Function at 0x14002c470
Capabilities:
Encrypt data using dpapi

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r13
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
mov qword [rbp + 7], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1401750a0]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rsi, r8
mov rdi, rdx
xor r14d, r14d
mov dword [rbp - 0x31], r14d
mov rcx, qword [r8 + 0x98]
lea r12, vtable.cookie_manager::TimeConverter.0
mov qword [rbp - 0x41], r12
mov qword [rbp - 0x39], rcx
movabs r13, 0x6666666666666667
mov rax, r13
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rbp - 0x41], r12
jne 0x14002c563
lea rcx, [rbp - 0x41]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov ecx, dword [rbp - 0x3d]
shl rcx, 0x20
mov eax, dword [rbp - 0x41]
add rcx, rax
mov dword [rbp - 0x41], ecx
shr rcx, 0x20
mov dword [rbp - 0x3d], ecx
mov qword [rbp - 0x59], r12
mov rcx, qword [rbp - 0x41]
mov qword [rbp - 0x51], rcx
mov dword [rbp - 0x31], 1
mov rax, r13
imul rcx
mov rcx, rdx
sar rcx, 2
mov rax, rcx
shr rax, 0x3f
add rcx, rax
mov r14d, 1
and r14d, 0xfffffffe
mov dword [rbp - 0x31], r14d
mov qword [rbp - 0x59], r12
mov rdx, qword [0x14017d4b0]
cmp rcx, rdx
jle 0x14002c560
mov rdx, rcx
mov qword [0x14017d4b0], rcx
jmp 0x14002c56a
inc rdx
mov qword [0x14017d4b0], rdx
mov rcx, qword [rdi + 8]
test rcx, rcx
jne 0x14002c577
xor ebx, ebx
jmp 0x14002c588
mov r8, rdx
mov edx, 1
call fcn.14005d6a0
mov rbx, qword [rdi + 8]
lea rcx, [rsi + 0x58]
call fcn.140002f80
mov r8, rax
test rbx, rbx
je 0x14002c5cc
mov rax, 0xffffffffffffffff
inc rax
cmp byte [r8 + rax], 0
jne 0x14002c5a0
mov byte [rsp + 0x28], 1
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9d, eax
mov edx, 2
mov rcx, rbx
call fcn.14005d490
mov rbx, qword [rdi + 8]
lea rcx, [rsi + 0x18]
call fcn.140002f80
mov r8, rax
test rbx, rbx
je 0x14002c636
mov rax, 0xffffffffffffffff
inc rax
cmp byte [r8 + rax], 0
jne 0x14002c5e4
mov byte [rsp + 0x28], 1
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9d, eax
mov edx, 3
mov rcx, rbx
call fcn.14005d490
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14002c636
mov byte [rsp + 0x28], 1
mov qword [rsp + 0x20], 0xffffffffffffffff
xor r9d, r9d
lea r8, [0x140135d28]
lea edx, [r9 + 4]
call fcn.14005d490
lea rcx, [rsi + 0x38]
call fcn.140002f80
mov rdx, rax
lea rcx, [rbp + 0xf]
call fcn.140002ff0
nop
lea rcx, [rbp + 0xf]
call fcn.140002e30
mov rbx, rax
lea rcx, [rbp + 0xf]
call fcn.140002f80
mov qword [rbp - 0x51], rax
mov dword [rbp - 0x59], ebx
lea rax, [rbp - 0x41]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14013c890]
lea rcx, [rbp - 0x59]
call qword [sym.imp.CRYPT32.dll_CryptProtectData]
test eax, eax
je 0x14002caa6
mov r8d, dword [rbp - 0x41]
mov rdx, qword [rbp - 0x39]
lea rcx, [rbp + 0xf]
call fcn.140003f30
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rcx, [rbp + 0xf]
call fcn.140002e30
mov rdx, rax
lea rcx, [rbp + 0xf]
call fcn.140002f80
mov rcx, qword [rdi + 8]
test rcx, rcx
jne 0x14002c6de
xor ebx, ebx
jmp 0x14002c700
mov byte [rsp + 0x28], 0
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9d, edx
mov r8, rax
mov edx, 5
call fcn.14005d490
mov rbx, qword [rdi + 8]
lea rcx, [rsi + 0x78]
call fcn.140002f80
mov r8, rax
test rbx, rbx
je 0x14002c748
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [r8 + rax], 0
jne 0x14002c720
mov byte [rsp + 0x28], 1
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9d, eax
mov edx, 6
mov rcx, rbx
call fcn.14005d490
mov rcx, qword [rsi + 0xa0]
mov qword [rbp - 0x59], r12
mov qword [rbp - 0x51], rcx
mov rax, r13
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rbp - 0x59], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14002c789
mov r8, rdx
mov edx, 7
call fcn.14005d6a0
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14002c7aa
xor r8d, r8d
cmp byte [rsi + 0xa8], r8b
setne r8b
mov edx, 8
call fcn.14005d6a0
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14002c7c2
movzx r8d, byte [rsi + 0xa9]
mov edx, 9
call fcn.14005d6a0
nop
lea rcx, [rbp - 0x41]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov edx, dword [rbp - 0x3d]
shl rdx, 0x20
mov ecx, dword [rbp - 0x41]
add rdx, rcx
mov dword [rbp - 0x41], edx
shr rdx, 0x20
mov dword [rbp - 0x3d], edx
mov qword [rbp - 0x59], r12
mov rcx, qword [rbp - 0x41]
mov qword [rbp - 0x51], rcx
or r14d, 2
mov dword [rbp - 0x31], r14d
mov rax, r13
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14002c821
mov r8, rdx
mov edx, 0xa
call fcn.14005d6a0
and r14d, 0xfffffffd
mov dword [rbp - 0x31], r14d
mov qword [rbp - 0x59], r12
lea rax, [rbp - 0x59]
mov qword [rbp - 0x41], rax
mov r14d, 0x16
mov word [rbp - 0x59], r14w
mov dword [rbp - 0x51], 1
mov rax, qword [rsi]
lea r9, [rbp - 0x59]
lea r8, str.has_expires
lea rdx, [rbp - 0x29]
mov rcx, rsi
call qword [rax + 0x10]
nop
cmp word [rbp - 0x29], r14w
jne 0x14002c86c
mov ebx, dword [rbp - 0x21]
jmp 0x14002c8a0
lea rcx, [rbp - 0x59]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov r9d, r14d
xor r8d, r8d
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x59]
call qword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
test eax, eax
js 0x14002cae4
mov ebx, dword [rbp - 0x51]
lea rcx, [rbp - 0x59]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14002c8b6
movsxd r8, ebx
mov edx, VariantTimeToDosDateTime
call fcn.14005d6a0
lea rax, [rbp - 0x59]
mov qword [rbp - 0x41], rax
mov word [rbp - 0x59], r14w
mov dword [rbp - 0x51], 1
mov rax, qword [rsi]
lea r9, [rbp - 0x59]
lea r8, str.persistent
lea rdx, [rbp - 0x11]
mov rcx, rsi
call qword [rax + 0x10]
nop
mov rdx, rax
lea rcx, [rbp - 0x29]
call qword [sym.imp.OLEAUT32.dll_VariantCopyInd]
test eax, eax
js 0x14002caec
lea rcx, [rbp - 0x11]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
cmp word [rbp - 0x29], 0x16
jne 0x14002c90e
mov ebx, dword [rbp - 0x21]
jmp 0x14002c942
lea rcx, [rbp - 0x59]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov r9d, r14d
xor r8d, r8d
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x59]
call qword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
test eax, eax
js 0x14002caf4
mov ebx, dword [rbp - 0x51]
lea rcx, [rbp - 0x59]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14002c958
movsxd r8, ebx
mov edx, reloc.SHLWAPI.dll_SHCreateMemStream
call fcn.14005d6a0
lea rax, [rbp - 0x59]
mov qword [rbp - 0x41], rax
mov word [rbp - 0x59], r14w
mov dword [rbp - 0x51], 1
mov rax, qword [rsi]
lea r9, [rbp - 0x59]
lea r8, str.priority
lea rdx, [rbp - 0x11]
mov rcx, rsi
call qword [rax + 0x10]
nop
mov rdx, rax
lea rcx, [rbp - 0x29]
call qword [sym.imp.OLEAUT32.dll_VariantCopyInd]
test eax, eax
js 0x14002cafc
lea rcx, [rbp - 0x11]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
cmp word [rbp - 0x29], 0x16
jne 0x14002c9b0
mov ebx, dword [rbp - 0x21]
jmp 0x14002c9e4
lea rcx, [rbp - 0x59]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov r9d, r14d
xor r8d, r8d
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x59]
call qword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
test eax, eax
js 0x14002cb04
mov ebx, dword [rbp - 0x51]
lea rcx, [rbp - 0x59]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14002c9fa
movsxd r8, ebx
mov edx, 0xd
call fcn.14005d6a0
lea rax, [rbp - 0x59]
mov qword [rbp - 0x41], rax
mov word [rbp - 0x59], r14w
mov dword [rbp - 0x51], 0
mov rax, qword [rsi]
lea r9, [rbp - 0x59]
lea r8, str.firstpartyonly
lea rdx, [rbp - 0x11]
mov rcx, rsi
call qword [rax + 0x10]
nop
mov rdx, rax
lea rcx, [rbp - 0x29]
call qword [sym.imp.OLEAUT32.dll_VariantCopyInd]
test eax, eax
js 0x14002cb0c
lea rcx, [rbp - 0x11]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
cmp word [rbp - 0x29], 0x16
jne 0x14002ca52
mov ebx, dword [rbp - 0x21]
jmp 0x14002ca82
lea rcx, [rbp - 0x59]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov r9d, r14d
xor r8d, r8d
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x59]
call qword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
test eax, eax
js 0x14002cadc
mov ebx, dword [rbp - 0x51]
lea rcx, [rbp - 0x59]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14002ca98
movsxd r8, ebx
mov edx, 0xe
call fcn.14005d6a0
mov bl, 1
lea rcx, [rbp - 0x29]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x14002caa8
xor bl, bl
lea rcx, [rbp + 0xf]
call fcn.140002fb0
movzx eax, bl
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1400dd420
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret
mov ecx, eax
call fcn.1400dd000
nop
mov ecx, eax
call fcn.1400dd000
nop
mov ecx, eax
call fcn.1400dd000
nop
mov ecx, eax
call fcn.1400dd000
nop
mov ecx, eax
call fcn.1400dd000
nop
mov ecx, eax
call fcn.1400dd000
nop
mov ecx, eax
call fcn.1400dd000
int3