Function at 0x14001be20
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x110
mov qword [rax - 0x80], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rbx, rdx
mov r15, rcx
xor r13d, r13d
call fcn.1400176b0
test rbx, rbx
jne 0x14001be59
lea eax, [rbx + 1]
jmp 0x14001c352
mov qword [rsp + 0x78], r13
mov r9d, 0x17
xor r8d, r8d
lea rdx, [0x140051d78]
lea rcx, [rsp + 0x78]
call fcn.140017a44
mov edi, 0x80000000
lea ecx, [rax + rdi]
test edi, ecx
jne 0x14001be93
cmp eax, 0x80004002
je 0x14001be93
mov ecx, eax
call fcn.140032390
nop
mov rcx, qword [rsp + 0x78]
test rcx, rcx
jne 0x14001bea7
mov ecx, 0x80004003
call fcn.140032390
mov rax, qword [rcx]
xor r8d, r8d
mov rdx, rbx
call qword [rax + 0x28]
mov esi, r13d
mov ecx, 0x80090006
test eax, eax
cmovne esi, ecx
mov dword [rsp + 0x30], esi
xor edx, edx
lea r8d, [rdx + 0x40]
lea rcx, [rsp + 0xd0]
call fcn.140034b00
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0xd0]
call fcn.140018aa8
nop
mov dword [rsp + 0x98], r13d
mov qword [rsp + 0xa0], r13
mov dword [rsp + 0xa8], r13d
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x98]
call fcn.140018c60
nop
lea rax, vtable.CCryptBlob_struct__CRYPTOAPI_BLOB__class__heap_allocator_.0
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x48], r13
mov dword [rsp + 0x40], r13d
mov eax, dword [rsp + 0xa8]
cmp eax, dword [rsp + 0x98]
jae 0x14001bf6c
mov ecx, eax
inc eax
mov dword [rsp + 0xa8], eax
cmp ecx, dword [rsp + 0x98]
jae 0x14001bf6c
shl rcx, 4
add rcx, qword [rsp + 0xa0]
je 0x14001bf6c
add rcx, 0xfffffffffffffff8
jmp 0x14001bf6f
mov rcx, r13
lea rax, [rcx + 8]
neg rcx
sbb rdx, rdx
and rdx, rax
mov r8d, 0x19
lea rcx, [rsp + 0x38]
call fcn.140018984
lea rdx, [rsp + 0x40]
mov rcx, r15
call fcn.140019994
test esi, esi
jns 0x14001bfa4
mov ecx, esi
call fcn.140032390
mov qword [rsp + 0x70], r13
mov r9d, 0x17
xor r8d, r8d
lea rdx, [0x140051d78]
lea rcx, [rsp + 0x70]
call fcn.140017bc4
lea ecx, [rax + rdi]
test edi, ecx
jne 0x14001bfd9
cmp eax, 0x80004002
je 0x14001bfd9
mov ecx, eax
call fcn.140032390
nop
mov qword [rsp + 0xb0], r13
mov rcx, qword [rsp + 0x70]
test rcx, rcx
jne 0x14001bff5
mov ecx, 0x80004003
call fcn.140032390
mov rax, qword [rcx]
lea rdx, [rsp + 0xb0]
call qword [rax + 0x18]
test eax, eax
jns 0x14001c00e
mov ecx, eax
call fcn.140032390
mov rbx, qword [rsp + 0xb0]
mov qword [rsp + 0x68], rbx
test rbx, rbx
je 0x14001c038
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptContextAddRef]
test eax, eax
jne 0x14001c038
call fcn.140007048
nop
lea r12, [r15 + 0x30]
mov rdx, r12
lea rcx, [rsp + 0x38]
call fcn.140007fb0
cmp dword [r15 + 8], 0x10020001
jne 0x14001c292
mov dword [rsp + 0x50], r13d
mov qword [rsp + 0x58], r13
mov dword [rsp + 0x60], r13d
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.140018c60
nop
mov qword [rsp + 0x158], r13
lea r8, [rsp + 0x158]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptGetUserKey]
test eax, eax
jne 0x14001c09f
call fcn.140007048
jmp 0x14001c0a2
mov eax, r13d
test eax, eax
jns 0x14001c0ad
mov ecx, eax
call fcn.140032390
lea rax, vtable.CCryptBlob_struct__CRYPTOAPI_BLOB__class__heap_allocator_.0
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x90], r13
mov qword [rsp + 0x90], r13
mov dword [rsp + 0x88], r13d
mov edi, dword [rsp + 0x60]
cmp edi, dword [rsp + 0x50]
jae 0x14001c0ff
mov eax, edi
inc edi
mov dword [rsp + 0x60], edi
cmp eax, dword [rsp + 0x50]
jae 0x14001c0ff
mov ecx, eax
shl rcx, 4
add rcx, qword [rsp + 0x58]
je 0x14001c0ff
add rcx, 0xfffffffffffffff8
jmp 0x14001c102
mov rcx, r13
lea rax, [rcx + 8]
neg rcx
sbb rdx, rdx
and rdx, rax
mov r8d, 0x19
lea rcx, [rsp + 0x80]
call fcn.140018984
cmp edi, dword [rsp + 0x50]
jae 0x14001c149
mov eax, edi
inc edi
mov dword [rsp + 0x60], edi
cmp eax, dword [rsp + 0x50]
jae 0x14001c149
mov ecx, eax
shl rcx, 4
add rcx, qword [rsp + 0x58]
je 0x14001c149
add rcx, 0xfffffffffffffff8
jmp 0x14001c14c
mov rcx, r13
lea rax, [rcx + 8]
neg rcx
sbb rdx, rdx
and rdx, rax
mov r8d, 0x19
lea rcx, [rsp + 0x38]
call fcn.140018984
mov qword [rsp + 0x150], r13
lea rax, [rsp + 0x150]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
mov r9, qword [rsp + 0x158]
mov r8d, dword [rsp + 0x88]
mov rdx, qword [rsp + 0x90]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x14001c1af
call fcn.140007048
jmp 0x14001c1b2
mov eax, r13d
test eax, eax
jns 0x14001c1bd
mov ecx, eax
call fcn.140032390
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x148], eax
lea rax, [rsp + 0x148]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [r9 + 1]
mov rdx, qword [0x14007a9a8]
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x14001c206
call fcn.140007048
jmp 0x14001c209
mov eax, r13d
test eax, eax
jns 0x14001c214
mov ecx, eax
call fcn.140032390
mov eax, dword [rsp + 0x148]
mov dword [rsp + 0x40], eax
mov rcx, qword [rsp + 0x150]
test rcx, rcx
je 0x14001c23a
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov qword [rsp + 0x150], r13
lea rdi, vtable.CCryptBlob_struct__CRYPTOAPI_BLOB__class__heap_allocator_.0
mov qword [rsp + 0x80], rdi
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x14001c25b
call fcn.140009660
mov qword [rsp + 0x90], r13
mov dword [rsp + 0x88], r13d
mov rcx, qword [rsp + 0x158]
test rcx, rcx
je 0x14001c286
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov qword [rsp + 0x158], r13
lea rcx, [rsp + 0x50]
call fcn.1400174d8
jmp 0x14001c2b6
xor r8d, r8d
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x38]
call fcn.14001a038
mov esi, eax
mov dword [rsp + 0x30], eax
mov rbx, qword [rsp + 0x68]
lea rdi, vtable.CCryptBlob_struct__CRYPTOAPI_BLOB__class__heap_allocator_.0
lea rax, [r15 + 0x28]
neg r12
sbb rcx, rcx
and rcx, rax
lea rdx, [rsp + 0x40]
call fcn.14001779c
nop
test rbx, rbx
je 0x14001c2ee
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test eax, eax
jne 0x14001c2e9
call fcn.140007048
jmp 0x14001c2ee
mov qword [rsp + 0x68], r13
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14001c2ff
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov qword [rsp + 0x38], rdi
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14001c313
call fcn.140009660
mov qword [rsp + 0x48], r13
mov dword [rsp + 0x40], r13d
lea rcx, [rsp + 0x98]
call fcn.1400174d8
nop
lea rcx, [rsp + 0xd0]
call fcn.140017430
nop
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14001c34a
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
jmp 0x14001c350
mov eax, esi
mov rbx, qword [rsp + 0x140]
add rsp, 0x110
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret