Function at 0x41e894
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x658
movzx eax, byte [0x43eec9]
mov byte [esp + 0x548], al
lea eax, [esp + 0x549]
push 0x103
push 0
push eax
call sub.msvcrt.dll_memset
mov dword [esp + 0x2c], 0x104
mov eax, dword [str.MozillaFirefox]
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x544], eax
mov eax, dword [0x43ff13]
mov dword [esp + 0x548], eax
mov eax, dword [0x43ff17]
mov dword [esp + 0x54c], eax
mov eax, dword [0x43ff1b]
mov dword [esp + 0x550], eax
lea eax, [esp + 0x30]
push eax
push 8
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.ADVAPI32.DLL_OpenProcessToken
add esp, 0xc
xor edx, edx
test eax, eax
je 0x41eb1b
push str.Userenv
call sub.KERNEL32.dll_LoadLibraryA
push str.GetUserProfileDirectoryA
push eax
call sub.KERNEL32.dll_GetProcAddress
lea edx, [esp + 0x20]
push edx
lea edx, [esp + 0x54c]
push edx
push dword [esp + 0x2c]
call eax
xor edx, edx
test eax, eax
je 0x41eb1b
push str.APPDATA
lea ebx, [esp + 0x42c]
call sub.msvcrt.dll_getenv
mov dword [esp], eax
push ebx
call sub.msvcrt.dll_strcpy
push 0x43fec9
push ebx
call sub.msvcrt.dll_strcat
lea eax, [esp + 0x548]
push eax
push ebx
call sub.msvcrt.dll_strcat
push str.profiles.ini
push ebx
call sub.msvcrt.dll_strcat
add esp, 0x20
push 0x43fecb
push ebx
call sub.msvcrt.dll_fopen
pop ecx
xor edx, edx
test eax, eax
mov ebp, eax
pop ebx
je 0x41eb1b
jmp 0x41eaf5
cld
or ecx, 0xffffffff
xor eax, eax
mov edi, esi
xor ebx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ebx, ecx
jge 0x41e9e0
movzx edx, byte [esi + ebx]
mov al, dl
sub al, 0x41
cmp al, 0x19
ja 0x41e9dd
add dl, 0x20
mov byte [esi + ebx], dl
inc ebx
jmp 0x41e9c7
cmp dword [esp + 0x18], 0
lea ebx, [esp + 0x28]
jne 0x41ea0d
push str.namedefault
push ebx
call sub.msvcrt.dll_strstr
pop edi
test eax, eax
pop edx
je 0x41eaf5
mov dword [esp + 0x18], 1
jmp 0x41eaf5
push str.path
push ebx
call sub.msvcrt.dll_strstr
pop ecx
test eax, eax
pop esi
je 0x41eaf5
push 0x2f
push ebx
call sub.msvcrt.dll_strchr
pop edi
test eax, eax
pop edx
je 0x41ea33
mov byte [eax], 0x5c
cld
xor eax, eax
or ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
mov byte [esp + ecx + 0x26], 0
push 0x3d
push ebx
call sub.msvcrt.dll_strchr
pop ebx
xor ecx, ecx
cmp byte [eax], 0
pop esi
mov esi, eax
je 0x41ea76
movzx eax, byte [esi + ecx]
cmp al, 0xd
sete dl
cmp al, 0xa
sete al
or eax, edx
test al, 1
je 0x41ea6f
mov byte [esi + ecx], 0
inc ecx
cmp byte [esi + ecx], 0
jmp 0x41ea55
push str.APPDATA
or ebx, 0xffffffff
call sub.msvcrt.dll_getenv
mov dword [esp + 0x10], eax
cld
mov edi, dword [esp + 0x10]
xor eax, eax
mov ecx, ebx
repne scasb al, byte es:[edi]
mov edx, ecx
lea edi, [esp + 0x53c]
mov ecx, ebx
repne scasb al, byte es:[edi]
not ecx
mov edi, esi
not edx
mov dword [esp + 4], ecx
mov ecx, ebx
repne scasb al, byte es:[edi]
sub dword [esp + 4], ecx
mov eax, dword [esp + 4]
lea ecx, [eax + edx + 8]
push ecx
call sub.msvcrt.dll_malloc
mov dword [esp + 0x24], eax
pop edx
test eax, eax
pop ecx
je 0x41eb10
lea eax, [esi + 1]
push eax
lea ecx, [esp + 0x53c]
push ecx
push str.APPDATA
call sub.msvcrt.dll_getenv
mov dword [esp], eax
push str._s_s_s_
push dword [esp + 0x2c]
call sub.msvcrt.dll_sprintf
add esp, 0x14
jmp 0x41eb10
push ebp
push 0x400
lea esi, [esp + 0x30]
push esi
call sub.msvcrt.dll_fgets
add esp, 0xc
test eax, eax
jne 0x41e9b8
push ebp
call sub.msvcrt.dll_fclose
mov edx, dword [esp + 0x20]
pop eax
add esp, 0x658
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret