Function at 0x1401449f0
Capabilities:
Encrypt data using dpapi
Get token membership

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xc0
mov rax, qword [0x140425440]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov r12, r8
mov r14, rdx
mov r15, rcx
mov qword [rbp - 9], rdx
mov qword [rbp - 1], r8
mov rax, qword [r8]
mov qword [rbp - 0x21], rax
xor ebx, ebx
mov edx, ebx
movzx ecx, byte [rax]
inc rax
test cl, cl
jns 0x140144a63
movzx ecx, byte [rax]
and cl, 0xc0
cmp cl, 0x80
jne 0x140144a67
nop word [rax + rax]
inc rax
movzx ecx, byte [rax]
and cl, 0xc0
cmp cl, 0x80
je 0x140144a50
inc rdx
jmp 0x140144a31
test ecx, ecx
je 0x140144a6c
inc rdx
jmp 0x140144a31
lea eax, [rdx + 1]
mov dword [rbp - 0x29], eax
mov dword [rbp + 7], ebx
mov word [rbp + 0xb], 0x500
lea rax, [rbp - 0x31]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
mov r9d, 0x220
mov r8d, 0x20
mov dl, 2
lea rcx, [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [rbp - 0x39], eax
test eax, eax
je 0x140144adf
lea r8, [rbp - 0x39]
mov rdx, qword [rbp - 0x31]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x140144ad2
mov dword [rbp - 0x39], ebx
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [rbp - 0x39]
neg eax
sbb eax, eax
and eax, 4
lea rcx, [rbp - 0x19]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x29]
call qword [sym.imp.CRYPT32.dll_CryptProtectData]
mov esi, 0xffffffff
test eax, eax
je 0x140144ba8
mov r8d, dword [rbp - 0x19]
mov rdx, qword [rbp - 0x11]
lea rcx, [rbp - 0x31]
call fcn.14017bbe0
nop
lea rax, [0x14039d110]
mov qword [rbp + 0xf], rax
mov rax, qword [rbp - 0x31]
mov qword [rbp + 0x17], rax
mov ecx, dword [rax - 0x10]
nop
test ecx, 0x30000000
jne 0x140144b4c
lock inc dword [rax - 0x10]
lea r8, [rbp + 0xf]
mov rdx, qword [r14]
mov rcx, qword [r15 + 0x168]
call fcn.14017b4f0
nop
mov rax, qword [rbp + 0xf]
mov rdx, qword [rax + 0x58]
lea rax, [fcn.140005b90]
lea rcx, [rbp + 0x17]
cmp rdx, rax
jne 0x140144b81
xor edx, edx
call fcn.140003440
jmp 0x140144b84
call rdx
nop
mov rcx, qword [rbp - 0x31]
add rcx, 0xfffffffffffffff0
mov eax, dword [rcx]
nop
test eax, 0x30000000
jne 0x140144ba8
mov eax, esi
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x140144ba8
call fcn.1400da0f0
mov rbx, qword [r15 + 0x168]
lea rdi, [rbx + 0x38]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx ebx, byte [rbx + 0x101]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test bl, bl
je 0x140144bdd
mov rcx, qword [r15 + 0x168]
call fcn.140184c80
nop
mov rcx, qword [r14]
add rcx, 0xfffffffffffffff0
mov eax, dword [rcx]
nop
test eax, 0x30000000
jne 0x140144c01
mov eax, esi
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x140144c01
call fcn.1400da0f0
nop
mov rcx, qword [r12]
sub rcx, 0x10
mov eax, dword [rcx]
nop
test eax, 0x30000000
jne 0x140144c23
lock xadd dword [rcx], esi
dec esi
cmp esi, 0xffffffff
jne 0x140144c23
call fcn.1400da0f0
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.1400d9d70
add rsp, 0xc0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret