Function at 0x401b30
Capabilities:
Encrypt data using dpapi
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x5458
call fcn.0040c840
mov eax, dword [0x41b074]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 0x544c], eax
push edi
mov eax, ebx
mov edi, edx
mov dword [ebp - 0x541c], 0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401b66
sub eax, edx
sar eax, 1
mov dword [ebp - 0x5414], eax
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401b80
push 0x1ff
sub eax, edx
mov byte [ebp - 0x40c], cl
lea ecx, [ebp - 0x40b]
sar eax, 1
push 0
push ecx
mov esi, eax
call fcn.00406a10
push 0xff
lea edx, [ebp - 0x20b]
push 0
push edx
mov byte [ebp - 0x20c], 0
call fcn.00406a10
push 0x200
lea eax, [ebp - 0x40c]
push ebx
push eax
call fcn.00405483
push 0x100
lea ecx, [ebp - 0x20c]
push edi
push ecx
call fcn.00405483
add esp, 0x30
lea edx, [ebp - 0x5454]
push edx
push 0xf013f
push 0
push str.SOFTWAREMicrosoftWlansvc_
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401f92
push 0x5000
push eax
lea eax, [ebp - 0x540c]
push eax
call fcn.00406a10
xor ecx, ecx
push 0xfe
push ecx
lea edx, [ebp - 0x10a]
push edx
mov word [ebp - 0x10c], cx
call fcn.00406a10
mov eax, dword [ebp - 0x544c]
push eax
push str.UserDataProfiles_
push str._s_s
lea edx, [ebp - 0x10c]
call fcn.00401000
mov eax, dword [ebp - 0x5454]
add esp, 0x24
push 0
lea ecx, [ebp - 0x5458]
push ecx
push 0
push 0xf013f
push 0
push 0
push 0
lea edx, [ebp - 0x10c]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x401f4e
inc esi
mov ebx, esi
shr ebx, 4
lea ecx, [ebx + 0xb]
shl ecx, 4
shr ecx, 8
add cl, 4
mov byte [ebp - 0x53fb], cl
mov byte [ebp - 0x53ef], cl
lea eax, [ebx + 0xb]
shl al, 4
mov byte [ebp - 0x53fc], al
mov byte [ebp - 0x53f0], al
mov al, bl
shl al, 4
lea ecx, [ebx + 9]
shl cl, 4
mov byte [ebp - 0x53dc], cl
lea ecx, [ebx + 9]
shl ecx, 4
shr ecx, 8
add cl, 4
lea edx, [eax + 0x6c]
mov byte [ebp - 0x53db], cl
lea ecx, [eax + 0x4c]
mov byte [ebp - 0x53e8], dl
mov dl, 0x20
mov byte [ebp - 0x53bc], cl
lea ecx, [eax + 0x38]
mov byte [ebp - 0x540d], al
add al, 0x10
mov byte [ebp - 0x53e4], dl
mov byte [ebp - 0x53b8], dl
mov byte [ebp - 0x5364], dl
mov edx, dword [ebp - 0x5414]
mov byte [ebp - 0x5374], al
push edx
lea eax, [ebp - 0x40c]
mov byte [ebp - 0x53a4], cl
mov byte [ebp - 0x539c], cl
push eax
lea ecx, [ebp - 0x535c]
push ecx
mov byte [ebp - 0x53f8], 0x18
mov byte [ebp - 0x53f4], 2
mov byte [ebp - 0x53ec], 1
mov byte [ebp - 0x53e7], 4
mov byte [ebp - 0x53e0], 0x1c
mov byte [ebp - 0x53d4], 1
mov byte [ebp - 0x53d0], 0x19
mov byte [ebp - 0x53c0], 2
mov byte [ebp - 0x53bb], 4
mov byte [ebp - 0x53b4], 0x19
mov byte [ebp - 0x53a3], 4
mov byte [ebp - 0x53a0], 2
mov byte [ebp - 0x539b], 4
mov byte [ebp - 0x537c], 1
mov byte [ebp - 0x5378], 1
mov byte [ebp - 0x5373], 4
mov byte [ebp - 0x5370], 0x1a
mov byte [ebp - 0x5368], 3
call fcn.0040b3f0
mov al, byte [ebp - 0x540d]
add esp, 0xc
sub al, 0x1a
mov byte [ebp - 0x5058], al
lea eax, [ebp - 0x5418]
push eax
push 4
push 0
shl ebx, 4
push 0
add ebx, 0xe6
shr ebx, 8
lea edx, [ebp - 0x20c]
push 0
mov byte [ebp - 0x5057], bl
mov dword [ebp - 0x544c], edx
mov dword [ebp - 0x5450], esi
push 0
lea ecx, [ebp - 0x5450]
mov ebx, dword [sym.imp.CRYPT32.dll_CryptProtectData]
push ecx
call ebx
test eax, eax
je 0x401f41
mov esi, dword [ebp - 0x5418]
mov edx, dword [ebp - 0x5414]
push esi
push edx
lea eax, [ebp - 0x5054]
push eax
call fcn.0040b3f0
lea edi, [ebp + esi - 0x5054]
mov dword [ebp - 0x5448], 0
mov dword [ebp - 0x5444], 0
mov dword [ebp - 0x5440], 0x5010000
mov dword [ebp - 0x543c], 0
mov dword [ebp - 0x5438], 0x150500
mov dword [ebp - 0x5434], 0xd1a50000
mov dword [ebp - 0x5430], 0xe4962957
mov dword [ebp - 0x542c], 0xa0183446
mov dword [ebp - 0x5428], 0x3e8ed44
mov dword [ebp - 0x5424], 0
mov word [ebp - 0x5420], 0
mov ecx, 0xa
lea esi, [ebp - 0x5448]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x5414]
add esp, 0xc
movsw word es:[edi], word [esi]
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
push ecx
call esi
mov eax, dword [ebp - 0x5418]
lea ecx, [ebp - 0x5418]
push ecx
push 0
push 0
push 0
lea edx, [ebp - 0x540c]
push 0
mov dword [ebp - 0x544c], edx
push 0
lea edx, [ebp - 0x5450]
add eax, 0x3e2
push edx
mov dword [ebp - 0x5450], eax
call ebx
test eax, eax
je 0x401f4e
mov eax, dword [ebp - 0x5418]
mov ecx, dword [ebp - 0x5414]
mov edx, dword [ebp - 0x5458]
push eax
push ecx
push 3
push str.MSMUserData
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
test eax, eax
jne 0x401f36
mov dword [ebp - 0x541c], 1
mov eax, dword [ebp - 0x5414]
push eax
call esi
jmp 0x401f4e
push str.failed_to_encrypt_credential_password._UserEapInfo_does_not_save_n
call fcn.00404d62
add esp, 4
mov ecx, dword [ebp - 0x5458]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call esi
test eax, eax
jne 0x401f6e
mov edx, dword [ebp - 0x5454]
push edx
call esi
test eax, eax
je 0x401fa4
push str.Cant_close_registry_n
call fcn.00404d62
mov eax, dword [ebp - 0x541c]
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00404b74
mov esp, ebp
pop ebp
ret
push str.SOFTWAREMicrosoftWlansvc_
push str.failed_to_open_subkey__s_n
call fcn.00404d62
add esp, 8
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x541c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404b74
mov esp, ebp
pop ebp
ret