Function at 0x4152e0
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
mov eax, dword [0x53c014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov esi, 0x80070057
cmp dword [ebp + 0xc], 1
jg 0x41549b
push dword [ebp + 0x10]
call dword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
test eax, eax
je 0x41549b
mov ebx, eax
call dword [sym.imp.ole32.dll_CoImpersonateClient]
test eax, eax
js 0x415462
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x50], esp
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
xor edi, edi
dec edi
lea eax, [ebp - 0x1c]
mov dword [eax], edi
push eax
mov esi, esp
push 0x14
call fcn.004e8c26
add esp, 4
mov ebx, eax
mov ecx, eax
push 0x4144e0
push 0x4144d0
call fcn.00442a90
mov dword [esi], ebx
lea ecx, [ebp - 0x1c]
call fcn.004429e0
mov esp, dword [ebp - 0x50]
lea esi, [ebp - 0x24]
mov dword [esi + 4], edi
mov dword [esi], edi
mov ecx, esi
call fcn.00415538
mov ecx, esi
call fcn.0044b290
test al, al
je 0x415466
lea ebx, [ebp - 0x30]
xor eax, eax
dec eax
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
push esi
push dword [ebp + 0xc]
push ebx
call fcn.00412f10
add esp, 0xc
movzx eax, byte [ebx + 0xb]
mov ecx, eax
test al, al
jns 0x4153ac
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x415470
xor esi, esi
lea edi, [ebp - 0x3c]
mov dword [edi + 4], esi
mov dword [edi], esi
mov dword [edi + 8], esi
push edi
push ebx
call fcn.0041559a
add esp, 8
lea ebx, [ebp - 0x48]
mov ecx, ebx
push dword [ebp - 0x4c]
push dword [ebp + 0x10]
call fcn.004155f4
push edi
push ebx
call fcn.0041559a
add esp, 8
cmp byte [ebx + 0xb], 0
jns 0x4153f6
push dword [ebp - 0x48]
call fcn.004e8c56
add esp, 4
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x48], esi
movzx eax, byte [ebp - 0x31]
test al, al
jns 0x41540a
mov edi, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edi
sub esp, 0x1c
lea eax, [ebp - 0x18]
mov dword [esp + 0x18], eax
xorps xmm0, xmm0
movups xmmword [esp + 8], xmm0
mov dword [esp], ebx
mov dword [esp + 4], 0x520be2
call dword [sym.imp.CRYPT32.dll_CryptProtectData]
xor edi, edi
test eax, eax
jne 0x415447
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
xor edi, edi
inc edi
cmp byte [ebp - 0x31], 0
jns 0x415458
push dword [ebp - 0x3c]
call fcn.004e8c56
add esp, 4
mov esi, 0x8004a005
mov al, byte [ebp - 0x25]
jmp 0x415478
mov esi, eax
jmp 0x41549b
xor edi, edi
inc edi
mov esi, 0x8004a001
jmp 0x415487
xor edi, edi
inc edi
mov esi, 0x8004a002
test al, al
jns 0x415487
push dword [ebp - 0x30]
call fcn.004e8c56
add esp, 4
lea ecx, [ebp - 0x24]
call fcn.00414500
lea ecx, [ebp - 0x1c]
call fcn.00442a10
test edi, edi
je 0x4154b1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e96e3
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
xor eax, eax
lea ecx, [ebp - 0x30]
mov dword [ecx + 4], eax
mov dword [ecx], eax
lea eax, [ebp - 0x18]
mov ebx, dword [eax + 4]
sub esp, 0x1c
mov dword [esp + 0x18], ecx
xorps xmm0, xmm0
movups xmmword [esp + 8], xmm0
mov dword [esp], eax
mov dword [esp + 4], 0x520be2
call dword [sym.imp.CRYPT32.dll_CryptProtectData]
mov edi, eax
test eax, eax
jne 0x4154f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov esi, 0x8004a006
test ebx, ebx
je 0x415502
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
test edi, edi
je 0x41549b
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp - 0x2c]
push dword [ebp - 0x30]
push edi
call dword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov dword [esi], eax
xor ecx, ecx
test eax, eax
mov esi, 0x8007000e
cmovne esi, ecx
test edi, edi
je 0x41549b
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x41549b