Function at 0x476842
Capabilities:
Gather firefox profile information

Disassembly:
push 0x850
mov eax, 0x5ce9bb
call fcn.00595e89
mov eax, dword [ebp + 0x10]
mov esi, ecx
mov dword [ebp - 0x830], eax
xor edi, edi
inc edi
mov dword [ebp - 4], edi
call fcn.0047618f
cmp eax, 3
jne 0x476bfe
push ecx
mov ecx, esp
mov dword [ebp - 0x818], esp
push str.cookies.sqlite
call fcn.004015a6
mov byte [ebp - 4], 2
push ecx
lea eax, [ebp + 0xc]
mov ecx, esp
mov dword [ebp - 0x828], esp
push eax
call fcn.004049a2
mov byte [ebp - 4], 3
mov byte [ebp - 4], 1
lea esi, [ebp - 0x82c]
call fcn.0040d17c
mov byte [ebp - 4], 4
add esp, 4
lea eax, [ebp - 0x82c]
mov ecx, esp
mov dword [ebp - 0x818], esp
xor esi, esi
push eax
mov dword [ebp - 0x81c], esi
call fcn.004049a2
mov byte [ebp - 4], 5
mov byte [ebp - 4], 4
call fcn.0040c97a
cmp eax, esi
pop ecx
jne 0x476912
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x82c]
call fcn.00401752
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00401752
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00401752
xor eax, eax
call fcn.00595f0c
ret 0xc
push ecx
mov eax, esp
mov dword [ebp - 0x818], esp
push str.Enumerating_Firefox3_cookies_for
push eax
lea ecx, [ebp + 8]
call fcn.004046a1
pop ecx
pop ecx
mov byte [ebp - 4], 6
push 4
mov byte [ebp - 4], 4
call fcn.0040b216
push esi
lea ecx, [ebp - 0x82c]
call fcn.0040133e
push esi
push edi
lea ecx, [ebp - 0x81c]
push ecx
push eax
call fcn.004acef3
add esp, 0x10
push 0xffffffffffffffff
lea ecx, [ebp - 0x82c]
mov edi, eax
call fcn.00411b03
cmp edi, esi
je 0x4769ff
push str.Cant_open_database:
lea ecx, [ebp - 0x824]
call fcn.004015a6
mov byte [ebp - 4], 7
push dword [ebp - 0x81c]
call fcn.004ac9ee
mov ecx, esp
mov dword [ebp - 0x818], esp
push eax
lea eax, [ebp - 0x824]
push eax
push ecx
call fcn.0040463d
add esp, 0xc
mov byte [ebp - 4], 8
push 1
mov byte [ebp - 4], 7
call fcn.0040b216
push dword [ebp - 0x81c]
call fcn.004ac14e
pop ecx
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x824]
call fcn.00401752
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x82c]
call fcn.00401752
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00401752
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00401752
mov eax, esi
jmp 0x47690a
lea eax, [ebp - 0x818]
push str.select_name__value_from_moz_cookies_where_host_like__
push eax
lea ecx, [ebp + 8]
mov dword [ebp - 0x828], esi
mov dword [ebp - 0x824], esi
mov dword [ebp - 0x834], esi
mov dword [ebp - 0x83c], esi
call fcn.004046a1
mov byte [ebp - 4], 9
push 0x63549c
push eax
lea eax, [ebp - 0x820]
push eax
call fcn.0040463d
add esp, 0x14
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x818]
call fcn.00401752
push esi
lea ecx, [ebp - 0x820]
call fcn.0040133e
lea ecx, [ebp - 0x83c]
push ecx
lea ecx, [ebp - 0x834]
push ecx
lea ecx, [ebp - 0x824]
push ecx
lea ecx, [ebp - 0x828]
push ecx
push eax
push dword [ebp - 0x81c]
call fcn.004a4230
add esp, 0x18
push 0xffffffffffffffff
lea ecx, [ebp - 0x820]
mov edi, eax
call fcn.00411b03
cmp edi, esi
mov ebx, dword [ebp - 0x828]
je 0x476b69
cmp dword [ebp - 0x83c], esi
je 0x476aff
push dword [ebp - 0x83c]
lea ecx, [ebp - 0x818]
call fcn.004015a6
mov byte [ebp - 4], 0xc
push ecx
mov ecx, esp
mov dword [ebp - 0x828], esp
push str.sqlite3_get_table_returned_error:
push ecx
mov ecx, eax
call fcn.004046a1
pop ecx
pop ecx
mov byte [ebp - 4], 0xd
push 1
mov byte [ebp - 4], 0xc
call fcn.0040b216
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x818]
call fcn.00401752
jmp 0x476bdc
lea eax, [ebp - 0x838]
push eax
call fcn.00410e40
mov byte [ebp - 4], 0xe
push edi
lea ecx, [ebp - 0x818]
push ecx
mov ecx, eax
call fcn.004110e6
mov byte [ebp - 4], 0xf
push ecx
mov ecx, esp
mov dword [ebp - 0x828], esp
push str.sqlite3_get_table_returned_error:
push ecx
mov ecx, eax
call fcn.004046a1
pop ecx
pop ecx
mov byte [ebp - 4], 0x10
push 1
mov byte [ebp - 4], 0xf
call fcn.0040b216
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x818]
call fcn.00401752
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x838]
call fcn.00410ee0
jmp 0x476bdc
mov eax, dword [ebp - 0x834]
cmp eax, esi
jle 0x476bd9
cmp dword [ebp - 0x824], esi
jle 0x476bd9
mov edi, eax
imul edi, dword [ebp - 0x824]
cmp eax, edi
mov esi, eax
jg 0x476bd9
mov ecx, dword [ebp - 0x830]
mov eax, dword [ecx]
cmp dword [eax - 0xc], 0
je 0x476ba2
push 0x62097c
call fcn.00409033
push dword [ebx + esi*4]
mov ecx, dword [ebp - 0x830]
call fcn.00409033
mov ecx, dword [ebp - 0x830]
push 0x61b020
call fcn.00409033
push dword [ebx + esi*4 + 4]
mov ecx, dword [ebp - 0x830]
call fcn.00409033
add esi, dword [ebp - 0x834]
cmp esi, edi
jle 0x476b8a
xor esi, esi
inc esi
push ebx
call fcn.004a438b
pop ecx
push dword [ebp - 0x81c]
call fcn.004ac14e
pop ecx
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x820]
jmp 0x4769cc
lea ecx, [esi + 0x10]
mov ebx, 0x61b5f4
push ebx
mov dword [ebp - 0x828], ecx
call fcn.004014d3
push ecx
mov ecx, esp
mov dword [ebp - 0x818], esp
push str.cookies.txt
call fcn.004015a6
mov byte [ebp - 4], 0x11
push ecx
lea eax, [ebp + 0xc]
mov ecx, esp
mov dword [ebp - 0x820], esp
push eax
call fcn.004049a2
mov byte [ebp - 4], 0x12
mov byte [ebp - 4], 1
lea esi, [ebp - 0x834]
call fcn.0040d17c
mov byte [ebp - 4], 0x13
push 0x635508
push dword [ebp - 0x834]
lea eax, [ebp - 0x81c]
xor esi, esi
push eax
mov dword [ebp - 0x81c], esi
call fcn.0058fd6d
add esp, 0x14
cmp dword [ebp - 0x81c], esi
jne 0x476c8b
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x834]
jmp 0x4769db
push ecx
mov eax, esp
mov dword [ebp - 0x818], esp
push str.Enumerating_Firefox_cookies_for
push eax
lea ecx, [ebp + 8]
call fcn.004046a1
pop ecx
pop ecx
mov byte [ebp - 4], 0x14
push 4
mov byte [ebp - 4], 0x13
call fcn.0040b216
jmp 0x476e55
mov esi, dword [ebp - 0x81c]
xor edi, edi
and dword [ebp - 0x820], edi
jmp 0x476ced
push esi
call fcn.005aa072
cmp al, 0xa
pop ecx
je 0x476cf8
cmp dword [ebp - 0x820], 0x7ff
jge 0x476ce7
mov byte [ebp + edi - 0x814], al
inc edi
inc dword [ebp - 0x820]
push esi
call fcn.00595f2a
test eax, eax
pop ecx
je 0x476cc8
mov byte [ebp + edi - 0x814], 0
cmp byte [ebp - 0x814], 0
je 0x476e55
cmp byte [ebp - 0x814], 0x23
je 0x476e55
lea eax, [ebp - 0x85c]
push eax
call fcn.00476e8c
mov byte [ebp - 4], 0x15
push ebx
lea ecx, [ebp - 0x85c]
call fcn.004014d3
push ecx
lea eax, [ebp - 0x814]
mov ecx, esp
mov dword [ebp - 0x820], esp
push eax
lea edi, [ebp - 0x85c]
call fcn.004015a6
mov byte [ebp - 4], 0x16
mov byte [ebp - 4], 0x15
mov ecx, edi
call fcn.00476f1d
cmp eax, 1
push dword [ebp + 8]
push dword [ebp - 0x85c]
jne 0x476dfd
call fcn.0058d09d
test eax, eax
pop ecx
pop ecx
jne 0x476e45
mov edi, dword [ebp - 0x830]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x476d9b
push 0x62097c
mov ecx, edi
call fcn.00409033
push 0x61b020
lea eax, [ebp - 0x844]
push eax
lea eax, [ebp - 0x824]
push eax
call fcn.0040463d
add esp, 0xc
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x840]
push ecx
push eax
lea eax, [ebp - 0x818]
push eax
call fcn.004045e6
add esp, 0xc
mov byte [ebp - 4], 0x18
push eax
mov ecx, edi
call fcn.004047d6
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x818]
call fcn.00401752
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x824]
call fcn.00401752
jmp 0x476e45
call fcn.0058d09d
test eax, eax
pop ecx
pop ecx
jne 0x476e45
mov ecx, dword [ebp - 0x828]
lea eax, [ebp - 0x840]
push eax
call fcn.004048fa
push ecx
mov ecx, dword [ebp - 0x828]
mov eax, esp
mov dword [ebp - 0x820], esp
push str.Found_partial_cookie_in_Firefox_profile:
push eax
call fcn.004046a1
pop ecx
pop ecx
mov byte [ebp - 4], 0x19
push 4
mov byte [ebp - 4], 0x15
call fcn.0040b216
mov byte [ebp - 4], 0x13
lea eax, [ebp - 0x85c]
push eax
call fcn.00476ed4
push dword [ebp - 0x81c]
call fcn.00595f2a
test eax, eax
pop ecx
je 0x476cb8
push dword [ebp - 0x81c]
call fcn.005900a3
pop ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x834]
call fcn.00401752
xor esi, esi
inc esi
jmp 0x4769e0