Function at 0x541e00
Capabilities:
Check if file exists
Enumerate files on windows
Move file

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f8945
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x2e0
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x2ec], esi
push str.Resetting_Firefoxs_print_settings...
push 0xffffffffffffffff
call fcn.0057b610
push 0
push 1
mov ecx, esi
call fcn.005494d0
sub esp, 8
mov dword [ebp - 0x3c], 0
xorps xmm0, xmm0
movq qword [ebp - 0x44], xmm0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.MozillaFirefoxProfiles
push ecx
mov ecx, esi
call fcn.0057be80
push eax
lea ecx, [ebp - 0x44]
call fcn.005dc520
mov ecx, str.firefox.exe
mov dword [ebp - 4], 0
call fcn.005cc330
push 0x260
lea eax, [ebp - 0x2e8]
push 0
push eax
call fcn.00420090
add esp, 0xc
lea ecx, [ebp - 0x44]
call fcn.005dc190
push 0x250
mov esi, eax
lea eax, [ebp - 0x2e8]
push 0
push eax
call fcn.00420090
add esp, 0xc
lea eax, [ebp - 0x2e8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov edx, eax
mov dword [ebp - 0x98], edx
cmp edx, 0xffffffff
je 0x541f92
mov ecx, 5
mov dword [ebp - 0x94], ecx
nop
cmp word [ebp - 0x2bc], 0x2e
jne 0x541f36
mov ax, word [ebp - 0x2ba]
test ax, ax
je 0x541f60
cmp ax, 0x2e
jne 0x541f36
cmp word [ebp - 0x2b8], 0
je 0x541f60
test ecx, ecx
je 0x541f92
mov eax, dword [ebp - 0x2e8]
test cl, 1
je 0x541f4c
test eax, 0x400
jne 0x541f60
test cl, 2
je 0x541f57
test al, 0x10
je 0x541f92
jmp 0x541f60
test cl, 4
je 0x541f92
test al, 0x10
jne 0x541f92
lea eax, [ebp - 0x2e8]
push eax
push edx
call esi
test eax, eax
je 0x541f7c
mov ecx, dword [ebp - 0x94]
mov edx, dword [ebp - 0x98]
jmp 0x541f10
push dword [ebp - 0x98]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x98], 0xffffffff
push 1
lea ecx, [ebp - 0x44]
call fcn.005dadc0
xorps xmm0, xmm0
lea ecx, [ebp - 0x38]
xor esi, esi
movq qword [ebp - 0x38], xmm0
mov dword [ebp - 0x30], esi
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x20]
movq qword [ebp - 0x20], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x24], esi
lea ecx, [ebp - 0x2c]
movq qword [ebp - 0x2c], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 4
cmp dword [ebp - 0x98], 0xffffffff
je 0x5421c6
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov ecx, dword [ebp - 0x2ec]
push 0
push 1
call fcn.005494d0
test eax, eax
jne 0x542258
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x64ebf8
lea eax, [ebp - 0x2bc]
push eax
lea ecx, [ebp - 0x44]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005dc200
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x542046
inc esi
jmp 0x542192
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str..tmp
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2c]
call fcn.005dc200
push 1
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x542192
xorps xmm0, xmm0
lea ecx, [ebp - 0x2c]
push 0
push 0
movups xmmword [ebp - 0x64], xmm0
movups xmmword [ebp - 0x54], xmm0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x64]
call fcn.005e4770
xorps xmm0, xmm0
mov byte [ebp - 4], 5
push 0
push 2
lea ecx, [ebp - 0x20]
movups xmmword [ebp - 0x84], xmm0
movups xmmword [ebp - 0x74], xmm0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x84]
call fcn.005e4770
push 0
push ecx
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x64]
call fcn.005e3a40
test eax, eax
je 0x542143
push 0
push 1
push 1
push 0
push str.user_pref__print.
lea ecx, [ebp - 0x38]
call fcn.005daa70
test eax, eax
jne 0x542130
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x62781c
lea ecx, [ebp - 0x38]
call fcn.005da780
push eax
lea ecx, [ebp - 0x84]
call fcn.005e3a10
push 0
push ecx
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x64]
call fcn.005e3a40
test eax, eax
jne 0x5420f3
push ecx
lea ecx, [ebp - 0x64]
call fcn.005e36a0
push 2
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push eax
call fcn.005771e0
lea ecx, [ebp - 0x7c]
inc esi
call fcn.005d9280
mov eax, dword [ebp - 0x84]
cmp eax, 0xffffffff
je 0x542177
test eax, eax
je 0x542177
push eax
call edi
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 4
call fcn.005d9280
mov eax, dword [ebp - 0x64]
cmp eax, 0xffffffff
je 0x542192
test eax, eax
je 0x542192
push eax
call edi
mov eax, dword [ebp - 0x98]
cmp eax, 0xffffffff
je 0x5421c6
lea ecx, [ebp - 0x2e8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x54223b
lea ecx, [ebp - 0x2e8]
call fcn.004011a0
test al, al
jne 0x541ff0
mov edi, dword [sym.imp.KERNEL32.dll_FindClose]
push 0
push 0
test esi, esi
mov ecx, str.Failed_to_reset_Firefoxs_print_preferences._Firefox_preferences_file_not_found.
mov eax, str.Successfully_reset_Firefoxs_print_preferences.
cmove eax, ecx
mov ecx, dword [ebp - 0x2ec]
push 0
push eax
call fcn.0057b7e0
lea ecx, [ebp - 0x2c]
call fcn.005dc430
lea ecx, [ebp - 0x20]
call fcn.005dc430
lea ecx, [ebp - 0x38]
call fcn.005dc430
mov eax, dword [ebp - 0x98]
cmp eax, 0xffffffff
je 0x542213
push eax
call edi
lea ecx, [ebp - 0x44]
call fcn.005dc430
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push dword [ebp - 0x98]
mov edi, dword [sym.imp.KERNEL32.dll_FindClose]
call edi
mov dword [ebp - 0x98], 0xffffffff
jmp 0x5421cc
mov edi, dword [sym.imp.KERNEL32.dll_FindClose]
or esi, 0xffffffff
jmp 0x5421ed