Function at 0x180002810
Capabilities:
Encrypt data using dpapi

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xe8
mov rax, qword [0x180013070]
xor rax, rsp
mov qword [rbp - 0x11], rax
mov rax, qword [rbp + 0x77]
xor ebx, ebx
mov r12, qword [rbp + 0x7f]
xorps xmm0, xmm0
mov r14, qword [rbp + 0x87]
mov rdi, rdx
mov r15, qword [rbp + 0x8f]
mov r13, rcx
mov qword [rsp + 0x48], rax
lea rcx, [rbp - 0x51]
mov qword [rsp + 0x50], r8
xor eax, eax
lea r8d, [rbx + 0x40]
mov qword [rsp + 0x58], r9
xor edx, edx
mov qword [rsp + 0x40], rbx
mov esi, ebx
mov qword [rbp - 0x61], rax
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rbp - 0x71], xmm0
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
test r12, r12
je 0x180002895
mov qword [r12], rbx
test r14, r14
je 0x18000289d
mov dword [r14], ebx
test r15, r15
je 0x1800028a5
mov qword [r15], rbx
cmp dword [r13], 2
je 0x1800028c2
lea rcx, str.NetpCreateProvisioningPackage:_unsupported_NETSETUP_PROVISIONING_PARAMS.dwVersion_value._n
call fcn.180008608
mov ebx, 0x57
jmp 0x180002987
lea rdx, [rsp + 0x40]
mov ecx, 1
call fcn.180002a50
mov rsi, qword [rsp + 0x40]
mov ebx, eax
test eax, eax
jne 0x180002987
mov rax, qword [rsp + 0x50]
mov qword [rbp - 0x79], rax
mov rax, qword [rsp + 0x58]
mov qword [rbp - 0x71], rax
mov eax, dword [rbp + 0x6f]
mov dword [rbp - 0x69], eax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x60], rdi
mov rdi, qword [0x1800137a8]
mov qword [rbp - 0x61], rax
jmp 0x18000295d
call fcn.1800023f0
test eax, eax
jne 0x180002932
mov rax, qword [rdi + 0x10]
cmp rax, qword [0x18000ce50]
jne 0x180002932
mov rax, qword [rdi + 0x18]
cmp rax, qword [0x18000ce58]
je 0x18000295a
lea rax, [rbp - 0x51]
mov r9, r13
mov qword [rsp + 0x28], rax
lea r8, [rdi + 0x10]
lea rax, [rsp + 0x60]
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.180002b54
mov ebx, eax
test eax, eax
jne 0x180002987
mov rdi, qword [rdi]
lea rax, [0x1800137a8]
cmp rdi, rax
jne 0x18000290f
mov qword [rsp + 0x38], r15
mov edx, 1
mov qword [rsp + 0x30], r14
mov rcx, rsi
mov qword [rsp + 0x28], r12
call fcn.180002cd0
mov ebx, eax
mov rcx, qword [rbp - 0x51]
test rcx, rcx
je 0x18000299c
call qword [sym.imp.netutils.dll_NetApiBufferFree]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x1800029b1
call qword [sym.imp.netutils.dll_NetApiBufferFree]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x1800029e7
mov edx, dword [rbp - 0x41]
xor r8d, r8d
call qword [sym.imp.CRYPT32.dll_CryptUnprotectMemory]
nop dword [rax + rax]
mov ecx, dword [rbp - 0x41]
xor eax, eax
mov rdi, qword [rbp - 0x49]
rep stosb byte [rdi], al
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.netutils.dll_NetApiBufferFree]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x1800029fc
call qword [sym.imp.netutils.dll_NetApiBufferFree]
nop dword [rax + rax]
test rsi, rsi
je 0x180002a27
lea r9, [rsp + 0x48]
mov r8b, 1
mov edx, 1
mov rcx, rsi
call fcn.180002f4c
test eax, eax
jne 0x180002a27
mov rcx, qword [rsp + 0x48]
lea edx, [rax + 1]
call fcn.180003014
mov eax, ebx
mov rcx, qword [rbp - 0x11]
xor rcx, rsp
call fcn.180009470
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret