Function at 0x4bff30
Capabilities:
Encrypt data using dpapi
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59eb5e
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x60
mov eax, dword [0x5de00c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4c], ecx
mov edi, dword [ebx + 8]
xorps xmm0, xmm0
mov eax, dword [ebx + 0xc]
mov esi, 7
mov dword [ebp - 0x6c], edi
xor ecx, ecx
mov dword [ebp - 0x68], 0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], esi
mov word [ebp - 0x44], cx
mov dword [ebp - 4], 1
test eax, eax
je 0x4c0025
mov esi, eax
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4bffb3
sub esi, ecx
mov edx, 2
xor ecx, ecx
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0052d7ad
add esp, 4
mov dword [ebp - 0x50], eax
lea eax, [esi*2 + 2]
mov esi, dword [ebp - 0x50]
push eax
push esi
push 0xffffffffffffffff
push dword [ebp - 0x48]
push 1
push 0x3a4
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4c0000
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x44]
call fcn.004039f0
push esi
call fcn.0052d7a8
mov esi, dword [ebp - 0x30]
add esp, 4
xorps xmm0, xmm0
xor ecx, ecx
mov edx, 0xf
mov dword [ebp - 0x1c], ecx
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], edx
mov byte [ebp - 0x2c], cl
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
test eax, eax
je 0x4c0198
mov dword [ebp - 0x4c], ecx
lea eax, [ebp - 0x44]
lea ecx, [ebp - 0x4c]
cmp esi, 8
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmovae eax, dword [ebp - 0x44]
push ecx
push 0
lea ecx, [ebp - 0x50]
push ecx
push 0
push eax
push dword [ebp - 0x48]
call esi
push dword [ebp - 0x4c]
call fcn.0052d7ad
add esp, 4
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x30], 8
lea edx, [ebp - 0x4c]
lea ecx, [ebp - 0x44]
cmovae ecx, dword [ebp - 0x44]
push edx
push eax
lea eax, [ebp - 0x50]
push eax
mov eax, dword [ebp - 0x58]
push 0
push ecx
push dword [eax]
call esi
test eax, eax
jne 0x4c0187
cmp dword [ebp - 0x50], 3
jne 0x4c0187
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x4c]
mov dword [ebp - 0x60], ecx
cmp edi, ecx
ja 0x4c00e8
cmp ecx, 0x10
mov dword [ebp - 0x1c], edi
push edi
push dword [ebp - 0x48]
lea esi, [ebp - 0x2c]
cmovae esi, dword [ebp - 0x2c]
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esi + edi], 0
jmp 0x4c0184
cmp edi, 0x7fffffff
ja 0x4c02a6
mov esi, edi
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x4c0108
mov esi, SysReAllocString
jmp 0x4c0126
mov edx, ecx
mov eax, SysReAllocString
shr edx, 1
sub eax, edx
cmp ecx, eax
jbe 0x4c011e
mov esi, SysReAllocString
jmp 0x4c0126
lea eax, [ecx + edx]
cmp esi, eax
cmovb esi, eax
lea eax, [esi + 1]
push eax
call fcn.00408710
push edi
push dword [ebp - 0x48]
mov dword [ebp - 0x18], esi
mov esi, eax
push esi
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x1c], edi
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebp - 0x60]
add esp, 0xc
mov byte [esi + edi], 0
cmp ecx, 0x10
jb 0x4c0181
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4c0177
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4c0177
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0052d747
add esp, 8
mov dword [ebp - 0x2c], esi
mov edi, dword [ebp - 0x54]
push dword [ebp - 0x48]
call fcn.0052d7a8
mov edx, dword [ebp - 0x18]
add esp, 4
mov ecx, dword [ebp - 0x1c]
xorps xmm0, xmm0
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
cmp edx, 0x10
mov dword [ebp - 0x68], 1
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x5c], ecx
cmovae eax, dword [ebp - 0x2c]
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x64]
push eax
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x4c0206
push dword [ebp - 0x64]
mov ecx, edi
push dword [ebp - 0x60]
call fcn.00412890
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0x18]
cmp ecx, 0x10
jb 0x4c0236
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4c022c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4c0274
push ecx
push edx
call fcn.0052d747
add esp, 8
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
cmp ecx, 8
jb 0x4c0284
mov edx, dword [ebp - 0x44]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4c027a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4c027a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0052d747
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0052d3c5
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
call fcn.00402990
int3