Function at 0x100c9830
Capabilities:
Encrypt data using dpapi
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1022f963
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x564
mov eax, dword [0x102db080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x3e0], ecx
mov dword [ebp - 0x344], 0
mov byte [ebp - 0x15], 0
lea ecx, [ebp - 0x44]
call fcn.1007e380
mov dword [ebp - 4], 0
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 0x10]
call fcn.10083220
movzx eax, al
test eax, eax
jne 0x100c989e
cmp dword [ebp + 0xc], 0
jne 0x100c98bf
push 0x10238600
lea ecx, [ebp - 0x3f8]
call fcn.10081ad0
push 0x102ca4c4
lea ecx, [ebp - 0x3f8]
push ecx
call sub.VCRUNTIME140.dll__CxxThrowException
push 0xa8
lea ecx, [ebp - 0x324]
call fcn.1004c4a0
push 1
push 2
lea ecx, [ebp - 0x324]
call fcn.100ca030
mov dword [ebp - 0x3e4], eax
mov byte [ebp - 4], 2
push 0x58
lea ecx, [ebp - 0xb4]
call fcn.1004c4a0
push 0
lea edx, [ebp - 0x2d4]
push edx
lea ecx, [ebp - 0xb4]
call fcn.100ca140
mov dword [ebp - 0x3e8], eax
mov byte [ebp - 4], 3
lea eax, [ebp - 0xa0]
mov dword [ebp - 0x3ac], eax
lea ecx, [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0x3ac]
call fcn.100c8e10
push 0xc
lea ecx, [ebp - 0x2c]
call fcn.1004c4a0
lea ecx, [ebp - 0x2c]
call fcn.10050080
mov byte [ebp - 4], 4
lea edx, [ebp - 0x2c]
push edx
lea ecx, [ebp - 0x324]
call fcn.100cb490
xor eax, eax
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x338], eax
lea ecx, [ebp - 0x2c]
call fcn.100bc690
mov dword [ebp - 0x33c], eax
push 0
lea ecx, [ebp - 0x2c]
call fcn.1004e3e0
mov dword [ebp - 0x338], eax
xor ecx, ecx
mov dword [ebp - 0x334], ecx
mov dword [ebp - 0x330], ecx
push str.694N91M93ikK0QZK2I5PO7Lk229H9QZDZVJBN36780LR2EC99g9TGX20903dQ8UjeKE263KpRGIPAN99iWFMORF993Ho9378YnOMF292LCRmm0HOlJ9QVUT620UE3XJi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov dword [ebp - 0x334], eax
mov dword [ebp - 0x330], str.694N91M93ikK0QZK2I5PO7Lk229H9QZDZVJBN36780LR2EC99g9TGX20903dQ8UjeKE263KpRGIPAN99iWFMORF993Ho9378YnOMF292LCRmm0HOlJ9QVUT620UE3XJi
mov dword [ebp - 0x340], 1
movzx edx, byte [ebp + 0x14]
test edx, edx
je 0x100c99cb
mov eax, dword [ebp - 0x340]
or eax, 4
mov dword [ebp - 0x340], eax
xor ecx, ecx
mov dword [ebp - 0x32c], ecx
mov dword [ebp - 0x328], ecx
lea edx, [ebp - 0x32c]
push edx
mov eax, dword [ebp - 0x340]
push eax
push 0
push 0
lea ecx, [ebp - 0x334]
push ecx
push str.BLOB
lea edx, [ebp - 0x33c]
push edx
call dword [sym.imp.CRYPT32.dll_CryptProtectData]
test eax, eax
jne 0x100c9b1e
push 0x98
lea ecx, [ebp - 0x14c]
call fcn.1004c4a0
push 1
lea ecx, [ebp - 0x14c]
call fcn.100846c0
mov dword [ebp - 0x3ec], eax
mov byte [ebp - 4], 5
push str.CryptProtectData_failed__0x
lea eax, [ebp - 0x14c]
push eax
call fcn.10082bb0
add esp, 8
mov dword [ebp - 0x3b0], eax
mov ecx, dword [ebp - 0x3b0]
mov dword [ebp - 0x3b4], ecx
push 0x100829b0
mov ecx, dword [ebp - 0x3b4]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
mov dword [ebp - 0x3b8], eax
mov edx, dword [ebp - 0x3b8]
mov dword [ebp - 0x3bc], edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x390], eax
mov eax, dword [ebp - 0x390]
push eax
mov ecx, dword [ebp - 0x3bc]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
mov dword [ebp - 0x3c0], eax
push 0x102b1b94
mov ecx, dword [ebp - 0x3c0]
push ecx
call fcn.10082bb0
add esp, 8
lea edx, [ebp - 0x43c]
push edx
lea ecx, [ebp - 0x14c]
call fcn.10082970
mov dword [ebp - 0x3c8], eax
mov eax, dword [ebp - 0x3c8]
mov dword [ebp - 0x3cc], eax
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x3cc]
push ecx
lea ecx, [ebp - 0x404]
call fcn.100831f0
push 0x102ca4c4
lea edx, [ebp - 0x404]
push edx
call sub.VCRUNTIME140.dll__CxxThrowException
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x43c]
call fcn.100895a0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x14c]
call fcn.10082f70
cmp dword [ebp - 0x328], 0
je 0x100c9f18
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x5c]
call fcn.1007e380
mov byte [ebp - 4], 8
push 4
lea ecx, [ebp - 0x1c]
call fcn.1004c4a0
lea eax, [ebp - 0x5c]
push eax
push 0x3e8
push 6
push 2
push 0
push 0
push 0x40000000
mov ecx, dword [ebp + 0x10]
call fcn.1007dd30
push eax
call fcn.100b78b0
add esp, 0x20
mov dword [ebp - 0x3d0], eax
mov ecx, dword [ebp - 0x3d0]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.1004f600
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x1c]
call fcn.1004f770
cmp eax, 0xffffffff
jne 0x100c9cdf
push 0x98
lea ecx, [ebp - 0x1e4]
call fcn.1004c4a0
push 1
lea ecx, [ebp - 0x1e4]
call fcn.100846c0
mov dword [ebp - 0x3d8], eax
mov byte [ebp - 4], 0xa
push str.Failed_to_open__
lea edx, [ebp - 0x1e4]
push edx
call fcn.10082bb0
add esp, 8
mov dword [ebp - 0x3d4], eax
mov eax, dword [ebp - 0x3d4]
mov dword [ebp - 0x354], eax
mov ecx, dword [ebp + 0x10]
call fcn.1007dd30
push eax
lea ecx, [ebp - 0x4f0]
call fcn.10098770
mov dword [ebp - 0x348], eax
mov ecx, dword [ebp - 0x348]
mov dword [ebp - 0x34c], ecx
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x34c]
call fcn.10095e50
mov dword [ebp - 0x350], eax
mov edx, dword [ebp - 0x350]
push edx
mov eax, dword [ebp - 0x354]
push eax
call fcn.10082bb0
add esp, 8
mov dword [ebp - 0x358], eax
push str.__for_writing:
mov ecx, dword [ebp - 0x358]
push ecx
call fcn.10082bb0
add esp, 8
mov dword [ebp - 0x35c], eax
lea edx, [ebp - 0x5c]
push edx
mov eax, dword [ebp - 0x35c]
push eax
call fcn.1004ef30
add esp, 8
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x4f0]
call fcn.1008f410
lea ecx, [ebp - 0x46c]
push ecx
lea ecx, [ebp - 0x1e4]
call fcn.10082970
mov dword [ebp - 0x360], eax
mov edx, dword [ebp - 0x360]
mov dword [ebp - 0x364], edx
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x364]
push eax
lea ecx, [ebp - 0x410]
call fcn.100831f0
push 0x102ca4c4
lea ecx, [ebp - 0x410]
push ecx
call sub.VCRUNTIME140.dll__CxxThrowException
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x46c]
call fcn.100895a0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x1e4]
call fcn.10082f70
mov dword [ebp - 0x20], 0
push 0
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x32c]
push eax
mov ecx, dword [ebp - 0x328]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.1004f770
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x100c9eaf
push 0x98
lea ecx, [ebp - 0x27c]
call fcn.1004c4a0
push 1
lea ecx, [ebp - 0x27c]
call fcn.100846c0
mov dword [ebp - 0x3dc], eax
mov byte [ebp - 4], 0xd
push str.Failed_to_write_config_file__
lea edx, [ebp - 0x27c]
push edx
call fcn.10082bb0
add esp, 8
mov dword [ebp - 0x368], eax
mov eax, dword [ebp - 0x368]
mov dword [ebp - 0x378], eax
mov ecx, dword [ebp + 0x10]
call fcn.1007dd30
push eax
lea ecx, [ebp - 0x574]
call fcn.10098770
mov dword [ebp - 0x36c], eax
mov ecx, dword [ebp - 0x36c]
mov dword [ebp - 0x370], ecx
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x370]
call fcn.10095e50
mov dword [ebp - 0x374], eax
mov edx, dword [ebp - 0x374]
push edx
mov eax, dword [ebp - 0x378]
push eax
call fcn.10082bb0
add esp, 8
mov dword [ebp - 0x37c], eax
push str.___0x
mov ecx, dword [ebp - 0x37c]
push ecx
call fcn.10082bb0
add esp, 8
mov dword [ebp - 0x380], eax
mov edx, dword [ebp - 0x380]
mov dword [ebp - 0x384], edx
push 0x100829b0
mov ecx, dword [ebp - 0x384]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
mov dword [ebp - 0x388], eax
mov eax, dword [ebp - 0x388]
mov dword [ebp - 0x3c4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x38c], eax
mov ecx, dword [ebp - 0x38c]
push ecx
mov ecx, dword [ebp - 0x3c4]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
mov dword [ebp - 0x394], eax
push 0x102b1b94
mov edx, dword [ebp - 0x394]
push edx
call fcn.10082bb0
add esp, 8
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x574]
call fcn.1008f410
lea eax, [ebp - 0x454]
push eax
lea ecx, [ebp - 0x27c]
call fcn.10082970
mov dword [ebp - 0x398], eax
mov ecx, dword [ebp - 0x398]
mov dword [ebp - 0x39c], ecx
mov byte [ebp - 4], 0xf
mov edx, dword [ebp - 0x39c]
push edx
lea ecx, [ebp - 0x41c]
call fcn.100831f0
push 0x102ca4c4
lea eax, [ebp - 0x41c]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x454]
call fcn.100895a0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x27c]
call fcn.10082f70
mov byte [ebp - 0x15], 1
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x1c]
call fcn.1007de30
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x5c]
call fcn.100895a0
jmp 0x100c9efb
mov dword [ebp - 4], 4
jmp 0x100c9f0b
mov edx, dword [ebp - 0x328]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c]
call fcn.10099560
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xb4]
call fcn.1008f720
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x324]
call fcn.100ca2f0
jmp 0x100c9f66
mov dword [ebp - 4], 0
jmp 0x100c9f76
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0x15]
push edx
lea eax, [ebp - 0x424]
push eax
call fcn.1004f0f0
add esp, 0xc
push eax
mov ecx, dword [ebp + 8]
call fcn.1004f110
mov ecx, dword [ebp - 0x344]
or ecx, 1
mov dword [ebp - 0x344], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.100895a0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100b9f43
mov esp, ebp
pop ebp
ret 0x10