Function at 0x1400a0159
Capabilities:
Acquire debug privileges
Encrypt data using dpapi

Disassembly:
jmp 0x1400ce7f0
push rbp
push rdi
mov eax, 0x10c8
call fcn.1400a04ba
sub rsp, rax
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x302
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14022f6c0]
xor rax, rbp
mov qword [rbp + 0x1078], rax
mov dword [rbp + 0xfe4], 0
lea rcx, [0x14024250e]
call fcn.1400a1a40
movzx eax, byte [0x14022ff2e]
test eax, eax
jne 0x1400ce84d
jmp 0x1400cf71a
mov dword [rbp + 4], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x88], 0
mov dword [rbp + 0xa4], 4
mov dword [rbp + 0xc4], 0
lea rax, [rbp + 0x110]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rbp + 0x524], 0x400
mov dword [rbp + 0x544], 0
mov dword [rbp + 0x5c4], 0
mov qword [rbp + 0x5e8], 0
mov qword [rbp + 0x608], 0
lea r9, [rbp + 0x28]
lea r8, [rbp + 4]
xor edx, edx
mov ecx, 2
call fcn.1400a10d1
test eax, eax
je 0x1400ce8ef
jmp 0x1400cf71a
lea r8, [rbp + 0x48]
xor edx, edx
mov rcx, qword [rbp + 0x28]
call fcn.1400a1171
test eax, eax
je 0x1400ce921
cmp qword [rbp + 0x28], 0
je 0x1400ce91c
xor edx, edx
mov rcx, qword [rbp + 0x28]
call fcn.1400a1022
mov qword [rbp + 0x28], 0
jmp 0x1400cf71a
mov rax, qword [rbp + 0x48]
cmp dword [rax], 0
jne 0x1400ce961
cmp qword [rbp + 0x28], 0
je 0x1400ce944
xor edx, edx
mov rcx, qword [rbp + 0x28]
call fcn.1400a1022
mov qword [rbp + 0x28], 0
cmp qword [rbp + 0x48], 0
je 0x1400ce95c
mov rcx, qword [rbp + 0x48]
call fcn.1400a1a77
mov qword [rbp + 0x48], 0
jmp 0x1400cf71a
mov dword [rbp + 0x624], 0
jmp 0x1400ce97b
mov eax, dword [rbp + 0x624]
inc eax
mov dword [rbp + 0x624], eax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax]
cmp dword [rbp + 0x624], eax
jae 0x1400cf6e8
mov eax, dword [rbp + 0x624]
imul rax, rax, 0x214
mov rcx, qword [rbp + 0x48]
lea rax, [rcx + rax + 8]
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x88]
lea r9, [rbp + 0x68]
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rbp + 0x28]
call fcn.1400a0564
test eax, eax
je 0x1400ce9ca
jmp 0x1400ce96d
mov dword [rbp + 0x644], 0
jmp 0x1400ce9e4
mov eax, dword [rbp + 0x644]
inc eax
mov dword [rbp + 0x644], eax
mov rax, qword [rbp + 0x68]
mov eax, dword [rax]
cmp dword [rbp + 0x644], eax
jae 0x1400cf6cb
mov eax, dword [rbp + 0x644]
imul rax, rax, 0x204
mov rcx, qword [rbp + 0x68]
lea rax, [rcx + rax + 8]
mov qword [rbp + 0xff8], rax
lea rdx, str.WLAN_Profile_Name:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400a0e06
mov rcx, qword [rbp + 0xff8]
mov rdx, rcx
mov rcx, rax
call fcn.1400a0d6b
lea rdx, [0x1400a0cbc]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov eax, dword [rbp + 0x644]
imul rax, rax, 0x204
mov rcx, qword [rbp + 0x68]
lea rax, [rcx + rax + 8]
mov rcx, qword [rbp + 0x88]
lea rdx, [rbp + 0xc4]
mov qword [rsp + 0x30], rdx
lea rdx, [rbp + 0xa4]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp + 0xe8]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
mov r8, rax
mov rdx, rcx
mov rcx, qword [rbp + 0x28]
call fcn.1400a1c07
test eax, eax
jne 0x1400cf66e
mov edx, 8
lea rcx, [rbp + 0x668]
call fcn.1400a18e7
lea rax, [rbp + 0xb28]
mov qword [rbp + 0xb68], rax
lea rdx, str.__pf:WLANProfile_pf:MSM_pf:security_pf:authEncryption
mov rcx, qword [rbp + 0xb68]
call fcn.1400a08bb
mov qword [rbp + 0xff8], rax
mov r8, qword [rbp + 0xff8]
mov rdx, qword [rbp + 0xe8]
lea rcx, [rbp + 0x668]
call fcn.1400a0bd1
nop
lea rax, [rbp + 0xba8]
mov qword [rbp + 0xbc8], rax
lea rdx, str.pf:authentication
mov rcx, qword [rbp + 0xbc8]
call fcn.1400a0f2d
mov qword [rbp + 0xff8], rax
mov rax, qword [rbp + 0xff8]
mov qword [rbp + 0x1000], rax
lea rcx, [rbp + 0x668]
call fcn.1400a0811
xor r8d, r8d
lea rdx, [rbp + 0xb88]
mov rcx, rax
call fcn.1400a1a22
mov qword [rbp + 0x1008], rax
mov rax, qword [rbp + 0x1008]
mov qword [rbp + 0x1010], rax
mov rcx, qword [rbp + 0x1010]
call fcn.1400a18e2
nop
mov r8, qword [rbp + 0x1000]
lea rdx, [rbp + 0xbe8]
mov rcx, rax
call fcn.1400a12c5
mov qword [rbp + 0x1018], rax
mov rax, qword [rbp + 0x1018]
mov qword [rbp + 0x1020], rax
mov rcx, qword [rbp + 0x1020]
call fcn.1400a18e2
lea rdx, [rbp + 0xc08]
mov rcx, rax
call fcn.1400a199b
mov qword [rbp + 0x1028], rax
mov rax, qword [rbp + 0x1028]
mov qword [rbp + 0x1030], rax
mov rcx, qword [rbp + 0x1030]
call fcn.1400a0ac3
mov qword [rbp + 0x1038], rax
lea rdx, str.Authentication:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400a0e06
mov rcx, qword [rbp + 0x1038]
mov rdx, rcx
mov rcx, rax
call fcn.1400a0e06
lea rdx, [0x1400a0cbc]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
lea rcx, [rbp + 0xc08]
call fcn.1400a1635
nop
lea rcx, [rbp + 0xbe8]
call fcn.1400a1478
nop
lea rcx, [rbp + 0xb88]
call fcn.1400a1478
lea rax, [rbp + 0xc48]
mov qword [rbp + 0xc68], rax
lea rdx, str.pf:encryption
mov rcx, qword [rbp + 0xc68]
call fcn.1400a0f2d
mov qword [rbp + 0xff8], rax
mov rax, qword [rbp + 0xff8]
mov qword [rbp + 0x1000], rax
lea rcx, [rbp + 0x668]
call fcn.1400a0811
xor r8d, r8d
lea rdx, [rbp + 0xc28]
mov rcx, rax
call fcn.1400a1a22
mov qword [rbp + 0x1008], rax
mov rax, qword [rbp + 0x1008]
mov qword [rbp + 0x1010], rax
mov rcx, qword [rbp + 0x1010]
call fcn.1400a18e2
nop
mov r8, qword [rbp + 0x1000]
lea rdx, [rbp + 0xc88]
mov rcx, rax
call fcn.1400a12c5
mov qword [rbp + 0x1018], rax
mov rax, qword [rbp + 0x1018]
mov qword [rbp + 0x1020], rax
mov rcx, qword [rbp + 0x1020]
call fcn.1400a18e2
lea rdx, [rbp + 0xca8]
mov rcx, rax
call fcn.1400a199b
mov qword [rbp + 0x1028], rax
mov rax, qword [rbp + 0x1028]
mov qword [rbp + 0x1030], rax
mov rcx, qword [rbp + 0x1030]
call fcn.1400a0ac3
mov qword [rbp + 0x1038], rax
lea rdx, str.Encryption:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400a0e06
mov rcx, qword [rbp + 0x1038]
mov rdx, rcx
mov rcx, rax
call fcn.1400a0e06
lea rdx, [0x1400a0cbc]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
lea rcx, [rbp + 0xca8]
call fcn.1400a1635
nop
lea rcx, [rbp + 0xc88]
call fcn.1400a1478
nop
lea rcx, [rbp + 0xc28]
call fcn.1400a1478
lea rax, [rbp + 0xce8]
mov qword [rbp + 0xd08], rax
lea rdx, str.pf:useOneX
mov rcx, qword [rbp + 0xd08]
call fcn.1400a0f2d
mov qword [rbp + 0xff8], rax
mov rax, qword [rbp + 0xff8]
mov qword [rbp + 0x1000], rax
lea rcx, [rbp + 0x668]
call fcn.1400a0811
xor r8d, r8d
lea rdx, [rbp + 0xcc8]
mov rcx, rax
call fcn.1400a1a22
mov qword [rbp + 0x1008], rax
mov rax, qword [rbp + 0x1008]
mov qword [rbp + 0x1010], rax
mov rcx, qword [rbp + 0x1010]
call fcn.1400a18e2
nop
mov r8, qword [rbp + 0x1000]
lea rdx, [rbp + 0xd28]
mov rcx, rax
call fcn.1400a12c5
mov qword [rbp + 0x1018], rax
mov rax, qword [rbp + 0x1018]
mov qword [rbp + 0x1020], rax
mov rcx, qword [rbp + 0x1020]
call fcn.1400a18e2
lea rdx, [rbp + 0xd48]
mov rcx, rax
call fcn.1400a199b
mov qword [rbp + 0x1028], rax
mov rax, qword [rbp + 0x1028]
mov qword [rbp + 0x1030], rax
mov rcx, qword [rbp + 0x1030]
call fcn.1400a0ac3
mov qword [rbp + 0x1038], rax
lea rdx, str.useOneX:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400a0e06
mov rcx, qword [rbp + 0x1038]
mov rdx, rcx
mov rcx, rax
call fcn.1400a0e06
lea rdx, [0x1400a0cbc]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
lea rcx, [rbp + 0xd48]
call fcn.1400a1635
nop
lea rcx, [rbp + 0xd28]
call fcn.1400a1478
nop
lea rcx, [rbp + 0xcc8]
call fcn.1400a1478
lea rax, [rbp + 0xda8]
mov qword [rbp + 0xdc8], rax
lea rdx, str.pf:useOneX
mov rcx, qword [rbp + 0xdc8]
call fcn.1400a0f2d
mov qword [rbp + 0xff8], rax
mov rax, qword [rbp + 0xff8]
mov qword [rbp + 0x1000], rax
lea rcx, [rbp + 0x668]
call fcn.1400a0811
xor r8d, r8d
lea rdx, [rbp + 0xd88]
mov rcx, rax
call fcn.1400a1a22
mov qword [rbp + 0x1008], rax
mov rax, qword [rbp + 0x1008]
mov qword [rbp + 0x1010], rax
mov eax, dword [rbp + 0xfe4]
or eax, 1
mov dword [rbp + 0xfe4], eax
mov rcx, qword [rbp + 0x1010]
call fcn.1400a18e2
nop
mov r8, qword [rbp + 0x1000]
lea rdx, [rbp + 0xde8]
mov rcx, rax
call fcn.1400a12c5
mov qword [rbp + 0x1018], rax
mov rax, qword [rbp + 0x1018]
mov qword [rbp + 0x1020], rax
mov eax, dword [rbp + 0xfe4]
or eax, 2
mov dword [rbp + 0xfe4], eax
mov rcx, qword [rbp + 0x1020]
call fcn.1400a18e2
lea rdx, [rbp + 0xe08]
mov rcx, rax
call fcn.1400a199b
mov qword [rbp + 0x1028], rax
mov rax, qword [rbp + 0x1028]
mov qword [rbp + 0x1030], rax
mov eax, dword [rbp + 0xfe4]
or eax, 4
mov dword [rbp + 0xfe4], eax
mov rcx, qword [rbp + 0x1030]
call fcn.1400a0e56
lea rdx, [0x1401ed828]
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
jne 0x1400cf0f5
lea rax, [rbp + 0xe48]
mov qword [rbp + 0xe68], rax
lea rdx, str.pf:authentication
mov rcx, qword [rbp + 0xe68]
call fcn.1400a0f2d
mov qword [rbp + 0x1038], rax
mov rax, qword [rbp + 0x1038]
mov qword [rbp + 0x1040], rax
lea rcx, [rbp + 0x668]
call fcn.1400a0811
xor r8d, r8d
lea rdx, [rbp + 0xe28]
mov rcx, rax
call fcn.1400a1a22
mov qword [rbp + 0x1048], rax
mov rax, qword [rbp + 0x1048]
mov qword [rbp + 0x1050], rax
mov eax, dword [rbp + 0xfe4]
or eax, 8
mov dword [rbp + 0xfe4], eax
mov rcx, qword [rbp + 0x1050]
call fcn.1400a18e2
nop
mov r8, qword [rbp + 0x1040]
lea rdx, [rbp + 0xe88]
mov rcx, rax
call fcn.1400a12c5
mov qword [rbp + 0x1058], rax
mov rax, qword [rbp + 0x1058]
mov qword [rbp + 0x1060], rax
mov eax, dword [rbp + 0xfe4]
or eax, 0x10
mov dword [rbp + 0xfe4], eax
mov rcx, qword [rbp + 0x1060]
call fcn.1400a18e2
lea rdx, [rbp + 0xea8]
mov rcx, rax
call fcn.1400a199b
mov qword [rbp + 0x1068], rax
mov eax, dword [rbp + 0xfe4]
or eax, 0x20
mov dword [rbp + 0xfe4], eax
mov rcx, qword [rbp + 0x1068]
call fcn.1400a0e56
lea rdx, str.open
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
je 0x1400cf0f5
mov dword [rbp + 0x1070], 1
jmp 0x1400cf0ff
mov dword [rbp + 0x1070], 0
movzx eax, byte [rbp + 0x1070]
mov byte [rbp + 0xd64], al
mov eax, dword [rbp + 0xfe4]
and eax, 0x20
test eax, eax
je 0x1400cf12d
and dword [rbp + 0xfe4], 0xffffffdf
lea rcx, [rbp + 0xea8]
call fcn.1400a1635
nop
mov eax, dword [rbp + 0xfe4]
and eax, 0x10
test eax, eax
je 0x1400cf14e
and dword [rbp + 0xfe4], 0xffffffef
lea rcx, [rbp + 0xe88]
call fcn.1400a1478
nop
mov eax, dword [rbp + 0xfe4]
and eax, 8
test eax, eax
je 0x1400cf16f
and dword [rbp + 0xfe4], 0xfffffff7
lea rcx, [rbp + 0xe28]
call fcn.1400a1478
nop
mov eax, dword [rbp + 0xfe4]
and eax, 4
test eax, eax
je 0x1400cf190
and dword [rbp + 0xfe4], 0xfffffffb
lea rcx, [rbp + 0xe08]
call fcn.1400a1635
nop
mov eax, dword [rbp + 0xfe4]
and eax, 2
test eax, eax
je 0x1400cf1b1
and dword [rbp + 0xfe4], 0xfffffffd
lea rcx, [rbp + 0xde8]
call fcn.1400a1478
nop
mov eax, dword [rbp + 0xfe4]
and eax, 1
test eax, eax
je 0x1400cf1d1
and dword [rbp + 0xfe4], 0xfffffffe
lea rcx, [rbp + 0xd88]
call fcn.1400a1478
movzx eax, byte [rbp + 0xd64]
test eax, eax
je 0x1400cf662
lea rax, [rbp + 0xec8]
mov qword [rbp + 0xf08], rax
lea rdx, str.__pf:WLANProfile_pf:MSM_pf:security_pf:sharedKey
mov rcx, qword [rbp + 0xf08]
call fcn.1400a08bb
mov qword [rbp + 0xff8], rax
mov r8, qword [rbp + 0xff8]
mov rdx, qword [rbp + 0xe8]
lea rcx, [rbp + 0xf28]
call fcn.1400a0bd1
mov qword [rbp + 0x1000], rax
mov rdx, qword [rbp + 0x1000]
lea rcx, [rbp + 0x668]
call fcn.1400a070d
lea rcx, [rbp + 0xf28]
call fcn.1400a0ffa
lea rax, [rbp + 0xf68]
mov qword [rbp + 0xf88], rax
lea rdx, str.pf:keyMaterial
mov rcx, qword [rbp + 0xf88]
call fcn.1400a0f2d
mov qword [rbp + 0xff8], rax
mov rax, qword [rbp + 0xff8]
mov qword [rbp + 0x1000], rax
lea rcx, [rbp + 0x668]
call fcn.1400a0811
xor r8d, r8d
lea rdx, [rbp + 0xf48]
mov rcx, rax
call fcn.1400a1a22
mov qword [rbp + 0x1008], rax
mov rax, qword [rbp + 0x1008]
mov qword [rbp + 0x1010], rax
mov rcx, qword [rbp + 0x1010]
call fcn.1400a18e2
nop
mov r8, qword [rbp + 0x1000]
lea rdx, [rbp + 0xfa8]
mov rcx, rax
call fcn.1400a12c5
mov qword [rbp + 0x1018], rax
mov rax, qword [rbp + 0x1018]
mov qword [rbp + 0x1020], rax
mov rcx, qword [rbp + 0x1020]
call fcn.1400a18e2
lea rdx, [rbp + 0xfc8]
mov rcx, rax
call fcn.1400a199b
mov qword [rbp + 0x1028], rax
mov rcx, qword [rbp + 0x1028]
call fcn.1400a1a04
mov qword [rbp + 0x688], rax
lea rcx, [rbp + 0xfc8]
call fcn.1400a1635
nop
lea rcx, [rbp + 0xfa8]
call fcn.1400a1478
nop
lea rcx, [rbp + 0xf48]
call fcn.1400a1478
lea rcx, str.winlogon.exe
call fcn.1400a0bb3
mov dword [rbp + 0x5c4], eax
cmp dword [rbp + 0x5c4], 0
jne 0x1400cf370
lea rcx, [rbp + 0x668]
call fcn.1400a0ffa
jmp 0x1400ce9d6
mov edx, 1
lea rcx, str.SeDebugPrivilege
call fcn.1400a05fa
test eax, eax
jne 0x1400cf3d9
lea rdx, str.Password:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400a02fd
lea rdx, str._encrypted_
mov rcx, rax
call fcn.1400a02fd
lea rdx, [0x1400a00f0]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x1400a00f0]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rbp + 0x668]
call fcn.1400a0ffa
jmp 0x1400ce9d6
mov r8d, dword [rbp + 0x5c4]
xor edx, edx
mov ecx, 0x2000000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x5e8], rax
cmp qword [rbp + 0x5e8], 0
jne 0x1400cf40f
lea rcx, [rbp + 0x668]
call fcn.1400a0ffa
jmp 0x1400ce9d6
lea r8, [rbp + 0x608]
mov edx, 0x2000000
mov rcx, qword [rbp + 0x5e8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1400cf45f
cmp qword [rbp + 0x5e8], 0
je 0x1400cf44e
mov rcx, qword [rbp + 0x5e8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x5e8], 0
lea rcx, [rbp + 0x668]
call fcn.1400a0ffa
jmp 0x1400ce9d6
mov rcx, qword [rbp + 0x608]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x1400cf4c5
cmp qword [rbp + 0x608], 0
je 0x1400cf492
mov rcx, qword [rbp + 0x608]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x608], 0
cmp qword [rbp + 0x5e8], 0
je 0x1400cf4b4
mov rcx, qword [rbp + 0x5e8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x5e8], 0
lea rcx, [rbp + 0x668]
call fcn.1400a0ffa
jmp 0x1400ce9d6
call fcn.1400a1a2c
test eax, eax
je 0x1400cf62f
mov rcx, qword [rbp + 0x688]
call qword [sym.imp.ucrtbased.dll_wcslen]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rcx, [rbp + 0x524]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, 4
mov edx, eax
mov rcx, qword [rbp + 0x688]
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
test eax, eax
jne 0x1400cf55d
lea rdx, str.Password:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400a02fd
lea rdx, str._encrypted_
mov rcx, rax
call fcn.1400a02fd
lea rdx, [0x1400a00f0]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rbp + 0x668]
call fcn.1400a0ffa
jmp 0x1400ce9d6
mov rcx, qword [rbp + 0x688]
call qword [sym.imp.ucrtbased.dll_wcslen]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rcx, [rbp + 0x524]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x110]
mov r8d, 4
mov edx, eax
mov rcx, qword [rbp + 0x688]
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
test eax, eax
je 0x1400cf62d
mov eax, dword [rbp + 0x524]
mov dword [rbp + 0x568], eax
lea rax, [rbp + 0x110]
mov qword [rbp + 0x570], rax
lea rax, [rbp + 0x598]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x568]
call fcn.1400a186f
test eax, eax
je 0x1400cf62d
lea rdx, str.Password:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400a02fd
mov rdx, qword [rbp + 0x5a0]
mov rcx, rax
call fcn.1400a171b
lea rdx, [0x1400a00f0]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400cf662
lea rdx, str.Password:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400a02fd
lea rdx, str._encrypted_
mov rcx, rax
call fcn.1400a02fd
lea rdx, [0x1400a00f0]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rbp + 0x668]
call fcn.1400a0ffa
lea rdx, [0x1400a0cbc]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
cmp qword [rbp + 0x5e8], 0
je 0x1400cf6a4
mov rcx, qword [rbp + 0x5e8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x5e8], 0
cmp qword [rbp + 0x608], 0
je 0x1400cf6c6
mov rcx, qword [rbp + 0x608]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x608], 0
jmp 0x1400ce9d6
cmp qword [rbp + 0x68], 0
je 0x1400cf6e3
mov rcx, qword [rbp + 0x68]
call fcn.1400a1a77
mov qword [rbp + 0x68], 0
jmp 0x1400ce96d
cmp qword [rbp + 0x48], 0
je 0x1400cf700
mov rcx, qword [rbp + 0x48]
call fcn.1400a1a77
mov qword [rbp + 0x48], 0
cmp qword [rbp + 0x28], 0
je 0x1400cf71a
xor edx, edx
mov rcx, qword [rbp + 0x28]
call fcn.1400a1022
mov qword [rbp + 0x28], 0
lea rcx, [rbp - 0x40]
lea rdx, [0x1401f2730]
call fcn.1400a15c2
mov rcx, qword [rbp + 0x1078]
xor rcx, rbp
call fcn.1400a0ca3
lea rsp, [rbp + 0x1088]
pop rdi
pop rbp
ret