Function at 0x4144d0
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov esi, esp
mov eax, dword [0x533014]
xor eax, ebp
mov dword [esi + 0x48], eax
mov edi, 0x80070057
cmp dword [ebp + 0xc], 1
jg 0x414696
push dword [ebp + 0x10]
call dword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
test eax, eax
je 0x414696
mov ebx, eax
call dword [sym.imp.ole32.dll_CoImpersonateClient]
test eax, eax
js 0x41465d
mov dword [esi + 8], ebx
mov dword [esi + 4], esp
xor eax, eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x40], eax
xor ecx, ecx
dec ecx
lea eax, [esi + 0x3c]
mov dword [eax], ecx
push eax
mov ebx, esp
push 0x14
call fcn.004e2886
add esp, 4
mov edi, eax
mov ecx, eax
push 0x414090
push 0x414080
call fcn.00441790
mov dword [ebx], edi
xor ebx, ebx
dec ebx
lea ecx, [esi + 0x3c]
call fcn.004416e0
mov esp, dword [esi + 4]
lea edi, [esi + 0x34]
mov dword [edi + 4], ebx
mov dword [edi], ebx
mov ecx, edi
call fcn.00414739
mov ecx, edi
call fcn.00449af0
test al, al
je 0x414661
lea eax, [esi + 0x28]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
push edi
push dword [ebp + 0xc]
push eax
mov edi, eax
call fcn.00412f30
mov edx, edi
add esp, 0xc
movzx eax, byte [edi + 0xb]
mov ecx, eax
test al, al
jns 0x4145a5
mov ecx, dword [esi + 0x2c]
test ecx, ecx
je 0x41466b
xor eax, eax
lea ebx, [esi + 0x18]
mov dword [ebx + 4], eax
mov dword [ebx], eax
mov dword [ebx + 8], eax
push ebx
push edx
call fcn.0041479c
add esp, 8
lea edi, [esi + 0xc]
mov ecx, edi
push dword [esi + 8]
push dword [ebp + 0x10]
call fcn.004147f6
push ebx
push edi
call fcn.0041479c
add esp, 8
cmp byte [edi + 0xb], 0
jns 0x4145ef
push dword [esi + 0xc]
call fcn.004e28b6
add esp, 4
xor eax, eax
mov dword [esi + 0x10], eax
mov dword [esi + 0xc], eax
movzx eax, byte [esi + 0x23]
test al, al
jns 0x414605
mov ebx, dword [esi + 0x18]
mov eax, dword [esi + 0x1c]
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ebx
sub esp, 0x1c
lea eax, [esi + 0x40]
mov dword [esp + 0x18], eax
xorps xmm0, xmm0
movups xmmword [esp + 8], xmm0
mov dword [esp], edi
mov dword [esp + 4], 0x51a95a
call dword [sym.imp.CRYPT32.dll_CryptProtectData]
xor ebx, ebx
test eax, eax
jne 0x414642
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
xor ebx, ebx
inc ebx
cmp byte [esi + 0x23], 0
jns 0x414653
push dword [esi + 0x18]
call fcn.004e28b6
add esp, 4
mov edi, 0x8004a005
mov al, byte [esi + 0x33]
jmp 0x414673
mov edi, eax
jmp 0x414696
xor ebx, ebx
inc ebx
mov edi, 0x8004a001
jmp 0x414682
xor ebx, ebx
inc ebx
mov edi, 0x8004a002
test al, al
jns 0x414682
push dword [esi + 0x28]
call fcn.004e28b6
add esp, 4
lea ecx, [esi + 0x34]
call fcn.004142f0
lea ecx, [esi + 0x3c]
call fcn.00441710
test ebx, ebx
je 0x4146ac
mov ecx, dword [esi + 0x48]
xor ecx, ebp
call fcn.004e3343
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
xor eax, eax
lea ecx, [esi + 0x28]
mov dword [ecx + 4], eax
mov dword [ecx], eax
lea eax, [esi + 0x40]
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
sub esp, 0x1c
mov dword [esp + 0x18], ecx
xorps xmm0, xmm0
movups xmmword [esp + 8], xmm0
mov dword [esp], eax
mov dword [esp + 4], 0x51a95a
call dword [sym.imp.CRYPT32.dll_CryptProtectData]
mov ebx, eax
test eax, eax
jne 0x4146f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov edi, 0x8004a006
mov eax, dword [esi + 4]
test eax, eax
je 0x414703
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
test ebx, ebx
je 0x414696
mov edi, dword [ebp + 0x14]
mov ebx, dword [esi + 0x2c]
push dword [esi + 0x28]
push ebx
call dword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov dword [edi], eax
xor ecx, ecx
test eax, eax
mov edi, 0x8007000e
cmovne edi, ecx
test ebx, ebx
je 0x414696
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x414696