Function at 0x402985
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x830
mov eax, dword [0x416ae8]
and dword [ebp - 0xb4], 0
and dword [ebp - 0xb0], 0
push ebx
push esi
add eax, 0x18
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
lea ebx, [ebp - 0xb4]
mov dword [ebp - 0xac], 0x1388
call fcn.0040343a
test eax, eax
je 0x402d94
xor eax, eax
mov word [ebp - 0x828], ax
mov word [ebp - 0x826], ax
mov dword [ebp - 0x824], eax
lea eax, [ebp - 0x82c]
push eax
mov eax, 0x778
mov dword [ebp - 0x82c], 0x4128e4
call fcn.00406def
mov ebx, dword [ebp + 8]
pop ecx
lea eax, [ebx + 0x9d8]
push eax
mov eax, 0x104
lea edi, [ebp - 0x81c]
call fcn.004065e5
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x3e0], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x3dc], eax
mov eax, dword [ebp - 0x80]
lea esi, [ebp - 0x90]
lea edi, [ebp - 0x3f4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x3e4], eax
mov eax, dword [ebp - 0x40]
xor esi, esi
cmp eax, esi
pop ecx
mov dword [ebp - 0x608], eax
jbe 0x402aa4
cmp eax, dword [ebp + 0x10]
jae 0x402aa4
mov ecx, dword [ebx + 0xbe4]
add ecx, eax
mov dword [ebp - 0x600], eax
push ecx
mov eax, 0x416330
call fcn.00407baa
push dword [ebp - 0x40]
mov eax, dword [ebx + 0xbe4]
add eax, dword [0x416330]
push dword [ebp + 0xc]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebx + 0xbe4]
mov ecx, dword [ebp - 0x40]
add esp, 0xc
mov dword [ebp - 0x604], eax
add eax, ecx
mov dword [ebx + 0xbe4], eax
push dword [ebp - 0x78]
mov eax, 0xff
lea edi, [ebp - 0x5f4]
call fcn.004065e5
xor eax, eax
lea edi, [ebp - 8]
mov dword [ebp - 0xc], esi
stosd dword es:[edi], eax
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], esi
stosd dword es:[edi], eax
mov edi, dword [ebp - 0x18]
pop ecx
mov ecx, dword [edi + 0x1690]
cmp ecx, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], 0x1388
mov dword [ebp - 0x1c], esi
je 0x402bd2
lea esi, [edi + 0x1694]
mov eax, esi
call fcn.004076a8
cmp word [eax], 0
je 0x402bd2
cmp ecx, 1
lea eax, [ebp - 0x14]
mov dword [ebp - 0x1c], eax
jne 0x402b38
lea eax, [ebp - 0x30]
push eax
mov eax, esi
call fcn.004076f5
push eax
mov eax, esi
call fcn.004076a8
push eax
call fcn.00401dd9
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x30]
add esp, 0xc
mov dword [ebp - 0x10], eax
jmp 0x402bd2
cmp ecx, 2
je 0x402b78
cmp ecx, 3
je 0x402b78
cmp ecx, 4
je 0x402b50
cmp ecx, 5
jne 0x402bd2
mov eax, esi
call fcn.004076f5
mov ecx, eax
add ecx, ecx
mov eax, esi
mov dword [ebp - 0x14], ecx
call fcn.004076a8
cmp dword [edi + 0x1690], 5
mov dword [ebp - 0x10], eax
jne 0x402bd2
inc ecx
inc ecx
mov dword [ebp - 0x14], ecx
jmp 0x402bd2
mov eax, esi
call fcn.004076f5
lea esi, [ebp - 0x30]
mov dword [ebp - 0x18], eax
call fcn.00407c0d
mov esi, dword [ebp - 0x18]
add esi, 0xa
push esi
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
xor ecx, ecx
push ecx
push ecx
push esi
push eax
mov dword [ebp - 0x30], eax
push 0xffffffffffffffff
lea eax, [edi + 0x1694]
mov dword [ebp - 0x2c], esi
call fcn.004076a8
push eax
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp dword [edi + 0x1690], 3
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
jne 0x402bd2
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x24], eax
mov eax, dword [edi]
cmp eax, 2
jne 0x402c20
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x1c]
lea eax, [ebx + 0x348]
push eax
lea eax, [ebp - 0x24]
call fcn.00404701
test eax, eax
mov dword [ebp + 0x10], eax
jne 0x402c0e
mov eax, dword [ebx + 0x664]
mov dword [ebp - 0x5f8], eax
lea esi, [ebp - 0x82c]
mov eax, ebx
call fcn.0040290e
jmp 0x402ccf
cmp eax, 1
jne 0x402ccf
lea ecx, [ebx + 0x348]
lea eax, [ebp - 0x24]
call fcn.004045b9
lea esi, [ebp - 0x82c]
mov eax, ebx
call fcn.0040290e
lea eax, [ebp - 0xc]
push eax
xor esi, esi
push esi
push esi
push esi
push dword [ebp - 0x1c]
lea eax, [ebp - 0x24]
push esi
push eax
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
cmp eax, esi
mov dword [ebp + 0x10], eax
jne 0x402c7b
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x1c]
lea eax, [ebx + 0x348]
push eax
lea eax, [ebp - 0x24]
call fcn.00404701
mov dword [ebp + 0x10], eax
cmp dword [edi + 0x1464], esi
je 0x402ccf
cmp dword [ebp + 0x10], esi
jne 0x402ccf
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.004072ca
test eax, eax
pop ecx
jne 0x402ccf
call fcn.004074cc
cmp eax, 1
je 0x402cac
call fcn.0040694f
test eax, eax
jne 0x402ccf
and dword [ebp + 0xc], esi
lea eax, [ebp + 0xc]
call fcn.0040e744
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0040c069
lea esi, [ebp + 0xc]
mov dword [ebp + 0x10], eax
call fcn.0040e6dc
mov eax, dword [ebp + 0x10]
test eax, eax
mov dword [ebp - 0x5fc], eax
je 0x402d7e
mov eax, dword [ebp - 0xc]
test eax, eax
jbe 0x402d75
mov ecx, dword [ebx + 0xbe4]
mov dword [ebp - 0x60c], eax
lea eax, [ecx + eax + 3]
push eax
mov eax, 0x416330
call fcn.00407baa
push dword [ebp - 0xc]
mov eax, dword [ebx + 0xbe4]
push dword [ebp - 8]
add eax, dword [0x416330]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebx + 0xbe4]
add eax, dword [ebp - 0xc]
mov ecx, dword [0x416330]
mov byte [eax + ecx], 0
mov eax, dword [ebx + 0xbe4]
add eax, dword [ebp - 0xc]
mov ecx, dword [0x416330]
mov byte [eax + ecx + 1], 0
mov eax, dword [ebx + 0xbe4]
mov ecx, dword [0x416330]
add esp, 0xc
add eax, dword [ebp - 0xc]
mov byte [eax + ecx + 2], 0
mov eax, dword [ebx + 0xbe4]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x610], eax
lea eax, [eax + ecx + 3]
mov dword [ebx + 0xbe4], eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp + 8]
lea ebx, [ebp - 0x82c]
call fcn.00409be8
lea esi, [ebp - 0x30]
call fcn.00407c0d
lea esi, [ebp - 0xb4]
call fcn.00407c0d
call fcn.00407c0d
pop edi
pop esi
pop ebx
leave
ret 0xc