Function at 0x18002c850
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push rbp
sub rsp, 0x190
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], r8
mov qword [rbp - 0x38], rdx
mov qword [rbp - 0x30], rcx
mov rax, qword [rbp + 0x140]
mov qword [rbp - 0x28], rax
mov rax, qword [0x1800950a8]
xor rax, rbp
mov qword [rbp + 0x108], rax
mov dword [rbp - 0x1c], 0xc23dd624
mov eax, dword [rbp - 0x1c]
mov dword [rbp - 0x4c], eax
sub eax, 0x80538eb3
je 0x18002d3f5
jmp 0x18002c8a9
mov eax, dword [rbp - 0x4c]
sub eax, 0x892e224d
je 0x18002d28d
jmp 0x18002c8bc
mov eax, dword [rbp - 0x4c]
sub eax, 0x8d4f61dd
je 0x18002d207
jmp 0x18002c8cf
mov eax, dword [rbp - 0x4c]
sub eax, 0x8edd76b0
je 0x18002cff3
jmp 0x18002c8e2
mov eax, dword [rbp - 0x4c]
sub eax, 0x8f98a412
je 0x18002d35e
jmp 0x18002c8f5
mov eax, dword [rbp - 0x4c]
sub eax, 0x984c6106
je 0x18002d157
jmp 0x18002c908
mov eax, dword [rbp - 0x4c]
sub eax, 0xa5850a9d
je 0x18002d1a1
jmp 0x18002c91b
mov eax, dword [rbp - 0x4c]
sub eax, 0xaa1831ac
je 0x18002cec1
jmp 0x18002c92e
mov eax, dword [rbp - 0x4c]
sub eax, 0xaac849e4
je 0x18002d05d
jmp 0x18002c941
mov eax, dword [rbp - 0x4c]
sub eax, 0xb289b61a
je 0x18002d02b
jmp 0x18002c954
mov eax, dword [rbp - 0x4c]
sub eax, 0xb4c08e5d
je 0x18002d344
jmp 0x18002c967
mov eax, dword [rbp - 0x4c]
sub eax, 0xbd06a32b
je 0x18002d318
jmp 0x18002c97a
mov eax, dword [rbp - 0x4c]
sub eax, 0xbeb144e1
je 0x18002d2ab
jmp 0x18002c98d
mov eax, dword [rbp - 0x4c]
sub eax, 0xbeb42c26
je 0x18002cee1
jmp 0x18002c9a0
mov eax, dword [rbp - 0x4c]
sub eax, 0xbebfd48c
je 0x18002d073
jmp 0x18002c9b3
mov eax, dword [rbp - 0x4c]
sub eax, 0xc23dd624
je 0x18002cce9
jmp 0x18002c9c6
mov eax, dword [rbp - 0x4c]
sub eax, 0xc5b04466
je 0x18002cf09
jmp 0x18002c9d9
mov eax, dword [rbp - 0x4c]
sub eax, 0xc7313f34
je 0x18002d2f1
jmp 0x18002c9ec
mov eax, dword [rbp - 0x4c]
sub eax, 0xc8ba2c19
je 0x18002ce0d
jmp 0x18002c9ff
mov eax, dword [rbp - 0x4c]
sub eax, 0xc8e1264f
je 0x18002cf1f
jmp 0x18002ca12
mov eax, dword [rbp - 0x4c]
sub eax, 0xcbc43641
je 0x18002cf8c
jmp 0x18002ca25
mov eax, dword [rbp - 0x4c]
sub eax, 0xd073d983
je 0x18002d16f
jmp 0x18002ca38
mov eax, dword [rbp - 0x4c]
sub eax, 0xdbc56ee0
je 0x18002d265
jmp 0x18002ca4b
mov eax, dword [rbp - 0x4c]
sub eax, 0xe75df149
je 0x18002cd33
jmp 0x18002ca5e
mov eax, dword [rbp - 0x4c]
sub eax, 0xeacfc859
je 0x18002d013
jmp 0x18002ca71
mov eax, dword [rbp - 0x4c]
sub eax, 0xf0826310
je 0x18002cd90
jmp 0x18002ca84
mov eax, dword [rbp - 0x4c]
sub eax, 0xf1570b69
je 0x18002d39a
jmp 0x18002ca97
mov eax, dword [rbp - 0x4c]
sub eax, 0xf2bb77a9
je 0x18002cf48
jmp 0x18002caaa
mov eax, dword [rbp - 0x4c]
sub eax, 0xfb6ae711
je 0x18002d095
jmp 0x18002cabd
mov eax, dword [rbp - 0x4c]
sub eax, 0x237c703
je 0x18002d137
jmp 0x18002cad0
mov eax, dword [rbp - 0x4c]
sub eax, 0x59a0773
je 0x18002d41e
jmp 0x18002cae3
mov eax, dword [rbp - 0x4c]
sub eax, 0x69d8587
je 0x18002d3cc
jmp 0x18002caf6
mov eax, dword [rbp - 0x4c]
sub eax, 0x6fcdc5f
je 0x18002d119
jmp 0x18002cb09
mov eax, dword [rbp - 0x4c]
sub eax, 0xf56e49c
je 0x18002d338
jmp 0x18002cb1c
mov eax, dword [rbp - 0x4c]
sub eax, 0x10417748
je 0x18002d3a6
jmp 0x18002cb2f
mov eax, dword [rbp - 0x4c]
sub eax, 0x1522beb2
je 0x18002cfd5
jmp 0x18002cb42
mov eax, dword [rbp - 0x4c]
sub eax, 0x155c5d8c
je 0x18002d03b
jmp 0x18002cb55
mov eax, dword [rbp - 0x4c]
sub eax, 0x1b160c3e
je 0x18002d225
jmp 0x18002cb68
mov eax, dword [rbp - 0x4c]
sub eax, 0x21813520
je 0x18002cded
jmp 0x18002cb7b
mov eax, dword [rbp - 0x4c]
sub eax, 0x226271a5
je 0x18002d3b6
jmp 0x18002cb8e
mov eax, dword [rbp - 0x4c]
sub eax, 0x2cc5d6d5
je 0x18002d051
jmp 0x18002cba1
mov eax, dword [rbp - 0x4c]
sub eax, 0x3440fc80
je 0x18002d195
jmp 0x18002cbb4
mov eax, dword [rbp - 0x4c]
sub eax, 0x3512b7b9
je 0x18002cea4
jmp 0x18002cbc7
mov eax, dword [rbp - 0x4c]
sub eax, 0x3afe2966
je 0x18002cef9
jmp 0x18002cbda
mov eax, dword [rbp - 0x4c]
sub eax, 0x3b8bc22f
je 0x18002ce31
jmp 0x18002cbed
mov eax, dword [rbp - 0x4c]
sub eax, 0x4d2b5a1a
je 0x18002d0f8
jmp 0x18002cc00
mov eax, dword [rbp - 0x4c]
sub eax, 0x50cc7a2b
je 0x18002d401
jmp 0x18002cc13
mov eax, dword [rbp - 0x4c]
sub eax, 0x50d275d8
je 0x18002d1e2
jmp 0x18002cc26
mov eax, dword [rbp - 0x4c]
sub eax, 0x51a8d2af
je 0x18002d17f
jmp 0x18002cc39
mov eax, dword [rbp - 0x4c]
sub eax, 0x5349b026
je 0x18002ce5c
jmp 0x18002cc4c
mov eax, dword [rbp - 0x4c]
sub eax, 0x5846e1d0
je 0x18002cf63
jmp 0x18002cc5f
mov eax, dword [rbp - 0x4c]
sub eax, 0x65bf065f
je 0x18002cf2b
jmp 0x18002cc72
mov eax, dword [rbp - 0x4c]
sub eax, 0x676eb27f
je 0x18002d3d8
jmp 0x18002cc85
mov eax, dword [rbp - 0x4c]
sub eax, 0x73c4609c
je 0x18002d37c
jmp 0x18002cc98
mov eax, dword [rbp - 0x4c]
sub eax, 0x746f35ab
je 0x18002d1c5
jmp 0x18002ccab
mov eax, dword [rbp - 0x4c]
sub eax, 0x749fbce3
je 0x18002d24b
jmp 0x18002ccbe
mov eax, dword [rbp - 0x4c]
sub eax, 0x761baf9b
je 0x18002d231
jmp 0x18002ccd1
mov eax, dword [rbp - 0x4c]
sub eax, 0x799c6744
je 0x18002ce45
jmp 0x18002cce4
jmp 0x18002d448
mov eax, 0x10
mov qword [rbp - 0x58], rax
call fcn.18008acc0
sub rsp, rax
mov rax, qword [rbp - 0x58]
mov rcx, rsp
mov qword [rbp + 0x10], rcx
call fcn.18008acc0
sub rsp, rax
mov rax, qword [rbp - 0x58]
mov rcx, rsp
mov qword [rbp + 0x18], rcx
call fcn.18008acc0
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0x20], rax
mov dword [rbp - 0x1c], 0xe75df149
jmp 0x18002d448
mov eax, 0x10
mov qword [rbp - 0x60], rax
call fcn.18008acc0
sub rsp, rax
mov rax, qword [rbp - 0x60]
mov rcx, rsp
mov qword [rbp + 0x28], rcx
call fcn.18008acc0
sub rsp, rax
mov rax, qword [rbp - 0x60]
mov rcx, rsp
mov qword [rbp + 0x30], rcx
call fcn.18008acc0
sub rsp, rax
mov rax, qword [rbp - 0x60]
mov rcx, rsp
mov qword [rbp + 0x38], rcx
call fcn.18008acc0
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0x40], rax
mov dword [rbp - 0x1c], 0xf0826310
jmp 0x18002d448
mov eax, 0x10
mov qword [rbp - 0x68], rax
call fcn.18008acc0
sub rsp, rax
mov rax, qword [rbp - 0x68]
mov rcx, rsp
mov qword [rbp + 0x48], rcx
call fcn.18008acc0
sub rsp, rax
mov rax, qword [rbp - 0x68]
mov rcx, rsp
mov qword [rbp + 0x50], rcx
call fcn.18008acc0
sub rsp, rax
mov rax, qword [rbp - 0x68]
mov rcx, rsp
mov qword [rbp + 0x58], rcx
call fcn.18008acc0
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0x60], rax
mov dword [rbp - 0x1c], 0x21813520
jmp 0x18002d448
mov eax, 0x10
call fcn.18008acc0
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0x68], rax
mov dword [rbp - 0x1c], 0xc8ba2c19
jmp 0x18002d448
mov rax, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x48]
mov rdx, qword [rbp - 0x28]
mov qword [rbp], rdx
mov qword [rbp - 8], rcx
mov qword [rbp - 0x10], rax
mov dword [rbp - 0x1c], 0x3b8bc22f
jmp 0x18002d448
mov rax, qword [rbp - 0x38]
mov qword [rbp - 0x18], rax
mov dword [rbp - 0x1c], 0x799c6744
jmp 0x18002d448
mov rcx, qword [rbp - 0x30]
mov rax, qword [rbp + 0x10]
mov qword [rax], rcx
mov dword [rbp - 0x1c], 0x5349b026
jmp 0x18002d448
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov qword [rbp + 0x70], rax
mov rcx, qword [rbp + 0x18]
mov edx, 1
mov r8d, 0x20
sub rsp, 0x20
call fcn.180031d40
add rsp, 0x20
mov rcx, qword [rbp + 0x18]
sub rsp, 0x20
call fcn.180031f30
add rsp, 0x20
mov qword [rbp + 0x78], rax
mov dword [rbp - 0x1c], 0x3512b7b9
jmp 0x18002d448
mov rdx, qword [rbp + 0x78]
mov eax, 0x65bf065f
mov ecx, 0xaa1831ac
cmp rdx, 0
cmove eax, ecx
mov dword [rbp - 0x1c], eax
jmp 0x18002d448
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
mov dword [rbp + 0x84], eax
mov dword [rbp - 0x1c], 0xbeb42c26
jmp 0x18002d448
mov rax, qword [rbp + 0x20]
mov ecx, dword [rbp + 0x84]
mov dword [rax], ecx
mov dword [rbp - 0x1c], 0x3afe2966
jmp 0x18002d448
mov byte [rbp + 0xf], 0
mov dword [rbp - 0x1c], 0xc5b04466
jmp 0x18002d448
mov rax, qword [rbp + 0x28]
mov dword [rax], 1
mov dword [rbp - 0x1c], 0xc8e1264f
jmp 0x18002d448
mov dword [rbp - 0x1c], 0x50cc7a2b
jmp 0x18002d448
mov rcx, qword [rbp + 0x30]
sub rsp, 0x20
call fcn.1800325f0
add rsp, 0x20
mov dword [rbp - 0x1c], 0xf2bb77a9
jmp 0x18002d448
mov rax, qword [rbp + 0x70]
add rax, 8
mov qword [rbp + 0x88], rax
mov dword [rbp - 0x1c], 0x5846e1d0
jmp 0x18002d448
mov rax, qword [rbp + 0x88]
mov eax, dword [rax]
mov dword [rbp + 0x94], eax
mov rax, qword [rbp + 0x70]
mov rax, qword [rax]
mov qword [rbp + 0x98], rax
mov dword [rbp - 0x1c], 0xcbc43641
jmp 0x18002d448
mov rdx, qword [rbp + 0x18]
mov rcx, qword [rbp + 0x30]
mov r9d, dword [rbp + 0x94]
mov r8, qword [rbp + 0x98]
sub rsp, 0x20
call fcn.1800326e0
add rsp, 0x20
mov ecx, eax
mov rax, qword [rbp + 0x38]
mov dword [rax], ecx
mov rax, qword [rbp + 0x38]
cmp dword [rax], 0xffffffff
sete al
and al, 1
mov byte [rbp + 0xa7], al
mov dword [rbp - 0x1c], 0x1522beb2
jmp 0x18002d448
mov dl, byte [rbp + 0xa7]
mov eax, 0xaac849e4
mov ecx, 0x8edd76b0
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x1c], eax
jmp 0x18002d448
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
mov dword [rbp + 0xa8], eax
mov dword [rbp - 0x1c], 0xeacfc859
jmp 0x18002d448
mov rax, qword [rbp + 0x40]
mov ecx, dword [rbp + 0xa8]
mov dword [rax], ecx
mov dword [rbp - 0x1c], 0xb289b61a
jmp 0x18002d448
mov byte [rbp + 0xf], 0
mov dword [rbp - 0x1c], 0x155c5d8c
jmp 0x18002d448
mov rax, qword [rbp + 0x28]
mov dword [rax], 1
mov dword [rbp - 0x1c], 0x2cc5d6d5
jmp 0x18002d448
mov dword [rbp - 0x1c], 0x676eb27f
jmp 0x18002d448
mov rax, qword [rbp - 8]
mov dword [rbp + 0xac], eax
mov dword [rbp - 0x1c], 0xbebfd48c
jmp 0x18002d448
mov rax, qword [rbp + 0x48]
mov ecx, dword [rbp + 0xac]
mov dword [rax], ecx
mov rax, qword [rbp - 0x10]
mov dword [rbp + 0xb0], eax
mov dword [rbp - 0x1c], 0xfb6ae711
jmp 0x18002d448
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x70], rax
mov rcx, qword [rbp + 0x30]
sub rsp, 0x20
call fcn.180032c60
mov r11, qword [rbp - 0x70]
add rsp, 0x20
mov rcx, rax
mov r10, qword [rbp + 0x48]
mov eax, dword [rbp + 0xb0]
xor edx, edx
mov r8d, 1
xor r9d, r9d
sub rsp, 0x40
mov qword [rsp + 0x20], r11
mov qword [rsp + 0x28], r10
mov dword [rsp + 0x30], eax
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
add rsp, 0x40
mov dword [rbp + 0xb4], eax
mov dword [rbp - 0x1c], 0x4d2b5a1a
jmp 0x18002d448
mov ecx, dword [rbp + 0xb4]
xor eax, eax
cmp eax, ecx
sete al
and al, 1
mov byte [rbp + 0xbb], al
mov dword [rbp - 0x1c], 0x6fcdc5f
jmp 0x18002d448
mov dl, byte [rbp + 0xbb]
mov eax, 0xa5850a9d
mov ecx, 0x237c703
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x1c], eax
jmp 0x18002d448
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
mov dword [rbp + 0xbc], eax
mov dword [rbp - 0x1c], 0x984c6106
jmp 0x18002d448
mov rax, qword [rbp + 0x50]
mov ecx, dword [rbp + 0xbc]
mov dword [rax], ecx
mov dword [rbp - 0x1c], 0xd073d983
jmp 0x18002d448
mov byte [rbp + 0xf], 0
mov dword [rbp - 0x1c], 0x51a8d2af
jmp 0x18002d448
mov rax, qword [rbp + 0x28]
mov dword [rax], 1
mov dword [rbp - 0x1c], 0x3440fc80
jmp 0x18002d448
mov dword [rbp - 0x1c], 0x676eb27f
jmp 0x18002d448
mov rax, qword [rbp + 0x48]
mov eax, dword [rax]
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
mov dword [rbp - 0x1c], 0x746f35ab
jmp 0x18002d448
mov rcx, qword [rbp + 0xc0]
mov rax, qword [rbp + 0xc8]
mov qword [rax], rcx
mov dword [rbp - 0x1c], 0x50d275d8
jmp 0x18002d448
mov rax, qword [rbp + 0x58]
mov qword [rax], 0
mov rax, qword [rbp]
mov rax, qword [rax]
mov qword [rbp + 0xd0], rax
mov dword [rbp - 0x1c], 0x8d4f61dd
jmp 0x18002d448
mov rcx, qword [rbp + 0xd0]
sub rcx, 1
mov rax, qword [rbp + 0x60]
mov qword [rax], rcx
mov dword [rbp - 0x1c], 0x1b160c3e
jmp 0x18002d448
mov dword [rbp - 0x1c], 0x761baf9b
jmp 0x18002d448
mov rax, qword [rbp + 0x58]
mov rax, qword [rax]
mov qword [rbp + 0xd8], rax
mov dword [rbp - 0x1c], 0x749fbce3
jmp 0x18002d448
mov rax, qword [rbp + 0x60]
mov rax, qword [rax]
mov qword [rbp + 0xe0], rax
mov dword [rbp - 0x1c], 0xdbc56ee0
jmp 0x18002d448
mov rax, qword [rbp + 0xd8]
mov rcx, qword [rbp + 0xe0]
cmp rax, rcx
setb al
and al, 1
mov byte [rbp + 0xee], al
mov dword [rbp - 0x1c], 0x892e224d
jmp 0x18002d448
mov dl, byte [rbp + 0xee]
mov eax, 0x10417748
mov ecx, 0xbeb144e1
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x1c], eax
jmp 0x18002d448
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp + 0x58]
mov rcx, qword [rcx]
mov cl, byte [rax + rcx]
mov rax, qword [rbp + 0x68]
mov byte [rax], cl
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp + 0x60]
mov rcx, qword [rcx]
mov al, byte [rax + rcx]
mov byte [rbp + 0xef], al
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp + 0x58]
add rax, qword [rcx]
mov qword [rbp + 0xf0], rax
mov dword [rbp - 0x1c], 0xc7313f34
jmp 0x18002d448
mov cl, byte [rbp + 0xef]
mov rax, qword [rbp + 0xf0]
mov byte [rax], cl
mov rax, qword [rbp + 0x68]
mov al, byte [rax]
mov byte [rbp + 0xff], al
mov dword [rbp - 0x1c], 0xbd06a32b
jmp 0x18002d448
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp + 0x60]
mov rcx, qword [rcx]
mov dl, byte [rbp + 0xff]
mov byte [rax + rcx], dl
mov dword [rbp - 0x1c], 0xf56e49c
jmp 0x18002d448
mov dword [rbp - 0x1c], 0xb4c08e5d
jmp 0x18002d448
mov rax, qword [rbp + 0x58]
mov rax, qword [rax]
mov qword [rbp + 0x100], rax
mov dword [rbp - 0x1c], 0x8f98a412
jmp 0x18002d448
mov rcx, qword [rbp + 0x100]
add rcx, 1
mov rax, qword [rbp + 0x58]
mov qword [rax], rcx
mov dword [rbp - 0x1c], 0x73c4609c
jmp 0x18002d448
mov rax, qword [rbp + 0x60]
mov rcx, qword [rax]
add rcx, 0xffffffffffffffff
mov rax, qword [rbp + 0x60]
mov qword [rax], rcx
mov dword [rbp - 0x1c], 0xf1570b69
jmp 0x18002d448
mov dword [rbp - 0x1c], 0x761baf9b
jmp 0x18002d448
mov byte [rbp + 0xf], 1
mov dword [rbp - 0x1c], 0x226271a5
jmp 0x18002d448
mov rax, qword [rbp + 0x28]
mov dword [rax], 1
mov dword [rbp - 0x1c], 0x69d8587
jmp 0x18002d448
mov dword [rbp - 0x1c], 0x676eb27f
jmp 0x18002d448
mov rcx, qword [rbp + 0x30]
sub rsp, 0x20
call fcn.180032d50
add rsp, 0x20
mov dword [rbp - 0x1c], 0x80538eb3
jmp 0x18002d448
mov dword [rbp - 0x1c], 0x50cc7a2b
jmp 0x18002d448
mov rcx, qword [rbp + 0x18]
sub rsp, 0x20
call fcn.180032fa0
add rsp, 0x20
mov dword [rbp - 0x1c], 0x59a0773
jmp 0x18002d448
mov al, byte [rbp + 0xf]
and al, 1
movzx eax, al
mov dword [rbp - 0x74], eax
mov rcx, qword [rbp + 0x108]
xor rcx, rbp
sub rsp, 0x20
call fcn.18008ac40
mov eax, dword [rbp - 0x74]
lea rsp, [rbp + 0x110]
pop rbp
ret
jmp 0x18002c893