Function at 0x14017aab0
Capabilities:
Encrypt data using dpapi

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x4f8
lea rdi, [rsp + 0x40]
mov ecx, 0x12e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x510]
mov rax, qword [0x1401db040]
xor rax, rsp
mov qword [rsp + 0x4e0], rax
mov edx, 0x110
lea rcx, [rsp + 0x50]
call fcn.140011590
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 0x20
mov rdx, qword [rsp + 0x518]
lea rcx, [rsp + 0x50]
call fcn.140012fa0
lea rax, [rsp + 0x178]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x50]
movsxd rax, dword [rax + 4]
lea rax, [rsp + rax + 0x50]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
movzx eax, al
test eax, eax
je 0x14017afee
mov r8d, 2
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::seekg_long_long___int64___int____ptr64]
nop
lea rdx, [rsp + 0x338]
lea rcx, [rsp + 0x50]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::fpos_struct__Mbstatet____cdecl_std::basic_istream_char__struct_std::char_traits_char__::tellg_void____ptr64]
mov rcx, rax
call fcn.140011a60
mov dword [rsp + 0x194], eax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::seekg_long_long___int64___int____ptr64]
nop
mov edx, 0x20
lea rcx, [rsp + 0x1a8]
call fcn.140011610
lea rcx, [rsp + 0x350]
call fcn.140004010
movsxd rcx, dword [rsp + 0x194]
mov r8, rax
mov rdx, rcx
lea rcx, [rsp + 0x1a8]
call fcn.1400135d0
nop
movsxd rax, dword [rsp + 0x194]
mov qword [rsp + 0x478], rax
lea rcx, [rsp + 0x1a8]
call fcn.140013500
mov rcx, qword [rsp + 0x478]
mov r8, rcx
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::read_char____ptr64__long_long___int64_____ptr64]
nop
lea rcx, [rsp + 0x351]
call fcn.140004010
mov qword [rsp + 0x480], rax
lea rax, [rsp + 0x358]
mov qword [rsp + 0x398], rax
xor edx, edx
mov rcx, qword [rsp + 0x398]
call fcn.140013030
mov qword [rsp + 0x488], rax
lea rcx, [rsp + 0x3a0]
call fcn.140004010
mov qword [rsp + 0x490], rax
lea rax, [rsp + 0x3a8]
mov qword [rsp + 0x3c0], rax
mov rdx, qword [rsp + 0x3c0]
lea rcx, [rsp + 0x1a8]
call fcn.140013400
mov qword [rsp + 0x498], rax
lea rax, [rsp + 0x3c8]
mov qword [rsp + 0x3e0], rax
mov rdx, qword [rsp + 0x3e0]
lea rcx, [rsp + 0x1a8]
call fcn.1400134a0
mov qword [rsp + 0x4a0], rax
mov r9, qword [rsp + 0x490]
mov r8, qword [rsp + 0x498]
mov rdx, qword [rsp + 0x4a0]
lea rcx, [rsp + 0x218]
call fcn.140018bb0
mov qword [rsp + 0x4a8], rax
mov byte [rsp + 0x20], 0
mov r9b, 1
mov r8, qword [rsp + 0x488]
mov rdx, qword [rsp + 0x4a8]
lea rcx, [rsp + 0x3e8]
call fcn.140018c80
mov qword [rsp + 0x4b0], rax
lea rdx, str.os_crypt
mov rcx, qword [rsp + 0x4b0]
call fcn.140018e20
mov qword [rsp + 0x4b8], rax
lea rdx, str.encrypted_key
mov rcx, qword [rsp + 0x4b8]
call fcn.140018e20
mov qword [rsp + 0x4c0], rax
mov r8, qword [rsp + 0x480]
mov rdx, qword [rsp + 0x4c0]
lea rcx, [rsp + 0x1e8]
call fcn.140018e70
lea rcx, [rsp + 0x3e8]
call fcn.140013080
lea rcx, [rsp + 0x218]
call fcn.140002650
nop
mov edx, 0x20
lea rcx, [rsp + 0x248]
call fcn.140011670
lea rax, [rsp + 0x3f8]
mov qword [rsp + 0x420], rax
lea rdx, [rsp + 0x1e8]
mov rcx, qword [rsp + 0x420]
call fcn.1400027c0
mov rdx, rax
lea rcx, [rsp + 0x248]
call fcn.140185820
nop
lea rcx, [rsp + 0x428]
call fcn.140004010
mov qword [rsp + 0x4c8], rax
lea rax, [rsp + 0x430]
mov qword [rsp + 0x448], rax
mov rdx, qword [rsp + 0x448]
lea rcx, [rsp + 0x248]
call fcn.1400131c0
mov qword [rsp + 0x4d0], rax
lea rax, [rsp + 0x450]
mov qword [rsp + 0x468], rax
mov rdx, qword [rsp + 0x468]
lea rcx, [rsp + 0x248]
call fcn.140013260
mov qword [rsp + 0x4d8], rax
mov r9, qword [rsp + 0x4c8]
mov r8, qword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x4d8]
lea rcx, [rsp + 0x288]
call fcn.140018f90
nop
mov r9, 0xffffffffffffffff
mov r8d, 5
lea rdx, [rsp + 0x2c8]
lea rcx, [rsp + 0x288]
call fcn.14000a1d0
lea rax, [rsp + 0x308]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov qword [rsp + 0x328], 0
lea rcx, [rsp + 0x2c8]
call fcn.14000a390
mov dword [rsp + 0x308], eax
lea rcx, [rsp + 0x2c8]
call fcn.140002630
mov qword [rsp + 0x310], rax
lea rcx, [rsp + 0x50]
call fcn.140012e80
nop
lea rax, [rsp + 0x178]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x308]
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x14017afac
mov rcx, qword [rsp + 0x180]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rsp + 0x510]
lea rcx, [rsp + 0x178]
lea rdi, [rax + 0x28]
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov byte [rsp + 0x470], 1
lea rcx, [rsp + 0x2c8]
call fcn.140002650
lea rcx, [rsp + 0x288]
call fcn.140002650
lea rcx, [rsp + 0x248]
call fcn.1400132f0
lea rcx, [rsp + 0x1e8]
call fcn.140002650
lea rcx, [rsp + 0x1a8]
call fcn.140013520
lea rcx, [rsp + 0x50]
call fcn.140011550
mov rcx, qword [rsp + 0x518]
call fcn.140002650
movzx eax, byte [rsp + 0x470]
jmp 0x14017b015
lea rcx, [rsp + 0x2c8]
call fcn.140002650
lea rcx, [rsp + 0x288]
call fcn.140002650
lea rcx, [rsp + 0x248]
call fcn.1400132f0
lea rcx, [rsp + 0x1e8]
call fcn.140002650
lea rcx, [rsp + 0x1a8]
call fcn.140013520
nop
mov byte [rsp + 0x471], 0
lea rcx, [rsp + 0x50]
call fcn.140011550
mov rcx, qword [rsp + 0x518]
call fcn.140002650
movzx eax, byte [rsp + 0x471]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1401ade30]
call fcn.140185b40
mov rax, rdi
mov rcx, qword [rsp + 0x4e0]
xor rcx, rsp
call fcn.140061a30
add rsp, 0x4f8
pop rdi
pop rsi
ret