Function at 0x40d4ca
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2ba4
call fcn.005fec20
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push edi
mov edi, dword [ebp + 0xc]
push 0x10
pop ebx
push ebx
push eax
lea eax, [ebp - 0x47c]
mov dword [ebp - 0x14], 0xf8a8ac1d
push eax
mov dword [ebp - 0x10], 0x3e48b8d3
mov dword [ebp - 0xc], 0xa3e7d48
mov dword [ebp - 8], 0x26dd0762
mov dword [ebp - 0x24], 0x38167e6
mov dword [ebp - 0x20], 0xa513b2e7
mov dword [ebp - 0x1c], 0x4fee79b0
mov dword [ebp - 0x18], 0xed15410f
mov dword [ebp - 0x34], 0xe58c147b
mov dword [ebp - 0x30], 0xc10d464b
mov dword [ebp - 0x2c], 0xe7d6fe8e
mov dword [ebp - 0x28], 0x8b067527
mov dword [ebp - 0x44], 0xfdc0049
mov dword [ebp - 0x40], 0xfd9ea030
mov dword [ebp - 0x3c], 0xc8f18509
mov dword [ebp - 0x38], 0x8c175aa
mov dword [ebp - 0x54], 0xe2017905
mov dword [ebp - 0x50], 0x80afd897
mov dword [ebp - 0x4c], 0x710b6038
mov dword [ebp - 0x48], 0x7753680e
mov dword [ebp - 0x64], 0xf6610f2f
mov dword [ebp - 0x60], 0x5c8f8e1d
mov dword [ebp - 0x5c], 0x74213db2
mov dword [ebp - 0x58], 0x6b54b40
mov dword [ebp - 0x74], 0xbd7aab6e
mov dword [ebp - 0x70], 0x327ea98b
mov dword [ebp - 0x6c], 0x24066e8f
mov dword [ebp - 0x68], 0xa5a429d9
mov dword [ebp - 0x84], 0xfd2326be
mov dword [ebp - 0x80], 0xf4cf1ee
mov dword [ebp - 0x7c], 0xfb585e74
mov dword [ebp - 0x78], 0x91ef7491
mov dword [ebp - 0x94], 0x2e6d6f63
mov dword [ebp - 0x90], 0x6c707061
mov dword [ebp - 0x8c], 0x61532e65
mov dword [ebp - 0x88], 0x69726166
call fcn.006269d0
push ebx
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x46c]
push eax
call fcn.006269d0
push ebx
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x45c]
push eax
call fcn.006269d0
push ebx
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x44c]
push eax
call fcn.006269d0
push ebx
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x43c]
push eax
call fcn.006269d0
push ebx
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x42c]
push eax
call fcn.006269d0
add esp, 0x48
push ebx
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x41c]
push eax
call fcn.006269d0
push ebx
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x40c]
push eax
call fcn.006269d0
push ebx
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x3fc]
push eax
call fcn.006269d0
add esp, 0x24
push esi
push esi
call fcn.00631510
pop ecx
push eax
mov ebx, str.DecryptSafariPassword
push ebx
push str._s___Decoding_base64_of_input_data___d_____s
call fcn.00449974
push 0x2710
lea eax, [ebp - 0x2b8c]
push eax
push esi
call fcn.00445e29
mov esi, eax
add esp, 0x1c
test esi, esi
jne 0x40d6ef
push ebx
push str._s___Base64_decoding_of_input_data_failed
call fcn.00449974
pop ecx
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
push esi
push ebx
push str._s___base64_decoded_data_length__is____d_
call fcn.00449974
lea eax, [ebp - 0x2b8c]
mov dword [ebp - 0x2b9c], esi
mov dword [ebp - 0x2b98], eax
lea eax, [ebp - 0x47c]
mov dword [ebp - 0x2b90], eax
mov eax, 0x90
push esi
push eax
push str._n_Decrypting_the_salt___d_and_buffer___d
mov dword [ebp - 0x2b94], eax
call fcn.00449974
mov eax, dword [0x715f88]
add esp, 0x18
test eax, eax
je 0x40d6de
lea ecx, [ebp - 0x2ba4]
xor ebx, ebx
push ecx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x2b94]
push ecx
push ebx
lea ecx, [ebp - 0x2b9c]
push ecx
call eax
test eax, eax
jne 0x40d77b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DecryptSafariPassword
push str._s___CryptUnprotectData_failed_with_error__0x_.8x
call fcn.00449974
add esp, 0xc
jmp 0x40d6de
push dword [ebp - 0x2ba4]
push str.CryptUnprotectData_Succeeded__decrypted_data_length___d
call fcn.00449974
mov eax, dword [ebp - 0x2ba0]
movzx esi, byte [eax]
add eax, 4
push esi
push eax
push edi
call fcn.006269d0
push edi
push esi
push str._n_Decrypted_Password__d____s
mov byte [edi + esi], bl
call fcn.00449974
xor eax, eax
add esp, 0x20
inc eax
jmp 0x40d6e0