Function at 0x140072380
Capabilities:
Encrypt data using dpapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
xor esi, esi
mov r12, r9
xor eax, eax
mov r13, r8
mov qword [rbp - 0x20], rax
mov r15, rdx
mov qword [rbp - 0x18], rax
mov rbx, rcx
mov rcx, qword [str.___t_]
lea rax, str.___t_
cmp rcx, rax
je 0x1400723e9
test byte [rcx + 0x1c], 2
je 0x1400723e9
cmp byte [rcx + 0x19], 5
jb 0x1400723e9
mov rcx, qword [rcx + 0x10]
lea edx, [rsi + 0x10]
lea r8, [0x1400864b8]
call fcn.140001024
mov rdi, qword [rbp + 0x58]
test rdi, rdi
je 0x1400723f4
and dword [rdi], esi
lea r8, [rbp - 0x30]
mov rdx, r15
mov rcx, rbx
call fcn.140066f7c
mov qword [rbp - 0x28], rax
mov r14, rax
test rax, rax
jne 0x140072454
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [str.___t_]
lea rax, str.___t_
cmp rcx, rax
je 0x14007244d
test byte [rcx + 0x1c], 2
je 0x14007244d
cmp byte [rcx + 0x19], 3
jb 0x14007244d
mov rcx, qword [rcx + 0x10]
lea edx, [r14 + 0x11]
mov r9d, edi
lea r8, [0x1400864b8]
call fcn.140001048
mov eax, edi
jmp 0x140072635
mov ebx, dword [rbp - 0x30]
cmp ebx, 1
jne 0x1400724a3
mov rcx, r14
call fcn.1400634d4
mov rcx, qword [str.___t_]
lea rax, str.___t_
cmp rcx, rax
je 0x140072499
test byte [rcx + 0x1c], 2
je 0x140072499
cmp byte [rcx + 0x19], 3
jb 0x140072499
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0x11]
mov r9, r15
lea r8, [0x1400864b8]
call fcn.1400011dc
mov eax, 2
jmp 0x140072635
mov r15d, 0x14
lea rax, [0x1400864c8]
mov qword [rbp - 8], rax
mov dword [rbp - 0x10], r15d
lea r8d, [r15 + 0x38]
cmp ebx, r8d
jbe 0x140072620
lea rdx, str.5b04adaa_5e01_4160_a61e_02d27d44f9db
mov rcx, r14
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x140072620
test rdi, rdi
je 0x1400724e7
mov dword [rdi], 1
add ebx, 0xffffffb4
mov ecx, ebx
mov dword [rbp - 0x30], ebx
call fcn.140063430
mov rdi, rax
test rax, rax
jne 0x14007254a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, qword [str.___t_]
lea rax, str.___t_
cmp rcx, rax
je 0x1400725f9
test byte [rcx + 0x1c], 2
je 0x1400725f9
cmp byte [rcx + 0x19], 2
jb 0x1400725f9
lea edx, [rdi + 0x13]
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400864b8]
mov r9d, esi
call fcn.140001048
jmp 0x1400725f9
mov rdx, qword [rbp - 0x28]
mov rcx, rdi
mov r8d, dword [rbp - 0x30]
add rdx, 0x4c
call sub.msvcrt.dll_memcpy
mov rcx, qword [rbp - 0x28]
call fcn.1400634d4
lea rax, [rbp - 0x20]
mov qword [rbp - 0x28], rdi
mov qword [rsp + 0x30], rax
lea r8, [rbp - 0x10]
mov dword [rsp + 0x28], 1
lea rcx, [rbp - 0x30]
and qword [rsp + 0x20], rsi
xor r9d, r9d
xor edx, edx
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
jne 0x1400725c7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, qword [str.___t_]
lea rax, str.___t_
cmp rcx, rax
je 0x1400725f9
test byte [rcx + 0x1c], 2
je 0x1400725f9
cmp byte [rcx + 0x19], 2
jb 0x1400725f9
mov edx, r15d
jmp 0x140072532
mov rax, qword [rbp - 0x20]
mov ecx, eax
mov dword [r12], eax
call fcn.140063430
mov qword [r13], rax
test rax, rax
jne 0x1400725e9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1400725f9
mov r8d, dword [rbp - 0x20]
mov rcx, rax
mov rdx, qword [rbp - 0x18]
call sub.msvcrt.dll_memcpy
mov rdi, qword [rbp - 0x18]
test rdi, rdi
je 0x140072613
mov ecx, dword [rbp - 0x20]
xor eax, eax
rep stosb byte [rdi], al
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 0x28]
call fcn.1400634d4
mov eax, esi
jmp 0x140072635
mov dword [r12], ebx
mov qword [r13], r14
test rdi, rdi
je 0x140072633
mov dword [rdi], 2
xor eax, eax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret