Function at 0x1400cd150
Capabilities:
Encrypt data using dpapi

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov dword [rax + 0x10], edx
mov qword [rax + 8], rcx
push rbp
lea rbp, [rax - 0x28]
sub rsp, 0x120
mov qword [rax - 0x10], rbx
mov edx, 0xfffd
mov qword [rax - 0x18], rsi
mov qword [rax - 0x20], rdi
mov qword [rax - 0x28], r12
mov r12d, r9d
mov qword [rax - 0x30], r13
mov r13, qword [rbp + 0x50]
mov qword [rax - 0x38], r14
mov qword [rax - 0x40], r15
xor r15d, r15d
mov dword [rsp + 0x60], r15d
lea rax, [0x140151eb8]
mov qword [rbp - 0x28], rax
mov eax, r15d
mov qword [rsp + 0x68], rax
mov esi, r15d
mov dword [rbp - 0x38], reloc.ODBC32.dll_SQLAllocHandle
mov dword [rbp - 0x34], reloc.Cabinet.dll_FCIAddFile
mov qword [rbp - 0x30], r15
mov qword [rsp + 0x70], r15
mov qword [rbp - 0x70], r15
mov dword [rbp - 0x80], r15d
mov dword [rbp + 0x48], r15d
test r9d, r9d
jle 0x1400cd4fa
mov rdi, r13
nop
mov rcx, qword [rdi]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], r15w
jne 0x1400cd1f0
cmp rax, 1
jbe 0x1400cd269
movzx eax, word [rcx]
sub ax, 0x2d
test dx, ax
jne 0x1400cd269
mov edx, 0x3a
lea rbx, [rcx + 2]
call fcn.14011a790
test rax, rax
jne 0x1400cd242
mov rcx, qword [rdi]
lea edx, [rax + 0x3d]
call fcn.14011a790
test rax, rax
jne 0x1400cd242
mov rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], r15w
jne 0x1400cd236
jmp 0x1400cd248
sub rax, rbx
sar rax, 1
cmp rax, 9
jne 0x1400cd264
mov r8, rax
lea rcx, str.unprotect
mov rdx, rbx
call fcn.140129ad0
test eax, eax
je 0x1400cd27a
mov edx, 0xfffd
inc esi
add rdi, 8
cmp esi, r12d
jl 0x1400cd1e0
jmp 0x1400cd281
mov dword [rbp + 0x48], 1
mov rdi, r13
mov r14d, r15d
nop word [rax + rax]
mov rcx, qword [rdi]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], r15w
jne 0x1400cd2a0
cmp rax, 1
jbe 0x1400cd326
movzx eax, word [rcx]
mov edx, 0xfffd
sub ax, 0x2d
test dx, ax
jne 0x1400cd326
mov edx, 0x3a
lea rbx, [rcx + 2]
call fcn.14011a790
mov rsi, rax
test rax, rax
jne 0x1400cd2fd
mov rcx, qword [rdi]
lea edx, [rax + 0x3d]
call fcn.14011a790
mov rsi, rax
test rax, rax
jne 0x1400cd2fd
mov rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], r15w
jne 0x1400cd2f1
jmp 0x1400cd306
mov rax, rsi
sub rax, rbx
sar rax, 1
cmp rax, 9
jne 0x1400cd326
mov r8, rax
lea rcx, str.masterkey
mov rdx, rbx
call fcn.140129ad0
test eax, eax
je 0x1400cd3d0
inc r14d
add rdi, 8
cmp r14d, r12d
jl 0x1400cd290
test r12d, r12d
jle 0x1400cd4fe
mov rsi, r13
mov r14d, r15d
nop word [rax + rax]
mov rcx, qword [rsi]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], r15w
jne 0x1400cd360
cmp rax, 1
jbe 0x1400cd4cf
movzx eax, word [rcx]
mov edx, 0xfffd
sub ax, 0x2d
test dx, ax
jne 0x1400cd4cf
mov edx, 0x3a
lea rbx, [rcx + 2]
call fcn.14011a790
mov rdi, rax
test rax, rax
jne 0x1400cd4aa
mov rcx, qword [rsi]
lea edx, [rax + 0x3d]
call fcn.14011a790
mov rdi, rax
test rax, rax
jne 0x1400cd4aa
mov rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], r15w
jne 0x1400cd3c1
jmp 0x1400cd4b3
test rsi, rsi
je 0x1400cd336
cmp word [rsi + 2], r15w
je 0x1400cd336
mov r14, 0xffffffffffffffff
nop dword [rax + rax]
inc r14
cmp word [rsi + r14*2 + 2], r15w
jne 0x1400cd3f0
mov qword [rbp - 0x80], r14
test r14b, 1
jne 0x1400cd336
shr r14d, 1
mov ecx, 0x40
mov edx, r14d
mov qword [rbp - 0x80], r14
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x70], rax
test rax, rax
je 0x1400cd336
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rsi + rdx*2 + 2], r15w
jne 0x1400cd433
lea ecx, [r14 + r14]
cmp rdx, rcx
jne 0x1400cd493
mov ebx, r15d
test r14d, r14d
je 0x1400cd33f
mov rdi, rax
nop word [rax + rax]
lea ecx, [rbx + rbx]
lea rcx, [rcx + 1]
lea rcx, [rsi + rcx*2]
lea r8, [rsp + 0x78]
lea rdx, [0x14015fbc0]
call fcn.140012090
movzx eax, byte [rsp + 0x78]
inc ebx
mov byte [rdi], al
lea rdi, [rdi + 1]
cmp ebx, r14d
jb 0x1400cd460
jmp 0x1400cd33f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0x70], rax
mov dword [rbp - 0x80], r15d
jmp 0x1400cd33f
mov rax, rdi
sub rax, rbx
sar rax, 1
cmp rax, 8
jne 0x1400cd4cf
mov r8, rax
lea rcx, str.password
mov rdx, rbx
call fcn.140129ad0
test eax, eax
je 0x1400cd4e1
inc r14d
add rsi, 8
cmp r14d, r12d
jl 0x1400cd350
jmp 0x1400cd4fe
test rdi, rdi
je 0x1400cd4fe
cmp word [rdi + 2], 0
lea r15, [rdi + 2]
mov qword [rbp - 0x68], r15
jne 0x1400cd502
xor r15d, r15d
jmp 0x1400cd4fe
mov dword [rbp + 0x48], r15d
mov qword [rbp - 0x68], r15
xor r14d, r14d
test r12d, r12d
jle 0x1400cd800
mov rdi, r13
mov rcx, qword [rdi]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400cd520
cmp rax, 1
jbe 0x1400cd5a2
movzx eax, word [rcx]
mov edx, 0xfffd
sub ax, 0x2d
test dx, ax
jne 0x1400cd5a2
mov edx, 0x3a
lea rbx, [rcx + 2]
call fcn.14011a790
mov rsi, rax
test rax, rax
jne 0x1400cd57d
mov rcx, qword [rdi]
lea edx, [rax + 0x3d]
call fcn.14011a790
mov rsi, rax
test rax, rax
jne 0x1400cd57d
mov rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], 0
jne 0x1400cd571
jmp 0x1400cd586
mov rax, rsi
sub rax, rbx
sar rax, 1
cmp rax, 7
jne 0x1400cd5a2
mov r8, rax
lea rcx, str.entropy
mov rdx, rbx
call fcn.140129ad0
test eax, eax
je 0x1400cd5b7
inc r14d
add rdi, 8
cmp r14d, r12d
jl 0x1400cd511
jmp 0x1400cd68f
test rsi, rsi
je 0x1400cd686
cmp word [rsi + 2], 0
je 0x1400cd686
mov r14, 0xffffffffffffffff
inc r14
cmp word [rsi + r14*2 + 2], 0
jne 0x1400cd5d2
mov qword [rsp + 0x68], r14
test r14b, 1
jne 0x1400cd686
shr r14d, 1
mov ecx, 0x40
mov edx, r14d
mov qword [rsp + 0x68], r14
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp - 0x70], rax
test rax, rax
je 0x1400cd686
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rsi + rdx*2 + 2], 0
jne 0x1400cd613
lea ecx, [r14 + r14]
cmp rdx, rcx
jne 0x1400cd670
xor ebx, ebx
test r14d, r14d
je 0x1400cd68f
mov rdi, rax
nop dword [rax]
nop word [rax + rax]
lea ecx, [rbx + rbx]
lea rcx, [rcx + 1]
lea rcx, [rsi + rcx*2]
lea r8, [rsp + 0x78]
lea rdx, [0x14015fbc0]
call fcn.140012090
movzx eax, byte [rsp + 0x78]
inc ebx
mov byte [rdi], al
lea rdi, [rdi + 1]
cmp ebx, r14d
jb 0x1400cd640
jmp 0x1400cd68f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbp - 0x70], rax
xor eax, eax
mov qword [rsp + 0x68], rax
jmp 0x1400cd68f
test r12d, r12d
jle 0x1400cd800
mov rdi, r13
xor esi, esi
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [rdi]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400cd6b0
cmp rax, 1
jbe 0x1400cd732
movzx eax, word [rcx]
mov edx, 0xfffd
sub ax, 0x2d
test dx, ax
jne 0x1400cd732
mov edx, 0x3a
lea rbx, [rcx + 2]
call fcn.14011a790
test rax, rax
jne 0x1400cd70c
mov rcx, qword [rdi]
lea edx, [rax + 0x3d]
call fcn.14011a790
test rax, rax
jne 0x1400cd70c
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x1400cd700
jmp 0x1400cd712
sub rax, rbx
sar rax, 1
cmp rax, 6
jne 0x1400cd732
mov r8, rax
lea rcx, str.prompt
mov rdx, rbx
call fcn.140129ad0
test eax, eax
je 0x1400cd7bc
inc esi
add rdi, 8
cmp esi, r12d
jl 0x1400cd6a0
xor r14d, r14d
mov qword [rsp + 0x78], r14
xor edi, edi
nop dword [rax + rax]
mov rcx, qword [r13]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400cd760
cmp rax, 1
jbe 0x1400cd7e7
movzx eax, word [rcx]
mov edx, 0xfffd
sub ax, 0x2d
test dx, ax
jne 0x1400cd7e7
mov edx, 0x3a
lea rbx, [rcx + 2]
call fcn.14011a790
test rax, rax
jne 0x1400cd7c5
mov rcx, qword [r13]
lea edx, [rax + 0x3d]
call fcn.14011a790
test rax, rax
jne 0x1400cd7c5
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x1400cd7b0
jmp 0x1400cd7cb
lea r14, [rbp - 0x38]
jmp 0x1400cd744
sub rax, rbx
sar rax, 1
cmp rax, 7
jne 0x1400cd7e7
mov r8, rax
lea rcx, str.machine
mov rdx, rbx
call fcn.140129ad0
test eax, eax
je 0x1400cd7f8
inc edi
add r13, 8
cmp edi, r12d
jl 0x1400cd750
jmp 0x1400cd808
mov r13d, 1
jmp 0x1400cd80b
xor r14d, r14d
mov qword [rsp + 0x78], r14
xor r13d, r13d
mov rcx, qword [rbp + 0x30]
lea r13d, [r13*4]
call fcn.1400062e0
mov rsi, rax
test rax, rax
je 0x1400cde55
mov rbx, qword [0x1401ac288]
lea rcx, [0x1401ac288]
cmp rbx, rcx
je 0x1400cd85c
nop dword [rax + rax]
mov rax, qword [rsi + 0x18]
cmp rax, qword [rbx + 0x10]
jne 0x1400cd854
mov rax, qword [rsi + 0x20]
cmp rax, qword [rbx + 0x18]
je 0x1400cd87b
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x1400cd840
xor ebx, ebx
mov r12, qword [rsp + 0x70]
test r12, r12
je 0x1400cd86e
cmp dword [rbp - 0x80], 0
jne 0x1400cd885
mov eax, dword [rbp + 0x48]
test eax, eax
je 0x1400cddf2
jmp 0x1400cd888
test rbx, rbx
je 0x1400cd85e
mov r12, qword [rsp + 0x70]
mov eax, dword [rbp + 0x48]
mov rdx, qword [rbp + 0x78]
test rdx, rdx
je 0x1400cd89d
lea rcx, [0x14015fc60]
call fcn.14000afb0
test eax, eax
je 0x1400cd8ad
lea rcx, str.__using_CryptUnprotectData_API_n
call fcn.14000afb0
test rbx, rbx
je 0x1400cd95b
lea rcx, str.__volatile_cache:
call fcn.14000afb0
lea rcx, str.GUID:
call fcn.14000afb0
lea rcx, [rbx + 0x10]
lea rdx, [rbp - 0x60]
call qword [sym.imp.ntdll.dll_RtlStringFromGUID]
test eax, eax
js 0x1400cd8fa
lea rdx, [rbp - 0x60]
lea rcx, [0x14015fbb8]
call fcn.14000afb0
lea rcx, [rbp - 0x60]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
lea rcx, [0x14016bb64]
call fcn.14000afb0
lea rcx, [0x14016bb68]
call fcn.14000afb0
lea rax, [rbx + 0x20]
mov r8d, SQLAllocHandle
nop dword [rax]
movzx edx, byte [rax]
lea rcx, [0x14015fbc0]
call fcn.14000afb0
lea rax, [rax + 1]
sub r8, 1
jne 0x1400cd920
cmp qword [rbx + 0x38], r8
lea rax, [0x140150bf0]
lea rdx, str.not
cmovne rdx, rax
lea rcx, str._Key:_savailable_n
call fcn.14000afb0
test r12, r12
je 0x1400cd9a5
lea rcx, str.__masterkey_____:
call fcn.14000afb0
mov rcx, qword [rbp - 0x80]
test ecx, ecx
je 0x1400cd999
mov rax, r12
mov r8d, ecx
nop word [rax + rax]
movzx edx, byte [rax]
lea rcx, [0x14015fbc0]
call fcn.14000afb0
lea rax, [rax + 1]
sub r8, 1
jne 0x1400cd980
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.14000afb0
test r14, r14
je 0x1400cd9fa
lea rcx, str.___prompt_flags__:
call fcn.14000afb0
mov r10d, dword [r14 + 4]
lea r9, str.on_unprotect
xor r8d, r8d
mov eax, r10d
mov ecx, r8d
shr eax, cl
test al, 1
je 0x1400cd9df
mov rdx, qword [r9]
lea rcx, [0x1401557e8]
call fcn.14000afb0
inc r8d
add r9, 8
cmp r8d, 5
jb 0x1400cd9c4
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.14000afb0
jmp 0x1400cd9fe
or r13d, 1
mov r10, qword [rbp - 0x70]
test r10, r10
je 0x1400cda57
lea rcx, str.___entropy_______:
call fcn.14000afb0
mov r9, qword [rsp + 0x68]
test r9d, r9d
je 0x1400cda49
mov rax, r10
mov r8d, r9d
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [rax]
lea rcx, [0x14015fbc0]
call fcn.14000afb0
lea rax, [rax + 1]
sub r8, 1
jne 0x1400cda30
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.14000afb0
jmp 0x1400cda5c
mov r9, qword [rsp + 0x68]
test r15, r15
je 0x1400cda70
mov rdx, r15
lea rcx, str.___password______:__s_n
call fcn.14000afb0
mov r15, qword [rbp + 0x70]
mov r12, qword [rbp + 0x68]
mov r14d, dword [rbp + 0x60]
mov rdi, qword [rbp + 0x58]
test rbx, rbx
je 0x1400cdb04
test rdi, rdi
je 0x1400cda97
test r14d, r14d
je 0x1400cda97
mov ecx, r14d
mov r9, rdi
jmp 0x1400cdaac
mov ecx, r9d
test rdi, rdi
je 0x1400cdaa9
test r14d, r14d
je 0x1400cdaa9
mov r9, rdi
jmp 0x1400cdaac
mov r9, r10
mov rdx, qword [rbp - 0x68]
lea rax, [rbx + 0x20]
mov rbx, qword [rbp + 0x30]
mov r8, qword [rbp + 0x40]
mov qword [rsp + 0x58], rdx
mov edx, dword [rbp + 0x38]
mov dword [rsp + 0x50], Ordinal_26
mov qword [rsp + 0x48], rax
xor eax, eax
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov rcx, rbx
call fcn.140007d60
mov dword [rsp + 0x60], eax
test eax, eax
jne 0x1400cddf2
mov r10, qword [rbp - 0x70]
jmp 0x1400cdb08
mov rbx, qword [rbp + 0x30]
mov r9, qword [rsp + 0x70]
test r9, r9
je 0x1400cdb18
cmp dword [rbp - 0x80], 0
jne 0x1400cdb22
cmp dword [rbp + 0x48], 0
je 0x1400cddf2
test rdi, rdi
je 0x1400cdb4c
test r14d, r14d
je 0x1400cdb36
mov eax, r14d
mov qword [rsp + 0x68], rax
jmp 0x1400cdb54
test rdi, rdi
je 0x1400cdb4c
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x68], rax
test r14d, r14d
je 0x1400cdb51
jmp 0x1400cdb54
mov rax, qword [rsp + 0x68]
mov rdi, r10
mov ecx, dword [rbp + 0x38]
mov r14, qword [rbp - 0x80]
mov dword [rbp - 0x50], ecx
mov qword [rbp - 0x48], rbx
mov dword [rbp - 0x60], eax
mov qword [rbp - 0x58], rdi
test r9, r9
je 0x1400cdc0d
test r14d, r14d
je 0x1400cdc0d
mov rcx, rbx
call fcn.1400062e0
mov rbx, rax
test rax, rax
je 0x1400cdc80
mov rax, qword [rbp - 0x68]
mov r9, rdi
mov qword [rsp + 0x38], r15
mov r8d, r14d
mov qword [rsp + 0x30], r12
mov rcx, rbx
mov r12, qword [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov rdx, r12
mov rax, qword [rsp + 0x68]
mov dword [rsp + 0x20], eax
call fcn.140007790
mov edi, eax
test eax, eax
je 0x1400cdc03
mov r15, qword [rbp + 0x40]
test r15, r15
je 0x1400cdc03
cmp qword [rbx + 0x30], 0
je 0x1400cdc03
mov ecx, dword [rbx + 0x2c]
test ecx, ecx
je 0x1400cdc03
mov edx, ecx
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [r15], rax
test rax, rax
je 0x1400cdc03
mov r8d, dword [rbx + 0x2c]
mov rcx, rax
mov rdx, qword [rbx + 0x30]
call fcn.14011b4a0
mov rcx, rbx
call fcn.140006430
jmp 0x1400cdc87
mov rdx, qword [rbp + 0x40]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea r8, [rbp - 0x60]
mov rax, qword [rsp + 0x78]
lea rcx, [rbp - 0x50]
mov dword [rsp + 0x28], r13d
xor r9d, r9d
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
mov dword [rsp + 0x60], eax
mov edi, eax
test eax, eax
je 0x1400cdc82
mov eax, dword [rbp - 0x80]
mov ecx, 0x40
mov edx, eax
mov dword [r15], eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [r12], rax
test rax, rax
je 0x1400cdc6f
mov r8d, dword [r15]
mov rcx, rax
mov rdx, qword [rbp - 0x78]
call fcn.14011b4a0
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r12, qword [rsp + 0x70]
jmp 0x1400cdc93
xor edi, edi
mov r12, qword [rsp + 0x70]
mov dword [rsp + 0x60], edi
test edi, edi
je 0x1400cdda9
test r12, r12
je 0x1400cddf2
test r14d, r14d
je 0x1400cddf2
lea rdi, [rsi + 0x18]
test rdi, rdi
je 0x1400cdd9b
mov rcx, qword [0x1401ac288]
lea r15, [0x1401ac288]
cmp rcx, r15
je 0x1400cdceb
mov rax, qword [rdi]
cmp rax, qword [rcx + 0x10]
jne 0x1400cdcd8
mov rax, qword [rdi + 8]
cmp rax, qword [rcx + 0x18]
je 0x1400cdce2
mov rcx, qword [rcx]
cmp rcx, r15
jne 0x1400cdcc5
jmp 0x1400cdceb
test rcx, rcx
jne 0x1400cddf2
mov edx, 0x40
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x1400cddf2
movups xmm0, xmmword [rdi]
movups xmmword [rax + 0x10], xmm0
cmp r14d, 0x14
jne 0x1400cdd24
movups xmm0, xmmword [r12]
movups xmmword [rax + 0x20], xmm0
mov eax, dword [r12 + 0x10]
mov dword [rbx + 0x30], eax
jmp 0x1400cdd7a
lea r9, [rbp - 0x50]
mov dword [rsp + 0x20], Ordinal_26
mov r8d, r14d
mov rdx, r12
mov ecx, 0x8004
call fcn.1400032b0
movups xmm0, xmmword [rbp - 0x50]
mov edx, r14d
mov ecx, 0x40
mov edi, r14d
movups xmmword [rbx + 0x20], xmm0
mov eax, dword [rbp - 0x40]
mov dword [rbx + 0x30], eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbx + 0x38], rax
test rax, rax
je 0x1400cdd7a
mov r8d, edi
mov rdx, r12
mov rcx, rax
call fcn.14011b4a0
mov dword [rbx + 0x34], r14d
mov rax, qword [0x1401ac290]
mov qword [rbx + 8], rax
mov qword [rbx], r15
mov rax, qword [0x1401ac290]
mov qword [rax], rbx
mov qword [0x1401ac290], rbx
jmp 0x1400cddf2
lea rcx, str.ERROR_kuhl_m_dpapi_oe_masterkey_add___No_GUID_or_Key_Hash_
call fcn.14000afb0
jmp 0x1400cddf2
test r12, r12
jne 0x1400cddf2
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x8009000b
jne 0x1400cddde
lea rcx, str.ERROR_kuhl_m_dpapi_unprotect_raw_or_blob___NTE_BAD_KEY_STATE__needed_Masterkey_is:
call fcn.14000afb0
lea rcx, [rsi + 0x18]
call fcn.1400126d0
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.14000afb0
jmp 0x1400cddf2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_kuhl_m_dpapi_unprotect_raw_or_blob___CryptUnprotectData__0x_08x__n
call fcn.14000afb0
mov rcx, qword [rsi + 0x30]
test rcx, rcx
je 0x1400cde01
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsi + 0x44]
test rcx, rcx
je 0x1400cde10
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsi + 0x50]
test rcx, rcx
je 0x1400cde1f
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsi + 0x64]
test rcx, rcx
je 0x1400cde2e
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsi + 0x70]
test rcx, rcx
je 0x1400cde3d
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsi + 0x7c]
test rcx, rcx
je 0x1400cde4c
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rbp - 0x70]
mov r15, qword [rsp + 0xe8]
mov r14, qword [rsp + 0xf0]
mov r13, qword [rsp + 0xf8]
mov r12, qword [rsp + 0x100]
mov rdi, qword [rsp + 0x108]
mov rsi, qword [rsp + 0x110]
mov rbx, qword [rsp + 0x118]
test rax, rax
je 0x1400cde9f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x1400cdeb2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [rsp + 0x60]
add rsp, 0x120
pop rbp
ret