Function at 0x401c00
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41a7fa
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
mov eax, dword [0x4213d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
test byte [0x423730], 1
jne 0x401c7c
or dword [0x423730], 1
xor esi, esi
mov dword [ebp - 4], esi
push 0x49
push str.9E487F0D_0985_4e93_89E2_D777C46714F0_2F89CF7F_1EAF_4ccd_A995_DC6470CC839B
mov ecx, 0x423714
mov dword [0x423728], 0xf
mov dword [0x423724], esi
mov byte [0x423714], 0
call fcn.004063d0
push 0x41ac50
call fcn.0040a456
add esp, 4
mov dword [ebp - 4], 0xffffffff
jmp 0x401c7e
xor esi, esi
mov eax, 0x10
cmp dword [0x423728], eax
jb 0x401c96
mov ecx, dword [0x423714]
mov dword [ebp - 0x18], ecx
jmp 0x401c9d
mov dword [ebp - 0x18], 0x423714
mov edx, dword [0x423724]
mov dword [ebp - 0x1c], edx
cmp dword [ebx + 0x14], eax
jb 0x401cb2
mov eax, dword [ebx]
mov dword [ebp - 0x20], eax
jmp 0x401cb5
mov dword [ebp - 0x20], ebx
mov ecx, dword [ebx + 0x10]
lea edx, [ebp - 0x14]
push edx
push esi
push esi
push esi
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x24], ecx
push str.AVSSD
lea ecx, [ebp - 0x24]
push ecx
call dword [sym.imp.CRYPT32.dll_CryptProtectData]
test eax, eax
jne 0x401cec
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test byte [0x423730], 2
mov ebx, 7
jne 0x401d44
or dword [0x423730], 2
mov dword [ebp - 4], 1
mov dword [0x423708], esi
xor edx, edx
push 0xb
mov eax, str._ByteArray_
mov esi, 0x4236f8
mov dword [0x42370c], ebx
mov word [0x4236f8], dx
call fcn.00405560
push 0x41ac10
call fcn.0040a456
add esp, 4
mov dword [ebp - 4], 0xffffffff
xor esi, esi
mov eax, 4
test byte [0x423730], al
jne 0x401d97
or dword [0x423730], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [0x4236ec], esi
mov word [0x4236dc], ax
push 1
mov eax, 0x41e0b8
mov esi, 0x4236dc
mov dword [0x4236f0], ebx
call fcn.00405560
push 0x41abd0
call fcn.0040a456
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [edi + 4]
mov esi, dword [edi]
cmp esi, ecx
je 0x401db9
mov eax, ecx
sub eax, ecx
sar eax, 1
lea ebx, [eax + eax]
push ebx
push ecx
push esi
call fcn.00409ec0
add esp, 0xc
add ebx, esi
mov dword [edi + 4], ebx
mov eax, dword [0x4236ec]
add eax, dword [0x423708]
mov esi, edi
add eax, dword [ebp - 0x14]
call fcn.00404920
mov eax, dword [0x4236f8]
mov esi, 8
cmp dword [0x42370c], esi
jae 0x401de5
mov eax, 0x4236f8
mov ecx, dword [0x423708]
lea edx, [ecx + ecx]
push edx
push eax
mov eax, dword [edi]
push eax
call fcn.0040ad20
mov ecx, dword [ebp - 0x14]
add esp, 0xc
xor eax, eax
test ecx, ecx
je 0x401e2d
jmp 0x401e10
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ecx + eax]
mov ecx, dword [0x423708]
mov ebx, dword [edi]
add ecx, eax
mov word [ebx + ecx*2], dx
mov ecx, dword [ebp - 0x14]
inc eax
cmp eax, ecx
jb 0x401e10
mov eax, dword [0x4236dc]
cmp dword [0x4236f0], esi
jae 0x401e3f
mov eax, 0x4236dc
mov edx, dword [0x4236ec]
add edx, edx
push edx
push eax
mov eax, dword [0x423708]
add eax, ecx
mov ecx, dword [edi]
lea edx, [ecx + eax*2]
push edx
call fcn.0040ad20
mov eax, dword [ebp - 0x10]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret