Function at 0x1005de99
Capabilities:
Encrypt data using dpapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x100ae134]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x30], eax
mov edx, eax
mov dword [ebp - 0x40], edx
push esi
push edi
test ebx, ebx
je 0x1005e117
cmp word [ebx], ax
je 0x1005e117
mov edi, ebx
push 2
pop esi
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, esi
cmp ax, word [ebp - 0x30]
jne 0x1005deda
sub edi, ecx
sar edi, 1
test edi, edi
jle 0x1005e10e
push 0x3b
pop edx
mov ecx, ebx
test edi, edi
je 0x1005e0a6
movzx eax, word [ebx]
cmp ax, dx
je 0x1005e0a6
cmp eax, 0x3d
je 0x1005df16
add ebx, esi
sub edi, 1
jne 0x1005defe
test edi, edi
je 0x1005e0a6
or eax, 0xffffffff
mov dword [ebp - 0x38], eax
mov eax, ebx
sub eax, ecx
sar eax, 1
movzx eax, ax
movsx esi, ax
cmp esi, 0x13
jae 0x1005dfaa
add esi, esi
lea eax, [ebp - 0x2c]
push esi
push ecx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
cmp esi, 0x26
jae 0x1005e112
xor eax, eax
mov word [ebp + esi - 0x2c], ax
mov esi, eax
movsx eax, si
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
imul eax, eax, 0x28
push ecx
add eax, 0x10015bc0
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x1005df7f
inc esi
cmp si, 0x18
jl 0x1005df57
jmp 0x1005df95
imul eax, dword [ebp - 0x30], 0x28
or ecx, 0xffffffff
movzx eax, word [eax + 0x10015be6]
mov dword [ebp - 0x38], eax
cmp ax, cx
jne 0x1005dfa7
cmp dword [ebp - 0x40], 0
push 0x3b
pop edx
jne 0x1005dfaa
mov dword [ebp - 0x40], 1
jmp 0x1005dfaa
push 0x3b
pop edx
mov ecx, dword [ebp - 0x38]
push 2
pop eax
add ebx, eax
movzx esi, cx
dec edi
movzx eax, word [ebx]
cmp eax, 0x7b
jne 0x1005dfca
push 0x7d
pop edx
push 2
pop eax
add ebx, eax
dec edi
movzx eax, word [ebx]
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x44], ebx
cmp ax, dx
je 0x1005dfe4
push 2
pop eax
test edi, edi
je 0x1005dfe4
add ebx, eax
dec edi
cmp word [ebx], dx
jne 0x1005dfd8
push 0x13
pop eax
cmp si, ax
ja 0x1005e0d4
mov esi, dword [ebp - 0x34]
movsx eax, cx
imul ecx, eax, 0x214
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], ecx
mov eax, dword [ecx + esi]
test al, 2
jne 0x1005e0d4
and eax, 0xffffffdf
or eax, 3
mov dword [ecx + esi], eax
mov esi, ebx
sub esi, dword [ebp - 0x44]
mov eax, 0x105
sar esi, 1
mov dword [ebp - 0x48], esi
cmp esi, eax
jb 0x1005e02e
mov esi, eax
mov dword [ebp - 0x48], eax
push 2
pop edx
cmp word [ebp - 0x38], dx
lea eax, [esi + esi]
mov edx, dword [ebp - 0x44]
push eax
mov dword [ebp - 0x30], eax
push edx
jne 0x1005e0ad
mov esi, dword [ebp - 0x34]
add esi, 8
add esi, ecx
push esi
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x30]
xor ecx, ecx
mov edx, dword [ebp - 0x48]
add esp, 0xc
shl edx, 7
add edx, 0x540
mov word [eax + esi], cx
and edx, 0xfc00
mov ecx, dword [ebp - 0x4c]
mov esi, dword [ebp - 0x34]
mov eax, dword [ecx + esi]
and eax, 0xffff003f
or edx, eax
mov eax, dword [ebp - 0x30]
mov dword [ecx + esi], edx
add eax, 2
add ecx, 4
shr edx, 6
add ecx, esi
and edx, 0x3ff
mov dword [ecx], eax
xor eax, eax
push eax
push edx
push ecx
call dword [sym.imp.CRYPT32.dll_CryptProtectMemory]
test eax, eax
jne 0x1005e0d1
mov eax, 0x80004005
jmp 0x1005e119
mov eax, dword [ebp - 0x34]
add eax, 4
add eax, ecx
push eax
call sub.msvcrt.dll_memcpy
imul eax, dword [ebp - 0x50], 0x10a
add esp, 0xc
add eax, esi
mov esi, dword [ebp - 0x34]
xor ecx, ecx
mov word [esi + eax*2 + 4], cx
mov edx, dword [ebp - 0x3c]
push 0x7d
pop eax
cmp dx, ax
jne 0x1005e0fa
test edi, edi
je 0x1005e0a6
cmp word [ebx], ax
jne 0x1005e0a6
push 2
pop esi
push 0x3b
pop edx
cmp edi, 1
jle 0x1005e100
add ebx, esi
dec edi
cmp word [ebx], dx
jne 0x1005e0a6
jmp 0x1005e100
push 2
pop esi
push 0x3b
pop edx
add ebx, esi
dec edi
test edi, edi
jg 0x1005def4
mov edx, dword [ebp - 0x40]
mov eax, edx
jmp 0x1005e119
call fcn.10036710
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100365c0
mov esp, ebp
pop ebp
ret 8