Function at 0x18000787c
Capabilities:
Encrypt or decrypt via wincrypt
Import public key

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov dword [r11 + 0x20], r9d
push rbp
push rsi
push rdi
push r12
push r14
mov rbp, rsp
sub rsp, 0x60
xor ebx, ebx
xor edi, edi
mov r14, r8
and qword [rbp - 8], rbx
and qword [rbp - 0x10], rbx
and qword [rbp - 0x18], rbx
test rcx, rcx
je 0x180007a2c
test edx, edx
je 0x180007a2c
and dword [rbp - 0x20], ebx
lea rax, [rbp - 0x20]
mov r9d, edx
mov qword [r11 - 0x50], rax
lea rax, [rbp - 8]
mov r8, rcx
mov qword [r11 - 0x58], rax
and qword [r11 - 0x60], rbx
lea esi, [rbx + 8]
lea r12d, [rbx + 1]
mov edx, esi
mov dword [rsp + 0x20], 0x8000
mov ecx, r12d
call qword [sym.imp.CRYPT32.dll_CryptDecodeObjectEx]
test eax, eax
jne 0x180007901
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x180007a31
lea r8, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
lea rcx, [rbp - 0x10]
mov r9d, r12d
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x180007941
lea r8, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
lea rcx, [rbp - 0x10]
mov r9d, r12d
xor edx, edx
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1800078f4
mov r8, qword [rbp - 8]
mov rcx, qword [rbp - 0x10]
lea r9, [rbp - 0x18]
mov edx, r12d
call qword [sym.imp.CRYPT32.dll_CryptImportPublicKeyInfo]
test eax, eax
je 0x1800078f4
mov eax, dword [rbp + 0x48]
mov rcx, qword [rbp - 0x18]
xor r9d, r9d
mov dword [rsp + 0x30], eax
mov dword [rbp + 0x30], eax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], rbx
mov r8d, r12d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov esi, dword [rbp + 0x30]
mov rcx, r12
mov edx, esi
call fcn.18001412c
mov rdi, rax
test rax, rax
jne 0x1800079a1
lea ebx, [rax + 0xe]
jmp 0x180007a42
mov r9d, dword [rbp + 0x48]
mov r8, r14
mov rdx, rsi
mov rcx, rax
call fcn.180015538
mov eax, dword [rbp + 0x30]
mov rcx, qword [rbp - 0x18]
mov dword [rsp + 0x30], eax
lea rax, [rbp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov r8d, r12d
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x1800078f4
mov ecx, dword [rbp + 0x30]
xor r9d, r9d
test ecx, 0xfffffffe
jbe 0x180007a1d
mov r8b, byte [r9 + rdi]
sub ecx, r9d
sub ecx, r12d
mov cl, byte [rcx + rdi]
mov byte [r9 + rdi], cl
mov eax, dword [rbp + 0x30]
sub eax, r9d
add r9d, r12d
sub eax, r12d
mov byte [rax + rdi], r8b
mov ecx, dword [rbp + 0x30]
mov eax, ecx
shr eax, 1
cmp r9d, eax
jb 0x1800079f0
mov rax, qword [rbp + 0x50]
mov qword [rax], rdi
mov rax, qword [rbp + 0x58]
mov dword [rax], ecx
jmp 0x180007a31
mov ebx, 0xa0
test ebx, ebx
je 0x180007a42
test rdi, rdi
je 0x180007a42
mov rcx, rdi
call fcn.1800138d8
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x180007a51
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x180007a60
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x180007a71
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, ebx
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret