Function at 0x4dd02c
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
sub esp, 0x698
lea ebp, [esp - 4]
mov eax, dword [0x601328]
xor eax, ebp
mov dword [ebp + 0x698], eax
push 0xdc
mov eax, 0x575789
call fcn.0054d40c
mov esi, ecx
mov dword [ebp - 0x1c], esi
call fcn.00462c28
mov al, byte [eax]
test al, al
jne 0x4dd18f
lea eax, [ebp - 0xcc]
push eax
call fcn.00409b60
and dword [ebp - 4], 0
mov eax, esi
lea ecx, [ebp - 0x3c]
call fcn.004066c0
push eax
push 0x5967ac
lea eax, [ebp - 0xc4]
push str.XpiUnInstaller.cpp:_fnProfilesXpiUnInstaller__folder_name
push eax
mov byte [ebp - 4], 1
call fcn.00407390
pop ecx
pop ecx
push eax
call fcn.00407390
pop ecx
pop ecx
push eax
call fcn.00411b20
pop ecx
pop ecx
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0
call fcn.00409c40
lea ecx, [ebp + 0x26c]
lea eax, [ebp - 0xcc]
call fcn.00407170
lea ecx, [ebp + 0x26c]
mov byte [ebp - 4], 2
call fcn.00406a80
lea ecx, [ebp + 0x26c]
call fcn.00409c40
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0xcc]
call fcn.00407660
mov ebx, 0x2710
push 0xffffffffffffffff
mov ecx, str.firefox.exe
call fcn.004671e5
pop ecx
lea ecx, [ebp + 0x288]
call fcn.004dcb99
test eax, eax
ja 0x4dd3ec
call fcn.00462c28
cmp byte [eax], 0
jne 0x4dd2de
lea eax, [ebp - 0xcc]
push eax
call fcn.00409b60
lea eax, [ebp - 0xc4]
push str.XpiUnInstaller.cpp:_fnProfilesXpiUnInstaller__DetermineFFProfilesDir_failed.
push eax
mov dword [ebp - 4], 0xb
call fcn.00407390
pop ecx
pop ecx
lea ecx, [ebp + 0x26c]
lea eax, [ebp - 0xcc]
call fcn.00407170
lea ecx, [ebp + 0x26c]
mov byte [ebp - 4], 0xc
call fcn.00406a80
lea ecx, [ebp + 0x26c]
call fcn.00409c40
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0xcc]
call fcn.00407660
push 3
pop eax
jmp 0x4dd793
lea eax, [ebp - 0xc4]
push eax
mov dword [ebp - 4], 3
call fcn.004068d0
mov eax, esi
lea ecx, [ebp + 0x26c]
mov byte [ebp - 4], 4
call fcn.004066c0
mov edi, eax
mov byte [ebp - 4], 5
call fcn.00462c28
lea esi, [ebp - 0x3c]
call fcn.00406720
mov byte [ebp - 4], 6
cmp dword [eax + 0x18], 8
jb 0x4dd1d5
mov esi, dword [eax + 4]
jmp 0x4dd1d8
lea esi, [eax + 4]
lea eax, [ebp - 0xc4]
push 0x5950f8
push eax
call fcn.00407390
pop ecx
pop ecx
push esi
push eax
call fcn.00407390
pop ecx
pop ecx
push 0x5950f0
push eax
call fcn.00407390
pop ecx
pop ecx
push str.XpiUnInstaller.cpp:_fnProfilesXpiUnInstaller__folder_name
push eax
call fcn.00407390
pop ecx
pop ecx
push 0x5967ac
push eax
call fcn.00407390
pop ecx
pop ecx
push edi
push eax
call fcn.00411b20
pop ecx
pop ecx
lea ecx, [ebp - 0x3c]
call fcn.00409c40
lea ecx, [ebp + 0x26c]
mov byte [ebp - 4], 4
call fcn.00409c40
lea eax, [ebp - 0x18]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov ebx, 0x2710
push ebx
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 7
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x4dd286
lea ecx, [ebp - 0x3c]
lea eax, [ebp - 0xc4]
call fcn.00406700
push 0x50
push str..XpiUnInstaller.cpp
push eax
push ebx
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 8
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
lea ecx, [ebp - 0x3c]
call fcn.00409c40
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 4
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0xc4]
mov byte [ebp - 4], 3
call fcn.004067e0
or dword [ebp - 4], 0xffffffff
jmp 0x4dd0f9
lea eax, [ebp - 0xc4]
push eax
mov dword [ebp - 4], 0xd
call fcn.004068d0
mov byte [ebp - 4], 0xe
call fcn.00462c28
lea esi, [ebp - 0x3c]
call fcn.00406720
mov byte [ebp - 4], 0xf
cmp dword [eax + 0x18], 8
jb 0x4dd311
mov esi, dword [eax + 4]
jmp 0x4dd314
lea esi, [eax + 4]
lea eax, [ebp - 0xc4]
push 0x5950f8
push eax
call fcn.00407390
pop ecx
pop ecx
push esi
push eax
call fcn.00407390
pop ecx
pop ecx
push 0x5950f0
push eax
call fcn.00407390
pop ecx
pop ecx
push str.XpiUnInstaller.cpp:_fnProfilesXpiUnInstaller__DetermineFFProfilesDir_failed.
push eax
call fcn.00407390
pop ecx
pop ecx
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0xe
call fcn.00409c40
lea eax, [ebp - 0x20]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
push ebx
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x10
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x4dd39c
lea ecx, [ebp - 0x3c]
lea eax, [ebp - 0xc4]
call fcn.00406700
push 0x58
push str..XpiUnInstaller.cpp
push eax
push ebx
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x11
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
lea ecx, [ebp - 0x3c]
call fcn.00409c40
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0xe
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0xc4]
mov byte [ebp - 4], 0xd
call fcn.004067e0
jmp 0x4dd187
lea edi, [ebp + 0x288]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
test ax, ax
jne 0x4dd3f4
lea eax, [ebp]
push eax
lea eax, [ebp + 0x288]
mov esi, 0x59cbbc
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x288]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4dd422
sub eax, edx
sar eax, 1
xor ecx, ecx
cmp dword [ebp - 0x14], 0xffffffff
mov word [ebp + eax*2 + 0x286], cx
je 0x4dd791
cmp word [ebp + 0x2c], 0x2e
je 0x4dd772
test byte [ebp], 0x10
je 0x4dd772
xor eax, eax
movzx ecx, word [ebp + eax + 0x288]
mov word [ebp + eax + 0x490], cx
inc eax
inc eax
test cx, cx
jne 0x4dd45b
lea eax, [ebp + 0x2c]
mov edx, eax
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4dd477
sub eax, edx
lea edi, [ebp + 0x490]
dec edi
dec edi
mov cx, word [edi + 2]
inc edi
inc edi
test cx, cx
jne 0x4dd48b
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp + 0x490]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
test ax, ax
jne 0x4dd4ae
mov eax, dword [ebp - 0x1c]
push 6
pop ecx
mov esi, str.extensions_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edx, eax
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4dd4ca
sub eax, edx
lea edi, [ebp + 0x490]
dec edi
dec edi
mov cx, word [edi + 2]
inc edi
inc edi
test cx, cx
jne 0x4dd4de
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00462c28
cmp byte [eax], 0
jne 0x4dd5a0
lea eax, [ebp - 0xcc]
push eax
call fcn.00409b60
lea eax, [ebp + 0x490]
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 0x14
call fcn.004066c0
push eax
push 0x5967ac
lea eax, [ebp - 0xc4]
push str.XpiUnInstaller.cpp:_fnProfilesXpiUnInstaller__about_to_remove
push eax
mov byte [ebp - 4], 0x15
call fcn.00407390
pop ecx
pop ecx
push eax
call fcn.00407390
pop ecx
pop ecx
push eax
call fcn.00411b20
pop ecx
pop ecx
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0x14
call fcn.00409c40
lea ecx, [ebp + 0x26c]
lea eax, [ebp - 0xcc]
call fcn.00407170
lea ecx, [ebp + 0x26c]
mov byte [ebp - 4], 0x16
call fcn.00406a80
lea ecx, [ebp + 0x26c]
call fcn.00409c40
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0xcc]
call fcn.00407660
jmp 0x4dd6f0
lea eax, [ebp - 0xc4]
push eax
mov dword [ebp - 4], 0x17
call fcn.004068d0
lea eax, [ebp + 0x490]
lea ecx, [ebp + 0x26c]
mov byte [ebp - 4], 0x18
call fcn.004066c0
mov edi, eax
mov byte [ebp - 4], 0x19
call fcn.00462c28
lea esi, [ebp - 0x3c]
call fcn.00406720
mov byte [ebp - 4], 0x1a
cmp dword [eax + 0x18], 8
jb 0x4dd5ea
mov esi, dword [eax + 4]
jmp 0x4dd5ed
lea esi, [eax + 4]
lea eax, [ebp - 0xc4]
push 0x5950f8
push eax
call fcn.00407390
pop ecx
pop ecx
push esi
push eax
call fcn.00407390
pop ecx
pop ecx
push 0x5950f0
push eax
call fcn.00407390
pop ecx
pop ecx
push str.XpiUnInstaller.cpp:_fnProfilesXpiUnInstaller__about_to_remove
push eax
call fcn.00407390
pop ecx
pop ecx
push 0x5967ac
push eax
call fcn.00407390
pop ecx
pop ecx
push edi
push eax
call fcn.00411b20
pop ecx
pop ecx
lea ecx, [ebp - 0x3c]
call fcn.00409c40
lea ecx, [ebp + 0x26c]
mov byte [ebp - 4], 0x18
call fcn.00409c40
lea eax, [ebp - 0x44]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
push ebx
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x1b
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x4dd696
lea ecx, [ebp - 0x3c]
lea eax, [ebp - 0xc4]
call fcn.00406700
push 0x6c
push str..XpiUnInstaller.cpp
push eax
push ebx
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x1c
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
lea ecx, [ebp - 0x3c]
call fcn.00409c40
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x18
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0xc4]
mov byte [ebp - 4], 0x17
call fcn.004067e0
or dword [ebp - 4], 0xffffffff
jmp 0x4dd6f0
lea eax, [ebp + 0x490]
lea ecx, [ebp - 0xe8]
call fcn.004066c0
mov ecx, eax
mov dword [ebp - 4], 0x1f
call fcn.004dcdf1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe8]
call fcn.00409c40
lea eax, [ebp + 0x490]
lea ecx, [ebp + 0x250]
call fcn.004066c0
lea eax, [ebp + 0x250]
push eax
mov eax, str..xpi
mov dword [ebp - 4], 0x20
call fcn.00411970
cmp dword [ebp + 0x268], 8
mov eax, dword [ebp + 0x254]
jae 0x4dd75c
lea eax, [ebp + 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x250]
call fcn.00409c40
lea eax, [ebp]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, 1
je 0x4dd444
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x698]
xor ecx, ebp
call fcn.0054677c
add ebp, 0x69c
leave
ret