Function at 0x140002ab0
Capabilities:
Encrypt data using dpapi
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbp
push rbx
lea rbp, [rax - 0x47]
sub rsp, 0xc8
xor ebx, ebx
mov qword [rax + 8], rsi
mov qword [rax - 0x20], r12
mov esi, ebx
mov qword [rax - 0x38], r15
mov r12d, ebx
mov qword [rdx], rbx
mov r15d, ebx
mov qword [r8], rbx
mov qword [rbp - 0x31], rbx
mov qword [rbp - 0x41], rbx
mov qword [rbp - 0x49], rbx
mov qword [rbp - 0x19], rbx
mov dword [rbp - 0x51], ebx
mov dword [rbp - 0x4d], ebx
call fcn.140009dd0
mov qword [rbp - 0x11], rax
test rax, rax
je 0x140002de1
mov qword [rsp + 0xc0], rdi
mov rcx, 0xffffffff80000002
mov qword [rsp + 0xa8], r14
mov edi, ebx
mov r14, qword [rbp + 0x7f]
mov qword [rbp - 0x49], rcx
cmp dword [r14 + 0x40048], 2
jg 0x140002b87
mov rcx, qword [r14 + 0x28]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x140002dc8
lea rdx, [rbp - 0x49]
mov qword [rbp - 0x49], rbx
mov ecx, 0xf003f
call qword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
je 0x140002b75
mov edx, eax
lea rcx, str.unable_to_open_users_registry_hive__ERROR____d
call fcn.140007d10
or edi, 0xffffffff
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
test edi, edi
jne 0x140002dc8
mov rcx, qword [rbp - 0x49]
lea rax, [rbp - 0x31]
mov r9d, 0x20109
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREOpenSSHAgentKeys
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002dc8
mov rdx, qword [rbp - 0x11]
lea rax, [rbp - 0x41]
mov rcx, qword [rbp - 0x31]
mov r9d, 0x20109
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140002dc8
mov rcx, qword [rbp - 0x41]
lea rax, [rbp - 0x51]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140002dc8
mov ecx, dword [rbp - 0x51]
mov qword [rsp + 0xb0], r13
call fcn.14001da34
mov r13, rax
test rax, rax
je 0x140002dc0
mov rcx, qword [rbp - 0x41]
lea rax, [rbp - 0x51]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r13
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140002d9e
cmp dword [r14 + 0x40048], 2
mov edi, ebx
mov eax, dword [rbp - 0x51]
mov dword [rbp - 0x39], eax
jg 0x140002c69
mov rcx, qword [r14 + 0x28]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x140002d9e
mov eax, dword [rbp - 0x39]
mov dword [rbp - 9], eax
lea rcx, [rbp - 9]
lea rax, [rbp - 0x29]
mov qword [rbp - 1], r13
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
mov dword [rbp - 0x29], ebx
mov qword [rbp - 0x21], rbx
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
jne 0x140002cad
lea rcx, str.cannot_decrypt_data
call fcn.140007d10
jmp 0x140002cee
mov ecx, dword [rbp - 0x29]
call fcn.14001da34
mov rsi, rax
test rax, rax
je 0x140002cee
mov edx, dword [rbp - 0x29]
mov rcx, rax
mov r8, qword [rbp - 0x21]
mov r9d, edx
call fcn.1400024d0
test eax, eax
je 0x140002ce3
mov edx, eax
lea rcx, str.memcpy_s_failed_with_error:__d.
call fcn.140007d10
jmp 0x140002cee
mov eax, dword [rbp - 0x29]
mov edi, 1
mov dword [rbp - 0x4d], eax
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x140002cfd
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [r14 + 0x40048], 2
jg 0x140002d0d
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
lea eax, [rdi - 1]
test eax, eax
jne 0x140002d91
mov edx, dword [rbp - 0x4d]
mov rcx, rsi
call fcn.140008180
mov r12, rax
test rax, rax
je 0x140002d91
mov ecx, dword [rbp + 0x77]
test cl, 2
je 0x140002d38
lea rdi, str.rsa_sha2_256
jmp 0x140002d46
test cl, 4
lea rdi, str.rsa_sha2_512
cmove rdi, rbx
lea rdx, [rbp - 0x19]
mov rcx, rax
call fcn.14000c320
mov r15, qword [rbp - 0x19]
test eax, eax
jne 0x140002d85
mov rax, qword [rbp + 0x6f]
mov rcx, r15
mov r9, qword [rbp + 0x67]
mov r8, qword [rbp + 0x5f]
mov rdx, qword [rbp + 0x57]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call fcn.14000bce0
test eax, eax
jne 0x140002d85
lea ebx, [rax + 1]
jmp 0x140002d91
lea rcx, str.cannot_sign_using_retrieved_key
call fcn.140007d10
test rsi, rsi
je 0x140002d9e
mov rcx, rsi
call fcn.14001da20
mov rcx, r13
call fcn.14001da20
test r12, r12
je 0x140002db3
mov rcx, r12
call fcn.1400082a0
test r15, r15
je 0x140002dc0
mov rcx, r15
call fcn.140009590
mov r13, qword [rsp + 0xb0]
mov rcx, qword [rbp - 0x11]
call fcn.14001da20
mov r14, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0xc0]
mov rcx, qword [rbp - 0x49]
mov r15, qword [rsp + 0xa0]
mov r12, qword [rsp + 0xb8]
mov rsi, qword [rsp + 0xe0]
test rcx, rcx
je 0x140002e08
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x140002e17
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x41]
test rcx, rcx
je 0x140002e26
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [rbx - 1]
add rsp, 0xc8
pop rbx
pop rbp
ret