Function at 0x1401f28c0
Capabilities:
Encrypt or decrypt data via bcrypt
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x18], r8
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
movsxd rax, dword [0x140336a50]
xor ebx, ebx
mov r10, qword [0x140336a48]
mov r13, r9
mov r12, r8
mov r14, rdx
mov rdi, rcx
test r10, r10
je 0x1401f2b9e
mov qword [rbp - 0x10], rax
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x1401f2b9e
nop word [rax + rax]
mov r9d, dword [r12 + 8]
mov ecx, r9d
mov r8d, dword [r13 + 8]
mov eax, dword [rbp + 0x50]
cdq
and edx, 7
add eax, edx
and eax, 0xfffffff8
cmp r9d, r8d
cmovbe ecx, r8d
cmp eax, ecx
ja 0x1401f294d
cmp r9d, r8d
mov eax, r8d
cmova eax, r9d
lea r8d, [rax*8]
mov dword [rbp - 0x20], eax
xor r9d, r9d
mov rdx, rdi
mov rcx, r10
call sub.bcrypt.dll_BCryptGenerateKeyPair
test eax, eax
js 0x1401f2e83
mov eax, dword [rbp - 0x20]
lea esi, [rax*2 + 0xc]
mov ecx, esi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x1401f2e83
mov dword [rax], esi
mov dword [rax + 4], 0x4d504844
mov ecx, dword [rbp - 0x20]
mov dword [rax + 8], ecx
lea rcx, [rax + 0xc]
mov r9d, dword [r13 + 8]
mov r8, qword [r13]
mov edx, dword [rbp - 0x20]
call fcn.1401f5bd0
mov edx, dword [rbp - 0x20]
mov r9d, dword [r12 + 8]
mov r8, qword [r12]
lea rcx, [rdx + 0xc]
add rcx, rbx
call fcn.1401f5bd0
mov rcx, qword [rdi]
lea rdx, str.DHParameters
mov r9d, esi
mov dword [rsp + 0x20], 0
mov r8, rbx
call sub.bcrypt.dll_BCryptSetProperty
mov qword [rdi + 8], rbx
test eax, eax
js 0x1401f2e83
mov rcx, qword [rdi]
xor edx, edx
call sub.bcrypt.dll_BCryptFinalizeKeyPair
test eax, eax
js 0x1401f2e83
mov rcx, qword [rdi]
lea rax, str.DHPRIVATEBLOB
cmp r15, 1
mov dword [rbp - 0x20], 0
lea rsi, str.DHPUBLICBLOB
cmovne rsi, rax
xor r15d, r15d
lea rax, [rbp - 0x20]
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov r8, rsi
mov dword [rsp + 0x20], r15d
xor edx, edx
call sub.bcrypt.dll_BCryptExportKey
test eax, eax
js 0x1401f2e83
mov ecx, dword [rbp - 0x20]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x1401f2e83
mov ecx, dword [rbp - 0x20]
lea rax, [rbp - 0x20]
mov dword [rsp + 0x30], r15d
mov r9, rbx
mov qword [rsp + 0x28], rax
mov r8, rsi
mov dword [rsp + 0x20], ecx
xor edx, edx
mov rcx, qword [rdi]
call sub.bcrypt.dll_BCryptExportKey
test eax, eax
js 0x1401f2b89
mov esi, dword [rbx + 4]
test r14, r14
je 0x1401f2b89
cmp esi, dword [r14 + 8]
je 0x1401f2abc
mov rcx, qword [r14]
mov edx, esi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
test rax, rax
je 0x1401f2b89
mov qword [r14], rax
mov dword [r14 + 8], esi
mov eax, dword [rbx + 4]
mov rcx, qword [r14]
mov r8d, eax
lea edx, [rax + rax]
add rdx, 8
add rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
cmp dword [rbx], 0x56504844
jne 0x1401f2b97
mov ecx, 0x10
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x1401f2b85
mov qword [rax], r15
mov dword [rax + 8], r15d
mov qword [rdi + 0x10], rax
mov r15d, dword [rbx + 4]
cmp r15d, dword [rax + 8]
je 0x1401f2b24
mov rcx, qword [rax]
mov edx, r15d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
test rax, rax
je 0x1401f2b89
mov qword [rsi], rax
mov dword [rsi + 8], r15d
mov eax, dword [rbx + 4]
mov rcx, qword [rdi + 0x10]
mov r8d, eax
lea edx, [rax + rax*2]
mov rcx, qword [rcx]
add rdx, 8
add rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rdx, qword [rdi + 0x10]
mov ecx, dword [rdx + 8]
mov rax, qword [rdx]
dec ecx
test byte [rcx + rax], 1
jne 0x1401f2b97
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rdi
call fcn.1401f2830
xor ebx, ebx
mov qword [rdi], rbx
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], rbx
mov r10, qword [0x140336a48]
test r10, r10
je 0x1401f2b9e
mov r15, qword [rbp - 0x10]
jmp 0x1401f2920
mov qword [rdi + 0x10], rsi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1401f2e83
xor eax, eax
jmp 0x1401f2e88
mov ecx, 0x10
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x1401f2e7f
mov qword [rax], rbx
mov dword [rax + 8], ebx
mov qword [rdi + 0x10], rax
mov eax, dword [rbp + 0x50]
lea ebx, [rax*8 - 1]
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x14024b468]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
cvttsd2si r15, xmm0
cmp r15d, dword [rsi + 8]
je 0x1401f2c05
mov rcx, qword [rsi]
mov edx, r15d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
test rax, rax
je 0x1401f2e83
mov qword [rsi], rax
mov dword [rsi + 8], r15d
mov rsi, qword [rsi]
xor r9d, r9d
mov rcx, qword [0x1403369c0]
mov rdx, rsi
mov r8d, r15d
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x1401f2e83
and ebx, 0x80000007
jge 0x1401f2c34
dec ebx
or ebx, 0xfffffff8
inc ebx
test ebx, ebx
mov eax, 1
mov edx, 8
cmovne edx, ebx
mov ecx, edx
shl al, cl
dec al
movzx ecx, al
movzx eax, byte [rsi]
and ecx, eax
lea eax, [rdx - 1]
bts ecx, eax
mov byte [rsi], cl
lea eax, [r15 - 1]
or byte [rax + rsi], 1
mov rbx, qword [rdi + 0x10]
test r14, r14
je 0x1401f2e83
test r12, r12
je 0x1401f2e83
test rbx, rbx
je 0x1401f2e83
test r13, r13
je 0x1401f2e83
mov esi, dword [r13 + 8]
add esi, 0x18
mov dword [rbp - 0x20], 0x18
add esi, dword [rbx + 8]
mov ecx, esi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x1401f2e83
mov dword [rax], 0x31415352
mov ecx, dword [r13 + 8]
shl ecx, 3
mov dword [rax + 4], ecx
mov ecx, dword [rbx + 8]
mov dword [rax + 8], ecx
mov ecx, dword [r13 + 8]
mov dword [rax + 0xc], ecx
xor eax, eax
mov qword [rdi + 0x10], rax
mov ecx, dword [rbp - 0x20]
mov r8d, dword [rbx + 8]
add rcx, rdi
mov rdx, qword [rbx]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [rbx + 8]
add ecx, dword [rbp - 0x20]
mov r8d, dword [r13 + 8]
add rcx, rdi
mov rdx, qword [r13]
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [0x140336a18]
lea r9, [rbp - 0x18]
xor r13d, r13d
lea r8, str.RSAPUBLICBLOB
mov dword [rsp + 0x30], r13d
xor edx, edx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rdi
mov dword [rbp - 0x20], r13d
call sub.bcrypt.dll_BCryptImportKeyPair
mov ebx, eax
test eax, eax
js 0x1401f2e6d
mov r8d, dword [r12 + 8]
lea rax, [rbp - 0x1c]
mov rdx, qword [r12]
lea r15, [r12 + 8]
mov rcx, qword [rbp - 0x18]
xor r9d, r9d
mov dword [rsp + 0x48], 1
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call sub.bcrypt.dll_BCryptEncrypt
mov ebx, eax
test eax, eax
js 0x1401f2e64
mov ebx, dword [rbp - 0x1c]
cmp ebx, dword [r14 + 8]
jne 0x1401f2d88
mov rax, r15
jmp 0x1401f2dac
mov rcx, qword [r14]
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
test rax, rax
je 0x1401f2e5f
mov qword [r14], rax
lea rax, [r12 + 8]
mov dword [r14 + 8], ebx
mov ebx, dword [rbp - 0x1c]
mov edx, dword [r15]
lea rcx, [r14 + 8]
lea r12, [r14 + 8]
cmp edx, ebx
jbe 0x1401f2dc6
mov ebx, edx
mov dword [rbp - 0x1c], edx
mov r15, rax
mov r12, rcx
mov ecx, ebx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r13, rax
test rax, rax
je 0x1401f2e5f
mov r8, qword [rbp + 0x40]
mov rcx, rax
mov r9d, dword [r15]
mov edx, dword [rbp - 0x1c]
mov r8, qword [r8]
call fcn.1401f5bd0
mov ecx, dword [r14 + 8]
lea rax, [rbp - 0x20]
mov r8d, dword [rbp - 0x1c]
xor r9d, r9d
mov dword [rsp + 0x48], 1
mov rdx, r13
mov qword [rsp + 0x40], rax
xor eax, eax
mov dword [rsp + 0x38], ecx
mov rcx, qword [r14]
mov qword [rsp + 0x30], rcx
mov rcx, qword [rbp - 0x18]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
call sub.bcrypt.dll_BCryptEncrypt
mov rcx, r13
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test ebx, ebx
js 0x1401f2e64
mov esi, dword [rbp - 0x20]
cmp esi, dword [r12]
je 0x1401f2e64
mov rcx, qword [r14]
mov edx, esi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
test rax, rax
je 0x1401f2e64
mov qword [r14], rax
mov dword [r12], esi
jmp 0x1401f2e64
mov ebx, 0xc0000017
mov rcx, qword [rbp - 0x18]
call sub.bcrypt.dll_BCryptDestroyKey
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
sar ebx, 0x1f
neg ebx
sbb eax, eax
jmp 0x1401f2e88
mov qword [rdi + 0x10], rsi
mov eax, 0xffffffff
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret