Function at 0x74a72860
Capabilities:
Allocate or change rwx memory
Encrypt data using dpapi

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x10a0]
mov dword [rsp + 0xa4], eax
mov dword [rsp], eax
mov qword [rbp - 0x1058], rbx
mov qword [rbp - 8], rcx
mov qword [rbp - 0x10], rdx
mov byte [rbp - 0x18], 0
mov rax, qword [0x74a7e7d0]
mov qword [rax + 0x90], 0
mov byte [rbp - 0x1050], 0
mov rax, qword [0x74a7e7d0]
lea rax, [rax + 0x168]
mov qword [rsp + 0x30], rax
mov rax, qword [0x74a7e7d0]
mov qword [rsp + 0x28], rax
mov rax, qword [0x74a7e7d0]
lea rax, [rax + 0x8c]
mov qword [rsp + 0x20], rax
mov rax, qword [0x74a7e7d0]
mov eax, dword [rax + 0x80]
imul rax, rax, 0x78
lea rdx, [0x74a7b160]
lea r8, [rdx + rax]
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp - 8]
movabs r9, 0
call fcn.74a724d0
mov rdx, qword [0x74a7e7d0]
mov qword [rdx + 0x84], rax
mov rax, qword [0x74a7e7d0]
cmp qword [rax + 0x84], 0
je 0x74a72c47
mov rdx, qword [0x74a7e7d0]
mov rax, qword [0x74a7e7d0]
mov eax, dword [rax + 0x8c]
mov dword [rdx + 0x98], eax
mov rax, qword [0x74a7e7d0]
mov eax, dword [rax + 0x8c]
lea eax, [eax + 0x100]
mov dword [rbp - 0x1020], eax
mov dword [rsp + 0x20], 0x40
movsxd r8, dword [rbp - 0x1020]
mov r9d, 0x3000
movabs rdx, 0
movabs rcx, 0xffffffffffffffff
call sub.kernel32.dll_VirtualAllocEx
mov rdx, qword [0x74a7e7d0]
mov qword [rdx + 0x90], rax
mov rax, qword [0x74a7e7d0]
cmp qword [rax + 0x90], 0
je 0x74a729d3
mov rax, qword [0x74a7e7d0]
mov rdx, qword [rax + 0x90]
mov rax, qword [0x74a7e7d0]
mov rcx, qword [rax + 0x84]
movsxd r8, dword [rbp - 0x1020]
call fcn.74a738e0
mov dword [rbp - 0x1028], 0x1000
lea rax, [rbp - 0x1028]
mov qword [rsp + 0x20], rax
mov rax, qword [0x74a7e7d0]
lea rax, [rax + 0x368]
mov qword [rsp + 0x30], rax
mov rax, qword [0x74a7e7d0]
lea rax, [rax + 0x40]
mov qword [rsp + 0x28], rax
mov rax, qword [0x74a7e7d0]
mov eax, dword [rax + 0x80]
imul rdx, rax, 0x78
lea rax, [0x74a7b160]
lea r8, [rax + rdx + 0x14]
lea r9, [rbp - 0x1018]
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp - 8]
call fcn.74a724d0
test rax, rax
je 0x74a72b0a
mov eax, dword [rbp - 0x1028]
mov dword [rbp - 0x1038], eax
lea rax, [rbp - 0x1018]
mov qword [rbp - 0x1030], rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea rax, [rbp - 0x1048]
mov qword [rsp + 0x30], rax
lea rcx, [rbp - 0x1038]
movabs r9, 0
movabs r8, 0
movabs rdx, 0
call sub.Crypt32.dll_CryptUnprotectData
test eax, eax
je 0x74a72b0a
cmp dword [rbp - 0x1048], 0x80
setbe al
and eax, 0xff
neg eax
test eax, eax
je 0x74a72b0a
mov r8d, dword [rbp - 0x1048]
mov rcx, qword [rbp - 0x1040]
mov rax, qword [0x74a7e7d0]
lea rdx, [rax + 0xe4]
call fcn.74a738e0
mov rdx, qword [0x74a7e7d0]
mov eax, dword [rbp - 0x1048]
mov dword [rdx + 0x164], eax
mov byte [rbp - 0x1050], 1
mov rcx, qword [rbp - 0x1040]
call sub.kernel32.dll_LocalFree
cmp byte [rbp - 0x1050], 0
jne 0x74a72bc3
mov rax, qword [0x74a7e7d0]
mov dword [rax + 0x164], pe_nt_image_headers64
mov rax, qword [0x74a7e7d0]
lea rax, [rax + 0x568]
mov qword [rsp + 0x30], rax
mov rax, qword [0x74a7e7d0]
lea rax, [rax + 0x40]
mov qword [rsp + 0x28], rax
mov rax, qword [0x74a7e7d0]
lea rax, [rax + 0x164]
mov qword [rsp + 0x20], rax
mov rax, qword [0x74a7e7d0]
mov eax, dword [rax + 0x80]
imul rdx, rax, 0x78
lea rax, [0x74a7b160]
lea r8, [rax + rdx + 0x28]
mov rax, qword [0x74a7e7d0]
lea r9, [rax + 0xe4]
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp - 8]
call fcn.74a724d0
test rax, rax
je 0x74a72bc3
mov rbx, qword [0x74a7e7d0]
mov rax, qword [0x74a7e7d0]
lea rcx, [rax + 0x40]
call sub.kernel32.dll_lstrlenW
movsxd rax, eax
mov word [rbx + rax*2 + 0x3c], 0x48
mov byte [rbp - 0x1050], 1
cmp byte [rbp - 0x1050], 0
je 0x74a72c47
mov rax, qword [0x74a7e7d0]
mov eax, dword [rax + 0x164]
mov dword [rsp + 0x20], eax
mov rax, qword [0x74a7e7d0]
lea r9, [rax + 0xe4]
mov rax, qword [0x74a7e7d0]
mov edx, dword [rax + 0x8c]
mov rax, qword [0x74a7e7d0]
mov rcx, qword [rax + 0x84]
lea r8, [rbp - 0x1020]
call fcn.74a71800
test al, al
je 0x74a72c47
mov rax, qword [0x74a7e7d0]
mov rax, qword [rax + 0x84]
cmp dword [rax], 0xce11da64
jne 0x74a72c47
mov rdx, qword [0x74a7e7d0]
mov eax, dword [rbp - 0x1020]
mov dword [rdx + 0x8c], eax
mov byte [rbp - 0x18], 1
cmp byte [rbp - 0x18], 0
jne 0x74a72cf1
mov rax, qword [0x74a7e7d0]
cmp qword [rax + 0x84], 0
je 0x74a72c8f
mov rax, qword [0x74a7e7d0]
mov rdx, qword [rax + 0x84]
mov r9d, 0x8000
movabs r8, 0
movabs rcx, 0xffffffffffffffff
call sub.kernel32.dll_VirtualFreeEx
mov rax, qword [0x74a7e7d0]
cmp qword [rax + 0x90], 0
je 0x74a72ccd
mov rax, qword [0x74a7e7d0]
mov rdx, qword [rax + 0x90]
mov r9d, 0x8000
movabs r8, 0
movabs rcx, 0xffffffffffffffff
call sub.kernel32.dll_VirtualFreeEx
mov rax, qword [0x74a7e7d0]
mov qword [rax + 0x84], 0
mov rax, qword [0x74a7e7d0]
mov qword [rax + 0x90], 0
movzx eax, byte [rbp - 0x18]
mov rbx, qword [rbp - 0x1058]
lea rsp, [rbp]
pop rbp
ret