Function at 0x14008efa0
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
mov r12, qword [0x140175408]
mov rbx, rcx
mov rdi, rdx
mov rsi, r8
mov rbp, r9
test r12, r12
je 0x14008f2b8
mov eax, dword [0x140175410]
cmp eax, 0xffffffff
je 0x14008f2b8
cmp qword [rcx], 0
je 0x14008f2b8
mov r11, qword [rcx + 8]
test r8, r8
je 0x14008f2b8
test r11, r11
je 0x14008f2b8
mov eax, dword [r8 + 8]
mov r14d, dword [r11 + 8]
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x80], 0
cmp r14d, eax
mov r15d, eax
mov dword [rsp + 0x54], eax
cmovae r15d, r14d
mov dword [rsp + 0x7c], 0
mov qword [rsp + 0x88], 0
lea eax, [r15 + r15]
lea ecx, [r15 + rax + 8]
mov dword [rsp + 0x64], eax
mov dword [rsp + 0x60], ecx
call sub.msvcrt.dll_malloc
mov r11, qword [rsp + 0x48]
test rax, rax
mov r13, rax
je 0x14008f318
mov dword [rax], 0x42504844
lea rax, [rax + 8]
mov dword [rax - 4], r15d
mov qword [rsp + 0x48], rax
lea rax, [r11 + 0xc]
mov qword [rsp + 0x58], rax
cmp r14d, r15d
jb 0x14008f390
mov r8d, r14d
mov r14d, r15d
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x58]
mov rcx, r14
mov qword [rsp + 0x68], r11
sub rcx, r8
add rcx, rax
call sub.msvcrt.dll_memcpy
mov r11, qword [rsp + 0x68]
mov r9, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x48]
mov r11d, dword [r11 + 8]
lea rcx, [rdx + r14]
add r9, r11
cmp r11d, r15d
jb 0x14008f360
mov rax, r14
mov rdx, r9
mov r8, r11
sub rax, r11
add rcx, rax
call sub.msvcrt.dll_memcpy
mov ecx, dword [rsp + 0x64]
mov rax, qword [rsp + 0x48]
mov r9, qword [rsi]
add rax, rcx
mov rcx, rax
cmp dword [rsp + 0x54], r15d
jb 0x14008f338
mov r8d, dword [rsp + 0x54]
mov rdx, r9
sub r14, r8
add rcx, r14
call sub.msvcrt.dll_memcpy
mov eax, dword [rsp + 0x60]
mov qword [rsp + 0x20], r13
xor edx, edx
mov dword [rsp + 0x30], 0
mov rcx, r12
lea r9, [rsp + 0x80]
lea r8, str.DHPUBLICBLOB
mov dword [rsp + 0x28], eax
call sub.bcrypt.dll_BCryptImportKeyPair
mov r12d, eax
test eax, eax
js 0x14008f280
mov rcx, qword [rbx]
mov rdx, qword [rsp + 0x80]
xor r9d, r9d
lea r8, [rsp + 0x88]
call sub.bcrypt.dll_BCryptSecretAgreement
mov r12d, eax
test eax, eax
js 0x14008f280
lea r13, [rsp + 0x7c]
mov dword [rsp + 0x30], 0
lea r12, str.TRUNCATE
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x28], r13
xor r9d, r9d
xor r8d, r8d
mov rdx, r12
mov dword [rsp + 0x20], 0
call sub.bcrypt.dll_BCryptDeriveKey
test eax, eax
js 0x14008f2e0
mov r14d, dword [rsp + 0x7c]
test rdi, rdi
je 0x14008f3fd
mov eax, dword [rdi + 8]
mov r9, qword [rdi]
cmp r14d, eax
je 0x14008f1e8
mov rcx, r9
mov edx, r14d
call sub.msvcrt.dll_realloc
mov r9, rax
test rax, rax
je 0x14008f3fd
mov dword [rdi + 8], r14d
mov qword [rdi], rax
mov eax, dword [rsp + 0x7c]
mov dword [rsp + 0x30], 0
xor r8d, r8d
mov rdx, r12
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], eax
call sub.bcrypt.dll_BCryptDeriveKey
test eax, eax
js 0x14008f2e0
mov rax, qword [rdi]
mov edx, dword [rdi + 8]
lea rdx, [rax + rdx - 1]
cmp rax, rdx
jae 0x14008f243
nop dword [rax]
movzx ecx, byte [rdx]
movzx r8d, byte [rax]
sub rdx, 1
add rax, 1
mov byte [rdx + 1], r8b
mov byte [rax - 1], cl
cmp rax, rdx
jb 0x14008f228
mov rcx, qword [rsp + 0x80]
mov dword [0x140175410], 1
test rcx, rcx
je 0x14008f25f
call sub.bcrypt.dll_BCryptDestroyKey
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x14008f271
call sub.bcrypt.dll_BCryptDestroySecret
xor eax, eax
jmp 0x14008f31d
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x14008f292
call sub.bcrypt.dll_BCryptDestroyKey
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x14008f2a4
call sub.bcrypt.dll_BCryptDestroySecret
cmp r12d, 0xc00000bb
jne 0x14008f318
mov eax, dword [0x140175410]
cmp eax, 0xffffffff
jne 0x14008f318
mov r8, qword [rbx + 0x10]
mov r9, rbp
mov rdx, rsi
mov rcx, rdi
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.140096610
mov rcx, qword [rsp + 0x80]
cmp eax, 0xc00000bb
je 0x14008f3ce
test rcx, rcx
je 0x14008f3b8
call sub.bcrypt.dll_BCryptDestroyKey
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x14008f318
call sub.bcrypt.dll_BCryptDestroySecret
nop dword [rax + rax]
mov eax, 0xffffffff
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [rsp + 0x54]
mov r8d, r15d
xor edx, edx
mov qword [rsp + 0x48], r9
sub r8d, eax
call sub.msvcrt.dll_memset
mov r9, qword [rsp + 0x48]
mov rcx, rax
jmp 0x14008f0fc
mov r8d, r15d
xor edx, edx
mov qword [rsp + 0x68], r9
sub r8d, r11d
mov qword [rsp + 0x58], r11
call sub.msvcrt.dll_memset
mov r9, qword [rsp + 0x68]
mov r11, qword [rsp + 0x58]
mov rcx, rax
jmp 0x14008f0cb
mov rcx, qword [rsp + 0x48]
mov r8d, r15d
xor edx, edx
mov qword [rsp + 0x68], r11
sub r8d, r14d
call sub.msvcrt.dll_memset
mov r11, qword [rsp + 0x68]
jmp 0x14008f085
mov rcx, qword [rsp + 0x88]
test rcx, rcx
jne 0x14008f30e
jmp 0x14008f318
mov dword [0x140175410], 0xffffffff
test rcx, rcx
je 0x14008f40a
call sub.bcrypt.dll_BCryptDestroyKey
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x14008f2ad
call sub.bcrypt.dll_BCryptDestroySecret
jmp 0x14008f2ad
mov rcx, qword [rsp + 0x80]
jmp 0x14008f2f3
mov rcx, qword [rsp + 0x88]
test rcx, rcx
jne 0x14008f3f3
jmp 0x14008f2ad