Function at 0x444bd0
Capabilities:
Check if file exists
Enumerate files on windows
Query environment variable
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c81cd
mov eax, dword fs:[0]
push eax
sub esp, 0x748
mov eax, dword [0x4fbf50]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0x104
lea ecx, [ebp - 0x424]
push ecx
push str.APPDATA
mov dword [ebp - 0x710], eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor esi, esi
xor edx, edx
mov dword [ebp - 0x42c], 7
mov dword [ebp - 0x430], esi
mov word [ebp - 0x440], dx
lea eax, [ebp - 0x424]
mov dword [ebp - 4], esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x444c45
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x440]
call fcn.0040b420
push 0x19
push str.MozillaFirefoxProfiles
lea ecx, [ebp - 0x440]
call fcn.0040b420
mov eax, dword [ebp - 0x440]
mov edi, 8
cmp dword [ebp - 0x42c], edi
jae 0x444c92
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x444cb5
cmp dword [ebp - 0x42c], edi
jb 0x444f78
mov ecx, dword [ebp - 0x440]
push ecx
jmp 0x444f6f
mov eax, dword [ebp - 0x440]
cmp dword [ebp - 0x42c], edi
jae 0x444cc9
lea eax, [ebp - 0x440]
push eax
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str..
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea ecx, [ebp - 0x704]
push ecx
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x70c], eax
cmp eax, 0xffffffff
je 0x444f60
test byte [ebp - 0x704], 0x10
je 0x444f60
cmp word [ebp - 0x6d8], 0x2e
je 0x444f3b
mov ebx, dword [ebp - 0x710]
lea ecx, [ebp - 0x478]
push str.user_pref__browser.startup.homepage____
push ecx
call fcn.00446bd0
add esp, 8
mov ecx, eax
lea esi, [ebp - 0x494]
mov byte [ebp - 4], 1
call fcn.0040c2c0
cmp dword [ebp - 0x464], edi
jb 0x444d6a
mov edx, dword [ebp - 0x478]
push edx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x448], 7
mov dword [ebp - 0x44c], ebx
mov word [ebp - 0x45c], ax
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x440]
cmp dword [ebp - 0x42c], edi
jae 0x444d9d
lea edx, [ebp - 0x440]
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x444da2
sub eax, edi
sar eax, 1
push eax
push edx
lea ecx, [ebp - 0x45c]
call fcn.0040b420
push 1
push 0x4eea48
lea ecx, [ebp - 0x45c]
call fcn.0040b420
lea eax, [ebp - 0x6d8]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x444de0
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x6d8]
push ecx
lea ecx, [ebp - 0x45c]
call fcn.0040b420
push 9
push str.prefs.js
lea ecx, [ebp - 0x45c]
call fcn.0040b420
push 6
push str.GB2312
lea ecx, [ebp - 0x750]
mov dword [ebp - 0x73c], 0xf
mov dword [ebp - 0x740], ebx
mov byte [ebp - 0x750], bl
call fcn.00403920
lea edx, [ebp - 0x45c]
push edx
lea ecx, [ebp - 0x750]
lea ebx, [ebp - 0x4b0]
mov byte [ebp - 4], 5
call fcn.0040d2a0
mov esi, 0x10
add esp, 4
cmp dword [eax + 0x14], esi
jb 0x444e67
mov eax, dword [eax]
push 0x4f1eec
push eax
call dword [sym.imp.MSVCR100.dll_fopen]
add esp, 8
mov edi, eax
mov dword [ebp - 0x708], edi
cmp dword [ebp - 0x49c], esi
jb 0x444e96
mov eax, dword [ebp - 0x4b0]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor ebx, ebx
mov byte [ebp - 4], 4
mov dword [ebp - 0x49c], 0xf
mov dword [ebp - 0x4a0], ebx
mov byte [ebp - 0x4b0], bl
cmp dword [ebp - 0x73c], esi
jb 0x444eca
mov ecx, dword [ebp - 0x750]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov dword [ebp - 0x73c], 0xf
mov dword [ebp - 0x740], ebx
mov byte [ebp - 0x750], bl
cmp edi, ebx
jne 0x444f98
mov esi, 8
cmp dword [ebp - 0x448], esi
jb 0x444f05
mov edx, dword [ebp - 0x45c]
push edx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
mov byte [ebp - 4], bl
mov dword [ebp - 0x448], 7
mov dword [ebp - 0x44c], ebx
mov word [ebp - 0x45c], ax
cmp dword [ebp - 0x480], esi
jb 0x444f39
mov ecx, dword [ebp - 0x494]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov edi, esi
mov eax, dword [ebp - 0x70c]
lea edx, [ebp - 0x704]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x444f60
test byte [ebp - 0x704], 0x10
jne 0x444d19
cmp dword [ebp - 0x42c], edi
jb 0x444f78
mov eax, dword [ebp - 0x440]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004b7299
mov esp, ebp
pop ebp
ret 4
mov esi, dword [sym.imp.MSVCR100.dll_fseek]
push 2
push ebx
push edi
call esi
push edi
call dword [sym.imp.MSVCR100.dll_ftell]
mov ecx, dword [ebp - 0x708]
push ebx
push ebx
push ecx
mov edi, eax
call esi
mov esi, dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new___unsigned_int_]
push edi
call esi
mov edx, dword [ebp - 0x708]
push edx
push 1
push edi
push eax
mov dword [ebp - 0x710], eax
call dword [sym.imp.MSVCR100.dll_fread]
push edi
call esi
push edi
mov esi, eax
push ebx
push esi
call sub.MSVCR100.dll_memset
xor ecx, ecx
add esp, 0x40
xor edx, edx
mov dword [ebp - 0x70c], ebx
mov dword [ebp - 0x714], ecx
cmp edi, ebx
jle 0x44512f
mov eax, dword [ebp - 0x710]
mov al, byte [ecx + eax]
mov byte [edx + esi], al
cmp al, 0xa
jne 0x445113
push str.user_pref__browser.startup.homepage__
push esi
mov dword [ebp - 0x718], ebx
call dword [sym.imp.MSVCR100.dll_strstr]
add esp, 8
push 6
push str.GB2312
lea ecx, [ebp - 0x734]
mov dword [ebp - 0x720], 0xf
mov dword [ebp - 0x724], ebx
mov byte [ebp - 0x734], bl
call fcn.00403920
lea ecx, [ebp - 0x494]
push ecx
lea ecx, [ebp - 0x734]
lea ebx, [ebp - 0x478]
mov byte [ebp - 4], 6
call fcn.0040d2a0
mov ebx, 0x10
add esp, 4
cmp dword [eax + 0x14], ebx
jb 0x44507c
mov eax, dword [eax]
mov edx, esi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x445080
cmp dword [ebp - 0x464], ebx
jb 0x4450a2
mov edx, dword [ebp - 0x478]
push edx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor ebx, ebx
mov byte [ebp - 4], 4
cmp dword [ebp - 0x720], 0x10
mov dword [ebp - 0x464], 0xf
mov dword [ebp - 0x468], ebx
mov byte [ebp - 0x478], bl
jb 0x4450d7
mov eax, dword [ebp - 0x734]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, esi
mov dword [ebp - 0x70c], 1
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4450e6
mov ecx, dword [ebp - 0x708]
push ecx
sub eax, edx
push 1
push eax
push esi
call dword [sym.imp.MSVCR100.dll_fwrite]
mov ecx, dword [ebp - 0x714]
mov edx, dword [ebp - 0x718]
add esp, 0x10
xor ebx, ebx
jmp 0x445114
inc edx
inc ecx
mov dword [ebp - 0x714], ecx
cmp ecx, edi
jl 0x445000
cmp dword [ebp - 0x70c], ebx
jne 0x4451e3
push 6
mov edi, 0xf
push str.GB2312
lea ecx, [ebp - 0x734]
mov dword [ebp - 0x720], edi
mov dword [ebp - 0x724], ebx
mov byte [ebp - 0x734], bl
call fcn.00403920
lea edx, [ebp - 0x494]
push edx
lea ecx, [ebp - 0x734]
lea ebx, [ebp - 0x478]
mov byte [ebp - 4], 7
call fcn.0040d2a0
mov ebx, 0x10
add esp, 4
cmp dword [eax + 0x14], ebx
jb 0x445183
mov eax, dword [eax]
mov ecx, dword [ebp - 0x708]
mov edx, dword [ebp - 0x484]
push ecx
push 1
push edx
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 0x464], ebx
jb 0x4451b5
mov eax, dword [ebp - 0x478]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
mov dword [ebp - 0x464], edi
mov dword [ebp - 0x468], eax
mov byte [ebp - 0x478], al
cmp dword [ebp - 0x720], ebx
jb 0x4451e1
mov ecx, dword [ebp - 0x734]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor ebx, ebx
push esi
mov esi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
call esi
mov edx, dword [ebp - 0x710]
push edx
call esi
mov eax, dword [ebp - 0x708]
push eax
call dword [sym.imp.MSVCR100.dll_fclose]
mov esi, 8
add esp, 0xc
cmp dword [ebp - 0x448], esi
jb 0x445222
mov ecx, dword [ebp - 0x45c]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor edx, edx
mov edi, 7
mov dword [ebp - 0x448], edi
mov dword [ebp - 0x44c], ebx
mov word [ebp - 0x45c], dx
cmp dword [ebp - 0x480], esi
jb 0x445254
mov eax, dword [ebp - 0x494]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x480], edi
mov dword [ebp - 0x484], ebx
mov word [ebp - 0x494], cx
cmp dword [ebp - 0x42c], esi
jb 0x445281
mov edx, dword [ebp - 0x440]
push edx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov al, 1
jmp 0x444f7a