Function at 0x10007d180
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc8
mov rax, qword [0x10010f190]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbp, qword [rsp + 0x138]
xor r13d, r13d
mov qword [rsp + 0x98], rdx
inc dword [rbp + 4]
mov qword [rsp + 0x90], rcx
lea rdx, [rsp + 0x60]
movdqu xmm0, xmmword [r8]
lea rcx, [r11 - 0x68]
mov esi, r9d
mov rdi, r8
movdqu xmmword [r11 - 0x68], xmm0
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x60], r13
mov r15, r13
mov r12d, r13d
mov dword [rsp + 0x48], r13d
call fcn.1000b1f80
mov ebx, eax
cmp eax, r13d
je 0x10007d218
mov edx, 0x20840139
mov r8d, eax
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
jmp 0x10007d7da
lea rax, [rdi + 0x10]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x44]
mov qword [rsp + 0x50], rax
lea eax, [rsi - 0x10]
lea rdx, [rsp + 0x50]
mov ecx, 1
mov dword [rsp + 0x44], eax
call fcn.10007ae30
mov ebx, eax
cmp eax, r13d
je 0x10007d24f
mov edx, 0x208c0139
jmp 0x10007d206
mov edx, dword [rsp + 0x40]
xor ecx, ecx
shr rdx, 1
lea rdx, [rdx + rdx + 2]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r14, rax
cmp rax, r13
jne 0x10007d288
mov r8d, 0x8007000e
xor r9d, r9d
mov edx, 0x20940139
xor ecx, ecx
mov ebx, r8d
call fcn.1000b51b8
jmp 0x10007d7cc
mov rdi, qword [rsp + 0x50]
mov r8d, dword [rsp + 0x40]
mov rcx, rax
mov rdx, rdi
call sub.msvcrt.dll_memcpy
mov edx, dword [rsp + 0x40]
shr rdx, 1
mov word [r14 + rdx*2], r13w
cmp dword [0x10011bd04], r13d
je 0x10007d2e4
lea rcx, [0x10001e320]
call fcn.1000b99b0
mov ecx, 0x8d4
call fcn.1000ba420
mov rcx, rax
call fcn.1000b99b0
mov r8, qword [rsp + 0x60]
lea rcx, [0x10001e358]
mov rdx, r14
call fcn.1000b99b0
mov ecx, dword [rsp + 0x40]
add rdi, rcx
sub dword [rsp + 0x44], ecx
mov qword [rsp + 0x50], rdi
je 0x10007d7c9
cmp dword [0x10011bd04], r13d
je 0x10007d30f
lea rcx, [0x10000c564]
call fcn.1000b99b0
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x44]
lea rdx, [rsp + 0x50]
xor ecx, ecx
call fcn.10007ae30
mov ebx, eax
cmp eax, r13d
jne 0x10007d86b
mov esi, dword [rsp + 0x68]
mov r12d, 1
cmp dword [0x10011bd04], r12d
jle 0x10007d36b
lea rcx, [0x10000c564]
call fcn.1000b99b0
lea r9, [0x100019500]
lea r8, [0x100019500]
mov dl, r12b
xor ecx, ecx
mov dword [rsp + 0x20], esi
call fcn.10006c924
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x44]
lea rdx, [rsp + 0x50]
mov ecx, r12d
call fcn.10007ae30
mov ebx, eax
cmp eax, r13d
jne 0x10007d861
mov ecx, dword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
mov qword [rsp + 0x78], rdi
mov ebx, ecx
mov dword [rsp + 0x58], ecx
cmp dword [0x10011bd20], r13d
je 0x10007d3d3
lea rcx, [0x10000c564]
call fcn.1000b99b0
or r8d, 0xffffffff
mov edx, ebx
mov rcx, rdi
call fcn.10007c5e8
mov ebx, eax
cmp eax, r13d
jne 0x10007d780
mov ecx, dword [rsp + 0x40]
sub dword [rsp + 0x44], ecx
mov eax, ecx
lea r9, [rsp + 0x80]
add rdi, rax
lea r8, [rsp + 0x44]
lea rdx, [rsp + 0x50]
xor ecx, ecx
mov qword [rsp + 0x50], rdi
call fcn.10007ae30
mov ebx, eax
cmp eax, r13d
jne 0x10007d857
lea r9, [rsp + 0x84]
lea r8, [rsp + 0x44]
lea rdx, [rsp + 0x50]
xor ecx, ecx
call fcn.10007ae30
mov ebx, eax
cmp eax, r13d
jne 0x10007d84d
cmp dword [0x10011bd04], r13d
je 0x10007d460
lea r9, [rsp + 0x80]
xor r8d, r8d
mov edx, 0x20f
xor ecx, ecx
call fcn.100051fbc
cmp eax, r13d
je 0x10007d460
xor r9d, r9d
mov r8d, eax
mov edx, 0x20e20139
xor ecx, ecx
call fcn.1000b51b8
and esi, 8
cmp sil, r13b
jne 0x10007d49c
add dword [rbp + 8], r12d
cmp dword [0x10011bd04], r13d
je 0x10007d493
mov ecx, 0x8a9
call fcn.1000ba420
mov rcx, rax
call fcn.1000b99b0
lea rcx, [0x10000c564]
call fcn.1000b99b0
mov ebp, dword [rsp + 0x44]
jmp 0x10007d771
add dword [rbp + 0xc], r12d
add dword [rbp + 0x20], r12d
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x44]
lea rdx, [rsp + 0x50]
mov ecx, r12d
call fcn.10007ae30
mov ebx, eax
cmp eax, r13d
jne 0x10007d843
cmp dword [0x10011bd04], 1
mov r12, qword [rsp + 0x50]
jle 0x10007d4f3
lea rcx, [0x10001e378]
call fcn.1000b99b0
mov r8d, 8
mov rdx, r12
mov ecx, 0xe04
call fcn.1000afa70
cmp qword [rsp + 0x130], r13
je 0x10007d52b
mov rcx, qword [rsp + 0x130]
xor r9d, r9d
mov r8, r12
lea edx, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
cmp eax, r13d
jne 0x10007d52b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, r13d
jne 0x10007d78d
mov ebp, dword [rsp + 0x44]
mov esi, dword [rsp + 0x40]
mov eax, 0xfffffff8
add ebp, eax
add r12, 8
cmp esi, 8
jb 0x10007d54a
add esi, eax
mov ebx, r13d
jmp 0x10007d552
or esi, 0xffffffff
mov ebx, 0x80070216
mov dword [rsp + 0x40], esi
cmp ebx, r13d
jne 0x10007d82a
cmp dword [0x10011bd04], 1
jle 0x10007d5a5
lea rcx, [0x10000c564]
call fcn.1000b99b0
mov ecx, 0x8d5
call fcn.1000ba420
mov rcx, rax
call fcn.1000b99b0
lea rcx, [0x10000c564]
call fcn.1000b99b0
mov r8d, dword [rsp + 0x40]
mov rdx, r12
xor ecx, ecx
call fcn.1000afa70
mov esi, dword [rsp + 0x40]
cmp qword [rsp + 0x130], r13
je 0x10007d761
mov edx, esi
xor ecx, ecx
mov dword [rsp + 0x48], esi
mov r13d, esi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r15, rax
test rax, rax
je 0x10007d7b4
mov r8, r13
mov rdx, r12
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rcx, qword [rsp + 0x130]
xor r9d, r9d
lea r11, [rsp + 0x40]
lea r8d, [r9 + 1]
xor edx, edx
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x10007d625
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor r9d, r9d
mov edx, 0x21340139
mov r8d, eax
xor ecx, ecx
call fcn.1000b51b8
jmp 0x10007d748
cmp dword [0x10011bd04], 1
jle 0x10007d66f
lea rcx, [0x10000c564]
call fcn.1000b99b0
mov ecx, 0x8d6
call fcn.1000ba420
mov rcx, rax
call fcn.1000b99b0
lea rcx, [0x10000c564]
call fcn.1000b99b0
mov ecx, dword [0x10011bd44]
mov r8d, dword [rsp + 0x40]
bts ecx, 0xc
mov rdx, r15
call fcn.1000afa70
lea rax, [rsp + 0x6c]
mov r9d, 0xa400
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x88]
mov edx, esi
mov rcx, r15
mov qword [rsp + 0x20], rax
call fcn.10007b064
mov ebx, eax
test eax, eax
jne 0x10007d79a
and dword [rsp + 0x28], eax
mov edi, dword [rsp + 0x6c]
mov rbx, qword [rsp + 0x88]
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x78]
mov r9d, edi
mov r8, rbx
mov dword [rsp + 0x20], 1
call fcn.10007bf88
test eax, eax
je 0x10007d6e5
xor r9d, r9d
mov r8d, eax
mov edx, 0x21530139
xor ecx, ecx
call fcn.1000b51b8
mov rax, qword [rsp + 0x70]
mov r9d, dword [rsp + 0x58]
mov r8, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x38], rax
and dword [rsp + 0x30], 0
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
call fcn.10007cdac
test eax, eax
je 0x10007d735
mov r9d, 0x80090006
mov r8d, eax
mov edx, 0x215e0139
xor ecx, ecx
call fcn.1000b51b8
mov rcx, rdi
xor eax, eax
mov rdi, rbx
rep stosb byte [rdi], al
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov rdi, r15
mov rcx, r13
rep stosb byte [rdi], al
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor r13d, r13d
mov r15, r13
mov eax, esi
add r12, rax
sub ebp, esi
mov dword [rsp + 0x44], ebp
mov qword [rsp + 0x50], r12
cmp ebp, r13d
jbe 0x10007d7c4
mov rbp, qword [rsp + 0x70]
jmp 0x10007d2fa
mov r8d, eax
mov edx, 0x20c90139
jmp 0x10007d832
mov r8d, eax
mov edx, 0x210f0139
jmp 0x10007d832
mov r8d, eax
mov edx, 0x214a0139
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
mov r12d, esi
xor r13d, r13d
jmp 0x10007d7cc
mov r8d, 0x8007000e
mov edx, 0x212e0139
mov ebx, r8d
jmp 0x10007d7a2
mov r12d, dword [rsp + 0x48]
mov ebx, r13d
cmp r14, r13
je 0x10007d7da
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp qword [rsp + 0x60], r13
je 0x10007d7ec
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp r15, r13
je 0x10007d804
xor eax, eax
mov ecx, r12d
mov rdi, r15
rep stosb byte [rdi], al
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebx
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1000ef870
add rsp, 0xc8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov r8d, ebx
mov edx, 0x21170139
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
mov r12d, dword [rsp + 0x48]
jmp 0x10007d7cc
mov r8d, eax
mov edx, 0x20f70139
jmp 0x10007d832
mov r8d, eax
mov edx, 0x20dd0139
jmp 0x10007d832
mov r8d, eax
mov edx, 0x20d60139
jmp 0x10007d832
mov r8d, eax
mov edx, 0x20bf0139
jmp 0x10007d832
mov r8d, eax
mov edx, 0x20b10139
jmp 0x10007d832