Function at 0x140019260
Capabilities:
Decode data using base64 via winapi
Encrypt or decrypt data via bcrypt

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rax, qword [0x140087048]
xor rax, rsp
mov qword [rbp + 0x68], rax
mov r15, r8
mov qword [rsp + 0x58], r8
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x60], rcx
mov qword [rbp - 0x10], rdx
xor r12d, r12d
mov rdx, qword [rdx + 0x10]
cmp rdx, 0xf
jae 0x1400192c1
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], r12
mov qword [rcx + 0x18], r12
jmp 0x140019ca7
mov edi, 0x16
lea r13, [rdi - 0x17]
test r9d, r9d
je 0x1400195e9
mov dword [rsp + 0x70], r12d
mov rcx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x1400192e5
mov rcx, qword [rbx]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [r9 + 1]
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
xorps xmm0, xmm0
test eax, eax
jne 0x1400193a2
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], r12
xor r8d, r8d
lea rdx, [0x1400775f0]
mov rcx, rsi
call fcn.140007670
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140019369
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140019364
add rdx, 0x27
mov rdi, qword [rcx - 8]
sub rcx, rdi
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140019d0a
mov rcx, rdi
call fcn.14003dd70
mov byte [rbx], 0
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], r12
mov rax, rsi
mov rcx, qword [rbp + 0x68]
xor rcx, rsp
call fcn.14003dd50
mov rbx, qword [rsp + 0x1c8]
add rsp, 0x170
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r14d, dword [rsp + 0x70]
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], 0xf
cmp r14, 0x10
jae 0x1400193da
mov qword [rbp + 0x10], r14
mov r8d, r14d
xor edx, edx
lea rcx, [rbp]
call fcn.14003fdf0
mov byte [rbp + r14], 0
jmp 0x14001945d
mov r15, r14
or r15, 0xf
cmp r15, rdi
cmovb r15, rdi
mov rcx, r15
add rcx, 1
cmovb rcx, r13
cmp rcx, 0x1000
jb 0x140019428
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140019d04
mov rcx, rax
call fcn.14003dd78
test rax, rax
je 0x140019d10
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14001943a
test rcx, rcx
je 0x140019437
call fcn.14003dd78
mov rdi, rax
jmp 0x14001943a
mov rdi, r12
mov qword [rbp], rdi
mov qword [rbp + 0x10], r14
mov qword [rbp + 0x18], r15
mov r8, r14
xor edx, edx
mov rcx, rdi
call fcn.14003fdf0
mov byte [rdi + r14], 0
mov r15, qword [rsp + 0x58]
lea r9, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae r9, qword [rbp]
mov rcx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140019478
mov rcx, qword [rbx]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r8d, 1
mov edx, dword [rbx + 0x10]
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x140019510
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], r12
xor r8d, r8d
lea rdx, [0x1400775f0]
mov rcx, rsi
call fcn.140007670
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x1400194fb
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400194f6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019d10
call fcn.14003dd70
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], 0xf
mov byte [rbp], 0
jmp 0x14001932f
mov ecx, dword [rsp + 0x70]
mov rdx, qword [rbp + 0x10]
cmp rcx, rdx
ja 0x140019535
lea rax, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae rax, qword [rbp]
mov qword [rbp + 0x10], rcx
mov byte [rax + rcx], 0
jmp 0x14001958a
mov r14, rcx
sub r14, rdx
mov rdi, qword [rbp + 0x18]
mov rax, rdi
sub rax, rdx
cmp r14, rax
ja 0x140019573
mov qword [rbp + 0x10], rcx
lea rax, [rbp]
cmp rdi, 0x10
cmovae rax, qword [rbp]
lea rdi, [rdx + rax]
mov r8, r14
xor edx, edx
mov rcx, rdi
call fcn.14003fdf0
mov byte [r14 + rdi], 0
jmp 0x14001958a
mov byte [rsp + 0x20], 0
mov r9, r14
xor r8d, r8d
mov rdx, r14
lea rcx, [rbp]
call fcn.14000b760
lea rax, [rbp]
cmp rbx, rax
je 0x1400195ae
lea rdx, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae rdx, qword [rbp]
mov r8, qword [rbp + 0x10]
mov rcx, rbx
call fcn.140007110
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x1400195e9
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400195e4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019d10
call fcn.14003dd70
cmp dword [r15], 0
je 0x140019c96
cmp qword [r15 + 8], 0
je 0x140019c96
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], r12
mov rdi, qword [rbx + 0x10]
mov dword [rbp - 8], r12d
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x20], xmm1
mov r13, r12
mov qword [rbp + 0x30], r12
test rdi, rdi
je 0x14001964e
mov rdx, rdi
lea rcx, [rbp + 0x20]
call fcn.14001c320
mov r8, rdi
xor edx, edx
mov r15, qword [rbp + 0x20]
mov rcx, r15
call fcn.14003fdf0
lea rax, [r15 + rdi]
mov qword [rbp + 0x28], rax
mov r13, qword [rbp + 0x30]
jmp 0x140019656
mov rax, qword [rbp + 0x28]
mov r15, qword [rbp + 0x20]
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x38], xmm1
mov rax, r12
mov qword [rsp + 0x70], rax
mov qword [rbp + 0x48], rax
movups xmmword [rbp + 0x50], xmm0
mov ecx, 0xc
call fcn.14003dd78
mov r14, rax
mov qword [rbp + 0x50], rax
lea r12, [rax + 0xc]
mov qword [rbp + 0x60], r12
xor eax, eax
mov qword [r14], rax
mov dword [r14 + 8], eax
mov qword [rbp + 0x58], r12
cmp qword [rbx + 0x18], 0x10
jb 0x1400196af
mov r8, qword [rbx]
add r8, 0xf
mov rdx, qword [rbx]
jmp 0x1400196b6
lea r8, [rbx + 0xf]
mov rdx, rbx
add rdx, 3
sub r8, rdx
mov rcx, r14
call fcn.1400401b0
cmp qword [rbx + 0x18], 0x10
jb 0x1400196d7
mov r8, qword [rbx]
add r8, rdi
mov rdx, qword [rbx]
jmp 0x1400196de
lea r8, [rdi + rbx]
mov rdx, rbx
add rdx, 0xf
sub r8, rdx
mov rcx, r15
call fcn.1400401b0
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140078398]
lea rcx, [rsp + 0x78]
call qword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
test eax, eax
jns 0x1400197f2
xor edi, edi
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], rdi
xor r8d, r8d
lea rdx, [0x1400775f0]
mov rcx, rsi
call fcn.140007670
nop
test r14, r14
je 0x140019769
sub r12, r14
cmp r12, 0x1000
jb 0x14001975d
mov rcx, qword [r14 - 8]
sub r14, rcx
add r12, 0x27
lea rax, [r14 - 8]
cmp rax, 0x1f
ja 0x140019cf2
mov r14, rcx
mov rdx, r12
mov rcx, r14
call fcn.14003dd70
nop
test r15, r15
je 0x1400197a2
sub r13, r15
mov rax, r15
cmp r13, 0x1000
jb 0x140019796
mov r15, qword [r15 - 8]
sub rax, r15
add r13, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019cf8
mov rdx, r13
mov rcx, r15
call fcn.14003dd70
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1400197de
inc rdx
cmp rdx, 0x1000
mov rcx, qword [rbx]
jb 0x1400197d9
add rdx, 0x27
mov rdi, qword [rcx - 8]
sub rcx, rdi
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140019cfe
mov rcx, rdi
xor edi, edi
call fcn.14003dd70
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
jmp 0x140019378
mov dword [rsp + 0x20], 0
mov r9d, 0x20
lea r8, str.ChainingModeGCM
lea rdx, str.ChainingMode
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.bcrypt.dll_BCryptSetProperty]
test eax, eax
jns 0x14001982f
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.bcrypt.dll_BCryptCloseAlgorithmProvider]
jmp 0x14001970d
mov dword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx]
mov dword [rsp + 0x28], eax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp - 0x80]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.bcrypt.dll_BCryptGenerateSymmetricKey]
test eax, eax
jns 0x140019876
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.bcrypt.dll_BCryptCloseAlgorithmProvider]
jmp 0x14001970d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x70], 0x58
mov dword [rbp - 0x6c], 1
lea rcx, [rdi - 0x1f]
mov qword [rsp + 0x58], rcx
mov qword [rbp - 0x68], r14
mov dword [rbp - 0x60], 0xc
lea rax, [r15 + rcx]
mov qword [rbp - 0x48], rax
mov dword [rbp - 0x40], 0x10
xor edi, edi
mov dword [rsp + 0x48], edi
lea rax, [rbp - 8]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], edi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x70]
mov r8d, ecx
mov rdx, r15
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.bcrypt.dll_BCryptDecrypt]
test eax, eax
js 0x14001970f
mov ecx, dword [rbp - 8]
cmp ecx, 0x400
ja 0x14001970f
mov edx, ecx
test ecx, ecx
je 0x14001992b
lea rcx, [rbp + 0x38]
call fcn.14001ef20
mov ecx, dword [rbp - 8]
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x48], edi
lea rax, [rbp - 8]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], ecx
mov rdi, qword [rbp + 0x38]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x30], rdi
xor eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x70]
mov r8d, dword [rsp + 0x58]
mov rdx, r15
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.bcrypt.dll_BCryptDecrypt]
test eax, eax
jns 0x140019a98
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
xor eax, eax
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], rax
xor r8d, r8d
lea rdx, [0x1400775f0]
mov rcx, rsi
call fcn.140007670
nop
test r14, r14
je 0x1400199cf
sub r12, r14
cmp r12, 0x1000
jb 0x1400199c3
add r12, 0x27
mov rcx, qword [r14 - 8]
sub r14, rcx
lea rax, [r14 - 8]
cmp rax, 0x1f
ja 0x140019cf2
mov r14, rcx
mov rdx, r12
mov rcx, r14
call fcn.14003dd70
nop
test rdi, rdi
je 0x140019a0d
mov rcx, qword [rsp + 0x70]
sub rcx, rdi
mov rax, rdi
cmp rcx, 0x1000
jb 0x140019a01
add rcx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019d28
mov rdx, rcx
mov rcx, rdi
call fcn.14003dd70
nop
test r15, r15
je 0x140019a46
sub r13, r15
mov rax, r15
cmp r13, 0x1000
jb 0x140019a3a
add r13, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019cf8
mov rdx, r13
mov rcx, r15
call fcn.14003dd70
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140019a80
inc rdx
cmp rdx, 0x1000
mov rcx, qword [rbx]
jb 0x140019a7b
add rdx, 0x27
mov rdi, qword [rcx - 8]
sub rcx, rdi
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140019cfe
mov rcx, rdi
call fcn.14003dd70
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
jmp 0x140019378
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.bcrypt.dll_BCryptCloseAlgorithmProvider]
mov rcx, qword [rsp + 0x50]
sub rcx, r15
mov rdi, r15
xor eax, eax
rep stosb byte [rdi], al
mov rdi, r14
mov ecx, 0xc
rep stosb byte [rdi], al
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.bcrypt.dll_BCryptDestroyKey]
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
xor r8d, r8d
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], 0xf
mov r9, qword [rbp + 0x40]
mov rdi, qword [rsp + 0x60]
cmp rdi, r9
jne 0x140019af3
mov byte [rsi], r8b
jmp 0x140019be9
mov rax, r9
sub rax, rdi
mov rdx, rdi
movabs rcx, 0x7fffffffffffffff
mov qword [rsp + 0x50], rcx
cmp rax, rcx
ja 0x140019d16
cmp rax, 0x10
jb 0x140019bb0
or rax, 0xf
cmp rax, rcx
ja 0x140019b3c
mov rcx, rax
cmp rax, 0x16
mov eax, 0x16
cmovb rcx, rax
mov qword [rsp + 0x50], rcx
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x140019b8a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140019d1c
mov rcx, rax
call fcn.14003dd78
mov rcx, rax
test rax, rax
je 0x140019d22
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov rdx, rdi
mov r9, qword [rbp + 0x40]
jmp 0x140019ba0
test rcx, rcx
je 0x140019b9d
call fcn.14003dd78
mov rdx, rdi
mov r9, qword [rbp + 0x40]
jmp 0x140019ba0
mov rax, r8
mov qword [rsi], rax
mov rax, qword [rsp + 0x50]
mov qword [rsi + 0x18], rax
nop dword [rax]
mov r8, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x140019bbd
mov r8, qword [rsi]
movzx ecx, byte [rdx]
mov rax, qword [rsi + 0x10]
mov byte [r8 + rax], cl
inc qword [rsi + 0x10]
mov rax, qword [rsi + 0x10]
inc rdx
cmp rdx, r9
jne 0x140019bb0
mov rcx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x140019be5
mov rcx, qword [rsi]
mov byte [rcx + rax], 0
test r14, r14
je 0x140019c22
sub r12, r14
cmp r12, 0x1000
jb 0x140019c16
add r12, 0x27
mov rcx, qword [r14 - 8]
sub r14, rcx
lea rax, [r14 - 8]
cmp rax, 0x1f
ja 0x140019cf2
mov r14, rcx
mov rdx, r12
mov rcx, r14
call fcn.14003dd70
nop
test rdi, rdi
je 0x140019c60
mov rcx, qword [rsp + 0x70]
sub rcx, rdi
mov rax, rdi
cmp rcx, 0x1000
jb 0x140019c54
add rcx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019d28
mov rdx, rcx
mov rcx, rdi
call fcn.14003dd70
nop
test r15, r15
je 0x140019a46
sub r13, r15
mov rax, r15
cmp r13, 0x1000
jb 0x140019a3a
add r13, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019cf8
jmp 0x140019a3a
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], r12
mov rcx, rsi
lea rdx, [0x1400775f0]
xor r8d, r8d
call fcn.140007670
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140019369
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140019364
add rdx, 0x27
mov rdi, qword [rcx - 8]
sub rcx, rdi
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140019cfe
jmp 0x140019361
call fcn.1400447b4
nop
call fcn.1400447b4
nop
call fcn.1400447b4
nop
call fcn.1400041d0
nop
call fcn.1400447b4
nop
call fcn.1400447b4
nop
call fcn.140004270
int3
call fcn.1400041d0
int3
call fcn.1400447b4
nop
call fcn.1400447b4
int3