Function at 0x410a2b
Capabilities:
Copy file
Delete file
Encrypt data using dpapi
Get common file path
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x5a1c
call fcn.005fec20
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x18]
mov ecx, dword [ebp + 0x10]
mov esi, str._encrypted_key_:
and dword [ebp - 0x59f8], 0
push eax
push ebx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x5a0c], ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x59f4], eax
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x5a10], ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, str.GetChromeEncryptionKey
push esi
push str._s___Entered__pass_path_s__keyfiile_s
call fcn.00449974
push ebx
lea eax, [ebp - 0x400]
push 0x3e8
push eax
call fcn.006311ec
lea eax, [ebp - 0x400]
push 0x5c
push eax
call fcn.006271e0
mov edi, eax
add esp, 0x24
test edi, edi
jne 0x410ad2
push ebx
push esi
push str._s___Invalid_profile_path___s_
call fcn.00449974
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
mov esi, dword [ebp - 0x59f4]
lea eax, [ebp - 0x400]
push esi
push 0x3e8
push eax
mov byte [edi + 1], 0
call fcn.00631246
lea eax, [ebp - 0x400]
push eax
push str.GetChromeEncryptionKey
push str._s___Root_level_browser_key_file_path_is__s
call fcn.00449974
lea eax, [ebp - 0x400]
push eax
call fcn.00449791
add esp, 0x1c
test eax, eax
jne 0x410bac
lea eax, [ebp - 0x400]
push eax
push str.GetChromeEncryptionKey
push str._s___Key_file___s__not_present_in_root_folder...trying_down...
call fcn.00449974
lea eax, [ebp - 0x400]
mov byte [edi], 0
push 0x5c
push eax
call fcn.006271e0
add esp, 0x14
test eax, eax
jne 0x410b59
push ebx
push str.GetChromeEncryptionKey
push str._s___Second_slash_not_found_....Invalid_profile_path___s_
jmp 0x410ab9
push esi
mov byte [eax + 1], 0
mov esi, 0x3e8
lea eax, [ebp - 0x400]
push esi
push eax
call fcn.00631246
lea eax, [ebp - 0x400]
mov ebx, str.GetChromeEncryptionKey
push eax
push ebx
push str._s___Final_browser_key_file_path_is__s
call fcn.00449974
lea eax, [ebp - 0x400]
push eax
call fcn.00449791
add esp, 0x1c
test eax, eax
jne 0x410bb6
lea eax, [ebp - 0x400]
push eax
push ebx
push str._s___Specified_Key_file_does_not_exist___s_
jmp 0x410ab9
mov ebx, str.GetChromeEncryptionKey
mov esi, 0x3e8
lea eax, [ebp - 0xbd0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call fcn.0063d3fc
push eax
push str.tmp_xa_br_keyfile_
lea eax, [ebp - 0xbd0]
push eax
push str._s_s_d
lea eax, [ebp - 0x7e8]
push esi
push eax
call fcn.00445d6d
add esp, 0x18
lea eax, [ebp - 0x7e8]
push 0
push eax
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x410c32
call esi
push eax
lea eax, [ebp - 0x7e8]
push eax
lea eax, [ebp - 0x400]
push eax
push ebx
push str._s:_Failed_to_copy_key_file__s__to_tmp_file__s__Error0x_.8x
call fcn.00449974
add esp, 0x14
lea edi, [ebp - 0x400]
jmp 0x410c4d
lea eax, [ebp - 0x7e8]
push eax
push ebx
push str._s:_Successfully_copied_to_tmp_file__s
call fcn.00449974
add esp, 0xc
lea edi, [ebp - 0x7e8]
xor eax, eax
push eax
push eax
push 3
push eax
push 1
push SysReAllocString
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x410c84
push edi
call esi
push eax
push str.GetChromeEncryptionKey
push str._s___Failed_to_open_key_file__Error0x_.8x___s
call fcn.00449974
add esp, 0x10
jmp 0x410f9e
xor eax, eax
push eax
push eax
push eax
push 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x5a14], eax
test eax, eax
jne 0x410cb7
call esi
push eax
push str.GetChromeEncryptionKey
push str._s___CreateFileMapping_Failed_Error0x_.8x___s
call fcn.00449974
add esp, 0xc
jmp 0x410f9a
xor ecx, ecx
push ecx
push ecx
push ecx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x59f4], eax
test eax, eax
jne 0x410ce9
call esi
push eax
push str.GetChromeEncryptionKey
push str._s___MapViewOfFile_Failed__Error0x_.8x___s
call fcn.00449974
add esp, 0xc
jmp 0x410f8e
push eax
push edi
mov edi, str.GetChromeEncryptionKey
push edi
push str._s___Successfully_mapped_the_file_to_memory__s_at_0x_.8x
call fcn.00449974
add esp, 0x10
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x410d22
call esi
push eax
push edi
push str._s___Failed_to_get_mapped_file_size_Failed___Critical_Error0x_.8x___Terminating_Now_...
call fcn.00449974
add esp, 0xc
jmp 0x410f82
push eax
push eax
push edi
push str._s___Size_of_the_file_is_0x_.8x_Bytes___d_bytes_
call fcn.00449974
and dword [ebp - 0x59f8], 0
push edi
push str._s____Searching_for_first_occurances_of_encrypted_key_string
call fcn.00449974
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x59f4]
call fcn.00627320
mov edi, eax
add esp, 0x20
test edi, edi
jne 0x410d69
lea eax, [ebp - 0x18]
push eax
push str.GetChromeEncryptionKey
push str._s___Failed_to_find__s_value_in_local_state_file___Terminating_Now_...
jmp 0x410d15
push edi
push str.GetChromeEncryptionKey
push str._s____Found_start_of_encrypted_key_at_0x_.8x
call fcn.00449974
lea eax, [ebp - 0x18]
push eax
call fcn.00631510
add edi, eax
push 0x22
push edi
call fcn.006270b0
mov edi, eax
add esp, 0x18
mov dword [ebp - 0x5a04], edi
test edi, edi
jne 0x410dae
lea eax, [ebp - 0x18]
push eax
push str.GetChromeEncryptionKey
push str._s___Invalid_start_of_encryption_key__s____Terminating_Now_...
jmp 0x410d15
push edi
push str.GetChromeEncryptionKey
push str._s____Found_starting_quote_at_address_0x_.8x
call fcn.00449974
lea eax, [edi + 1]
push 0x22
push eax
mov dword [ebp - 0x5a08], eax
call fcn.006270b0
mov edi, eax
add esp, 0x14
test edi, edi
jne 0x410deb
lea eax, [ebp - 0x18]
push eax
push str.GetChromeEncryptionKey
push str._s___Invalid_end_of_encryption_key__s____Terminating_Now_...
jmp 0x410d15
sub edi, dword [ebp - 0x5a04]
dec edi
push edi
push str.GetChromeEncryptionKey
push str._s____Found_encoded_key_length_d
call fcn.00449974
push 0x270f
lea eax, [ebp - 0x32df]
mov byte [ebp - 0x32e0], 0
push 0
push eax
call fcn.00626f50
push edi
push dword [ebp - 0x5a08]
lea eax, [ebp - 0x32e0]
push eax
call fcn.006269d0
add esp, 0x24
cmp edi, 0x2710
jae 0x410fbd
lea eax, [ebp - 0x32e0]
mov byte [ebp + edi - 0x32e0], 0
push eax
push str.GetChromeEncryptionKey
push str._s__Found_the_encrypted_key_value__s
call fcn.00449974
push 0x2710
lea eax, [ebp - 0x59f0]
push eax
lea eax, [ebp - 0x32e0]
push eax
call fcn.00445e29
mov edi, eax
add esp, 0x18
test edi, edi
jne 0x410e93
push str.GetChromeEncryptionKey
push str._s___Base64_decoding_of_key_data_failed
call fcn.00449974
pop ecx
pop ecx
jmp 0x410f82
push edi
push str.GetChromeEncryptionKey
push str._s___Successfully_Base64_decoded_key_data_of_legnth___d_
call fcn.00449974
push str.DPAPI
call fcn.00631510
push eax
lea eax, [ebp - 0x59f0]
push str.DPAPI
push eax
call fcn.0062534d
add esp, 0x1c
test eax, eax
je 0x410eda
push str.DPAPI
push str.GetChromeEncryptionKey
push str._s___Final_key_is_not_matching_the_DPAPI_signature__s
jmp 0x410d15
push str.GetChromeEncryptionKey
push str._s___Successfully_verified_the_decoded_key_signature
call fcn.00449974
push str.DPAPI
call fcn.00631510
lea ecx, [ebp - 0x59f0]
add eax, ecx
push str.DPAPI
mov dword [ebp - 0x5a18], eax
call fcn.00631510
add esp, 0x10
sub edi, eax
mov dword [ebp - 0x5a1c], edi
lea eax, [ebp - 0x5a00]
xor edi, edi
inc edi
push eax
push edi
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x5a1c]
push eax
call sub.CRYPT32.dll_CryptUnprotectData
test eax, eax
jne 0x410f44
call esi
push eax
push str._n_n__CryptUnprotectData_failed_to_decrypt_key__Error__0x_.8x
jmp 0x410e87
push dword [ebp - 0x5a00]
push str._n_n__CryptUnprotectData_Succeeded_with_final_key_size___d
call fcn.00449974
push dword [ebp - 0x5a00]
push dword [ebp - 0x59fc]
push dword [ebp - 0x5a0c]
call fcn.006269d0
mov ecx, dword [ebp - 0x5a10]
add esp, 0x14
mov eax, dword [ebp - 0x5a00]
mov dword [ebp - 0x59f8], edi
mov dword [ecx], eax
push dword [ebp - 0x59f4]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x5a14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x410fa5
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x7e8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0x59f8]
jmp 0x410ac3
call fcn.005fe87a
int3