Function at 0x4071e1
Capabilities:
Encrypt data using dpapi

Disassembly:
push 0x64
mov eax, 0x430758
call fcn.0041bab3
mov dword [ebp - 0x20], edx
mov edi, ecx
mov dword [ebp - 0x14], edi
xor esi, esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x5c], esi
push 1
push str.SoftwareNinite
push 0x80000001
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], esi
call fcn.004121b8
test eax, eax
je 0x40727a
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0xd
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov esi, esp
call fcn.00412bcd
push eax
mov ecx, esi
call fcn.0040f03e
lea ecx, [ebp - 0x70]
call fcn.00412d2a
push eax
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.00402671
mov ecx, dword [ebp - 0x68]
lea ecx, [ecx - 0x10]
call fcn.00412d0e
cmp dword [ebp - 0x64], 0
je 0x40759e
push dword [ebp - 0x64]
jmp 0x407598
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 2
mov ebx, dword [ebp - 0x64]
mov edx, ebx
push eax
lea eax, [ebp - 0x4c]
push eax
push ecx
lea ecx, [ebp - 0x58]
call fcn.004034ba
add esp, 0xc
mov byte [ebp - 4], 3
cmp dword [ebp - 0x58], 0
jge 0x40731d
cmp dword [ebp - 0x54], 0
mov edi, dword [ebp - 0x50]
push 0x11
pop eax
cmovne eax, dword [ebp - 0x54]
push eax
push dword [ebp - 0x58]
push ecx
lea ecx, [edi - 0x10]
mov esi, esp
call fcn.00412c8f
add eax, 0x10
lea ecx, [ebp - 0x70]
mov dword [esi], eax
call fcn.00412d2a
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x70]
push eax
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.00402671
mov ecx, dword [ebp - 0x68]
lea ecx, [ecx - 0x10]
call fcn.00412d0e
lea ecx, [edi - 0x10]
call fcn.00412d0e
cmp dword [ebp - 0x4c], 0
je 0x40730b
push dword [ebp - 0x4c]
call fcn.00418034
pop ecx
test ebx, ebx
je 0x407316
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x4075a0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x50]
lea ecx, [ecx - 0x10]
call fcn.00412d0e
mov edx, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x4c]
sub edx, ecx
setne al
test al, al
jne 0x407379
push 0x13
push 0x80004005
push ecx
mov esi, esp
call fcn.00412bcd
push eax
mov ecx, esi
call fcn.0040f03e
lea ecx, [ebp - 0x70]
call fcn.00412d2a
mov byte [ebp - 4], 5
lea eax, [ebp - 0x70]
mov ecx, edi
push eax
call fcn.00402671
mov ecx, dword [ebp - 0x68]
lea ecx, [ecx - 0x10]
call fcn.00412d0e
jmp 0x407585
lea eax, [ebp - 0x38]
mov dword [ebp - 0x40], edx
push eax
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x40]
mov dword [ebp - 0x3c], ecx
push eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], esi
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
setne al
test al, al
jne 0x4073e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x17
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov esi, esp
call fcn.00412bcd
push eax
mov ecx, esi
call fcn.0040f03e
lea ecx, [ebp - 0x70]
call fcn.00412d2a
mov byte [ebp - 4], 6
jmp 0x40735e
mov esi, dword [ebp - 0x34]
mov dword [ebp - 0x28], esi
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x38]
cmp ecx, 2
sbb al, al
inc al
jne 0x407432
push 0x1a
push 0x80004005
push ecx
mov edi, esp
call fcn.00412bcd
push eax
mov ecx, edi
call fcn.0040f03e
lea ecx, [ebp - 0x70]
call fcn.00412d2a
mov byte [ebp - 4], 8
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x70]
push eax
mov ecx, edi
call fcn.00402671
mov ecx, dword [ebp - 0x68]
jmp 0x407572
cmp byte [esi + ecx - 1], 0
sete al
test al, al
jne 0x407463
push 0x1b
push 0x80004005
push ecx
mov edi, esp
call fcn.00412bcd
push eax
mov ecx, edi
call fcn.0040f03e
lea ecx, [ebp - 0x70]
call fcn.00412d2a
mov byte [ebp - 4], 9
jmp 0x40741c
cmp byte [esi + ecx - 2], 0
sete al
test al, al
jne 0x407494
push 0x1c
push 0x80004005
push ecx
mov edi, esp
call fcn.00412bcd
push eax
mov ecx, edi
call fcn.0040f03e
lea ecx, [ebp - 0x70]
call fcn.00412d2a
mov byte [ebp - 4], 0xa
jmp 0x40741c
push esi
lea ecx, [ebp - 0x18]
call fcn.0041284d
xor eax, eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
push ecx
mov byte [ebp - 4], 0xc
mov ecx, esp
mov dword [ebp - 0x2c], esp
push 0x438aa0
call fcn.0041284d
push ecx
mov byte [ebp - 4], 0xd
mov edi, esp
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00412c8f
add eax, 0x10
lea ecx, [ebp - 0x58]
mov dword [edi], eax
mov dl, 1
mov byte [ebp - 4], 0xc
call fcn.0040f921
mov eax, dword [ebp - 0x54]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x58]
sub eax, ecx
sar eax, 2
cmp eax, 2
sbb al, al
inc al
jne 0x407535
push 0x20
push 0x80004005
push ecx
mov edi, esp
call fcn.00412bcd
push eax
mov ecx, edi
call fcn.0040f03e
lea ecx, [ebp - 0x70]
call fcn.00412d2a
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x70]
push eax
mov ecx, edi
mov byte [ebp - 4], 0xe
call fcn.00402671
mov ecx, dword [ebp - 0x68]
lea ecx, [ecx - 0x10]
call fcn.00412d0e
jmp 0x407567
mov edi, dword [ebp - 0x20]
push ecx
mov ecx, edi
call fcn.004124b3
mov eax, dword [ebp - 0x58]
lea ecx, [edi + 4]
add eax, 4
push eax
call fcn.004124b3
mov edi, dword [ebp - 0x14]
and dword [edi], 0
and dword [edi + 4], 0
call fcn.00412bcd
push eax
lea ecx, [edi + 8]
call fcn.0040f03e
lea ecx, [ebp - 0x58]
call fcn.0040f330
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00412d0e
test esi, esi
je 0x407585
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x407593
push eax
call fcn.00418034
pop ecx
test ebx, ebx
je 0x40759e
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
call fcn.0041ba81
ret