Function at 0x401b50
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41a2da
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
mov eax, dword [0x4213d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
test byte [0x42372c], 1
jne 0x401bcc
or dword [0x42372c], 1
xor esi, esi
mov dword [ebp - 4], esi
push 0x49
push str.9E487F0D_0985_4e93_89E2_D777C46714F0_2F89CF7F_1EAF_4ccd_A995_DC6470CC839B
mov ecx, 0x423710
mov dword [0x423724], 0xf
mov dword [0x423720], esi
mov byte [0x423710], 0
call fcn.00405ed0
push 0x41a710
call fcn.00409f66
add esp, 4
mov dword [ebp - 4], 0xffffffff
jmp 0x401bce
xor esi, esi
mov eax, 0x10
cmp dword [0x423724], eax
jb 0x401be6
mov ecx, dword [0x423710]
mov dword [ebp - 0x18], ecx
jmp 0x401bed
mov dword [ebp - 0x18], 0x423710
mov edx, dword [0x423720]
mov dword [ebp - 0x1c], edx
cmp dword [ebx + 0x14], eax
jb 0x401c02
mov eax, dword [ebx]
mov dword [ebp - 0x20], eax
jmp 0x401c05
mov dword [ebp - 0x20], ebx
mov ecx, dword [ebx + 0x10]
lea edx, [ebp - 0x14]
push edx
push esi
push esi
push esi
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x24], ecx
push str.AVSSD
lea ecx, [ebp - 0x24]
push ecx
call dword [sym.imp.CRYPT32.dll_CryptProtectData]
test eax, eax
jne 0x401c3c
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test byte [0x42372c], 2
mov ebx, 7
jne 0x401c94
or dword [0x42372c], 2
mov dword [ebp - 4], 1
mov dword [0x423704], esi
xor edx, edx
push 0xb
mov eax, str._ByteArray_
mov esi, 0x4236f4
mov dword [0x423708], ebx
mov word [0x4236f4], dx
call fcn.00405150
push 0x41a6d0
call fcn.00409f66
add esp, 4
mov dword [ebp - 4], 0xffffffff
xor esi, esi
mov eax, 4
test byte [0x42372c], al
jne 0x401ce7
or dword [0x42372c], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [0x4236e8], esi
mov word [0x4236d8], ax
push 1
mov eax, 0x41e0b0
mov esi, 0x4236d8
mov dword [0x4236ec], ebx
call fcn.00405150
push 0x41a690
call fcn.00409f66
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [edi + 4]
mov esi, dword [edi]
cmp esi, ecx
je 0x401d09
mov eax, ecx
sub eax, ecx
sar eax, 1
lea ebx, [eax + eax]
push ebx
push ecx
push esi
call fcn.004099d0
add esp, 0xc
add ebx, esi
mov dword [edi + 4], ebx
mov eax, dword [0x4236e8]
add eax, dword [0x423704]
mov esi, edi
add eax, dword [ebp - 0x14]
call fcn.00404510
mov eax, dword [0x4236f4]
mov esi, 8
cmp dword [0x423708], esi
jae 0x401d35
mov eax, 0x4236f4
mov ecx, dword [0x423704]
lea edx, [ecx + ecx]
push edx
push eax
mov eax, dword [edi]
push eax
call fcn.0040a830
mov ecx, dword [ebp - 0x14]
add esp, 0xc
xor eax, eax
test ecx, ecx
je 0x401d7d
jmp 0x401d60
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ecx + eax]
mov ecx, dword [0x423704]
mov ebx, dword [edi]
add ecx, eax
mov word [ebx + ecx*2], dx
mov ecx, dword [ebp - 0x14]
inc eax
cmp eax, ecx
jb 0x401d60
mov eax, dword [0x4236d8]
cmp dword [0x4236ec], esi
jae 0x401d8f
mov eax, 0x4236d8
mov edx, dword [0x4236e8]
add edx, edx
push edx
push eax
mov eax, dword [0x423704]
add eax, ecx
mov ecx, dword [edi]
lea edx, [ecx + eax*2]
push edx
call fcn.0040a830
mov eax, dword [ebp - 0x10]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret