Function at 0x140010fc0
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rdi, rdx
xor r12d, r12d
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x40], r12
mov dword [rbp + 0x40], r12d
mov dword [rbp + 0x58], 4
mov r13d, r12d
mov dword [rsp + 0x20], 0xf0000040
lea r9d, [r12 + 1]
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov r14d, eax
test eax, eax
je 0x1400111e4
mov rdx, qword [0x140051ae8]
mov r8, qword [0x140051af0]
sub r8, rdx
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
xor r9d, r9d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov r14d, eax
test eax, eax
je 0x1400111e4
mov dword [rsp + 0x20], r12d
lea r9, [rbp + 0x58]
lea r8, [rbp + 0x40]
lea edx, [r12 + 8]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptGetKeyParam]
mov r14d, eax
test eax, eax
je 0x1400111e4
mov eax, dword [rbp + 0x40]
shr eax, 3
mov dword [rbp + 0x40], eax
mov esi, eax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x30], xmm0
mov r15d, r12d
mov qword [rbp - 0x20], r12
test eax, eax
je 0x1400110c8
mov edx, esi
lea rcx, [rbp - 0x30]
call fcn.140006620
mov r8d, esi
xor edx, edx
mov rbx, qword [rbp - 0x30]
mov rcx, rbx
call fcn.14003b810
lea rax, [rsi + rbx]
mov qword [rbp - 0x28], rax
mov eax, dword [rbp + 0x40]
mov r15, qword [rbp - 0x20]
jmp 0x1400110cc
mov rbx, qword [rbp - 0x30]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], r12
mov rsi, r12
nop dword [rax + rax]
mov r9, qword [rdi]
mov r8, qword [rdi + 8]
sub r8, r9
mov rdx, r8
sub rdx, rsi
mov ecx, eax
cmp rcx, rdx
jb 0x1400110fd
mov eax, r8d
sub eax, r13d
mov dword [rbp + 0x50], eax
mov r8d, eax
lea rdx, [r9 + rsi]
mov rcx, rbx
call fcn.14003b170
add r13d, dword [rbp + 0x50]
mov r12, qword [rdi + 8]
sub r12, qword [rdi]
mov esi, r13d
xor r8d, r8d
cmp rsi, r12
sete r8b
lea rax, [rbp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor edx, edx
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov r14d, eax
test eax, eax
je 0x14001116c
mov r9d, dword [rbp + 0x50]
mov r8, rbx
mov rdx, qword [rbp - 0x10]
lea rcx, [rbp - 0x18]
call fcn.1400113a0
cmp rsi, r12
je 0x14001116c
mov eax, dword [rbp + 0x40]
jmp 0x1400110e0
lea rdx, [rbp - 0x18]
mov rcx, rdi
call fcn.140011260
nop
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1400111b0
mov rdx, qword [rbp - 8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400111aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011225
call fcn.140019450
nop
test rbx, rbx
je 0x1400111e4
sub r15, rbx
mov rax, rbx
cmp r15, 0x1000
jb 0x1400111d9
add r15, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001121f
mov rdx, r15
mov rcx, rbx
call fcn.140019450
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x1400111f3
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x140011204
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, r14d
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14002a6d4
nop
call fcn.14002a6d4
nop
int3