Function at 0x1400011f0
Capabilities:
Encrypt data using dpapi

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x100
mov rax, qword [0x140007040]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov r15, rdx
mov qword [rbp - 0x71], rcx
mov qword [rsp + 0x58], rcx
mov qword [rbp - 0x49], rdx
mov dword [rbp - 0x79], 0
mov eax, dword [rdx + 0x10]
xor ebx, ebx
xorps xmm0, xmm0
movups xmmword [rbp - 0x41], xmm0
xor r14d, r14d
mov qword [rbp - 0x31], r14
mov r13d, 0xf
mov qword [rbp - 0x29], r13
mov byte [rbp - 0x41], bl
mov dword [rbp - 0x79], 2
lea rdi, [rbx - 1]
test eax, eax
je 0x1400016be
xor r9d, r9d
xor ecx, ecx
lea r8, [0x140007740]
movzx esi, byte [rsp + 0x45]
nop word [rax + rax]
dec eax
mov dword [rsp + 0x48], eax
mov rax, r15
mov rdx, qword [r15 + 0x18]
cmp rdx, 0xf
jbe 0x140001296
mov rax, qword [r15]
cmp byte [r9 + rax], 0x3d
je 0x1400014db
mov rax, r15
cmp rdx, 0xf
jbe 0x1400012ad
mov rax, qword [r15]
movzx eax, byte [r9 + rax]
mov byte [rsp + rcx + 0x44], al
inc ebx
inc rcx
inc r9
mov qword [rsp + 0x50], r9
cmp rcx, 4
jne 0x1400014ca
cmp qword [0x140007758], 0xf
seta r12b
mov byte [rsp + 0x40], r12b
mov rbx, r8
mov rsi, qword [0x140007740]
cmova rbx, rsi
mov rdi, qword [0x140007750]
test rdi, rdi
je 0x140001312
movsx edx, byte [rsp + 0x44]
mov r8, rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x140001312
sub rax, rbx
jmp 0x140001319
mov rax, 0xffffffffffffffff
mov byte [rsp + 0x44], al
lea rbx, [0x140007740]
test r12b, r12b
cmovne rbx, rsi
test rdi, rdi
je 0x14000134d
movsx edx, byte [rsp + 0x45]
mov r8, rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rsi, rax
test rax, rax
je 0x14000134d
sub rsi, rbx
jmp 0x140001354
mov rsi, 0xffffffffffffffff
mov byte [rsp + 0x45], sil
lea r12, [0x140007740]
cmp byte [rsp + 0x40], 0
cmovne r12, qword [0x140007740]
test rdi, rdi
je 0x14000138f
movsx edx, byte [rsp + 0x46]
mov r8, rdi
mov rcx, r12
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x14000138f
sub rbx, r12
jmp 0x140001396
mov rbx, 0xffffffffffffffff
mov byte [rsp + 0x46], bl
lea r12, [0x140007740]
cmp byte [rsp + 0x40], 0
cmovne r12, qword [0x140007740]
test rdi, rdi
je 0x1400013d0
movsx edx, byte [rsp + 0x47]
mov r8, rdi
mov rcx, r12
call sub.VCRUNTIME140.dll_memchr
mov rcx, rax
test rax, rax
je 0x1400013d0
sub rcx, r12
jmp 0x1400013d7
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x47], cl
movzx r9d, sil
shr r9b, 4
and r9b, 3
movzx eax, byte [rsp + 0x44]
shl al, 2
add r9b, al
movzx edi, byte [rsp + 0x46]
shr dil, 2
and dil, 0xf
movzx eax, sil
shl al, 4
add dil, al
shl bl, 6
add bl, cl
cmp r14, r13
jae 0x140001434
lea rax, [r14 + 1]
mov qword [rbp - 0x31], rax
lea rax, [rbp - 0x41]
cmp r13, 0xf
cmova rax, qword [rbp - 0x41]
mov byte [rax + r14], r9b
mov byte [rax + r14 + 1], 0
jmp 0x14000143d
lea rcx, [rbp - 0x41]
call fcn.140003060
mov rcx, qword [rbp - 0x31]
mov rdx, qword [rbp - 0x29]
cmp rcx, rdx
jae 0x14000146a
lea rax, [rcx + 1]
mov qword [rbp - 0x31], rax
lea rax, [rbp - 0x41]
cmp rdx, 0xf
cmova rax, qword [rbp - 0x41]
mov byte [rax + rcx], dil
mov byte [rax + rcx + 1], 0
jmp 0x140001477
movzx r9d, dil
lea rcx, [rbp - 0x41]
call fcn.140003060
mov rcx, qword [rbp - 0x31]
mov rdx, qword [rbp - 0x29]
cmp rcx, rdx
jae 0x1400014a3
lea rax, [rcx + 1]
mov qword [rbp - 0x31], rax
lea rax, [rbp - 0x41]
cmp rdx, 0xf
cmova rax, qword [rbp - 0x41]
mov byte [rax + rcx], bl
mov byte [rax + rcx + 1], 0
jmp 0x1400014b0
movzx r9d, bl
lea rcx, [rbp - 0x41]
call fcn.140003060
xor ebx, ebx
xor ecx, ecx
mov r13, qword [rbp - 0x29]
mov r14, qword [rbp - 0x31]
lea r8, [0x140007740]
mov r9, qword [rsp + 0x50]
jmp 0x1400014cf
movzx esi, byte [rsp + 0x45]
mov eax, dword [rsp + 0x48]
test eax, eax
jne 0x140001280
test ebx, ebx
je 0x1400016b7
movsxd rax, ebx
cmp rax, 4
jge 0x140001505
jae 0x140001b96
mov byte [rsp + rax + 0x44], 0
inc rax
cmp rax, 4
jl 0x1400014ec
movzx esi, byte [rsp + 0x45]
cmp qword [0x140007758], 0xf
seta byte [rsp + 0x40]
lea r12, [0x140007740]
mov rdi, r12
cmova rdi, qword [0x140007740]
mov rax, qword [0x140007750]
test rax, rax
je 0x140001556
movsx edx, byte [rsp + 0x44]
mov r8, rax
mov rcx, rdi
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x140001556
sub rax, rdi
mov qword [rsp + 0x50], rax
mov rdi, 0xffffffffffffffff
jmp 0x140001562
mov rdi, 0xffffffffffffffff
mov qword [rsp + 0x50], rdi
mov rax, r12
cmp byte [rsp + 0x40], 0
cmovne rax, qword [0x140007740]
mov qword [rsp + 0x48], rax
cmp qword [0x140007750], 0
je 0x1400015a8
movsx edx, sil
mov rsi, qword [0x140007750]
mov r8, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x1400015af
sub rax, qword [rsp + 0x48]
mov qword [rsp + 0x48], rax
jmp 0x1400015b4
mov rsi, qword [0x140007750]
mov qword [rsp + 0x48], rdi
mov rax, r12
cmp byte [rsp + 0x40], 0
cmovne rax, qword [0x140007740]
mov qword [rsp + 0x58], rax
test rsi, rsi
je 0x1400015ed
movsx edx, byte [rsp + 0x46]
mov r8, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
mov rsi, rax
test rax, rax
je 0x1400015ed
sub rsi, qword [rsp + 0x58]
jmp 0x1400015f0
mov rsi, rdi
cmp byte [rsp + 0x40], 0
cmovne r12, qword [0x140007740]
mov r8, qword [0x140007750]
test r8, r8
je 0x140001623
movsx edx, byte [rsp + 0x47]
mov rcx, r12
call sub.VCRUNTIME140.dll_memchr
mov rdx, rax
test rax, rax
je 0x140001623
sub rdx, r12
jmp 0x140001626
mov rdx, rdi
mov rcx, qword [rsp + 0x48]
movzx eax, cl
shr al, 4
and al, 3
mov r8, qword [rsp + 0x50]
shl r8b, 2
add al, r8b
mov byte [rsp + 0x44], al
movzx eax, sil
shr al, 2
and al, 0xf
shl cl, 4
add al, cl
mov byte [rsp + 0x45], al
shl sil, 6
add sil, dl
mov byte [rsp + 0x46], sil
lea eax, [rbx - 1]
movsxd rsi, eax
test eax, eax
jle 0x1400016be
xor ebx, ebx
nop dword [rax]
movzx r9d, byte [rsp + rbx + 0x44]
cmp r14, r13
jae 0x14000169c
lea rax, [r14 + 1]
mov qword [rbp - 0x31], rax
lea rax, [rbp - 0x41]
cmp r13, 0xf
cmova rax, qword [rbp - 0x41]
mov byte [rax + r14], r9b
mov byte [rax + r14 + 1], 0
jmp 0x1400016a5
lea rcx, [rbp - 0x41]
call fcn.140003060
inc rbx
mov r13, qword [rbp - 0x29]
mov r14, qword [rbp - 0x31]
cmp rbx, rsi
jl 0x140001670
jmp 0x1400016be
mov rdi, 0xffffffffffffffff
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x11], xmm1
cmp r14, 5
jb 0x140001b9c
lea rax, [r14 - 5]
cmp rax, 0xffffffffffffffff
cmovb rdi, rax
lea rdx, [rbp - 0x41]
cmp r13, 0xf
cmova rdx, qword [rbp - 0x41]
add rdx, 5
mov r8, rdi
lea rcx, [rbp - 0x21]
call fcn.1400031c0
nop
mov rdx, qword [rbp - 0x29]
cmp rdx, 0xf
jbe 0x14000173c
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001737
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001ab7
call fcn.1400039e8
xorps xmm0, xmm0
movups xmmword [rbp - 0x41], xmm0
lea rdx, [rbp - 0x21]
cmp qword [rbp - 9], 0xf
cmova rdx, qword [rbp - 0x21]
mov r14, qword [rbp - 0x11]
add r14, rdx
lea rax, [rbp - 0x21]
cmp qword [rbp - 9], 0xf
cmova rax, qword [rbp - 0x21]
mov qword [rsp + 0x58], rax
xor ebx, ebx
mov qword [rbp - 0x41], rbx
xor r12d, r12d
mov qword [rbp - 0x39], r12
xor esi, esi
mov qword [rbp - 0x31], rsi
xor edi, edi
xor r13d, r13d
sub r14, rax
je 0x140001801
movabs rax, 0x7fffffffffffffff
cmp r14, rax
ja 0x140001ba2
cmp r14, 0x1000
jb 0x1400017cd
lea rcx, [r14 + 0x27]
cmp rcx, r14
jbe 0x140001b90
call fcn.14000376c
test rax, rax
je 0x140001ab7
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x1400017d8
mov rcx, r14
call fcn.14000376c
mov rbx, rax
mov qword [rbp - 0x41], rbx
lea r12, [rbx + r14]
mov rsi, r12
mov qword [rbp - 0x31], r12
mov r8, r14
mov rdx, qword [rsp + 0x58]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp - 0x39], r12
mov rdi, rbx
mov r13, r12
cmp rdi, r13
je 0x140001847
mov r14, r12
sub r14, rbx
nop dword [rax]
movzx edx, byte [rdi]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x140005464]
call fcn.140002d00
mov edx, r14d
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
inc rdi
cmp rdi, r13
jne 0x140001810
lea rdx, [0x140002ed0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
sub r12, rbx
mov dword [rbp - 0x59], r12d
mov qword [rbp - 0x51], rbx
lea rax, [rbp - 0x69]
mov qword [rsp + 0x30], rax
xor r14d, r14d
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x59]
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test eax, eax
je 0x140001a4a
lea rdx, str.Decrypted_Data:
call fcn.140002d00
mov edi, r14d
cmp dword [rbp - 0x69], r14d
jbe 0x1400018df
mov ecx, edi
mov rax, qword [rbp - 0x61]
movzx edx, byte [rcx + rax]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x140005464]
call fcn.140002d00
inc edi
cmp edi, dword [rbp - 0x69]
jb 0x1400018b2
lea rdx, [0x140002ed0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r8d, dword [rbp - 0x69]
xorps xmm0, xmm0
movups xmmword [rbp - 1], xmm0
mov qword [rbp + 0xf], r14
mov qword [rbp + 0x17], r14
mov rdx, qword [rbp - 0x61]
lea rcx, [rbp - 1]
call fcn.1400031c0
nop
lea rdx, str.Decrypted_String:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002d00
lea rdx, [rbp - 1]
cmp qword [rbp + 0x17], 0xf
cmova rdx, qword [rbp - 1]
mov r8, qword [rbp + 0xf]
mov rcx, rax
call fcn.1400032c0
mov rcx, rax
lea rdx, [0x140002ed0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp - 0x61]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdi, qword [rbp - 0x71]
movups xmm0, xmmword [rbp - 1]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbp + 0xf]
movups xmmword [rdi + 0x10], xmm1
mov qword [rbp + 0xf], r14
mov qword [rbp + 0x17], 0xf
mov byte [rbp - 1], 0
test rbx, rbx
je 0x1400019ba
sub rsi, rbx
mov rax, rbx
cmp rsi, 0x1000
jb 0x1400019ae
add rsi, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400019ae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, rsi
mov rcx, rbx
call fcn.1400039e8
nop
mov rdx, qword [rbp - 9]
cmp rdx, 0xf
jbe 0x1400019f8
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400019f3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400019f3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400039e8
movdqa xmm0, xmmword [0x140005520]
movdqu xmmword [rbp - 0x11], xmm0
mov byte [rbp - 0x21], 0
mov rdx, qword [r15 + 0x18]
cmp rdx, 0xf
jbe 0x140001b4f
inc rdx
mov rcx, qword [r15]
cmp rdx, 0x1000
jb 0x140001b4a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
jbe 0x140001b47
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, str.CryptUnprotectData_failed.
call fcn.140002d00
mov rcx, rax
lea rdx, [0x140002ed0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xorps xmm0, xmm0
mov rdi, qword [rbp - 0x71]
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], r14
mov r8d, 7
lea rdx, str.nothing
mov rcx, rdi
call fcn.1400031c0
nop
test rbx, rbx
je 0x140001aca
sub rsi, rbx
mov rax, rbx
cmp rsi, 0x1000
jb 0x140001abe
add rsi, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001abe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, rsi
mov rcx, rbx
call fcn.1400039e8
nop
mov rdx, qword [rbp - 9]
cmp rdx, 0xf
jbe 0x140001b08
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001b03
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001b03
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400039e8
movdqa xmm0, xmmword [0x140005520]
movdqu xmmword [rbp - 0x11], xmm0
mov byte [rbp - 0x21], 0
mov rdx, qword [r15 + 0x18]
cmp rdx, 0xf
jbe 0x140001b4f
inc rdx
mov rcx, qword [r15]
cmp rdx, 0x1000
jb 0x140001b4a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140001b89
mov rcx, r8
call fcn.1400039e8
mov rax, rdi
mov byte [r15], 0
mov qword [r15 + 0x18], 0xf
mov qword [r15 + 0x10], r14
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.1400034b0
mov rbx, qword [rsp + 0x150]
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140001130
nop
call fcn.1400035d8
int3
call fcn.140002ce0
nop
call fcn.140003480
int3