Function at 0x1400138a0
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], rdx
mov r14, rcx
xor edi, edi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x68], rdi
mov r12, qword [r8 + 8]
movabs rax, 0x7fffffffffffffff
sub r12, qword [r8]
mov dword [rsp + 0x50], edi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x78], xmm0
mov esi, edi
mov qword [rbp - 0x68], rdi
je 0x14001396a
cmp r12, rax
ja 0x140013e7f
cmp r12, 0x1000
jb 0x140013940
lea rcx, [r12 + 0x27]
cmp rcx, r12
jbe 0x140013e85
call fcn.1400fcad4
test rax, rax
je 0x140013e72
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x14001394b
mov rcx, r12
call fcn.1400fcad4
mov rbx, rax
mov qword [rbp - 0x78], rbx
lea rsi, [rbx + r12]
mov qword [rbp - 0x68], rsi
mov r8, r12
xor edx, edx
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rbp - 0x70], rsi
jmp 0x14001396e
mov rbx, qword [rbp - 0x78]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x60], xmm0
mov r13, rdi
mov qword [rbp - 0x50], rdi
mov ecx, 0xc
call fcn.1400fcad4
mov rdi, rax
mov qword [rbp + 0x20], rax
lea r15, [rax + 0xc]
mov qword [rbp + 0x30], r15
xor eax, eax
mov qword [rdi], rax
mov dword [rdi + 8], eax
mov qword [rbp + 0x28], r15
mov rax, qword [rsp + 0x78]
mov rcx, qword [rax]
mov qword [rsp + 0x60], rcx
mov rax, qword [rax + 8]
sub rax, rcx
mov qword [rbp + 0x98], rax
mov rax, qword [rsp + 0x70]
mov rdx, qword [rax]
add rdx, 3
mov r8d, 0xc
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
lea r8, [rax + r12]
lea rdx, [rax + 0xf]
sub r8, rdx
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140104080]
lea rcx, [rsp + 0x58]
call sub.bcrypt.dll_BCryptOpenAlgorithmProvider
test eax, eax
jns 0x140013ad2
xorps xmm0, xmm0
movups xmmword [r14], xmm0
xor eax, eax
mov qword [r14 + 0x10], rax
mov eax, 0xf
mov qword [r14 + 0x18], rax
mov byte [r14], 0
test rdi, rdi
je 0x140013a66
sub r15, rdi
cmp r15, 0x1000
jb 0x140013a5a
mov r15d, 0x33
mov rcx, qword [rdi - 8]
sub rdi, rcx
lea rax, [rdi - 8]
cmp rax, 0x1f
ja 0x140013e2a
mov rdi, rcx
mov rdx, r15
mov rcx, rdi
call fcn.1400fcb10
nop
test rbx, rbx
je 0x140013a9f
sub rsi, rbx
mov rax, rbx
cmp rsi, 0x1000
jb 0x140013a93
add rsi, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140013e72
mov rdx, rsi
mov rcx, rbx
call fcn.1400fcb10
nop
mov rcx, qword [rsp + 0x78]
call fcn.140011220
nop
mov rcx, qword [rsp + 0x70]
call fcn.140011220
mov rax, r14
mov rbx, qword [rsp + 0x180]
add rsp, 0x140
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [rsp + 0x20], 0
mov r9d, 0x20
lea r8, str.ChainingModeGCM
lea rdx, str.ChainingMode
mov rcx, qword [rsp + 0x58]
call sub.bcrypt.dll_BCryptSetProperty
mov rcx, qword [rsp + 0x58]
test eax, eax
jns 0x140013b0d
xor edx, edx
call sub.bcrypt.dll_BCryptCloseAlgorithmProvider
jmp 0x140013a11
mov dword [rsp + 0x30], 0
mov rax, qword [rbp + 0x98]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x68]
call sub.bcrypt.dll_BCryptGenerateSymmetricKey
test eax, eax
jns 0x140013b4f
mov rcx, qword [rsp + 0x58]
xor edx, edx
call sub.bcrypt.dll_BCryptCloseAlgorithmProvider
jmp 0x140013a11
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], rax
mov dword [rbp - 0x40], 0x58
mov dword [rbp - 0x3c], 1
lea rcx, [r12 - 0x1f]
mov qword [rsp + 0x60], rcx
mov qword [rbp - 0x38], rdi
mov dword [rbp - 0x30], 0xc
lea rax, [rbx + rcx]
mov qword [rbp - 0x18], rax
mov dword [rbp - 0x10], 0x10
xor r12d, r12d
mov dword [rsp + 0x48], r12d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x40]
mov r8d, ecx
mov rdx, rbx
mov rcx, qword [rsp + 0x68]
call sub.bcrypt.dll_BCryptDecrypt
test eax, eax
jns 0x140013bf8
xorps xmm0, xmm0
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], r12
mov eax, 0xf
mov qword [r14 + 0x18], rax
mov byte [r14], r12b
jmp 0x140013a2b
mov eax, dword [rsp + 0x50]
mov edx, eax
test eax, eax
je 0x140013c1a
lea r8, [rbp + 0x98]
lea rcx, [rbp - 0x60]
call fcn.140009f70
mov eax, dword [rsp + 0x50]
mov r13, qword [rbp - 0x50]
mov dword [rsp + 0x48], r12d
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], eax
mov r12, qword [rbp - 0x60]
mov qword [rsp + 0x30], r12
xor eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x40]
mov r8d, dword [rsp + 0x60]
mov rdx, rbx
mov rcx, qword [rsp + 0x68]
call sub.bcrypt.dll_BCryptDecrypt
test eax, eax
jns 0x140013cf4
xorps xmm0, xmm0
movups xmmword [r14], xmm0
xor eax, eax
mov qword [r14 + 0x10], rax
mov eax, 0xf
mov qword [r14 + 0x18], rax
mov byte [r14], 0
test rdi, rdi
je 0x140013cb2
sub r15, rdi
cmp r15, 0x1000
jb 0x140013ca6
add r15, 0x27
mov rcx, qword [rdi - 8]
sub rdi, rcx
lea rax, [rdi - 8]
cmp rax, 0x1f
ja 0x140013e2a
mov rdi, rcx
mov rdx, r15
mov rcx, rdi
call fcn.1400fcb10
nop
test r12, r12
je 0x140013a66
sub r13, r12
mov rax, r12
cmp r13, 0x1000
jb 0x140013ce4
add r13, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140013e23
mov rdx, r13
mov rcx, r12
call fcn.1400fcb10
jmp 0x140013a66
xor edx, edx
mov rcx, qword [rsp + 0x58]
call sub.bcrypt.dll_BCryptCloseAlgorithmProvider
xorps xmm0, xmm0
movups xmmword [r14], xmm0
xor eax, eax
mov qword [r14 + 0x10], rax
mov eax, 0xf
mov qword [r14 + 0x18], rax
mov rcx, qword [rbp - 0x58]
cmp r12, rcx
jne 0x140013d28
mov byte [r14], 0
jmp 0x140013dc4
sub rcx, r12
mov qword [rsp + 0x60], rcx
movabs rdx, 0x7fffffffffffffff
cmp rcx, rdx
ja 0x140013e79
cmp rcx, rax
jbe 0x140013d88
or rcx, rax
cmp rcx, rdx
ja 0x140013d5f
mov rdx, rcx
mov eax, 0x16
cmp rcx, rax
cmovb rdx, rax
mov qword [rbp + 0x98], rdx
lea rdx, [rbp + 0x98]
mov rcx, r14
call fcn.140003d00
mov qword [r14], rax
mov rax, qword [rbp + 0x98]
mov qword [r14 + 0x18], rax
mov rcx, qword [rsp + 0x60]
mov r9, r14
mov qword [rbp + 0x90], r14
cmp rax, 0xf
jbe 0x140013da2
mov r9, qword [r14]
mov qword [rbp + 0x90], r9
mov r8, rcx
mov rdx, r12
mov rcx, r9
call sub.VCRUNTIME140.dll_memmove
mov rax, qword [rsp + 0x60]
mov qword [r14 + 0x10], rax
mov rcx, qword [rbp + 0x90]
mov byte [rcx + rax], 0
test rdi, rdi
je 0x140013df9
sub r15, rdi
cmp r15, 0x1000
jb 0x140013ded
add r15, 0x27
mov rcx, qword [rdi - 8]
sub rdi, rcx
lea rax, [rdi - 8]
cmp rax, 0x1f
ja 0x140013e2a
mov rdi, rcx
mov rdx, r15
mov rcx, rdi
call fcn.1400fcb10
nop
test r12, r12
je 0x140013e3d
sub r13, r12
mov rax, r12
cmp r13, 0x1000
jb 0x140013e31
add r13, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140013e31
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rdx, r13
mov rcx, r12
call fcn.1400fcb10
nop
test rbx, rbx
je 0x140013a9f
sub rsi, rbx
mov rax, rbx
cmp rsi, 0x1000
jb 0x140013a93
add rsi, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140013a93
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140020e80
nop
call fcn.140020ea0
int3
call fcn.1400204f0
int3