Function at 0x418e89
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x74
call fcn.00411583
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x418eaf
mov byte [0x46703c], 1
mov ebx, 0xffffffff
jmp 0x419451
movzx eax, byte [0x46703d]
xor eax, 1
test al, al
je 0x418ed0
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], str.Installing_into__s
call fcn.0041b00c
mov dword [esp], 0
call fcn.00418c3a
mov dword [esp], str.FFExtension
call fcn.00418c3a
mov dword [esp], str.FFExtensionchrome
call fcn.00418c3a
mov dword [esp], str.FFExtensionchromemodules
call fcn.00418c3a
mov dword [esp], str.FFExtensionchromecontent
call fcn.00418c3a
mov dword [esp], str.FFExtensionchromelocale
call fcn.00418c3a
mov dword [esp], str.FFExtensionchromelocaleen_US
call fcn.00418c3a
mov dword [esp], str.FFExtensiondefault
call fcn.00418c3a
mov dword [esp], str.FFExtensiondefaultpreferences
call fcn.00418c3a
mov dword [esp], str.FFExtensioncomponents
call fcn.00418c3a
call fcn.0041202b
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str.3.4.2_enterprise
mov dword [esp], str.Installing_MAZINGER__s_into__s_n
call fcn.00411655
call fcn.004114aa
test eax, eax
setne al
test al, al
je 0x419108
mov dword [esp + 8], str.Mazinger.exe
mov dword [esp + 4], str.Mazinger64.exe
mov dword [esp], 0
call fcn.00418bc5
mov eax, dword [0x467044]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.MazingerHook.dll
mov dword [esp + 4], str.MazingerHook64.dll
mov dword [esp], 0
call fcn.00418530
mov eax, dword [0x467044]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.MazingerHook32.dll
mov dword [esp + 4], str.MazingerHook.dll
mov dword [esp], 0
call fcn.00418530
mov dword [esp + 8], str.KojiKabuto.exe
mov dword [esp + 4], str.KojiKabuto64.exe
mov dword [esp], 0
call fcn.00418bc5
mov dword [esp + 8], str.KojiHook.dll
mov dword [esp + 4], str.KojiHook64.dll
mov dword [esp], 0
call fcn.00418bc5
movzx eax, byte [0x46703f]
test al, al
je 0x41902a
mov eax, dword [0x446cc4]
jmp 0x41902f
mov eax, dword [0x446cc0]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.Afrodita_chrome.exe
mov dword [esp + 4], str.AfroditaC64.exe
mov dword [esp], 0
call fcn.00418530
mov eax, dword [ebp - 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.AfroditaE.dll
mov dword [esp + 4], str.AfroditaE64.dll
mov dword [esp], 0
call fcn.00418530
mov eax, dword [ebp - 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.AfroditaE32.dll
mov dword [esp + 4], str.AfroditaE.dll
mov dword [esp], 0
call fcn.00418530
mov dword [esp + 4], str.JetScrander.exe
mov dword [esp], 0
call fcn.00418c17
mov dword [esp + 8], str.SayakaCP.dll
mov dword [esp + 4], str.SayakaCP64.dll
mov dword [esp], 0
call fcn.00418bc5
mov dword [esp + 8], str.SayakaCP32.dll
mov dword [esp + 4], str.SayakaCP.dll
mov dword [esp], 0
call fcn.00418bc5
mov dword [esp + 8], str.SoffidConfig.exe
mov dword [esp + 4], str.SoffidConfig64.exe
mov dword [esp], 0
call fcn.00418bc5
jmp 0x4191fc
mov dword [esp + 4], str.Mazinger.exe
mov dword [esp], 0
call fcn.00418c17
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.MazingerHook.dll
mov dword [esp + 4], str.MazingerHook.dll
mov dword [esp], 0
call fcn.00418530
mov dword [esp + 4], str.KojiKabuto.exe
mov dword [esp], 0
call fcn.00418c17
mov dword [esp + 4], str.KojiHook.dll
mov dword [esp], 0
call fcn.00418c17
movzx eax, byte [0x46703f]
test al, al
je 0x41917a
mov eax, dword [0x446cc4]
jmp 0x41917f
mov eax, dword [0x446cc0]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], str.AfroditaE.dll
mov dword [esp], 0
call fcn.00418bef
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.Afrodita_chrome.exe
mov dword [esp + 4], str.AfroditaC.exe
mov dword [esp], 0
call fcn.00418530
mov dword [esp + 4], str.JetScrander.exe
mov dword [esp], 0
call fcn.00418c17
mov dword [esp + 4], str.SayakaCP.dll
mov dword [esp], 0
call fcn.00418c17
mov dword [esp + 4], str.SoffidConfig.exe
mov dword [esp], 0
call fcn.00418c17
lea eax, [ebp - 0x15]
mov ecx, eax
call fcn.00436750
mov dword [esp], str.SystemRoot
call sub.msvcrt.dll_getenv
mov edx, eax
lea eax, [ebp - 0x30]
lea ecx, [ebp - 0x15]
mov dword [esp + 4], ecx
mov dword [esp], edx
mov ecx, eax
call fcn.0043d460
sub esp, 8
lea eax, [ebp - 0x15]
mov ecx, eax
call fcn.00436780
call fcn.004114aa
test eax, eax
setne al
test al, al
je 0x4192d5
lea eax, [ebp - 0x48]
mov dword [esp + 8], str.Sysnative
lea edx, [ebp - 0x30]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00441ac0
lea eax, [ebp - 0x48]
mov ecx, eax
call fcn.004350a0
mov dword [esp + 8], str.libwinpthread_1.dll
mov dword [esp + 4], str.libwinpthread_1_64.dll
mov dword [esp], eax
call fcn.00418bc5
lea eax, [ebp - 0x60]
mov dword [esp + 8], str.SysWOW64
lea edx, [ebp - 0x30]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00441ac0
lea eax, [ebp - 0x60]
mov ecx, eax
call fcn.004350a0
mov dword [esp + 8], str.libwinpthread_1.dll
mov dword [esp + 4], str.libwinpthread_1_32.dll
mov dword [esp], eax
call fcn.00418bc5
lea eax, [ebp - 0x60]
mov ecx, eax
call fcn.0043dfb0
lea eax, [ebp - 0x48]
mov ecx, eax
call fcn.0043dfb0
jmp 0x4192f1
mov dword [esp + 8], str.libwinpthread_1.dll
mov dword [esp + 4], str.libwinpthread_1_32.dll
mov dword [esp], 0
call fcn.00418bc5
call fcn.0041151b
test eax, eax
setne al
test al, al
je 0x419313
mov dword [esp + 4], str.Boss.exe
mov dword [esp], 0
call fcn.00418c17
mov dword [esp + 4], str.SayakaGina.dll
mov dword [esp], 0
call fcn.00418c17
call fcn.004114aa
test eax, eax
setne al
test al, al
je 0x419353
mov dword [esp + 8], str.ShiroKabuto.exe
mov dword [esp + 4], str.ShiroKabuto64.exe
mov dword [esp], 0
call fcn.00418bc5
jmp 0x419367
mov dword [esp + 4], str.ShiroKabuto.exe
mov dword [esp], 0
call fcn.00418c17
mov dword [esp + 4], str.Nossori.exe
mov dword [esp], 0
call fcn.00418c17
mov dword [esp + 4], str.logon.tcl
mov dword [esp], 0
call fcn.00418c17
mov dword [esp + 4], str.uninstall.exe
mov dword [esp], 0
call fcn.00418c17
mov dword [esp + 4], str.sewashi.exe
mov dword [esp], 0
call fcn.00418c17
mov dword [esp + 4], str.sewbr.dll
mov dword [esp], 0
call fcn.00418c17
mov dword [esp + 4], str.profyumi.jar
mov dword [esp], 0
call fcn.00418c17
mov dword [esp + 4], str.afroditaFf2.xpi
mov dword [esp], 0
call fcn.00418c17
mov dword [esp + 4], str.afroditaFf3.xpi
mov dword [esp], 0
call fcn.00418c17
movzx eax, byte [0x46703c]
xor eax, 1
test al, al
je 0x41941a
call fcn.00415827
cmp dword [ebp + 8], 0
je 0x419433
movzx eax, byte [0x46703c]
xor eax, 1
test al, al
je 0x419433
call fcn.00417ea8
call fcn.00418ca3
call fcn.00413a20
movzx eax, byte [0x46703c]
movzx ebx, al
lea eax, [ebp - 0x30]
mov ecx, eax
call fcn.0043dfb0
mov eax, ebx
jmp 0x41949d
mov ebx, dword [ebp - 4]
leave
ret