Function at 0x4060db
Capabilities:
Encrypt data using dpapi
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
push 0x66
mov eax, edx
mov dword [ebp - 0x10], ecx
push 0
push eax
mov dword [ebp - 0x18], eax
call sub.msvcrt.dll_memset
and dword [ebp - 0x28], 0
add esp, 0xc
and dword [ebp - 0x24], 0
and dword [ebp - 0x20], 0
and dword [ebp - 0x1c], 0
xor ebx, ebx
and dword [ebp - 8], 0
xor edi, edi
and dword [ebp - 0xc], 0
mov esi, 0x401730
test ebx, ebx
je 0x406125
mov esi, 0x401690
lea eax, [ebp - 8]
push eax
push esi
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x406174
jg 0x40613f
mov edi, eax
jmp 0x406148
movzx edi, ax
or edi, 0x80070000
mov ecx, dword [0x40b018]
cmp ecx, 0x40b018
je 0x40616c
cmp byte [ecx + 0x19], 2
jb 0x40616c
push eax
push esi
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0xe
pop ecx
call fcn.00405e54
test edi, edi
js 0x4062a1
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4061c5
jg 0x406196
mov edi, eax
jmp 0x40619f
movzx edi, ax
or edi, 0x80070000
mov ecx, dword [0x40b018]
cmp ecx, 0x40b018
je 0x406201
cmp byte [ecx + 0x19], 2
jb 0x406201
push eax
push esi
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0xf
pop ecx
call fcn.00405e54
jmp 0x406201
cmp dword [ebp - 0x14], 3
je 0x406201
mov ecx, 0x8007065d
mov edi, ecx
mov eax, dword [0x40b018]
cmp eax, 0x40b018
je 0x4062a1
cmp byte [eax + 0x19], 2
jb 0x4062a1
push ecx
push esi
push dword [eax + 0x14]
mov edx, 0x4018e0
push dword [eax + 0x10]
push 0x10
pop ecx
call fcn.004025e0
test edi, edi
js 0x4062a1
mov eax, dword [ebp - 0xc]
push eax
push 0x40
mov dword [ebp - 0x28], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x40624f
mov ecx, 0x8007000e
mov edi, ecx
mov eax, dword [0x40b018]
cmp eax, 0x40b018
je 0x4062a1
cmp byte [eax + 0x19], 2
jb 0x4062a1
push ecx
push dword [ebp - 0xc]
mov edx, 0x4018e0
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x11
pop ecx
call fcn.00402664
test edi, edi
js 0x4062a1
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x24]
push 0
push 0
push dword [ebp - 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4062a1
jg 0x406274
mov edi, eax
jmp 0x40627d
movzx edi, ax
or edi, 0x80070000
mov ecx, dword [0x40b018]
cmp ecx, 0x40b018
je 0x4062a1
cmp byte [ecx + 0x19], 2
jb 0x4062a1
push eax
push esi
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x12
pop ecx
call fcn.00405e54
cmp dword [ebp - 8], 0
je 0x4062b4
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 8], 0
test edi, edi
jns 0x4062d9
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x4062ca
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
and dword [ebp - 0x24], 0
inc ebx
cmp ebx, 2
jb 0x40610d
jmp 0x40637b
lea eax, [ebp - 0x20]
push eax
push 1
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
jne 0x406322
mov edi, 0x80090330
mov eax, dword [0x40b018]
cmp eax, 0x40b018
je 0x40637b
cmp byte [eax + 0x19], 2
jb 0x40637b
push edi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x13
mov edx, 0x4018e0
pop ecx
call fcn.00401d64
jmp 0x40637b
mov esi, dword [ebp - 0x20]
cmp esi, 0x66
ja 0x406356
push esi
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [0x40b018]
cmp eax, 0x40b018
je 0x40637e
cmp byte [eax + 0x19], 4
jb 0x40637e
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x14
jmp 0x406315
mov edi, 0x8007007a
mov eax, dword [0x40b018]
cmp eax, 0x40b018
je 0x40637e
cmp byte [eax + 0x19], 2
jb 0x40637e
push edi
push ecx
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00405ed1
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x406399
test esi, esi
je 0x406390
mov byte [eax], 0
inc eax
dec esi
jne 0x406389
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x4063b7
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x4063ae
mov byte [eax], 0
inc eax
dec ecx
jne 0x4063a7
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4