Function at 0x1402f9080
Capabilities:
Encrypt data using dpapi

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xc8
lea rbp, [rsp + 0x100]
xor eax, eax
mov qword [rbp - 0x78], rax
xorps xmm4, xmm4
movaps xmmword [rbp - 0x70], xmm4
movaps xmmword [rbp - 0x60], xmm4
movaps xmmword [rbp - 0x50], xmm4
mov qword [rbp - 0x40], rax
mov ebx, r9d
mov eax, dword [rcx + 8]
test eax, eax
je 0x1402f90c0
jmp 0x1402f90cb
mov rcx, qword [0x140850148]
mov rcx, qword [rcx + 8]
mov qword [rbp - 0x40], rcx
test rcx, rcx
je 0x1402f90de
mov rcx, qword [rbp - 0x40]
cmp dword [rcx + 8], 0
jne 0x1402f90e2
xor ecx, ecx
jmp 0x1402f90f8
mov rcx, qword [rbp - 0x40]
cmp dword [rcx + 8], 0
jbe 0x1402f939b
mov rcx, qword [rbp - 0x40]
add rcx, 0x10
mov qword [rbp - 0x48], rdx
test rdx, rdx
je 0x1402f910c
mov r10, qword [rbp - 0x48]
cmp dword [r10 + 8], 0
jne 0x1402f9111
xor r10d, r10d
jmp 0x1402f9128
mov r10, qword [rbp - 0x48]
cmp dword [r10 + 8], 0
jbe 0x1402f939b
mov r10, qword [rbp - 0x48]
add r10, 0x10
mov dword [rbp - 0x58], eax
mov qword [rbp - 0x50], rcx
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
test rdx, rdx
je 0x1402f9145
mov ecx, dword [rdx + 8]
mov dword [rbp - 0x68], ecx
mov qword [rbp - 0x60], r10
mov esi, 1
mov ecx, 5
cmp r8d, 1
cmove esi, ecx
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
test bl, bl
jne 0x1402f9273
lea rdi, [rbp - 0x78]
lea r14, [rbp - 0x68]
lea r15, [rbp - 0x58]
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
xor ecx, ecx
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x30], rdi
mov rcx, r15
mov qword [rbp - 0x80], rcx
mov r8, r14
mov qword [rbp - 0x88], r8
xor edx, edx
mov qword [rbp - 0x90], rdx
xor r9d, r9d
mov qword [rbp - 0x98], r9
lea rcx, [rbp - 0xc0]
call fcn.140009510
mov rcx, qword [rbp - 0x80]
mov r8, qword [rbp - 0x88]
mov rdx, qword [rbp - 0x90]
mov r9, qword [rbp - 0x98]
call sub.CRYPT32.dll_CryptUnprotectData
mov esi, eax
lea rcx, [rbp - 0xc0]
call fcn.140009560
call sub.KERNEL32.dll_GetLastError
mov edi, eax
test esi, esi
setne sil
movzx esi, sil
call fcn.140003fd4
mov dword [rax + 0xe0], edi
jmp 0x1402f9312
lea rcx, [0x140512bc0]
call fcn.140009080
mov r14, rax
mov rcx, r14
call fcn.1401c83a0
mov rcx, r14
call fcn.140009670
call fcn.140003fd4
mov ecx, dword [rax + 0xe0]
test bl, bl
je 0x1402f9266
cmp ecx, 0x80070002
je 0x1402f9240
cmp ecx, 2
jne 0x1402f9266
lea rcx, [0x140514200]
call fcn.140009080
mov rdi, rax
mov rcx, rdi
lea rdx, [0x1404ba218]
call fcn.1401cacd0
mov rcx, rdi
call fcn.140009670
call fcn.1402f9010
mov rcx, rax
call fcn.140009670
lea rdi, [rbp - 0x78]
lea r14, [rbp - 0x68]
xor r15d, r15d
lea r13, [rbp - 0x58]
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
xor ecx, ecx
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x30], rdi
mov rcx, r13
mov qword [rbp - 0x98], rcx
mov rdx, r15
mov qword [rbp - 0x90], rdx
mov r8, r14
mov qword [rbp - 0x88], r8
xor r9d, r9d
mov qword [rbp - 0x80], r9
lea rcx, [rbp - 0xc0]
call fcn.140009510
mov rcx, qword [rbp - 0x98]
mov rdx, qword [rbp - 0x90]
mov r8, qword [rbp - 0x88]
mov r9, qword [rbp - 0x80]
call sub.CRYPT32.dll_CryptProtectData
mov esi, eax
lea rcx, [rbp - 0xc0]
call fcn.140009560
call sub.KERNEL32.dll_GetLastError
mov edi, eax
test esi, esi
setne sil
movzx esi, sil
call fcn.140003fd4
mov dword [rax + 0xe0], edi
test sil, sil
je 0x1402f9224
cmp qword [rbp - 0x70], 0
je 0x1402f9205
mov ebx, dword [rbp - 0x78]
movsxd rdx, ebx
lea rcx, [0x1405e1dd8]
call fcn.1400091a0
mov rsi, rax
mov rcx, qword [rbp - 0x70]
mov rdx, rsi
mov r9d, ebx
xor r8d, r8d
call fcn.14042fd00
nop
cmp qword [rbp - 0x70], 0
je 0x1402f9384
mov ebx, dword [rbp - 0x78]
mov rdi, qword [rbp - 0x70]
xor r14d, r14d
test ebx, ebx
jle 0x1402f9372
movsxd rcx, r14d
mov byte [rdi + rcx], 0
inc r14d
cmp r14d, ebx
jl 0x1402f9363
mov rcx, qword [rbp - 0x70]
test rcx, 0xffffffffffff0000
je 0x1402f9384
call fcn.140270ba0
mov rax, rsi
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.14026efe0
int3