Function at 0x1800171b4
Capabilities:
Check if file exists
Enumerate files on windows
Get common file path
Terminate process

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x930
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov rax, qword [0x18010e350]
xor rax, rsp
mov qword [rsp + 0x920], rax
and word [rsp + 0x300], 0
xor edx, edx
mov r8d, 0x618
lea rcx, [r11 - 0x636]
call fcn.180086e90
and qword [rsp + 0x60], 0
and qword [rsp + 0x68], 0
and qword [rsp + 0x70], 0
and qword [rsp + 0x78], 0
mov r9b, 1
mov r8d, 0x410
lea rdx, str.D00904B0_A9E9_434a_AD26_BB6BBF49849A
lea rcx, [rsp + 0x80]
call fcn.180024380
nop
lea rcx, [rsp + 0x60]
call fcn.1800082f0
nop
lea rcx, [rsp + 0x60]
call fcn.18000752c
mov rdi, rax
test rax, rax
je 0x1800172b4
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x180017288
lea rax, [rsp + 0x300]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
jmp 0x1800172a9
lea rax, [rsp + 0x300]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800172d5
lea rax, [rsp + 0x300]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ebx, eax
test ebx, ebx
js 0x180017597
lea rdx, str.Mozilla
lea rcx, [rsp + 0x300]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov edi, 0x80070000
test eax, eax
jne 0x18001730b
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, edi
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x180017597
lea rdx, str.Firefox
lea rcx, [rsp + 0x300]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
jne 0x18001733c
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, edi
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x180017597
lea rdx, str.Profiles
lea rcx, [rsp + 0x300]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
jne 0x18001736d
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, edi
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x180017597
lea rcx, [rsp + 0x300]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180017397
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, edi
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x180017597
lea rcx, [0x18010e058]
mov rax, qword [0x18010e058]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea r8, [rsp + 0x300]
lea rdx, str._s.default
lea rcx, [rsp + 0x40]
call fcn.18000acf4
and dword [rsp + 0xb0], 0
xor edx, edx
mov r8d, 0x24c
lea rcx, [rsp + 0xb4]
call fcn.180086e90
lea rdx, [rsp + 0xb0]
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
or rbp, 0xffffffffffffffff
cmp rax, rbp
jne 0x18001741c
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18001757c
test byte [rsp + 0xb0], 0x10
je 0x18001754d
lea rcx, [0x18010e058]
mov rax, qword [0x18010e058]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0xdc]
lea r8, [rsp + 0x300]
lea rdx, str._s_sprefs.js
lea rcx, [rsp + 0x30]
call fcn.18000acf4
mov rcx, qword [rsp + 0x30]
call fcn.180013c18
mov ebx, eax
lea rcx, [0x18010e058]
mov rdx, qword [0x18010e058]
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0xdc]
lea r8, [rsp + 0x300]
lea rdx, str._s_sextensions.json
lea rcx, [rsp + 0x38]
call fcn.18000acf4
lea rdx, str.websecurity_ati.org
lea rcx, [rsp + 0x48]
call fcn.18000b7f4
nop
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
call fcn.1800156b8
cmp ebx, 0x800705bb
je 0x1800174dc
cmp eax, 0x800705bb
jne 0x1800174ee
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, ebp
test eax, eax
jg 0x18001750e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, ebp
test eax, eax
jg 0x18001752e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, ebp
test eax, eax
jg 0x18001754d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, [rsp + 0xb0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x18001756e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rdi, rbp
cmp rdi, rbp
jne 0x18001741c
mov rbx, qword [rsp + 0x40]
lea rdx, [rbx - 0x18]
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, ebp
test eax, eax
jg 0x180017597
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.180006f3c
lea rcx, [rsp + 0x80]
call fcn.180021010
mov rcx, qword [rsp + 0x920]
xor rcx, rsp
call fcn.180086e60
lea r11, [rsp + 0x930]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret