Function at 0x140002b90
Capabilities:
Encrypt data using dpapi
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbp
push rsi
lea rbp, [rax - 0x47]
sub rsp, 0xc8
xor esi, esi
mov qword [rax - 0x20], r12
mov qword [rax - 0x30], r14
lea r9, [rbp - 0x41]
mov qword [rdx], rsi
mov r12d, esi
mov qword [r8], rsi
mov r14d, esi
mov qword [rax - 0x38], r15
lea r8, [rbp - 0x31]
mov qword [rbp - 0x29], rsi
mov r15d, esi
mov qword [rbp - 0x39], rsi
mov qword [rbp - 0x49], rsi
mov qword [rbp - 0x11], rsi
mov dword [rbp + 0x77], esi
mov dword [rbp - 0x51], esi
call fcn.140005a40
test eax, eax
jne 0x140002ef0
cmp qword [0x140036958], rsi
mov rcx, qword [str.SHA256]
mov qword [rsp + 0xe0], rbx
cmove rcx, rsi
mov rbx, qword [rbp - 0x41]
mov qword [rsp + 0xc0], rdi
mov r8, rbx
mov rdi, qword [rbp - 0x31]
mov rdx, rdi
mov qword [rsp + 0xb0], r13
call fcn.140005b50
mov rdx, rbx
mov qword [rbp - 0x41], rax
mov rcx, rdi
mov r13, rax
call fcn.14000e1c0
mov rcx, rdi
call fcn.14001b710
test r13, r13
je 0x140002ed8
mov rdi, qword [rbp + 0x7f]
mov rcx, 0xffffffff80000002
mov ebx, esi
mov qword [rbp - 0x49], rcx
cmp dword [rdi + 0x40048], 2
jg 0x140002cba
mov rcx, qword [rdi + 0x28]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x140002ed0
lea rdx, [rbp - 0x49]
mov qword [rbp - 0x49], rsi
mov ecx, 0xf003f
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenCurrentUser]
test eax, eax
je 0x140002ca8
mov edx, eax
lea rcx, str.unable_to_open_users_registry_hive__ERROR____d
call fcn.1400039b0
or ebx, 0xffffffff
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_RevertToSelf]
test ebx, ebx
jne 0x140002ed0
mov rcx, qword [rbp - 0x49]
lea rax, [rbp - 0x29]
mov r9d, 0x20109
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREOpenSSHAgentKeys
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002ed0
mov rcx, qword [rbp - 0x29]
lea rax, [rbp - 0x39]
mov r9d, 0x20109
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, r13
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExA]
test eax, eax
jne 0x140002ed0
mov rcx, qword [rbp - 0x39]
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x140002ed0
mov ecx, dword [rbp + 0x77]
call fcn.14001b724
mov rbx, rax
test rax, rax
je 0x140002ed0
mov rcx, qword [rbp - 0x39]
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x140002eae
cmp dword [rdi + 0x40048], 2
mov r13d, esi
mov eax, dword [rbp + 0x77]
mov dword [rbp - 0x31], eax
jg 0x140002d93
mov rcx, qword [rdi + 0x28]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x140002eaa
mov eax, dword [rbp - 0x31]
mov dword [rbp - 9], eax
lea rcx, [rbp - 9]
lea rax, [rbp - 0x21]
mov qword [rbp - 1], rbx
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov dword [rsp + 0x28], esi
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rsi
mov dword [rbp - 0x21], esi
mov qword [rbp - 0x19], rsi
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
jne 0x140002dd7
lea rcx, str.cannot_decrypt_data
call fcn.1400039b0
jmp 0x140002e19
mov ecx, dword [rbp - 0x21]
call fcn.14001b724
mov r14, rax
test rax, rax
je 0x140002e19
mov edx, dword [rbp - 0x21]
mov rcx, rax
mov r8, qword [rbp - 0x19]
mov r9d, edx
call fcn.1400025b0
test eax, eax
je 0x140002e0d
mov edx, eax
lea rcx, [0x140036208]
call fcn.1400039b0
jmp 0x140002e19
mov eax, dword [rbp - 0x21]
mov r13d, 1
mov dword [rbp - 0x51], eax
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x140002e28
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
cmp dword [rdi + 0x40048], 2
jg 0x140002e37
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_RevertToSelf]
lea eax, [r13 - 1]
test eax, eax
jne 0x140002e9d
mov edx, dword [rbp - 0x51]
mov rcx, r14
call fcn.140003dc0
mov r15, rax
test rax, rax
je 0x140002e9d
lea rdx, [rbp - 0x11]
mov rcx, rax
call fcn.140006850
mov r12, qword [rbp - 0x11]
test eax, eax
jne 0x140002e91
mov rcx, qword [rbp + 0x6f]
mov r9, qword [rbp + 0x67]
mov r8, qword [rbp + 0x5f]
mov rdx, qword [rbp + 0x57]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rcx
mov rcx, r12
call fcn.1400066b0
test eax, eax
jne 0x140002e91
lea esi, [rax + 1]
jmp 0x140002e9d
lea rcx, str.cannot_sign_using_retrieved_key
call fcn.1400039b0
test r14, r14
je 0x140002eaa
mov rcx, r14
call fcn.14001b710
mov r13, qword [rbp - 0x41]
mov rcx, rbx
call fcn.14001b710
test r15, r15
je 0x140002ec3
mov rcx, r15
call fcn.140003f20
test r12, r12
je 0x140002ed0
mov rcx, r12
call fcn.1400054f0
mov rcx, r13
call fcn.14001b710
mov rdi, qword [rsp + 0xc0]
mov rbx, qword [rsp + 0xe0]
mov r13, qword [rsp + 0xb0]
mov rcx, qword [rbp - 0x49]
mov r15, qword [rsp + 0xa0]
mov r14, qword [rsp + 0xa8]
mov r12, qword [rsp + 0xb8]
test rcx, rcx
je 0x140002f17
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x140002f26
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x140002f35
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
lea eax, [rsi - 1]
add rsp, 0xc8
pop rsi
pop rbp
ret