Function at 0x10018487
Capabilities:
Encrypt data using dpapi
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x60ac
call fcn.10025b70
push esi
push edi
lea eax, [ebp - 0x4e24]
push eax
call fcn.10018011
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 0x4e2c], str.SoftwareMicrosoftInternet_ExplorerIntelliFormsStorage2
lea ecx, [ebp - 0x4e28]
push ecx
push 1
push 0
mov edx, dword [ebp - 0x4e2c]
push edx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10018767
mov dword [ebp - 0x4e30], 0
jmp 0x100184f2
mov eax, dword [ebp - 0x4e30]
add eax, 1
mov dword [ebp - 0x4e30], eax
mov dword [ebp - 0x4e34], 0x400
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x4e34]
push ecx
lea edx, [ebp - 0x5638]
push edx
mov eax, dword [ebp - 0x4e30]
push eax
mov ecx, dword [ebp - 0x4e28]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x10018532
jmp 0x1001875a
mov dword [ebp - 0x4e38], 0
jmp 0x1001854d
mov edx, dword [ebp - 0x4e38]
add edx, 1
mov dword [ebp - 0x4e38], edx
mov eax, dword [ebp - 0x4e38]
cmp eax, dword [ebp - 4]
jge 0x10018755
lea ecx, [ebp - 0x5e38]
push ecx
mov edx, dword [ebp - 0x4e38]
mov eax, dword [ebp + edx*4 - 0x4e24]
push eax
call fcn.10018134
add esp, 8
lea ecx, [ebp - 0x5e38]
push ecx
lea edx, [ebp - 0x5638]
push edx
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
test eax, eax
jne 0x10018750
mov eax, dword [ebp - 0x4e38]
mov ecx, dword [ebp + eax*4 - 0x4e24]
push ecx
call fcn.1001c3b8
add esp, 4
mov dword [ebp - 0x5e3c], eax
mov byte [ebp - 0x6088], 0
mov ecx, 0x8f
xor eax, eax
lea edi, [ebp - 0x6087]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x1008cab4
lea edx, [ebp - 0x6088]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x5e3c]
push eax
lea ecx, [ebp - 0x5f68]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x5e3c]
mov dword [ebp - 0x60a4], edx
mov eax, dword [ebp - 0x60a4]
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
lea ecx, [ebp - 0x5e48]
push ecx
push 0
lea edx, [ebp - 0x5e44]
push edx
push 0
lea eax, [ebp - 0x5638]
push eax
mov ecx, dword [ebp - 0x4e28]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x5e48]
push edx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x60a8], eax
mov eax, dword [ebp - 0x60a8]
mov dword [ebp - 0x5e40], eax
lea ecx, [ebp - 0x5e48]
push ecx
mov edx, dword [ebp - 0x5e40]
push edx
lea eax, [ebp - 0x5e44]
push eax
push 0
lea ecx, [ebp - 0x5638]
push ecx
mov edx, dword [ebp - 0x4e28]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1001874e
mov eax, dword [ebp - 0x5e40]
mov dword [ebp - 0x608c], eax
mov ecx, dword [ebp - 0x5e48]
mov dword [ebp - 0x6090], ecx
mov edx, dword [ebp - 0x4e38]
mov eax, dword [ebp + edx*4 - 0x4e24]
mov dword [ebp - 0x6094], eax
mov ecx, dword [ebp - 0x4e38]
mov edx, dword [ebp + ecx*4 - 0x4e24]
push edx
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
lea eax, [eax + eax + 2]
mov dword [ebp - 0x6098], eax
lea ecx, [ebp - 0x60a0]
push ecx
push 1
push 0
push 0
lea edx, [ebp - 0x6098]
push edx
push 0
lea eax, [ebp - 0x6090]
push eax
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x10018733
sub esp, 0x240
mov ecx, 0x90
lea esi, [ebp - 0x6088]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x609c]
push ecx
call fcn.100182b0
add esp, 0x244
mov edx, dword [ebp - 0x609c]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x5e40]
mov dword [ebp - 0x60ac], eax
mov ecx, dword [ebp - 0x60ac]
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
jmp 0x10018755
jmp 0x1001853e
jmp 0x100184e3
mov edx, dword [ebp - 0x4e28]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret