Function at 0x1400042c0
Capabilities:
Encrypt data using dpapi
Query environment variable
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x158]
sub rsp, 0x230
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x100], rax
mov rdi, rcx
xor r13d, r13d
xorps xmm0, xmm0
movaps xmmword [rbp + 0x60], xmm0
movaps xmmword [rbp + 0x70], xmm0
movups xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x2e], r13w
movdqa xmmword [rbp + 0x30], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x40], xmm1
movdqa xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], r13
mov qword [rbp + 0x68], 0x400
mov dword [rbp + 0x70], r13d
mov qword [rbp + 0x78], r13
lea ecx, [r13 + 0x18]
call fcn.140009060
mov rbx, rax
mov qword [rbp - 0x40], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx], 0x10000
lea ecx, [rax + 1]
call fcn.140009060
mov qword [rbx + 8], rax
lea ecx, [r13 + 0x38]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rbx + 0x10], rax
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov rcx, qword [rbx + 0x10]
lea rax, [rcx + 0x20]
mov qword [rcx], rax
mov rax, qword [rbx + 0x10]
mov rcx, qword [rax]
mov qword [rcx], r13
mov rax, qword [rbx + 0x10]
mov rcx, qword [rax]
mov qword [rcx + 8], r13
mov rax, qword [rbx + 0x10]
mov rcx, qword [rax]
mov qword [rcx + 0x10], r13
mov rax, qword [rbx + 0x10]
mov byte [rax + 0x18], 1
mov rax, qword [rbx + 0x10]
mov qword [rax + 0x10], 1
mov qword [rbp + 0x30], rbx
mov qword [rbp + 0x38], rbx
lea rcx, [rbp + 0x20]
call fcn.1400055a0
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov r15d, 3
mov word [rbp + 0x2e], r15w
mov r14, qword [rbp + 0x30]
mov ebx, dword [rdi + 0x10]
cmp qword [rdi + 0x18], 0xf
jbe 0x1400043f7
mov rdi, qword [rdi]
movups xmmword [rbp - 0x40], xmm0
lea rsi, [0x14000b8de]
test rdi, rdi
cmovne rsi, rdi
cmp ebx, 0xd
ja 0x140004427
mov eax, 0x1c05
mov word [rbp - 0x32], ax
mov eax, 0xd
sub al, bl
mov byte [rbp - 0x33], al
lea rdi, [rbp - 0x40]
jmp 0x140004459
mov eax, 0xc05
mov word [rbp - 0x32], ax
mov dword [rbp - 0x40], ebx
lea edx, [rbx + 1]
mov rcx, r14
call fcn.1400057f0
mov rdi, rax
mov rcx, qword [rbp - 0x38]
movabs rax, 0xffff000000000000
and rcx, rax
or rcx, rdi
mov qword [rbp - 0x38], rcx
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rdi], 0
lea rax, str.guid
mov qword [rbp - 0x60], rax
mov ebx, 4
mov dword [rbp - 0x58], ebx
mov r9, r14
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x20]
call fcn.140005420
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
movdqu xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], 0x100
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xd0], xmm0
lea rax, [rbp - 0x30]
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0xa8], r13
movdqa xmmword [rbp + 0xb0], xmm0
movdqa xmmword [rbp + 0xc0], xmm1
mov qword [rbp + 0xd0], 0x200
mov dword [rbp + 0xd8], 0x144
mov byte [rbp + 0xdc], 0
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x20]
call fcn.140005d60
test al, al
jne 0x14000451b
xor dil, dil
jmp 0x140004c64
mov rax, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x18]
sub rax, rcx
cmp rax, 1
jge 0x14000453e
mov edx, 1
lea rcx, [rbp - 0x30]
call fcn.140008580
mov rcx, qword [rbp - 0x18]
lea rax, [rcx + 1]
mov qword [rbp - 0x18], rax
mov byte [rcx], 0
mov rcx, qword [rbp - 0x18]
dec rcx
mov qword [rbp - 0x18], rcx
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x68], rax
sub ecx, eax
mov dword [rbp - 0x70], ecx
lea rcx, str.LOCALAPPDATA
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], r13
mov qword [rbp + 0x18], r13
mov r8d, 0x15
lea rdx, str.DigitalEntitlements_
lea rcx, [rbp]
call fcn.140007490
nop
lea r8, [rbp]
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.140006810
nop
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x1400045b7
mov rax, qword [rax]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rcx
call fcn.1400087d8
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp - 0x60], xmm0
lea r8, [rbp - 0x60]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.140002a10
nop
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova rcx, qword [rsp + 0x40]
mov r9d, 0xffffffff
mov r8d, r15d
lea rdx, [rbp + 0x80]
call fcn.140008a40
mov ecx, eax
test eax, eax
jne 0x14000463c
mov edx, dword [rbp + 0x90]
bt edx, 0xa
jae 0x14000462f
mov eax, dword [rbp + 0x94]
cmp eax, 0xa000000c
je 0x140004659
cmp eax, 0xa0000003
jne 0x14000462f
lea ebx, [rcx + 0xa]
jmp 0x140004659
mov ebx, edx
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
jmp 0x140004659
sub eax, 2
je 0x140004654
sub eax, 1
je 0x140004654
sub eax, 0x32
je 0x140004654
cmp eax, 0x46
je 0x140004654
xor al, al
jmp 0x140004656
mov al, 1
movzx ebx, al
mov dword [rbp - 0x60], ecx
lea rsi, [0x14000f070]
mov qword [rbp - 0x58], rsi
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp - 0x60], xmm0
test ebx, ebx
je 0x1400046ba
cmp ebx, 1
setne bl
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x1400046cb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400046c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400046c6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
xor bl, bl
test ecx, ecx
jne 0x140004dae
jmp 0x14000467a
call fcn.14000909c
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r13w
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14000471f
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000471a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000471a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000909c
test bl, bl
je 0x14000485b
lea r8, [rbp]
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.140006810
nop
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x140004747
mov rax, qword [rax]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rcx
call fcn.1400087d8
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp - 0x60], xmm0
lea r8, [rbp - 0x60]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.140002a10
nop
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova rcx, qword [rsp + 0x40]
call fcn.140008dc0
movzx ecx, al
mov qword [rbp - 0x40], rcx
shr rax, 0x20
mov dword [rbp - 0x60], eax
mov qword [rbp - 0x58], rsi
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp - 0x60], xmm0
cmp eax, 0x91
jne 0x1400047b8
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x40]
call fcn.140003e50
cmp dword [rbp - 0x60], 0
jne 0x140004dca
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x140004807
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004802
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004802
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000909c
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r13w
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14000485b
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004856
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004856
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000909c
lea r8, [rbp]
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.140006810
nop
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x14000487b
mov rax, qword [rax]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rcx
call fcn.1400087d8
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp - 0x60], xmm0
lea r8, [rbp - 0x60]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.140002a10
nop
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova rcx, qword [rsp + 0x40]
call fcn.140008914
shr rax, 0x20
test eax, eax
jne 0x140004de0
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x140004909
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004904
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004904
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000909c
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r13w
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14000495d
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004958
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004958
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000909c
lea r8, [rbp]
mov rdx, rdi
lea rcx, [rbp - 0x60]
call fcn.140006810
nop
mov r8d, 0x25
lea rdx, str.38d8f400_aa8a_4784_a9f0_26a08628577e
mov rcx, rax
call fcn.140005770
movups xmm7, xmmword [rax]
movups xmmword [rbp + 0xe0], xmm7
movups xmm6, xmmword [rax + 0x10]
movups xmmword [rbp + 0xf0], xmm6
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x1400049e5
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400049e0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400049e0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000909c
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
lea r14, [rbp + 0xe0]
movdqa xmm0, xmm6
psrldq xmm0, 8
movq r15, xmm0
cmp r15, 0xf
seta r12b
movq rsi, xmm7
cmova r14, rsi
movabs rdi, 0x7fffffffffffffff
movq rbx, xmm6
cmp rbx, rdi
ja 0x140004da8
mov qword [rsp + 0x58], 0xf
cmp rbx, 0xf
ja 0x140004a67
mov qword [rsp + 0x50], rbx
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x40], xmm0
jmp 0x140004afb
mov rax, rbx
or rax, 0xf
cmp rax, rdi
jbe 0x140004aa3
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140009060
mov rcx, rax
test rax, rax
je 0x140004b66
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140004add
mov ecx, 0x16
cmp rax, rcx
cmovb rax, rcx
mov rdi, rax
lea rcx, [rax + 1]
cmp rcx, 0x1000
jb 0x140004ace
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140004dc4
jmp 0x140004a81
test rcx, rcx
je 0x140004ada
call fcn.140009060
jmp 0x140004add
mov rax, r13
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rdi
lea r8, [rbx + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x80]
call fcn.140004150
cmp qword [rax + 0x18], 7
jbe 0x140004b16
mov rax, qword [rax]
lea rdx, [0x14000b6e8]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov rbx, rax
mov rdx, qword [rbp + 0x98]
cmp rdx, 7
jbe 0x140004b72
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004b6d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004b6d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000909c
mov qword [rbp + 0x90], r13
mov qword [rbp + 0x98], 7
mov word [rbp + 0x80], r13w
test rbx, rbx
jne 0x140004b96
xor dil, dil
jmp 0x140004beb
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x70]
call qword [sym.imp.CRYPT32.dll_CryptProtectData]
test eax, eax
je 0x140004be8
mov r8d, dword [rbp - 0x80]
mov r9, rbx
mov edx, 1
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov dil, 1
test r12b, r12b
je 0x140004c25
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140004c1c
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004c1c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.14000909c
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x140004c64
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004c5e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004c5e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000909c
nop
mov rcx, qword [rbp + 0xb8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov edx, 1
mov rcx, qword [rbp + 0xb0]
call fcn.14000909c
nop
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov edx, 1
mov rcx, qword [rbp - 0x28]
call fcn.14000909c
nop
mov rbx, qword [rbp + 0x38]
test rbx, rbx
je 0x140004d52
lea rcx, [rbp + 0x20]
call fcn.1400055a0
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x2e], r13w
mov rbx, qword [rbp + 0x38]
test rbx, rbx
je 0x140004d52
cmp qword [rbx + 0x10], 0
je 0x140004d45
mov rcx, qword [rbx + 0x10]
mov rax, qword [rcx + 0x10]
cmp rax, 1
jbe 0x140004ce9
dec rax
mov qword [rcx + 0x10], rax
jmp 0x140004d45
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x140004d19
mov rdx, qword [rbx + 0x10]
nop dword [rax]
mov qword [rdx], rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rdx]
mov rax, qword [rcx + 0x10]
test rax, rax
jne 0x140004d00
mov rax, qword [rbx + 0x10]
mov rcx, qword [rax]
mov qword [rcx + 8], r13
mov rcx, qword [rbx + 0x10]
mov rsi, qword [rcx + 8]
cmp byte [rcx + 0x18], 0
je 0x140004d38
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov edx, 1
mov rcx, rsi
call fcn.14000909c
mov edx, 0x18
mov rcx, rbx
call fcn.14000909c
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov edx, 1
mov rcx, qword [rbp + 0x48]
call fcn.14000909c
movzx eax, dil
mov rcx, qword [rbp + 0x100]
xor rcx, rsp
call fcn.140009040
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400022c0
nop
lea r8, [rsp + 0x40]
lea rdx, [rbp - 0x60]
lea rcx, str.exists
call fcn.1400038d0
nop
call fcn.140001110
nop
lea r8, [rsp + 0x40]
lea rdx, [rbp - 0x60]
lea rcx, str.remove_all
call fcn.1400038d0
nop
lea r8, [rsp + 0x40]
mov edx, eax
call fcn.140003860
int3