Function at 0x41a620
Capabilities:
Check if file exists
Delete registry value
Get file attributes
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x114]
sub esp, 0x114
push 0xffffffffffffffff
push 0x61c2a8
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x70a308]
xor eax, ebp
mov dword [ebp + 0x110], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x18], ebx
xor edi, edi
mov dword [ebp - 4], edi
push str.IEXPLORE
lea ecx, [ebx + 4]
call fcn.0040deb0
mov dword [ebx + 0x34], eax
mov ecx, ebx
cmp dword [ebx + 0x1c], edi
je 0x41a681
push 1
jmp 0x41a682
push edi
push eax
call fcn.00418b40
call fcn.00413a70
mov dword [ebp - 0x2c], edi
lea eax, [ebp - 0x2c]
push eax
mov ecx, ebx
call fcn.004190b0
test eax, eax
jne 0x41a87d
xor esi, esi
mov dword [ebp - 0x40], esi
call fcn.00445c40
test eax, eax
je 0x41a6c4
mov ecx, ebx
call fcn.00419660
test eax, eax
je 0x41a6c4
mov esi, 1
mov dword [ebp - 0x40], esi
mov ecx, ebx
call fcn.004198a0
test eax, eax
je 0x41a6d8
mov dword [ebp - 0x40], 1
jmp 0x41a6e0
cmp esi, edi
je 0x41a87d
cmp dword [ebp - 0x2c], edi
je 0x41a721
push 0x651bbc
call fcn.00410c40
add esp, 4
test eax, eax
je 0x41a87d
push 0x50040
mov ecx, dword [0x710c08]
push ecx
mov edx, dword [0x710f2c]
push edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call fcn.00469b60
add esp, 0x10
jmp 0x41a87d
xor esi, esi
mov dword [ebp - 0x4c], esi
lea eax, [ebp - 0x14]
push eax
push 0x20019
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallGoogle_Chrome
push 0x80000002
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call edi
test eax, eax
jne 0x41a7a0
mov dword [ebp - 0x1c], 0x104
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp + 0xc]
push edx
push eax
push eax
push str.DisplayIcon
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41a796
push 0x2c
lea ecx, [ebp + 0xc]
push ecx
call fcn.005f9b50
add esp, 8
test eax, eax
je 0x41a796
mov byte [eax], 0
lea edx, [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x41a796
mov esi, 1
mov dword [ebp - 0x4c], esi
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00445c40
test eax, eax
je 0x41a820
lea ecx, [ebp - 0x14]
push ecx
push 0x20119
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallGoogle_Chrome
push 0x80000002
call edi
test eax, eax
jne 0x41a820
mov dword [ebp - 0x20], 0x104
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp + 0xc]
push eax
push 0
push 0
push str.DisplayIcon
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41a816
push 0x2c
lea edx, [ebp + 0xc]
push edx
call fcn.005f9b50
add esp, 8
test eax, eax
je 0x41a816
mov byte [eax], 0
lea eax, [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x41a816
mov esi, 1
mov dword [ebp - 0x4c], esi
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x41a835
push 0x651bbc
call fcn.00410c40
add esp, 4
test eax, eax
je 0x41a87d
cmp dword [0x70f5ec], 0
jne 0x41a87d
mov edx, dword [ebx + 0x48]
push 0
cmp byte [edx + 0x4e], 0
je 0x41a85d
push 0
push 0
push 0
push 0
push 0x4117c0
call fcn.005db08e
jmp 0x41a87d
lea ecx, [ebp + 0x10]
call fcn.0049c370
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x10]
call fcn.005d199e
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.004101f0
mov dword [ebp - 0x34], 1
mov ebx, 4
mov dword [ebp - 0x38], ebx
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x24]
push ecx
xor edi, edi
push edi
push edi
push str.mzcc_vers
mov edx, dword [0x70f604]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41a8bc
mov eax, dword [ebp - 0x24]
cmp eax, dword [0x70f5c4]
jb 0x41a8bc
mov dword [ebp - 0x34], edi
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x2c]
push edx
call fcn.00417b80
add esp, 0x14
mov dword [ebp - 0x48], edi
mov esi, dword [ebp - 0x30]
cmp esi, edi
jne 0x41a9dd
mov edi, dword [ebp - 0x28]
test edi, edi
jne 0x41a9dd
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp], eax
mov dword [ebp + 8], eax
mov word [ebp + 4], ax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp]
push edx
mov ecx, dword [ebp - 0x18]
call fcn.00413ac0
test eax, eax
je 0x41a9c9
mov eax, dword [ebp - 0x3c]
cmp eax, 2
jne 0x41a996
lea ecx, [ebp - 0x14]
call fcn.004024e0
mov byte [ebp - 4], 3
mov eax, dword [ebp]
test eax, eax
jne 0x41a93a
lea eax, [ebp + 4]
push 1
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.00415de0
add esp, 0xc
test eax, eax
je 0x41a988
push 0x2e
mov edx, dword [ebp - 0x14]
push edx
call fcn.005f9b50
add esp, 8
test eax, eax
je 0x41a988
mov byte [eax], 0
mov eax, dword [ebp - 0x14]
push eax
call fcn.005f9da1
add esp, 4
cmp eax, 0x34
jle 0x41a97b
mov esi, 1
mov dword [ebp - 0x30], esi
cmp eax, 0x49
jle 0x41a988
mov edi, 1
mov dword [ebp - 0x28], edi
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
call fcn.00402550
jmp 0x41a9c9
cmp eax, 0x11
jne 0x41a9c9
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx + 0x48]
cmp byte [eax + 0x4f], 0
jne 0x41a9c9
cmp byte [eax + 0x51], 0
jne 0x41a9c9
cmp dword [0x70f5f4], 0
jne 0x41a9c9
mov eax, dword [ebp]
test eax, eax
jne 0x41a9c0
lea eax, [ebp + 4]
push eax
call fcn.0041a500
add esp, 4
mov byte [ebp - 4], 0
lea ecx, [ebp]
call fcn.004011f0
test esi, esi
jne 0x41a9dd
test edi, edi
je 0x41aa50
cmp dword [ebp + 0x11c], 0
je 0x41aa50
mov dword [ebp - 0x38], ebx
lea edx, [ebp - 0x38]
push edx
lea eax, [ebp - 0x24]
push eax
push 0
push 0
push str.bShNAdvIntMsg
mov ecx, dword [0x70f604]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x41aa50
mov edi, 1
mov dword [ebp - 0x24], edi
push ebx
lea edx, [ebp - 0x24]
push edx
push ebx
push 0
push str.bShNAdvIntMsg
mov eax, dword [0x70f604]
push eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call esi
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0x1c], 0
je 0x41aa4b
mov dword [ebp - 0x54], 0
lea edx, [ebp - 0x54]
push edx
call fcn.00410670
test eax, eax
jne 0x41aa56
mov dword [ebp - 0x48], edi
jmp 0x41aa56
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0
call fcn.00417de0
add esp, 4
mov ebx, eax
mov dword [ebp - 0x50], 0
mov edi, 1
mov dword [ebp - 0x44], edi
cmp dword [ebp - 0x30], 0
jne 0x41aa81
cmp dword [ebp - 0x28], 0
je 0x41ab39
test ebx, ebx
jne 0x41ab39
xor edi, edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x5c], 1
mov dword [ebp - 0x58], 4
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x14]
push ecx
push edi
push edi
push str.bFF73Checked
mov edx, dword [0x70f604]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41aac7
cmp dword [ebp - 0x14], 1
jne 0x41aac7
mov dword [ebp - 0x5c], edi
jmp 0x41ab39
mov dword [ebp - 0x14], 1
push 4
lea eax, [ebp - 0x14]
push eax
push 4
push 0
push str.bFF73Checked
mov ecx, dword [0x70f604]
push ecx
call esi
cmp dword [0x70f5ec], edi
jne 0x41ab1a
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x48]
push 0
cmp byte [eax + 0x4e], 0
je 0x41ab10
push 0
push 0
push 0
push 0
push fcn.00416390
call fcn.005db08e
jmp 0x41ab39
call fcn.00416390
add esp, 4
jmp 0x41ab39
mov dword [ebp - 0x14], 1
push 4
lea ecx, [ebp - 0x14]
push ecx
push 4
push 0
push str.bShMsgInstFFExt2
mov edx, dword [0x70f604]
push edx
call esi
cmp dword [ebp - 0x1c], 0
je 0x41ab56
push 0
push 0x1b
mov ecx, dword [ebp - 0x18]
call fcn.00418c90
test eax, eax
je 0x41ab56
mov dword [ebp - 0x50], 1
cmp dword [ebp - 0x2c], 0
jne 0x41ab6a
cmp dword [ebp - 0x20], 0
jne 0x41ab6a
push 1
mov eax, dword [ebp - 0x34]
push eax
jmp 0x41ab70
push 0
mov ecx, dword [ebp - 0x34]
push ecx
mov ecx, dword [ebp - 0x18]
call fcn.00414bb0
cmp dword [ebp - 0x34], 0
je 0x41ab9f
mov edx, dword [0x70f5c4]
mov dword [ebp - 0x24], edx
push 4
lea eax, [ebp - 0x24]
push eax
push 4
push 0
push str.mzcc_vers
mov ecx, dword [0x70f604]
push ecx
call esi
test edi, edi
je 0x41ac17
push 0
call fcn.00417de0
add esp, 4
test eax, eax
je 0x41ac48
test ebx, ebx
jne 0x41ac04
cmp dword [ebp - 0x50], ebx
je 0x41ac04
cmp dword [0x70f5ec], ebx
jne 0x41ac04
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x48]
cmp byte [eax + 0x4e], bl
je 0x41abe2
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x411ae0
call fcn.005db08e
jmp 0x41ac04
push 0x50040
mov ecx, dword [0x710c08]
push ecx
mov edx, dword [0x710c3c]
push edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call fcn.00469b60
add esp, 0x10
cmp dword [ebp - 0x30], 0
jne 0x41ac10
cmp dword [ebp - 0x28], 0
je 0x41ac48
mov dword [ebp - 0x44], 0
cmp dword [ebp - 0x48], 0
je 0x41ac7f
cmp dword [0x70f5ec], 0
jne 0x41ac7f
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x48]
cmp byte [ecx + 0x4e], 0
je 0x41ac5e
push 0
push 0
push 0
push 0
push 0
push 0x411b10
call fcn.005db08e
jmp 0x41ac7f
push 0
push 0
push 0
push 0
push 0
push 0x418240
call fcn.005db08e
jmp 0x41ac7f
push 0x50040
mov edx, dword [0x710c08]
push edx
mov eax, dword [0x71101c]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call fcn.00469b60
add esp, 0x10
cmp dword [ebp - 0x2c], 0
jne 0x41acf0
cmp dword [ebp - 0x20], 0
jne 0x41acf0
lea ecx, [ebp - 0x20]
push ecx
push 0xf003f
push 0
push str.SoftwareMozillaFirefoxExtensions
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41acf0
mov ecx, 0x704370
lea edx, [ebp + 0x90]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x41acb5
lea edx, [ebp + 0x90]
push edx
call fcn.0044ee60
add esp, 4
lea eax, [ebp + 0x90]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x30], 0
jne 0x41acfc
cmp dword [ebp - 0x28], 0
je 0x41ad6b
cmp dword [ebp - 0x1c], 0
jne 0x41ad6b
lea eax, [ebp - 0x1c]
push eax
push 0xf003f
push 0
push str.SoftwareMozillaFirefoxExtensions
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41ad6b
mov ecx, 0x7043c0
lea edx, [ebp + 0x90]
lea esp, [esp]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x41ad30
lea ecx, [ebp + 0x90]
push ecx
call fcn.0044ee60
add esp, 4
lea edx, [ebp + 0x90]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x110]
xor ecx, ebp
call fcn.005f85e7
add ebp, 0x114
mov esp, ebp
pop ebp
ret 4