov edx, eax
add esp, 8
test edx, edx
mov dword [ebp - 0x44], edx
je 0x41dc72
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x28]
call fcn.004023b0
push eax
lea ecx, [ebp - 0x34]
call fcn.004023b0
push eax
lea ecx, [ebp - 0x1c]
call fcn.004023b0
push eax
mov eax, dword [ebp - 0x44]
push esi
push eax
call fcn.005e512b
mov ecx, dword [ebp - 0x44]
push ecx
call fcn.005e519b
add esp, 0x18
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00401070
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 8
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00401070
mov eax, dword [ebp - 0x44]
test eax, eax
jne 0x41dc9f
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41dde1
mov esi, dword [0x6f6320]
test esi, esi
jne 0x41dcbe
mov esi, 0x6f6324
mov edx, str._s_scomponents12idmmzcc.dll
test edx, edx
je 0x41ddbe
test esi, esi
je 0x41ddbe
mov eax, str.idmmzcc5
test eax, eax
je 0x41ddbe
push edx
lea ecx, [ebp - 0x1c]
call fcn.00402330
push esi
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0xb
call fcn.0040e5b0
mov bl, 0xc
push str.idmmzcc5
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.0040e5b0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0xd
call fcn.00401070
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
call fcn.004023b0
push eax
call fcn.005e519b
add esp, 4
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.004023b0
push eax
call fcn.005e519b
add esi, edi
lea esi, [eax + esi + 3]
lea edi, [esi + esi]
push edi
call fcn.005fdccd
mov edx, eax
add esp, 8
test edx, edx
mov dword [ebp - 0x44], edx
je 0x41dd9b
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x28]
call fcn.004023b0
push eax
lea ecx, [ebp - 0x34]
call fcn.004023b0
push eax
lea ecx, [ebp - 0x1c]
call fcn.004023b0
push eax
mov eax, dword [ebp - 0x44]
push esi
push eax
call fcn.005e512b
mov ecx, dword [ebp - 0x44]
push ecx
call fcn.005e519b
add esp, 0x18
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00401070
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0xb
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00401070
mov eax, dword [ebp - 0x44]
test eax, eax
jne 0x41ddc8
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41dde1
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x41e039
jmp 0x41dde4
mov ebx, dword [ebp + 8]
lea edx, [ebp - 0x36c]
mov dword [ebp + 8], 0
push edx
call fcn.005d2d70
mov esi, eax
add esp, 4
test esi, esi
je 0x41de4d
lea eax, [ebp - 0x60]
push eax
push esi
call fcn.005d31b0
add esp, 8
xor edi, edi
cmp edi, dword [ebp - 0x60]
jae 0x41de44
mov edx, dword [ebp - 0x54]
lea ecx, [ebp + 8]
push ecx
push edx
push str.idmmzcc5
push ebx
push esi
call fcn.0041c170
add esp, 0x14
test eax, eax
jne 0x41de44
mov eax, dword [ebp - 0x60]
inc edi
cmp edi, eax
jae 0x41de44
push esi
call fcn.005d3600
add esp, 4
test eax, eax
je 0x41de0f
push esi
call fcn.005d3170
add esp, 4
mov eax, dword [ebp + 8]
test eax, eax
je 0x41deee
test ebx, ebx
je 0x41deee
mov eax, dword [0x6f6da8]
mov ecx, dword [0x6f6a98]
push 0x50035
push eax
push ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 4
jne 0x41deee
lea edx, [ebp - 0x36c]
mov dword [ebp + 8], 0
push edx
call fcn.005d2d70
mov edi, eax
add esp, 4
test edi, edi
je 0x41deee
lea eax, [ebp - 0x60]
push eax
push edi
call fcn.005d31b0
add esp, 8
test eax, eax
jne 0x41deee
xor esi, esi
cmp esi, dword [ebp - 0x60]
jae 0x41dee8
mov edx, dword [ebp - 0x54]
lea ecx, [ebp + 8]
push ecx
push edx
push str.idmmzcc5
push ebx
push edi
call fcn.0041c170
add esp, 0x14
test eax, eax
jne 0x41dee8
mov eax, dword [ebp - 0x60]
inc esi
cmp esi, eax
jae 0x41dee8
push edi
call fcn.005d3600
add esp, 4
test eax, eax
je 0x41deb3
push edi
jmp 0x41de45
push str.idmmzcc5
call fcn.0041d070
xor eax, eax
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
mov word [ebp - 0x18], ax
mov esi, dword [0x6f6320]
mov byte [ebp - 4], 0xe
cmp esi, eax
jne 0x41df1a
mov esi, 0x6f6324
mov ecx, 0x6c5124
test ecx, ecx
je 0x41e01d
test esi, esi
je 0x41e01d
mov edx, str.idmmzcc5
test edx, edx
je 0x41e01d
push ecx
lea ecx, [ebp - 0x64]
call fcn.00402330
push esi
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0xf
call fcn.0040e5b0
mov bl, 0x10
push str.idmmzcc5
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.0040e5b0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x11
call fcn.00401070
mov esi, dword [ebp - 0x5c]
lea ecx, [ebp - 0x28]
call fcn.004023b0
push eax
call fcn.005e519b
add esp, 4
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.004023b0
push eax
call fcn.005e519b
add esi, edi
lea esi, [eax + esi + 3]
lea edi, [esi + esi]
push edi
call fcn.005fdccd
mov edx, eax
add esp, 8
test edx, edx
mov dword [ebp - 0x1c], edx
je 0x41dff7
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x28]
call fcn.004023b0
push eax
lea ecx, [ebp - 0x34]
call fcn.004023b0
push eax
lea ecx, [ebp - 0x64]
call fcn.004023b0
push eax
mov eax, dword [ebp - 0x1c]
push esi
push eax
call fcn.005e512b
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.005e519b
add esp, 0x18
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00401070
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0xf
call fcn.00401070
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0xe
call fcn.00401070
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x41e024
lea eax, [ebp - 0x18]
push eax
call fcn.0041cff0
add esp, 4
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00401070
mov eax, dword [ebp + 0xc]
xor ebx, ebx
cmp eax, ebx
jne 0x41e113
lea edx, [ebp + 8]
push edx
push 0xf003f
push ebx
push str.SoftwareMozillaFirefoxExtensions
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x41e107
lea eax, [ebp + 8]
push ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push eax
push ebx
push 0xf003f
push ebx
push 0x6f5cb8
push ebx
push str.SoftwareMozilla
push reloc.WS2_32.dll_accept
call esi
test eax, eax
jne 0x41e0e6
mov ecx, dword [ebp + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call edi
lea edx, [ebp + 8]
push ebx
push edx
push ebx
push 0xf003f
push ebx
push 0x6f5cb8
push ebx
push str.SoftwareMozillaFirefox
push reloc.WS2_32.dll_accept
call esi
test eax, eax
jne 0x41e0e6
mov eax, dword [ebp + 8]
push eax
call edi
lea ecx, [ebp + 8]
push ebx
push ecx
push ebx
push 0xf003f
push ebx
push 0x6f5cb8
push ebx
push str.SoftwareMozillaFirefoxExtensions
push reloc.WS2_32.dll_accept
call esi
test eax, eax
je 0x41e10d
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0
call fcn.00401070
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp + 8]
push edx
call edi
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x48], ebx
mov word [ebp - 0x4c], bx
mov esi, dword [0x6f6320]
mov byte [ebp - 4], 0x12
cmp esi, ebx
jne 0x41e130
mov esi, 0x6f6324
mov eax, 0x6c5124
test eax, eax
je 0x41e230
test esi, esi
je 0x41e230
mov ecx, str.idmmzcc5
test ecx, ecx
je 0x41e230
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402330
push esi
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x13
call fcn.0040e5b0
mov bl, 0x14
push str.idmmzcc5
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.0040e5b0
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0x15
call fcn.00401070
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
call fcn.004023b0
push eax
call fcn.005e519b
add esp, 4
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.004023b0
push eax
call fcn.005e519b
add esi, edi
lea esi, [eax + esi + 3]
lea edi, [esi + esi]
push edi
call fcn.005fdccd
mov edx, eax
add esp, 8
test edx, edx
mov dword [ebp - 0x50], edx
je 0x41e20d
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x28]
call fcn.004023b0
push eax
lea ecx, [ebp - 0x34]
call fcn.004023b0
push eax
lea ecx, [ebp - 0x1c]
call fcn.004023b0
push eax
mov eax, dword [ebp - 0x50]
push esi
push eax
call fcn.005e512b
mov ecx, dword [ebp - 0x50]
push ecx
call fcn.005e519b
add esp, 0x18
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00401070
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x13
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x12
call fcn.00401070
lea edx, [ebp - 0x100]
push 0x6c5dbc
push edx
call fcn.005e5369
lea eax, [ebp - 0x100]
push eax
call fcn.005e519b
add esp, 0xc
xor ecx, ecx
cmp ecx, eax
jge 0x41e273
mov dx, word [ebp + ecx*2 - 0x100]
xor dx, 0x4d
sub edx, 0xff
mov word [ebp + ecx*2 - 0x100], dx
inc ecx
jmp 0x41e252
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x41e283
mov dword [ebp - 0x58], 1
jmp 0x41e28b
call fcn.004103b0
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x68]
xor esi, esi
push eax
push 0x20019
push esi
xor ebx, ebx
push str.SOFTWAREMozillaSeaMonkey
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x54], ebx
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41e359
mov ecx, 0x19
lea edi, [ebp - 0x164]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x5c]
lea edx, [ebp - 0x164]
push ecx
push edx
push eax
push eax
mov eax, dword [ebp - 0x68]
push str.CurrentVersion
push eax
mov dword [ebp - 0x5c], 0x64
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41e34c
lea ecx, [ebp - 0x164]
mov ebx, 1
push 0x2e
push ecx
mov dword [ebp - 0x54], ebx
call fcn.005e51d0
mov esi, eax
add esp, 8
test esi, esi
je 0x41e34c
lea edx, [ebp - 0x164]
mov byte [esi], 0
push edx
call fcn.005e5453
add esp, 4
test eax, eax
je 0x41e326
mov dword [ebp + 8], eax
inc esi
push 0x6c7bb8
push esi
call fcn.005e6920
add esp, 8
test eax, eax
je 0x41e33c
mov byte [eax], 0
push esi
call fcn.005e5453
add esp, 4
test eax, eax
je 0x41e34c
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 0x68]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x38]
push ecx
push 0xf003f
push 0
push str.SoftwareMozillaSeaMonkeyExtensions
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x41e5b4
lea edx, [ebp - 0x38]
push 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push edx
push 0
push 0xf003f
push 0
push 0x6f5cb8
push 0
push str.SoftwareMozillaSeaMonkey
push reloc.WS2_32.dll_accept
call esi
test eax, eax
jne 0x41e7bc
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x38]
push 0
push ecx
push 0
push 0xf003f
push 0
push 0x6f5cb8
push 0
push str.SoftwareMozillaSeaMonkeyExtensions
push reloc.WS2_32.dll_accept
call esi
test eax, eax
jne 0x41e7bc
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x41e40a
mov eax, dword [ebp + 8]
cmp eax, 2
jg 0x41e3f7
jne 0x41e40a
cmp dword [ebp + 0xc], 0x26
jl 0x41e40a
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x100]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x41e43f
mov eax, dword [ebp - 0x50]
test eax, eax
jne 0x41e591
lea eax, [ebp - 0x4c]
lea esi, [ebp - 0x4c]
push eax
call fcn.005e519b
add esp, 4
lea ecx, [eax + eax + 2]
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x100]
push ecx
push esi
push 1
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, dword [0x6f62f8]
test esi, esi
jne 0x41e44e
mov esi, 0x6f62fc
mov ecx, 0x6c5124
test ecx, ecx
je 0x41e54e
test esi, esi
je 0x41e54e
mov edx, str.idmmzcc2.xpi
test edx, edx
je 0x41e54e
push ecx
lea ecx, [ebp - 0x1c]
call fcn.00402330
push esi
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x16
call fcn.0040e5b0
mov bl, 0x17
push str.idmmzcc2.xpi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.0040e5b0
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0x18
call fcn.00401070
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
call fcn.004023b0
push eax
call fcn.005e519b
add esp, 4
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.004023b0
push eax
call fcn.005e519b
add esi, edi
lea esi, [eax + esi + 3]
lea edi, [esi + esi]
push edi
call fcn.005fdccd
mov edx, eax
add esp, 8
test edx, edx
mov dword [ebp - 0x50], edx
je 0x41e52b
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x28]
call fcn.004023b0
push eax
lea ecx, [ebp - 0x34]
call fcn.004023b0
push eax
lea ecx, [ebp - 0x1c]
call fcn.004023b0
push eax
mov eax, dword [ebp - 0x50]
push esi
push eax
call fcn.005e512b
mov ecx, dword [ebp - 0x50]
push ecx
call fcn.005e519b
add esp, 0x18
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00401070
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x16
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x12
call fcn.00401070
lea edx, [ebp - 0x100]
push 0x6c5e0c
push edx
call fcn.005e5369
lea eax, [ebp - 0x100]
push eax
call fcn.005e519b
add esp, 0xc
xor ecx, ecx
cmp ecx, eax
jge 0x41e598
mov dx, word [ebp + ecx*2 - 0x100]
xor dx, 0x4d
sub edx, 0xff
mov word [ebp + ecx*2 - 0x100], dx
inc ecx
jmp 0x41e570
mov esi, eax
jmp 0x41e41b
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x41e77d
mov eax, dword [ebp + 8]
cmp eax, 2
jg 0x41e77d
jmp 0x41e775
test ebx, ebx
je 0x41e5d8
cmp esi, 2
jg 0x41e5c5
jne 0x41e5d8
cmp dword [ebp + 0xc], 0x26
jl 0x41e5d8
mov edx, dword [ebp - 0x38]
lea ecx, [ebp - 0x100]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x41e60d
mov eax, dword [ebp - 0x50]
test eax, eax
jne 0x41e75f
lea eax, [ebp - 0x4c]
lea esi, [ebp - 0x4c]
push eax
call fcn.005e519b
mov edx, dword [ebp - 0x38]
add esp, 4
lea eax, [eax + eax + 2]
lea ecx, [ebp - 0x100]
push eax
push esi
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, dword [0x6f62f8]
test esi, esi
jne 0x41e61c
mov esi, 0x6f62fc
mov eax, 0x6c5124
test eax, eax
je 0x41e71c
test esi, esi
je 0x41e71c
mov ecx, str.idmmzcc2.xpi
test ecx, ecx
je 0x41e71c
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402330
push esi
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x19
call fcn.0040e5b0
mov bl, 0x1a
push str.idmmzcc2.xpi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.0040e5b0
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0x1b
call fcn.00401070
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
call fcn.004023b0
push eax
call fcn.005e519b
add esp, 4
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.004023b0
push eax
call fcn.005e519b
add esi, edi
lea esi, [eax + esi + 3]
lea edi, [esi + esi]
push edi
call fcn.005fdccd
mov edx, eax
add esp, 8
test edx, edx
mov dword [ebp - 0x50], edx
je 0x41e6f9
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x28]
call fcn.004023b0
push eax
lea ecx, [ebp - 0x34]
call fcn.004023b0
push eax
lea ecx, [ebp - 0x1c]
call fcn.004023b0
push eax
mov eax, dword [ebp - 0x50]
push esi
push eax
call fcn.005e512b
mov ecx, dword [ebp - 0x50]
push ecx
call fcn.005e519b
add esp, 0x18
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00401070
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x19
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x12
call fcn.00401070
lea edx, [ebp - 0x100]
push 0x6c5e0c
push edx
call fcn.005e5369
lea eax, [ebp - 0x100]
push eax
call fcn.005e519b
add esp, 0xc
xor ecx, ecx
cmp ecx, eax
jge 0x41e766
mov dx, word [ebp + ecx*2 - 0x100]
xor dx, 0x4d
sub edx, 0xff
mov word [ebp + ecx*2 - 0x100], dx
inc ecx
jmp 0x41e73e
mov esi, eax
jmp 0x41e5e9
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x41e77d
mov eax, dword [ebp + 8]
cmp eax, 2
jg 0x41e77d
jne 0x41e7b2
cmp dword [ebp + 0xc], 0x26
jl 0x41e7b2
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x41e788
mov esi, eax
jmp 0x41e78e
lea eax, [ebp - 0x4c]
lea esi, [ebp - 0x4c]
push eax
call fcn.005e519b
mov edx, dword [ebp - 0x38]
add esp, 4
lea eax, [eax + eax + 2]
lea ecx, [ebp - 0x100]
push eax
push esi
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x58]
xor esi, esi
cmp ebx, esi
je 0x41e973
mov eax, dword [ebp - 0x50]
cmp eax, esi
jne 0x41e7d3
lea eax, [ebp - 0x4c]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call edi
cmp eax, 0xffffffff
je 0x41e973
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x2c], esi
mov word [ebp - 0x30], si
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x5c], esi
mov word [ebp - 0x60], si
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], esi
mov word [ebp - 0x18], si
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], esi
mov word [ebp - 0x24], si
lea ecx, [ebp - 0x74]
call fcn.0041cbc0
lea ecx, [ebp - 0x80]
call fcn.0041cbc0
mov ecx, 0x6f6320
mov byte [ebp - 4], 0x21
call fcn.004023b0
push eax
push str._sidmmzcc
lea ecx, [ebp - 0x34]
call fcn.0041afe0
mov ecx, 0x6f6320
call fcn.004023b0
push eax
push str._sidmmzcc2
lea ecx, [ebp - 0x64]
call fcn.0041afe0
mov ecx, 0x6f6320
call fcn.004023b0
push eax
push str._sidmmzcc3
lea ecx, [ebp - 0x1c]
call fcn.0041afe0
mov ecx, 0x6f6320
call fcn.004023b0
push eax
push str._sidmmzcc01
lea ecx, [ebp - 0x28]
call fcn.0041afe0
mov ecx, 0x6f6320
call fcn.004023b0
push eax
push str._sidmmzcc02
lea ecx, [ebp - 0x74]
call fcn.0041afe0
mov ecx, 0x6f6320
call fcn.004023b0
push eax
push str._sidmmzcc03
lea ecx, [ebp - 0x80]
call fcn.0041afe0
lea ecx, [ebp - 0x34]
call fcn.004023b0
push eax
call edi
cmp eax, 0xffffffff
je 0x41e8dd
lea ecx, [ebp - 0x28]
call fcn.004023b0
push eax
lea ecx, [ebp - 0x34]
call fcn.004023b0
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileW]
push eax
call esi
jmp 0x41e8e3
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [ebp - 0x64]
call fcn.004023b0
push eax
call edi
cmp eax, 0xffffffff
je 0x41e907
lea ecx, [ebp - 0x74]
call fcn.004023b0
push eax
lea ecx, [ebp - 0x64]
call fcn.004023b0
push eax
call esi
lea ecx, [ebp - 0x1c]
call fcn.004023b0
push eax
call edi
cmp eax, 0xffffffff
je 0x41e92b
lea ecx, [ebp - 0x80]
call fcn.004023b0
push eax
lea ecx, [ebp - 0x1c]
call fcn.004023b0
push eax
call esi
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0x20
call fcn.00401070
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0x1f
call fcn.00401070
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x1e
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x1d
call fcn.00401070
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x1c
call fcn.00401070
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x12
call fcn.00401070
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 1
call fcn.00401070
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0
call fcn.00401070
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8