Function at 0x140003afc
Capabilities:
Acquire debug privileges
Encrypt data using dpapi

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x8c0
mov r13, qword [0x140020e18]
mov rsi, rcx
xor edi, edi
lea rcx, [rax - 0x868]
mov r12d, 0x1388
mov ebx, r8d
mov rbp, rdx
mov qword [rax - 0x868], rdi
mov dword [rax - 0x860], edi
mov dword [rax - 0x85c], r12d
call fcn.140005098
cmp eax, edi
je 0x1400040ad
lea rcx, [rsp + 0x90]
mov r8d, ebx
mov rdx, rbp
call fcn.14000510c
cmp eax, edi
je 0x1400040ad
lea rax, [0x14001ad60]
lea rcx, [rsp + 0x148]
xor edx, edx
mov r8d, 0x778
mov word [rsp + 0x148], di
mov word [rsp + 0x14a], di
mov qword [rsp + 0x140], rax
mov dword [rsp + 0x14c], edi
call sub.msvcrt.dll_memset
lea rdx, [rsi + 0xa90]
lea rcx, [rsp + 0x158]
mov r8d, 0x104
call fcn.140009ff4
mov eax, dword [rsp + 0xf4]
mov ecx, dword [rsp + 0x128]
movdqu xmm0, xmmword [rsp + 0xb8]
movdqu xmmword [rsp + 0x580], xmm0
cmp ecx, edi
mov r11d, dword [rsp + 0xd8]
mov dword [rsp + 0x598], eax
mov eax, dword [rsp + 0xc8]
mov dword [rsp + 0x36c], ecx
mov dword [rsp + 0x594], r11d
mov dword [rsp + 0x590], eax
jbe 0x140003c76
cmp ecx, ebx
jae 0x140003c76
mov eax, dword [rsi + 0xc9c]
mov dword [rsp + 0x374], ecx
lea edx, [rcx + rax]
lea rcx, [0x1400203c0]
call fcn.14000b474
mov ecx, dword [rsi + 0xc9c]
mov r8d, dword [rsp + 0x128]
add rcx, qword [0x1400203c0]
mov rdx, rbp
call sub.msvcrt.dll_memcpy
mov r11d, dword [rsi + 0xc9c]
mov eax, dword [rsp + 0x128]
lea ecx, [r11 + rax]
mov dword [rsp + 0x370], r11d
mov dword [rsi + 0xc9c], ecx
mov rdx, qword [rsp + 0xd0]
lea rcx, [rsp + 0x380]
mov r8d, 0xff
call fcn.140009ff4
xor eax, eax
mov ebp, edi
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x58], rax
mov eax, dword [r13 + 0x16b0]
cmp eax, edi
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x68], edi
mov dword [rsp + 0x6c], r12d
mov r14, rdi
je 0x140003e0b
mov rcx, qword [r13 + 0x16b8]
cmp rcx, rdi
je 0x140003e0b
cmp word [rcx], di
je 0x140003e0b
cmp eax, 1
lea r14, [rsp + 0x50]
jne 0x140003d26
cmp rcx, rdi
lea r12, [0x14001a8d0]
cmovne r12, rcx
lea rcx, [r13 + 0x16b8]
call fcn.14000adb8
lea r8, [rsp + 0x60]
mov rcx, r12
mov edx, eax
call fcn.140002270
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x58], rax
jmp 0x140003e0b
cmp eax, 2
je 0x140003d85
cmp eax, 3
je 0x140003d85
cmp eax, 4
je 0x140003d3e
cmp eax, 5
jne 0x140003e0b
lea rcx, [r13 + 0x16b8]
call fcn.14000adb8
lea r12, [0x14001a8d0]
add eax, eax
cmp qword [r13 + 0x16b8], rdi
cmovne r12, qword [r13 + 0x16b8]
cmp dword [r13 + 0x16b0], 5
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x58], r12
jne 0x140003e0b
add eax, 2
mov dword [rsp + 0x50], eax
jmp 0x140003e0b
lea rcx, [r13 + 0x16b8]
call fcn.14000adb8
mov dword [rsp + 0x918], eax
lea ebx, [rax + 0xa]
movsxd rcx, ebx
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
lea r8, [0x14001a8d0]
mov dword [rsp + 0x68], ebx
mov rdi, rax
mov qword [rsp + 0x60], rax
xor eax, eax
cmp qword [r13 + 0x16b8], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
cmovne r8, qword [r13 + 0x16b8]
or r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp dword [r13 + 0x16b0], 3
mov eax, dword [rsp + 0x918]
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x58], rdi
jne 0x140003e09
add eax, 1
mov dword [rsp + 0x50], eax
xor edi, edi
cmp dword [r13 + 0x18], 2
mov rax, qword [rsp + 0x908]
mov qword [rsp + 0x78], rax
mov eax, dword [rsp + 0x128]
mov dword [rsp + 0x70], eax
jne 0x140003e96
lea rax, [rsp + 0x40]
lea rcx, [rsi + 0x3d8]
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], edi
mov r9, r14
xor r8d, r8d
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call fcn.140006b24
cmp eax, edi
mov ebp, eax
jne 0x140003e6c
mov ecx, dword [rsi + 0x718]
mov dword [rsp + 0x37c], ecx
mov ecx, dword [rsi + 0x71c]
cmp ecx, edi
mov dword [rsp + 0x59c], ecx
je 0x140003fd0
lea rdx, [rsp + 0x140]
mov rcx, rsi
call fcn.140003a80
jmp 0x140003fd0
cmp dword [r13 + 0x18], 1
jne 0x140003fd0
lea rdx, [rsp + 0x70]
lea rcx, [rsi + 0x3d8]
call fcn.140006934
mov r11d, dword [rsi + 0x71c]
cmp r11d, edi
mov dword [rsp + 0x59c], r11d
je 0x140003ed6
lea rdx, [rsp + 0x140]
mov rcx, rsi
call fcn.140003a80
lea rax, [rsp + 0x40]
lea rcx, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov r8, r14
xor edx, edx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
cmp eax, edi
mov ebp, eax
jne 0x140003f33
lea rax, [rsp + 0x40]
lea rdx, [rsp + 0x70]
lea rcx, [rsi + 0x3d8]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], edi
mov r9, r14
xor r8d, r8d
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call fcn.140006b24
mov ebp, eax
cmp dword [r13 + 0x147c], edi
je 0x140003fd0
cmp ebp, edi
jne 0x140003fd0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
call fcn.14000a964
cmp eax, edi
jne 0x140003fd0
call fcn.14000aa58
cmp eax, 1
je 0x140003f6f
call fcn.14000a2c4
cmp dword [rax + 4], 5
ja 0x140003fd0
lea rdx, str.SeDebugPrivilege
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x80], rdi
call fcn.140015a20
lea r11, [rsp + 0x40]
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x38], r11
mov dword [rsp + 0x30], edi
lea rcx, [rsp + 0x918]
mov r9, r14
xor r8d, r8d
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call fcn.140010c94
mov rcx, qword [rsp + 0x80]
cmp rcx, rdi
mov ebp, eax
je 0x140003fd0
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp ebp, edi
mov dword [rsp + 0x378], ebp
je 0x140004093
mov edx, dword [rsp + 0x40]
cmp edx, edi
jbe 0x140004088
mov eax, dword [rsi + 0xc9c]
mov dword [rsp + 0x368], edx
lea rcx, [0x1400203c0]
lea edx, [rax + rdx + 3]
call fcn.14000b474
mov ecx, dword [rsi + 0xc9c]
mov r8d, dword [rsp + 0x40]
add rcx, qword [0x1400203c0]
mov rdx, qword [rsp + 0x48]
call sub.msvcrt.dll_memcpy
mov rax, qword [0x1400203c0]
mov r11d, dword [rsi + 0xc9c]
add r11d, dword [rsp + 0x40]
mov byte [r11 + rax], dil
mov ecx, dword [rsi + 0xc9c]
mov eax, dword [rsp + 0x40]
lea ecx, [rcx + rax + 1]
mov rax, qword [0x1400203c0]
mov byte [rcx + rax], dil
mov ecx, dword [rsi + 0xc9c]
mov eax, dword [rsp + 0x40]
lea ecx, [rcx + rax + 2]
mov rax, qword [0x1400203c0]
mov byte [rcx + rax], dil
mov ecx, dword [rsi + 0xc9c]
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x364], ecx
lea ecx, [rcx + rax + 3]
mov dword [rsi + 0xc9c], ecx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rdx, [rsp + 0x140]
mov rcx, rsi
call fcn.14000dab8
lea rcx, [rsp + 0x60]
call fcn.14000b450
mov rcx, qword [rsp + 0x90]
cmp rcx, rdi
je 0x1400040ce
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rsp + 0x90], rdi
mov dword [rsp + 0x98], edi
lea rcx, [rsp + 0x90]
call fcn.14000b450
mov rbx, qword [rsp + 0x900]
add rsp, 0x8c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret