Function at 0x41d7c0
Capabilities:
Check if file exists
Delete registry value
Get file attributes
Move file
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x615c98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x360
mov eax, dword [0x6d1288]
push ebx
push esi
xor ebx, ebx
push edi
cmp eax, ebx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x54], ecx
mov dword [ebp - 4], ebx
jne 0x41d7fa
mov eax, 0x6d128c
push str.idmmzcc.xpi
push eax
lea eax, [ebp - 0x36c]
push 0x6a1544
push eax
call fcn.005e72e7
add esp, 0x10
lea ecx, [ebp - 0x36c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41e002
xor eax, eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x44], eax
mov word [ebp - 0x40], bx
mov esi, dword [0x6d12b0]
mov byte [ebp - 4], 1
cmp esi, ebx
jne 0x41d849
mov esi, 0x6d12b4
mov edx, str._s_scomponents2idmmzcc.dll
test edx, edx
je 0x41d951
cmp esi, ebx
je 0x41d951
mov ecx, str.idmmzcc5
test ecx, ecx
je 0x41d951
push edx
lea ecx, [ebp - 0x1c]
call fcn.00402380
push esi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.0040e5a0
push str.idmmzcc5
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 3
call fcn.0040e5a0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 4
call fcn.00401070
mov edi, dword [ebp - 0x28]
cmp edi, ebx
jne 0x41d8a8
lea edi, [ebp - 0x24]
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x34]
call fcn.00402400
push eax
call fcn.005e639f
mov edx, eax
push edi
mov dword [ebp - 0x58], edx
call fcn.005e639f
mov edx, dword [ebp - 0x58]
add esi, edx
lea esi, [eax + esi + 3]
lea edi, [esi + esi]
push edi
call fcn.005feedc
mov edx, eax
add esp, 0xc
cmp edx, ebx
mov dword [ebp - 0x44], edx
je 0x41d92a
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x34]
call fcn.00402400
push eax
lea ecx, [ebp - 0x28]
call fcn.00402400
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402400
push eax
mov eax, dword [ebp - 0x44]
push esi
push eax
call fcn.005e632f
mov ecx, dword [ebp - 0x44]
push ecx
call fcn.005e639f
add esp, 0x18
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 3
call fcn.00401070
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00401070
mov eax, dword [ebp - 0x44]
cmp eax, ebx
jne 0x41d958
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41dcf1
mov esi, dword [0x6d12b0]
test esi, esi
jne 0x41d977
mov esi, 0x6d12b4
mov edx, str._s_scomponents2idmcchandler2.dll
test edx, edx
je 0x41da7c
test esi, esi
je 0x41da7c
mov eax, str.idmmzcc5
test eax, eax
je 0x41da7c
push edx
lea ecx, [ebp - 0x1c]
call fcn.00402380
push esi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 5
call fcn.0040e5a0
mov bl, 6
push str.idmmzcc5
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.0040e5a0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 7
call fcn.00401070
mov edi, dword [ebp - 0x28]
test edi, edi
jne 0x41d9d7
lea edi, [ebp - 0x24]
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x34]
call fcn.00402400
push eax
call fcn.005e639f
mov edx, eax
push edi
mov dword [ebp - 0x58], edx
call fcn.005e639f
mov ecx, dword [ebp - 0x58]
add esi, ecx
lea esi, [eax + esi + 3]
lea edi, [esi + esi]
push edi
call fcn.005feedc
mov edx, eax
add esp, 0xc
test edx, edx
mov dword [ebp - 0x44], edx
je 0x41da59
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x34]
call fcn.00402400
push eax
lea ecx, [ebp - 0x28]
call fcn.00402400
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402400
push eax
mov eax, dword [ebp - 0x44]
push esi
push eax
call fcn.005e632f
mov ecx, dword [ebp - 0x44]
push ecx
call fcn.005e639f
add esp, 0x18
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.00401070
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 5
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00401070
mov eax, dword [ebp - 0x44]
test eax, eax
jne 0x41da86
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41dcf1
mov esi, dword [0x6d12b0]
test esi, esi
jne 0x41daa5
mov esi, 0x6d12b4
mov edx, str._s_schromeidmmzcc.jar
test edx, edx
je 0x41dba5
test esi, esi
je 0x41dba5
mov eax, str.idmmzcc5
test eax, eax
je 0x41dba5
push edx
lea ecx, [ebp - 0x1c]
call fcn.00402380
push esi
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 8
call fcn.0040e5a0
mov bl, 9
push str.idmmzcc5
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.0040e5a0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0xa
call fcn.00401070
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
call fcn.00402400
push eax
call fcn.005e639f
add esp, 4
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.00402400
push eax
call fcn.005e639f
add esi, edi
lea esi, [eax + esi + 3]
lea edi, [esi + esi]
push edi
call fcn.005feedc
mov edx, eax
add esp, 8
test edx, edx
mov dword [ebp - 0x44], edx
je 0x41db82
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x28]
call fcn.00402400
push eax
lea ecx, [ebp - 0x34]
call fcn.00402400
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402400
push eax
mov eax, dword [ebp - 0x44]
push esi
push eax
call fcn.005e632f
mov ecx, dword [ebp - 0x44]
push ecx
call fcn.005e639f
add esp, 0x18
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00401070
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 8
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00401070
mov eax, dword [ebp - 0x44]
test eax, eax
jne 0x41dbaf
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41dcf1
mov esi, dword [0x6d12b0]
test esi, esi
jne 0x41dbce
mov esi, 0x6d12b4
mov edx, str._s_scomponents12idmmzcc.dll
test edx, edx
je 0x41dcce
test esi, esi
je 0x41dcce
mov eax, str.idmmzcc5
test eax, eax
je 0x41dcce
push edx
lea ecx, [ebp - 0x1c]
call fcn.00402380
push esi
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0xb
call fcn.0040e5a0
mov bl, 0xc
push str.idmmzcc5
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.0040e5a0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0xd
call fcn.00401070
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
call fcn.00402400
push eax
call fcn.005e639f
add esp, 4
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.00402400
push eax
call fcn.005e639f
add esi, edi
lea esi, [eax + esi + 3]
lea edi, [esi + esi]
push edi
call fcn.005feedc
mov edx, eax
add esp, 8
test edx, edx
mov dword [ebp - 0x44], edx
je 0x41dcab
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x28]
call fcn.00402400
push eax
lea ecx, [ebp - 0x34]
call fcn.00402400
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402400
push eax
mov eax, dword [ebp - 0x44]
push esi
push eax
call fcn.005e632f
mov ecx, dword [ebp - 0x44]
push ecx
call fcn.005e639f
add esp, 0x18
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00401070
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0xb
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00401070
mov eax, dword [ebp - 0x44]
test eax, eax
jne 0x41dcd8
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41dcf1
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x41df49
jmp 0x41dcf4
mov ebx, dword [ebp + 8]
lea edx, [ebp - 0x36c]
mov dword [ebp + 8], 0
push edx
call fcn.005d3fa0
mov esi, eax
add esp, 4
test esi, esi
je 0x41dd5d
lea eax, [ebp - 0x60]
push eax
push esi
call fcn.005d43e0
add esp, 8
xor edi, edi
cmp edi, dword [ebp - 0x60]
jae 0x41dd54
mov edx, dword [ebp - 0x54]
lea ecx, [ebp + 8]
push ecx
push edx
push str.idmmzcc5
push ebx
push esi
call fcn.0041c080
add esp, 0x14
test eax, eax
jne 0x41dd54
mov eax, dword [ebp - 0x60]
inc edi
cmp edi, eax
jae 0x41dd54
push esi
call fcn.005d4830
add esp, 4
test eax, eax
je 0x41dd1f
push esi
call fcn.005d43a0
add esp, 4
mov eax, dword [ebp + 8]
test eax, eax
je 0x41ddfe
test ebx, ebx
je 0x41ddfe
mov eax, dword [0x6d1d60]
mov ecx, dword [0x6d1a50]
push 0x50035
push eax
push ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 4
jne 0x41ddfe
lea edx, [ebp - 0x36c]
mov dword [ebp + 8], 0
push edx
call fcn.005d3fa0
mov edi, eax
add esp, 4
test edi, edi
je 0x41ddfe
lea eax, [ebp - 0x60]
push eax
push edi
call fcn.005d43e0
add esp, 8
test eax, eax
jne 0x41ddfe
xor esi, esi
cmp esi, dword [ebp - 0x60]
jae 0x41ddf8
mov edx, dword [ebp - 0x54]
lea ecx, [ebp + 8]
push ecx
push edx
push str.idmmzcc5
push ebx
push edi
call fcn.0041c080
add esp, 0x14
test eax, eax
jne 0x41ddf8
mov eax, dword [ebp - 0x60]
inc esi
cmp esi, eax
jae 0x41ddf8
push edi
call fcn.005d4830
add esp, 4
test eax, eax
je 0x41ddc3
push edi
jmp 0x41dd55
push str.idmmzcc5
call fcn.0041cf80
xor eax, eax
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
mov word [ebp - 0x18], ax
mov esi, dword [0x6d12b0]
mov byte [ebp - 4], 0xe
cmp esi, eax
jne 0x41de2a
mov esi, 0x6d12b4
mov ecx, 0x6a012c
test ecx, ecx
je 0x41df2d
test esi, esi
je 0x41df2d
mov edx, str.idmmzcc5
test edx, edx
je 0x41df2d
push ecx
lea ecx, [ebp - 0x64]
call fcn.00402380
push esi
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0xf
call fcn.0040e5a0
mov bl, 0x10
push str.idmmzcc5
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.0040e5a0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x11
call fcn.00401070
mov esi, dword [ebp - 0x5c]
lea ecx, [ebp - 0x28]
call fcn.00402400
push eax
call fcn.005e639f
add esp, 4
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.00402400
push eax
call fcn.005e639f
add esi, edi
lea esi, [eax + esi + 3]
lea edi, [esi + esi]
push edi
call fcn.005feedc
mov edx, eax
add esp, 8
test edx, edx
mov dword [ebp - 0x1c], edx
je 0x41df07
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x28]
call fcn.00402400
push eax
lea ecx, [ebp - 0x34]
call fcn.00402400
push eax
lea ecx, [ebp - 0x64]
call fcn.00402400
push eax
mov eax, dword [ebp - 0x1c]
push esi
push eax
call fcn.005e632f
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.005e639f
add esp, 0x18
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00401070
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0xf
call fcn.00401070
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0xe
call fcn.00401070
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x41df34
lea eax, [ebp - 0x18]
push eax
call fcn.0041cf00
add esp, 4
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00401070
mov eax, dword [ebp + 0xc]
xor ebx, ebx
cmp eax, ebx
jne 0x41e023
lea edx, [ebp + 8]
push edx
push 0xf003f
push ebx
push str.SoftwareMozillaFirefoxExtensions
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x41e017
lea eax, [ebp + 8]
push ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push eax
push ebx
push 0xf003f
push ebx
push 0x6d0c38
push ebx
push str.SoftwareMozilla
push reloc.WS2_32.dll_accept
call esi
test eax, eax
jne 0x41dff6
mov ecx, dword [ebp + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call edi
lea edx, [ebp + 8]
push ebx
push edx
push ebx
push 0xf003f
push ebx
push 0x6d0c38
push ebx
push str.SoftwareMozillaFirefox
push reloc.WS2_32.dll_accept
call esi
test eax, eax
jne 0x41dff6
mov eax, dword [ebp + 8]
push eax
call edi
lea ecx, [ebp + 8]
push ebx
push ecx
push ebx
push 0xf003f
push ebx
push 0x6d0c38
push ebx
push str.SoftwareMozillaFirefoxExtensions
push reloc.WS2_32.dll_accept
call esi
test eax, eax
je 0x41e01d
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0
call fcn.00401070
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp + 8]
push edx
call edi
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x48], ebx
mov word [ebp - 0x4c], bx
mov esi, dword [0x6d12b0]
mov byte [ebp - 4], 0x12
cmp esi, ebx
jne 0x41e040
mov esi, 0x6d12b4
mov eax, 0x6a012c
test eax, eax
je 0x41e140
test esi, esi
je 0x41e140
mov ecx, str.idmmzcc5
test ecx, ecx
je 0x41e140
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402380
push esi
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x13
call fcn.0040e5a0
mov bl, 0x14
push str.idmmzcc5
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.0040e5a0
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0x15
call fcn.00401070
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
call fcn.00402400
push eax
call fcn.005e639f
add esp, 4
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.00402400
push eax
call fcn.005e639f
add esi, edi
lea esi, [eax + esi + 3]
lea edi, [esi + esi]
push edi
call fcn.005feedc
mov edx, eax
add esp, 8
test edx, edx
mov dword [ebp - 0x50], edx
je 0x41e11d
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x28]
call fcn.00402400
push eax
lea ecx, [ebp - 0x34]
call fcn.00402400
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402400
push eax
mov eax, dword [ebp - 0x50]
push esi
push eax
call fcn.005e632f
mov ecx, dword [ebp - 0x50]
push ecx
call fcn.005e639f
add esp, 0x18
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00401070
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x13
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x12
call fcn.00401070
lea edx, [ebp - 0x100]
push 0x6a0dc4
push edx
call fcn.005e6569
lea eax, [ebp - 0x100]
push eax
call fcn.005e639f
add esp, 0xc
xor ecx, ecx
cmp ecx, eax
jge 0x41e183
mov dx, word [ebp + ecx*2 - 0x100]
xor dx, 0x4d
sub edx, 0xff
mov word [ebp + ecx*2 - 0x100], dx
inc ecx
jmp 0x41e162
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x41e193
mov dword [ebp - 0x58], 1
jmp 0x41e19b
call fcn.004103a0
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x68]
xor esi, esi
push eax
push 0x20019
push esi
xor ebx, ebx
push str.SOFTWAREMozillaSeaMonkey
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x54], ebx
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41e269
mov ecx, 0x19
lea edi, [ebp - 0x164]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x5c]
lea edx, [ebp - 0x164]
push ecx
push edx
push eax
push eax
mov eax, dword [ebp - 0x68]
push str.CurrentVersion
push eax
mov dword [ebp - 0x5c], 0x64
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41e25c
lea ecx, [ebp - 0x164]
mov ebx, 1
push 0x2e
push ecx
mov dword [ebp - 0x54], ebx
call fcn.005e63d0
mov esi, eax
add esp, 8
test esi, esi
je 0x41e25c
lea edx, [ebp - 0x164]
mov byte [esi], 0
push edx
call fcn.005e6653
add esp, 4
test eax, eax
je 0x41e236
mov dword [ebp + 8], eax
inc esi
push 0x6a2bc0
push esi
call fcn.005e7b20
add esp, 8
test eax, eax
je 0x41e24c
mov byte [eax], 0
push esi
call fcn.005e6653
add esp, 4
test eax, eax
je 0x41e25c
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 0x68]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x38]
push ecx
push 0xf003f
push 0
push str.SoftwareMozillaSeaMonkeyExtensions
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x41e4c4
lea edx, [ebp - 0x38]
push 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push edx
push 0
push 0xf003f
push 0
push 0x6d0c38
push 0
push str.SoftwareMozillaSeaMonkey
push reloc.WS2_32.dll_accept
call esi
test eax, eax
jne 0x41e6cc
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x38]
push 0
push ecx
push 0
push 0xf003f
push 0
push 0x6d0c38
push 0
push str.SoftwareMozillaSeaMonkeyExtensions
push reloc.WS2_32.dll_accept
call esi
test eax, eax
jne 0x41e6cc
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x41e31a
mov eax, dword [ebp + 8]
cmp eax, 2
jg 0x41e307
jne 0x41e31a
cmp dword [ebp + 0xc], 0x26
jl 0x41e31a
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x100]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x41e34f
mov eax, dword [ebp - 0x50]
test eax, eax
jne 0x41e4a1
lea eax, [ebp - 0x4c]
lea esi, [ebp - 0x4c]
push eax
call fcn.005e639f
add esp, 4
lea ecx, [eax + eax + 2]
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x100]
push ecx
push esi
push 1
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, dword [0x6d1288]
test esi, esi
jne 0x41e35e
mov esi, 0x6d128c
mov ecx, 0x6a012c
test ecx, ecx
je 0x41e45e
test esi, esi
je 0x41e45e
mov edx, str.idmmzcc2.xpi
test edx, edx
je 0x41e45e
push ecx
lea ecx, [ebp - 0x1c]
call fcn.00402380
push esi
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x16
call fcn.0040e5a0
mov bl, 0x17
push str.idmmzcc2.xpi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.0040e5a0
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0x18
call fcn.00401070
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
call fcn.00402400
push eax
call fcn.005e639f
add esp, 4
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.00402400
push eax
call fcn.005e639f
add esi, edi
lea esi, [eax + esi + 3]
lea edi, [esi + esi]
push edi
call fcn.005feedc
mov edx, eax
add esp, 8
test edx, edx
mov dword [ebp - 0x50], edx
je 0x41e43b
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x28]
call fcn.00402400
push eax
lea ecx, [ebp - 0x34]
call fcn.00402400
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402400
push eax
mov eax, dword [ebp - 0x50]
push esi
push eax
call fcn.005e632f
mov ecx, dword [ebp - 0x50]
push ecx
call fcn.005e639f
add esp, 0x18
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00401070
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x16
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x12
call fcn.00401070
lea edx, [ebp - 0x100]
push 0x6a0e14
push edx
call fcn.005e6569
lea eax, [ebp - 0x100]
push eax
call fcn.005e639f
add esp, 0xc
xor ecx, ecx
cmp ecx, eax
jge 0x41e4a8
mov dx, word [ebp + ecx*2 - 0x100]
xor dx, 0x4d
sub edx, 0xff
mov word [ebp + ecx*2 - 0x100], dx
inc ecx
jmp 0x41e480
mov esi, eax
jmp 0x41e32b
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x41e68d
mov eax, dword [ebp + 8]
cmp eax, 2
jg 0x41e68d
jmp 0x41e685
test ebx, ebx
je 0x41e4e8
cmp esi, 2
jg 0x41e4d5
jne 0x41e4e8
cmp dword [ebp + 0xc], 0x26
jl 0x41e4e8
mov edx, dword [ebp - 0x38]
lea ecx, [ebp - 0x100]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x41e51d
mov eax, dword [ebp - 0x50]
test eax, eax
jne 0x41e66f
lea eax, [ebp - 0x4c]
lea esi, [ebp - 0x4c]
push eax
call fcn.005e639f
mov edx, dword [ebp - 0x38]
add esp, 4
lea eax, [eax + eax + 2]
lea ecx, [ebp - 0x100]
push eax
push esi
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, dword [0x6d1288]
test esi, esi
jne 0x41e52c
mov esi, 0x6d128c
mov eax, 0x6a012c
test eax, eax
je 0x41e62c
test esi, esi
je 0x41e62c
mov ecx, str.idmmzcc2.xpi
test ecx, ecx
je 0x41e62c
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402380
push esi
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x19
call fcn.0040e5a0
mov bl, 0x1a
push str.idmmzcc2.xpi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.0040e5a0
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0x1b
call fcn.00401070
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
call fcn.00402400
push eax
call fcn.005e639f
add esp, 4
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.00402400
push eax
call fcn.005e639f
add esi, edi
lea esi, [eax + esi + 3]
lea edi, [esi + esi]
push edi
call fcn.005feedc
mov edx, eax
add esp, 8
test edx, edx
mov dword [ebp - 0x50], edx
je 0x41e609
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x28]
call fcn.00402400
push eax
lea ecx, [ebp - 0x34]
call fcn.00402400
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402400
push eax
mov eax, dword [ebp - 0x50]
push esi
push eax
call fcn.005e632f
mov ecx, dword [ebp - 0x50]
push ecx
call fcn.005e639f
add esp, 0x18
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00401070
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x19
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x12
call fcn.00401070
lea edx, [ebp - 0x100]
push 0x6a0e14
push edx
call fcn.005e6569
lea eax, [ebp - 0x100]
push eax
call fcn.005e639f
add esp, 0xc
xor ecx, ecx
cmp ecx, eax
jge 0x41e676
mov dx, word [ebp + ecx*2 - 0x100]
xor dx, 0x4d
sub edx, 0xff
mov word [ebp + ecx*2 - 0x100], dx
inc ecx
jmp 0x41e64e
mov esi, eax
jmp 0x41e4f9
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x41e68d
mov eax, dword [ebp + 8]
cmp eax, 2
jg 0x41e68d
jne 0x41e6c2
cmp dword [ebp + 0xc], 0x26
jl 0x41e6c2
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x41e698
mov esi, eax
jmp 0x41e69e
lea eax, [ebp - 0x4c]
lea esi, [ebp - 0x4c]
push eax
call fcn.005e639f
mov edx, dword [ebp - 0x38]
add esp, 4
lea eax, [eax + eax + 2]
lea ecx, [ebp - 0x100]
push eax
push esi
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x58]
xor esi, esi
cmp ebx, esi
je 0x41e883
mov eax, dword [ebp - 0x50]
cmp eax, esi
jne 0x41e6e3
lea eax, [ebp - 0x4c]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call edi
cmp eax, 0xffffffff
je 0x41e883
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x2c], esi
mov word [ebp - 0x30], si
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x5c], esi
mov word [ebp - 0x60], si
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], esi
mov word [ebp - 0x18], si
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], esi
mov word [ebp - 0x24], si
lea ecx, [ebp - 0x74]
call fcn.0041cad0
lea ecx, [ebp - 0x80]
call fcn.0041cad0
mov ecx, 0x6d12b0
mov byte [ebp - 4], 0x21
call fcn.00402400
push eax
push str._sidmmzcc
lea ecx, [ebp - 0x34]
call fcn.0041aef0
mov ecx, 0x6d12b0
call fcn.00402400
push eax
push str._sidmmzcc2
lea ecx, [ebp - 0x64]
call fcn.0041aef0
mov ecx, 0x6d12b0
call fcn.00402400
push eax
push str._sidmmzcc3
lea ecx, [ebp - 0x1c]
call fcn.0041aef0
mov ecx, 0x6d12b0
call fcn.00402400
push eax
push str._sidmmzcc01
lea ecx, [ebp - 0x28]
call fcn.0041aef0
mov ecx, 0x6d12b0
call fcn.00402400
push eax
push str._sidmmzcc02
lea ecx, [ebp - 0x74]
call fcn.0041aef0
mov ecx, 0x6d12b0
call fcn.00402400
push eax
push str._sidmmzcc03
lea ecx, [ebp - 0x80]
call fcn.0041aef0
lea ecx, [ebp - 0x34]
call fcn.00402400
push eax
call edi
cmp eax, 0xffffffff
je 0x41e7ed
lea ecx, [ebp - 0x28]
call fcn.00402400
push eax
lea ecx, [ebp - 0x34]
call fcn.00402400
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileW]
push eax
call esi
jmp 0x41e7f3
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [ebp - 0x64]
call fcn.00402400
push eax
call edi
cmp eax, 0xffffffff
je 0x41e817
lea ecx, [ebp - 0x74]
call fcn.00402400
push eax
lea ecx, [ebp - 0x64]
call fcn.00402400
push eax
call esi
lea ecx, [ebp - 0x1c]
call fcn.00402400
push eax
call edi
cmp eax, 0xffffffff
je 0x41e83b
lea ecx, [ebp - 0x80]
call fcn.00402400
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402400
push eax
call esi
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0x20
call fcn.00401070
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0x1f
call fcn.00401070
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x1e
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x1d
call fcn.00401070
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x1c
call fcn.00401070
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x12
call fcn.00401070
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 1
call fcn.00401070
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0
call fcn.00401070
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8