Function at 0x1121020
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1146945
mov eax, dword fs:[0]
push eax
sub esp, 0x1fc
mov eax, dword [0x115f604]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x14]
xor ebx, ebx
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x138], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x130], ebx
mov edx, dword [0x1161d94]
mov eax, dword [edx + 0xc]
mov ecx, 0x1161d94
mov byte [ebp - 4], 1
call eax
add eax, 0x10
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x128], ebx
mov edx, dword [0x1161d94]
mov eax, dword [edx + 0xc]
mov ecx, 0x1161d94
mov byte [ebp - 4], 3
call eax
add eax, 0x10
mov dword [ebp - 0x13c], eax
lea ecx, [ebp - 0x184]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov dword [ebp - 0x140], ebx
push ebx
push 0x10678a0
lea edx, [ebp - 0x120]
push edx
push 0x1067820
lea eax, [ebp - 0x11c]
push 2
push eax
mov byte [ebp - 4], 6
call fcn.01075110
add esp, 0x18
mov byte [edi], bl
mov edx, dword [0x1161d94]
mov eax, dword [edx + 0xc]
mov ecx, 0x1161d94
mov byte [ebp - 4], 7
mov dword [ebp - 0x16c], ebx
call eax
add eax, 0x10
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x164], ebx
cmp byte [ebp + 8], bl
mov eax, dword [0x115f560]
mov byte [ebp - 4], 8
jne 0x112112c
mov eax, dword [0x115f564]
push 0xffffffffffffffff
push eax
push ebx
lea ecx, [ebp - 0x16c]
call fcn.010c8ad0
test eax, eax
jne 0x1121192
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x112114f
call esi
jmp 0x112115b
call esi
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x120], eax
call fcn.01127f00
test al, al
je 0x11213b6
mov ecx, dword [ebp - 0x120]
push 0x10677f0
push ecx
push 0x1066708
push 0x1067770
push ebx
call fcn.01128b70
add esp, 0x14
jmp 0x11213b6
cmp esi, ebx
je 0x112167e
cmp word [esi], bx
je 0x112167e
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x138]
push edx
push eax
call fcn.01120240
cmp eax, ebx
mov dword [ebp - 0x120], eax
jge 0x11211e9
call fcn.01127f00
test al, al
je 0x11213b6
mov ecx, dword [ebp - 0x120]
push ecx
push 0x1066fb8
push 0x10676f0
push ebx
call fcn.01128b70
add esp, 0x10
jmp 0x11213b6
lea edx, [ebp - 0x134]
push edx
push 0xffffffffffffffff
push esi
call fcn.011258c0
lea ecx, [ebp - 0x134]
call fcn.0109d5e0
mov eax, dword [0x1162c5c]
mov ecx, dword [ebp - 0x134]
mov edx, dword [0x1162c64]
push eax
mov eax, dword [0x1162c58]
push ecx
push edx
push eax
lea ecx, [ebp - 0x13c]
push 0x1065944
push ecx
call fcn.0109dc70
mov edx, dword [ebp - 0x13c]
mov esi, dword [ebp - 0x138]
add esp, 0x18
push edx
lea ecx, [ebp - 0x170]
call fcn.010969e0
mov eax, dword [eax]
mov ecx, dword [esi]
lea edx, [ebp - 0x130]
push edx
push eax
mov eax, dword [ecx + 0x94]
push esi
mov byte [ebp - 4], 9
call eax
mov ecx, dword [ebp - 0x170]
push ecx
mov dword [ebp - 0x120], eax
mov byte [ebp - 4], 8
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x120]
cmp eax, ebx
jl 0x11213b6
je 0x1121293
mov edi, 0x80048052
jmp 0x11213c6
mov eax, dword [ebp - 0x130]
mov edx, dword [eax]
mov edx, dword [edx + 0x68]
lea ecx, [ebp - 0x128]
push ecx
push eax
call edx
cmp eax, ebx
mov dword [ebp - 0x120], eax
jne 0x11213b6
mov eax, dword [ebp - 0x128]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantInit]
push eax
call esi
test eax, eax
jne 0x11212d3
mov edi, 0x80048052
jmp 0x11213c6
lea ecx, [ebp - 0x124]
call fcn.01099650
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x154], ebx
mov dword [ebp - 0x150], ebx
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0x144], ebx
lea ecx, [ebp - 0x12c]
call fcn.01099650
mov ecx, dword [ebp - 0x128]
push ecx
lea ecx, [ebp - 0x208]
mov byte [ebp - 4], 0xc
call fcn.01099260
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], 0xd
call fcn.01133ee0
lea ecx, [ebp - 0x208]
mov byte [ebp - 4], 0xc
call fcn.010977c0
mov eax, dword [ebp - 0x12c]
mov ecx, dword [eax - 0xc]
lea edx, [ebp - 0x124]
push edx
push ecx
push eax
call fcn.010a07b0
cmp eax, ebx
mov dword [ebp - 0x120], eax
jge 0x11214ef
call fcn.01127f00
test al, al
je 0x1121395
mov eax, dword [ebp - 0x128]
push eax
call esi
push eax
push 0x10531d0
push 0x1067670
push ebx
call fcn.01128b70
add esp, 0x10
lea ecx, [ebp - 0x12c]
call fcn.0111cdb0
lea ecx, [ebp - 0x14c]
call fcn.010975a0
lea ecx, [ebp - 0x124]
call fcn.0111cdb0
mov edi, dword [ebp - 0x120]
cmp edi, 1
jne 0x11213cc
mov edi, 0x8000ffff
mov dword [ebp - 0x120], edi
cmp dword [ebp - 0x16c], ebx
mov esi, dword [ebp - 0x164]
mov byte [ebp - 4], 7
je 0x11213e9
cmp esi, ebx
je 0x11213f4
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp esi, ebx
je 0x11213f4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x168]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1121416
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 6
call fcn.01075230
mov eax, dword [ebp - 0x140]
cmp eax, ebx
mov byte [ebp - 4], 5
je 0x112143b
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea eax, [ebp - 0x184]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x13c]
add eax, 0xfffffff0
mov byte [ebp - 4], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x112146e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x128]
push ecx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x134]
add eax, 0xfffffff0
mov byte [ebp - 4], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x11214a1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x130]
cmp eax, ebx
mov byte [ebp - 4], bl
je 0x11214b6
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x138]
cmp eax, ebx
mov dword [ebp - 4], 0xffffffff
je 0x11214cf
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.010840d6
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp - 0x124]
mov ecx, dword [eax - 0xc]
lea edx, [ebp - 0x154]
push edx
push 5
push ebx
push ebx
push ebx
mov dword [ebp - 0x15c], eax
push ebx
lea eax, [ebp - 0x160]
push eax
mov dword [ebp - 0x160], ecx
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
jne 0x1121550
call fcn.01071a70
mov dword [ebp - 0x120], eax
call fcn.01127f00
test al, al
je 0x1121395
mov ecx, dword [ebp - 0x120]
push ecx
push 0x1053110
push 0x10675f0
jmp 0x112138c
mov eax, dword [ebp - 0x150]
cmp eax, ebx
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0x144], ebx
je 0x112157e
mov ecx, dword [ebp - 0x154]
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 0x144], ecx
push eax
lea ecx, [ebp - 0x158]
call fcn.0107f6b0
mov ecx, dword [ebp - 0x174]
lea edx, [ebp - 0x158]
push edx
mov byte [ebp - 4], 0xe
call fcn.0109ea30
lea ecx, [ebp - 0x158]
call fcn.0111cdb0
mov ecx, dword [ebp - 0x154]
cmp ecx, ebx
mov eax, dword [ebp - 0x150]
je 0x11215ca
jmp 0x11215c0
mov byte [eax], bl
add eax, 1
sub ecx, 1
jne 0x11215c0
lea ecx, [ebp - 0x12c]
call fcn.0111cdb0
lea ecx, [ebp - 0x14c]
call fcn.010975a0
lea ecx, [ebp - 0x124]
mov byte [ebp - 4], 8
call fcn.0111cdb0
mov eax, dword [ebp - 0x130]
push eax
lea ecx, [ebp - 0x140]
call fcn.010c6310
mov eax, dword [ebp - 0x140]
mov ecx, dword [eax]
lea edx, [ebp - 0x184]
push edx
mov edx, dword [0x1162c74]
push edx
push eax
mov eax, dword [ecx + 0xb0]
call eax
cmp eax, ebx
mov dword [ebp - 0x120], eax
jl 0x11213b6
cmp eax, 1
jne 0x112163c
mov byte [edi], bl
xor edi, edi
jmp 0x11213c6
cmp word [ebp - 0x184], 8
jne 0x1121677
mov ecx, dword [ebp - 0x17c]
push ecx
call esi
test eax, eax
je 0x1121677
mov edx, dword [ebp - 0x17c]
push 0x101055c
push edx
call fcn.01128fcd
add esp, 8
test eax, eax
jne 0x11213b6
mov byte [edi], 1
jmp 0x11213b6
mov byte [edi], bl
jmp 0x11213b6
mov edi, 0x80070057
jmp 0x11213c6