Function at 0x439e23
Capabilities:
Encrypt data using dpapi
Get session user name
Terminate process

Disassembly:
push 0x4b4
mov eax, 0x4cccde
call fcn.004cbf72
mov esi, ecx
mov dword [ebp - 0x380], esi
mov dword [ebp - 0x370], esi
mov dword [ebp - 0x370], esi
xor ecx, ecx
mov dword [ebp - 4], ecx
lea edi, [ebp - 0x25c]
xor eax, eax
stosd dword es:[edi], eax
push 7
pop ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x24c], ecx
mov dword [ebp - 0x248], ebx
mov word [ebp - 0x25c], ax
lea eax, [ebp - 0x22c]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x22c], 0x101
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov edi, 0x104
lea eax, [ebp - 0x118]
push edi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
cmp dword [ebp + 0x1c], 0xf
lea ecx, [ebp - 0x21c]
push ecx
lea eax, [ebp + 8]
cmova eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x118]
push edi
push eax
call fcn.00435356
mov byte [ebp - 0x370], 0
lea edx, [ebp - 0x118]
push dword [ebp - 0x370]
lea ecx, [ebp - 0x244]
call fcn.0044649e
add esp, 0x20
lea eax, [ebp - 0x244]
lea ecx, [ebp - 0x25c]
push eax
call fcn.0043833b
lea ecx, [ebp - 0x244]
call fcn.0043d537
mov byte [ebp - 0x370], 0
lea ecx, [ebp - 0x244]
push dword [ebp - 0x370]
call fcn.004464d3
pop ecx
lea eax, [ebp - 0x3a0]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x25c]
call fcn.00437b56
lea ecx, [ebp - 0x274]
mov byte [ebp - 4], 3
push ecx
mov ecx, eax
call fcn.00437b56
lea ecx, [ebp - 0x2a4]
mov byte [ebp - 4], 4
push ecx
mov ecx, eax
call fcn.00437b56
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 5
push ecx
mov edx, eax
lea ecx, [ebp - 0x28c]
call fcn.00437c09
pop ecx
lea ecx, [ebp - 0x2a4]
call fcn.0043d537
lea ecx, [ebp - 0x274]
call fcn.0043d537
lea ecx, [ebp - 0x3a0]
call fcn.0043d537
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 0xa
call fcn.0043d537
push 0xb8
lea eax, [ebp - 0x35c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
cmp dword [ebp - 0x278], ebx
lea eax, [ebp - 0x28c]
lea ecx, [ebp - 0x35c]
cmova eax, dword [ebp - 0x28c]
push eax
call fcn.00444911
mov eax, dword [ebp - 0x35c]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0x35c], 0x42c970
mov eax, dword [ebp - 0x35c]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0x360], eax
mov byte [ebp - 4], 0xb
cmp dword [ebp - 0x300], 0
jne 0x43a037
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, 0x4211f8
call fcn.00442580
lea edx, [ebp - 0x28c]
mov ecx, eax
call fcn.00442809
push 0x442711
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
xor eax, eax
mov dword [ebp - 0x4c0], 0x429c9c
lea edi, [ebp - 0x26c]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x488]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0043d402
mov eax, dword [ebp - 0x4c0]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0x4c0], 0x42c978
lea eax, [ebp - 0x4b0]
mov byte [ebp - 0x4b8], 0
mov dword [ebp - 0x4b0], 0x429cd0
mov dword [ebp - 0x48c], eax
lea eax, [ebp - 0x4c0]
mov byte [ebp - 4], 0xd
push eax
lea edx, [ebp - 0x35c]
lea ecx, [ebp - 0x26c]
call fcn.0043b444
pop ecx
lea ecx, [ebp - 0x4b0]
mov byte [ebp - 4], 0xf
call fcn.0043bb71
lea ecx, [ebp - 0x488]
call fcn.00439775
lea eax, [ebp - 0x374]
mov dword [ebp - 0x374], 0x421208
push eax
lea eax, [ebp - 0x394]
mov dword [ebp - 0x370], 8
push eax
lea ecx, [ebp - 0x26c]
call fcn.0043b3a5
mov ecx, eax
mov dword [ebp - 0x374], 0x421214
mov dword [ebp - 0x378], ecx
mov dword [ebp - 0x370], 0xd
lea eax, [ecx + 4]
mov ecx, dword [ecx]
push eax
call fcn.00445448
lea ecx, [ebp - 0x374]
push ecx
mov ecx, eax
call fcn.00445448
lea ecx, [ebp - 0x379]
push ecx
lea ecx, [ebp - 0x2a4]
push ecx
mov ecx, eax
call fcn.0044bea3
mov byte [ebp - 4], 0x10
lea edi, [ebp - 0x228]
xor eax, eax
lea edx, [ebp - 0x2a4]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x228]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0043858a
mov ebx, dword [ebp - 0x228]
lea eax, [ebx + 5]
cmp ebx, eax
je 0x43a18e
mov esi, dword [ebp - 0x224]
sub esi, eax
push esi
push eax
push ebx
call sub.VCRUNTIME140.dll_memmove
lea ecx, [esi + ebx]
add esp, 0xc
mov ebx, dword [ebp - 0x228]
mov esi, dword [ebp - 0x380]
mov dword [ebp - 0x224], ecx
jmp 0x43a194
mov ecx, dword [ebp - 0x224]
xor eax, eax
lea edi, [ebp - 0x244]
stosd dword es:[edi], eax
xor edx, edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x234], edx
mov dword [ebp - 0x230], 0xf
mov byte [ebp - 0x244], dl
lea eax, [ebp - 0x36c]
mov byte [ebp - 4], 0x12
push eax
push edx
push edx
push edx
push edx
push edx
lea eax, [ebp - 0x364]
mov dword [ebp - 0x360], ebx
sub ecx, ebx
push eax
mov dword [ebp - 0x364], ecx
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
jne 0x43a1fc
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, 0x421224
call fcn.00442580
jmp 0x43a022
push dword [ebp - 0x36c]
xor eax, eax
mov edi, esi
push dword [ebp - 0x368]
mov ecx, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
and dword [esi + 0x10], 0
and dword [esi + 0x14], 0
call fcn.004384e4
lea ecx, [ebp - 0x228]
call fcn.0043bc45
lea ecx, [ebp - 0x2a4]
call fcn.0043d60d
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], 0x13
call fcn.0043d4e7
lea ecx, [ebp - 0x2ec]
call fcn.0043b247
lea ecx, [ebp - 0x2ec]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
lea ecx, [ebp - 0x28c]
call fcn.0043d537
lea ecx, [ebp - 0x25c]
call fcn.0043d537
lea ecx, [ebp + 8]
call fcn.0043d60d
mov eax, esi
call fcn.004cbec4
ret