Function at 0x140146960
Capabilities:
Encrypt data using dpapi
Get token membership

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xd0
mov rax, qword [0x14041d440]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r12, r8
mov r15, rdx
mov r14, rcx
mov qword [rbp - 0x11], rdx
mov qword [rbp - 9], r8
mov rax, qword [r8]
mov qword [rbp - 0x29], rax
xor ebx, ebx
mov edx, ebx
movzx ecx, byte [rax]
inc rax
test cl, cl
jns 0x1401469d3
movzx ecx, byte [rax]
and cl, 0xc0
cmp cl, 0x80
jne 0x1401469d7
nop word [rax + rax]
inc rax
movzx ecx, byte [rax]
and cl, 0xc0
cmp cl, 0x80
je 0x1401469c0
inc rdx
jmp 0x1401469a1
test ecx, ecx
je 0x1401469dc
inc rdx
jmp 0x1401469a1
lea eax, [rdx + 1]
mov dword [rbp - 0x31], eax
mov dword [rbp - 1], ebx
mov word [rbp + 3], 0x500
lea rax, [rbp - 0x41]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
mov r9d, 0x220
mov r8d, 0x20
mov dl, 2
lea rcx, [rbp - 1]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [rbp - 0x49], eax
test eax, eax
je 0x140146a5a
lea r8, [rbp - 0x49]
mov rdx, qword [rbp - 0x41]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov ecx, dword [rbp - 0x49]
test eax, eax
cmove ecx, ebx
mov dword [rbp - 0x49], ecx
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rbp - 0x49], ebx
mov eax, 4
jne 0x140146a5c
mov eax, ebx
lea rcx, [rbp - 0x21]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x31]
call qword [sym.imp.CRYPT32.dll_CryptProtectData]
mov esi, 0xffffffff
test eax, eax
je 0x140146b1e
mov r8d, dword [rbp - 0x21]
mov rdx, qword [rbp - 0x19]
lea rcx, [rbp - 0x39]
call fcn.14017da60
nop
lea rax, [0x140393cd0]
mov qword [rbp + 7], rax
mov rax, qword [rbp - 0x39]
mov qword [rbp + 0xf], rax
mov ecx, dword [rax - 0x10]
nop
test ecx, 0x30000000
jne 0x140146ac2
lock inc dword [rax - 0x10]
lea r8, [rbp + 7]
mov rdx, qword [r15]
mov rcx, qword [r14 + 0x168]
call fcn.14017d370
nop
mov rax, qword [rbp + 7]
mov rdx, qword [rax + 0x58]
lea rax, [fcn.140005b70]
lea rcx, [rbp + 0xf]
cmp rdx, rax
jne 0x140146af7
xor edx, edx
call fcn.140003440
jmp 0x140146afa
call rdx
nop
mov rcx, qword [rbp - 0x39]
add rcx, 0xfffffffffffffff0
mov eax, dword [rcx]
nop
test eax, 0x30000000
jne 0x140146b1e
mov eax, esi
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x140146b1e
call fcn.1400daaa8
mov rbx, qword [r14 + 0x168]
lea rdi, [rbx + 0x38]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx ebx, byte [rbx + 0x101]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test bl, bl
je 0x140146b53
mov rcx, qword [r14 + 0x168]
call fcn.1401867e0
nop
mov rcx, qword [r15]
add rcx, 0xfffffffffffffff0
mov eax, dword [rcx]
nop
test eax, 0x30000000
jne 0x140146b77
mov eax, esi
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x140146b77
call fcn.1400daaa8
nop
mov rcx, qword [r12]
sub rcx, 0x10
mov eax, dword [rcx]
nop
test eax, 0x30000000
jne 0x140146b99
lock xadd dword [rcx], esi
dec esi
cmp esi, 0xffffffff
jne 0x140146b99
call fcn.1400daaa8
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1400da5a0
add rsp, 0xd0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret