Function at 0x403450
Capabilities:
Enumerate files on windows
Gather firefox profile information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x704
mov eax, dword [0x4c32cc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
lea edi, [ebp - 0x5b0]
mov dword [ebp - 0x6f8], ebx
call fcn.00481d30
mov dword [ebp - 0x6fc], eax
lea eax, [ebp - 0x320]
push eax
mov edx, 0x7ffffffe
mov eax, 0x104
mov ecx, ebx
mov byte [ebp - 0x320], 0
mov byte [ebp - 0x110], 0
call fcn.00401000
push 0x104
push str.CookieFolder
push str.SoftwareBillP_StudiosWinPatrol
lea ecx, [ebp - 0x110]
mov edx, 0x80000001
mov dword [ebp - 0x6f4], 0
call fcn.0048e050
add esp, 0xc
test eax, eax
mov edx, 0x7ffffffe
mov eax, 0x104
je 0x403503
lea ecx, [ebp - 0x110]
push ecx
mov ecx, ebx
call fcn.00401000
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
lea ecx, [ebp - 0x428]
call fcn.00401000
mov edx, 0x104
lea eax, [ebp - 0x428]
mov edi, edi
cmp byte [eax], 0
je 0x40352b
inc eax
dec edx
jne 0x403520
jmp 0x403553
test edx, edx
je 0x403553
mov ecx, 0x104
sub ecx, edx
mov eax, 0x104
sub eax, ecx
push str.Shell_Folders
lea ecx, [ebp + ecx - 0x428]
mov edx, 0x7fffffff
call fcn.00401000
call fcn.0047e2a0
push 0x104
lea edx, [ebp - 0x428]
push str.AppData
push edx
lea ecx, [ebp - 0x110]
mov edx, 0x80000001
mov dword [ebp - 0x700], eax
call fcn.0048e050
add esp, 0xc
mov edx, 0x104
lea eax, [ebp - 0x110]
lea ecx, [ecx]
cmp byte [eax], 0
je 0x40359b
inc eax
dec edx
jne 0x403590
jmp 0x4035c3
test edx, edx
je 0x4035c3
mov ecx, 0x104
sub ecx, edx
mov eax, 0x104
sub eax, ecx
push str.Moonchild_ProductionsPale_MoonProfiles_
lea ecx, [ebp + ecx - 0x110]
mov edx, 0x7fffffff
call fcn.00401000
lea eax, [ebp - 0x110]
push eax
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [ebp - 0x320]
call fcn.00401000
lea ecx, [ebp - 0x110]
push ecx
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [ebp - 0x530]
call fcn.00401000
mov edx, 0x104
lea eax, [ebp - 0x110]
cmp byte [eax], 0
je 0x403611
inc eax
dec edx
jne 0x403606
jmp 0x403639
test edx, edx
je 0x403639
mov ecx, 0x104
sub ecx, edx
mov eax, 0x104
sub eax, ecx
push str..default
lea ecx, [ebp + ecx - 0x110]
mov edx, 0x7fffffff
call fcn.00401000
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea edx, [ebp - 0x6f0]
push edx
lea eax, [ebp - 0x110]
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x403673
mov edx, 0x104
lea eax, [ebp - 0x320]
cmp byte [eax], 0
je 0x403842
inc eax
dec edx
jne 0x403661
jmp 0x40386c
push 0x104
lea ecx, [ebp - 0x428]
push str.AppData
push ecx
lea ecx, [ebp - 0x110]
mov edx, 0x80000001
call fcn.0048e050
add esp, 0xc
mov edx, 0x104
lea eax, [ebp - 0x110]
cmp byte [eax], 0
je 0x4036ad
inc eax
dec edx
jne 0x4036a2
jmp 0x4036d5
test edx, edx
je 0x4036d5
mov ecx, 0x104
sub ecx, edx
mov eax, 0x104
sub eax, ecx
push str.MozillaFireFoxProfiles_
lea ecx, [ebp + ecx - 0x110]
mov edx, 0x7fffffff
call fcn.00401000
lea edx, [ebp - 0x110]
push edx
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [ebp - 0x320]
call fcn.00401000
lea eax, [ebp - 0x110]
push eax
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [ebp - 0x530]
call fcn.00401000
mov eax, 0x104
lea ecx, [ebp - 0x110]
cmp byte [ecx], 0
je 0x403723
inc ecx
dec eax
jne 0x403718
jmp 0x40374b
test eax, eax
je 0x40374b
mov ecx, 0x104
sub ecx, eax
mov eax, 0x104
sub eax, ecx
push str..default
lea ecx, [ebp + ecx - 0x110]
mov edx, 0x7fffffff
call fcn.00401000
lea ecx, [ebp - 0x6f0]
push ecx
lea edx, [ebp - 0x110]
push edx
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x4037bb
mov edx, 0x104
lea eax, [ebp - 0x320]
lea ecx, [ecx]
cmp byte [eax], 0
je 0x403785
inc eax
dec edx
jne 0x403770
lea ecx, [ebp - 0x320]
push ecx
jmp 0x403873
test edx, edx
je 0x4037af
lea eax, [ebp - 0x6c4]
push eax
mov ecx, 0x104
sub ecx, edx
mov eax, 0x104
sub eax, ecx
lea ecx, [ebp + ecx - 0x320]
mov edx, 0x7fffffff
call fcn.00401000
lea ecx, [ebp - 0x320]
push ecx
jmp 0x403873
lea edx, [ebp - 0x320]
push edx
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [ebp - 0x110]
call fcn.00401000
mov edx, 0x104
lea eax, [ebp - 0x110]
cmp byte [eax], 0
je 0x4037ed
inc eax
dec edx
jne 0x4037e2
jmp 0x403815
test edx, edx
je 0x403815
mov ecx, 0x104
sub ecx, edx
mov eax, 0x104
sub eax, ecx
push str.default.
lea ecx, [ebp + ecx - 0x110]
mov edx, 0x7fffffff
call fcn.00401000
lea eax, [ebp - 0x6f0]
push eax
lea ecx, [ebp - 0x110]
push ecx
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x403895
mov edx, 0x104
lea eax, [ebp - 0x320]
cmp byte [eax], 0
je 0x403842
inc eax
dec edx
jne 0x403837
jmp 0x40386c
test edx, edx
je 0x40386c
mov ecx, 0x104
sub ecx, edx
lea edx, [ebp - 0x6c4]
mov eax, 0x104
push edx
sub eax, ecx
mov edx, 0x7fffffff
lea ecx, [ebp + ecx - 0x320]
call fcn.00401000
lea eax, [ebp - 0x320]
push eax
mov edx, 0x7ffffffe
mov eax, 0x104
mov ecx, ebx
call fcn.00401000
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x6f4], 1
push ebx
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [ebp - 0x218]
call fcn.00401000
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [ebp - 0x218]
push ecx
call edi
cmp eax, 3
jle 0x403956
lea esi, [ebp - 0x218]
mov edx, esi
push edx
call edi
cmp byte [eax + esi - 1], 0x5c
jne 0x4038df
mov eax, esi
push eax
call edi
mov byte [eax + esi - 1], 0
call fcn.00404b90
cmp eax, 2
lea ecx, [ebp - 0x218]
mov eax, 0x104
jle 0x403910
cmp byte [ecx], 0
je 0x4038ff
inc ecx
dec eax
jne 0x4038f4
jmp 0x403943
test eax, eax
je 0x403943
push str.cookies.sqlite
jmp 0x403924
cmp byte [ecx], 0
je 0x40391b
inc ecx
dec eax
jne 0x403910
jmp 0x403943
test eax, eax
je 0x403943
push str.cookies.txt
mov ecx, 0x104
sub ecx, eax
mov eax, 0x104
sub eax, ecx
mov edx, 0x7fffffff
lea ecx, [ebp + ecx - 0x218]
call fcn.00401000
lea ecx, [ebp - 0x218]
call fcn.0047d280
test eax, eax
jne 0x4034ed
cmp dword [ebp - 0x6fc], 0
je 0x403b46
lea ecx, [ebp - 0x530]
push ecx
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [ebp - 0x110]
call fcn.00401000
mov edx, 0x104
lea eax, [ebp - 0x110]
lea ebx, [ebx]
cmp byte [eax], 0
je 0x40399b
inc eax
dec edx
jne 0x403990
jmp 0x4039c3
test edx, edx
je 0x4039c3
mov ecx, 0x104
sub ecx, edx
mov eax, 0x104
sub eax, ecx
push 0x4b1b38
lea ecx, [ebp + ecx - 0x110]
mov edx, 0x7fffffff
call fcn.00401000
mov edx, 0x104
lea eax, [ebp - 0x110]
mov edi, edi
cmp byte [eax], 0
je 0x4039db
inc eax
dec edx
jne 0x4039d0
jmp 0x403a05
test edx, edx
je 0x403a05
mov ecx, 0x104
sub ecx, edx
lea edx, [ebp - 0x5b0]
mov eax, 0x104
push edx
sub eax, ecx
lea ecx, [ebp + ecx - 0x110]
mov edx, 0x7fffffff
call fcn.00401000
lea eax, [ebp - 0x6f0]
push eax
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x403a8e
mov edx, 0x104
lea eax, [ebp - 0x530]
jmp 0x403a30
cmp byte [eax], 0
je 0x403a3b
inc eax
dec edx
jne 0x403a30
jmp 0x403a65
test edx, edx
je 0x403a65
mov ecx, 0x104
sub ecx, edx
lea edx, [ebp - 0x6c4]
mov eax, 0x104
push edx
sub eax, ecx
lea ecx, [ebp + ecx - 0x530]
mov edx, 0x7fffffff
call fcn.00401000
lea eax, [ebp - 0x530]
push eax
mov edx, 0x7ffffffe
mov eax, 0x104
mov ecx, ebx
call fcn.00401000
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x6f4], 1
push ebx
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [ebp - 0x218]
call fcn.00401000
lea ecx, [ebp - 0x218]
push ecx
call edi
cmp eax, 3
jle 0x403b46
lea esi, [ebp - 0x218]
mov edx, esi
push edx
call edi
cmp byte [eax + esi - 1], 0x5c
jne 0x403ad2
mov eax, esi
push eax
call edi
mov byte [eax + esi - 1], 0
call fcn.00404b90
cmp eax, 2
lea ecx, [ebp - 0x218]
mov eax, 0x104
jle 0x403b00
cmp byte [ecx], 0
je 0x403af2
inc ecx
dec eax
jne 0x403ae7
jmp 0x403b33
test eax, eax
je 0x403b33
push str.cookies.sqlite
jmp 0x403b14
cmp byte [ecx], 0
je 0x403b0b
inc ecx
dec eax
jne 0x403b00
jmp 0x403b33
test eax, eax
je 0x403b33
push str.cookies.txt
mov ecx, 0x104
sub ecx, eax
mov eax, 0x104
sub eax, ecx
mov edx, 0x7fffffff
lea ecx, [ebp + ecx - 0x218]
call fcn.00401000
lea ecx, [ebp - 0x218]
call fcn.0047d280
test eax, eax
jne 0x4034ed
cmp dword [ebp - 0x700], 2
jne 0x403d43
push 0x104
lea ecx, [ebp - 0x428]
push str.AppData
push ecx
lea ecx, [ebp - 0x110]
mov edx, 0x80000001
call fcn.0048e050
add esp, 0xc
mov edx, 0x104
lea eax, [ebp - 0x110]
cmp byte [eax], 0
je 0x403b8d
inc eax
dec edx
jne 0x403b82
jmp 0x403bb5
test edx, edx
je 0x403bb5
mov ecx, 0x104
sub ecx, edx
mov eax, 0x104
sub eax, ecx
push str.MozillaProfilesdefault_
lea ecx, [ebp + ecx - 0x110]
mov edx, 0x7fffffff
call fcn.00401000
lea edx, [ebp - 0x110]
push edx
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [ebp - 0x320]
call fcn.00401000
mov edx, 0x104
lea eax, [ebp - 0x110]
lea esp, [esp]
cmp byte [eax], 0
je 0x403beb
inc eax
dec edx
jne 0x403be0
jmp 0x403c13
test edx, edx
je 0x403c13
mov ecx, 0x104
sub ecx, edx
mov eax, 0x104
sub eax, ecx
push 0x4b1b58
lea ecx, [ebp + ecx - 0x110]
mov edx, 0x7fffffff
call fcn.00401000
lea eax, [ebp - 0x6f0]
push eax
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x403c88
push 0x4b17de
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [ebp - 0x320]
call fcn.00401000
lea edx, [ebp - 0x320]
push edx
mov edx, 0x7ffffffe
mov eax, 0x104
mov ecx, ebx
call fcn.00401000
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x6f4], 0
mov eax, dword [ebp - 0x6f4]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
mov eax, esi
test esi, esi
je 0x403d43
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov bl, 0x2e
lea ebx, [ebx]
test byte [ebp - 0x6f0], 0x10
je 0x403cbb
cmp byte [ebp - 0x6c4], bl
jne 0x403cd6
lea eax, [ebp - 0x6f0]
push eax
push esi
call edi
test eax, eax
jne 0x403ca0
mov eax, dword [ebp - 0x6f4]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
mov edx, 0x104
lea eax, [ebp - 0x320]
cmp byte [eax], 0
je 0x403cec
inc eax
dec edx
jne 0x403ce1
jmp 0x403d16
test edx, edx
je 0x403d16
mov ecx, 0x104
sub ecx, edx
lea edx, [ebp - 0x6c4]
mov eax, 0x104
push edx
sub eax, ecx
lea ecx, [ebp + ecx - 0x320]
mov edx, 0x7fffffff
call fcn.00401000
mov ecx, dword [ebp - 0x6f8]
lea eax, [ebp - 0x320]
push eax
mov edx, 0x7ffffffe
mov eax, 0x104
call fcn.00401000
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x6f4], 1
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x6f4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a01d6
mov esp, ebp
pop ebp
ret