Function at 0x14000cfc0
Capabilities:
Encrypt data using dpapi

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xf8
mov rsi, rcx
lea rdi, [rsp + 0xd8]
mov rcx, rdi
mov r8, rdx
call fcn.14000e2fa
xorps xmm0, xmm0
lea r8, [rsp + 0x90]
movaps xmmword [r8], xmm0
movaps xmmword [r8 + 0x10], xmm0
mov byte [rsp + 0x20], 0
lea rcx, [rsp + 0x70]
mov rdx, rdi
mov r9b, 1
call fcn.14000f192
mov rax, qword [rsp + 0xa0]
test rax, rax
je 0x14000d02b
lea rcx, [rsp + 0x90]
mov rdx, rcx
mov r8d, 3
call rax
lea rdx, str.os_crypt
lea rcx, [rsp + 0x70]
call fcn.14000f702
lea rdx, str.encrypted_key
mov rcx, rax
call fcn.14000f702
lea rcx, [rsp + 0xb8]
mov rdx, rax
call fcn.140016e4a
mov rdi, qword [rsp + 0xb8]
mov r14, qword [rsp + 0xc0]
xorps xmm0, xmm0
lea rcx, [rsp + 0x40]
movaps xmmword [rcx], xmm0
xor eax, eax
mov qword [rcx + 0x10], rax
mov rdx, r14
shr rdx, 2
lea rbx, [rdx + rdx*2]
mov qword [rsp + 0x88], rax
mov rdx, rbx
call fcn.1400189d4
lea rcx, [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, [rsp + 0x80]
mov qword [rdx], rax
mov r8, rdi
mov r9, r14
call fcn.14000e944
mov rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0x40]
call fcn.1400189d4
mov rdi, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov rax, r8
sub rax, rdi
cmp rax, rbx
ja 0x14000d249
lea rbx, [rdi + 5]
sub r8, rbx
je 0x14000d0fe
cmp r8, 2
jl 0x14000d235
mov rcx, rdi
mov rdx, rbx
call sub.msvcrt.dll_memmove
mov rax, qword [rsp + 0x48]
mov rcx, rax
sub rcx, rbx
add rdi, rcx
cmp rax, rdi
je 0x14000d119
mov qword [rsp + 0x48], rdi
mov rax, rdi
mov rdx, qword [rsp + 0x40]
sub eax, edx
lea rcx, [rsp + 0x80]
mov dword [rcx], eax
mov qword [rcx + 8], rdx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x14000d182
mov rdx, qword [rsp + 0x68]
mov r8d, dword [rsp + 0x60]
add r8, rdx
lea r9, [rsp + 0x3f]
mov rcx, rsi
call fcn.140018b02
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14000d1d3
mov rdi, qword [sym.imp.libstdc_6.dll_std::cerr]
lea rdx, str._ERROR__Failed_to_decrypt_the_master_key.
mov r8d, 0x29
mov rcx, rdi
call fcn.1400017e8
mov rax, qword [rdi]
add rdi, qword [rax - 0x18]
mov rcx, rdi
mov dl, 0xa
call fcn.1400018d0
mov rcx, qword [sym.imp.libstdc_6.dll_std::cerr]
mov edx, eax
call fcn.1400018c8
mov rcx, rax
call fcn.1400018c0
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000d1e2
call sub.libstdc_6.dll_operator_delete_void_
lea rax, [rsp + 0xc8]
mov rcx, qword [rax - 0x10]
cmp rcx, rax
je 0x14000d1f8
call sub.libstdc_6.dll_operator_delete_void_
lea rdi, [rsp + 0x70]
mov rcx, rdi
xor edx, edx
call fcn.140016dc2
mov rcx, rdi
call fcn.14000ef36
lea rax, [rsp + 0xe8]
mov rcx, qword [rax - 0x10]
cmp rcx, rax
je 0x14000d225
call sub.libstdc_6.dll_operator_delete_void_
mov rax, rsi
add rsp, 0xf8
pop rbx
pop rdi
pop rsi
pop r14
ret
cmp r8, 1
jne 0x14000d0fe
mov al, byte [rdi + 5]
mov byte [rdi], al
jmp 0x14000d0fe
lea rcx, str.data::size_binary_result____binary_buffer_size
lea rdx, str.C:UsersMohamedDownloads_niggerinclude_detail_codec.hpp
mov r8d, 0x110
call qword [sym.imp.msvcrt.dll__assert]
mov rdi, rax
mov rcx, qword [rsi]
test rcx, rcx
je 0x14000d2b0
call sub.libstdc_6.dll_operator_delete_void_
jmp 0x14000d2b0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000d2bf
call sub.libstdc_6.dll_operator_delete_void_
lea rax, [rsp + 0xc8]
mov rcx, qword [rax - 0x10]
cmp rcx, rax
je 0x14000d2d5
call sub.libstdc_6.dll_operator_delete_void_
lea rsi, [rsp + 0x70]
mov rcx, rsi
xor edx, edx
call fcn.140016dc2
mov rcx, rsi
call fcn.14000ef36
lea rax, [rsp + 0xe8]
mov rcx, qword [rax - 0x10]
cmp rcx, rax
je 0x14000d302
call sub.libstdc_6.dll_operator_delete_void_
mov rcx, rdi
call sub.libgcc_s_seh_1.dll__Unwind_Resume
int3