Function at 0x18002e260
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push rbp
sub rsp, 0x120
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x58], r9
mov qword [rbp - 0x50], r8
mov qword [rbp - 0x48], rdx
mov qword [rbp - 0x40], rcx
mov rax, qword [rbp + 0xd0]
mov qword [rbp - 0x38], rax
mov rax, qword [0x1800950a8]
xor rax, rbp
mov qword [rbp + 0x98], rax
mov dword [rbp - 0x2c], 0xb96d56cc
mov eax, dword [rbp - 0x2c]
mov dword [rbp - 0x5c], eax
sub eax, 0x849142b3
je 0x18002e7b6
jmp 0x18002e2b9
mov eax, dword [rbp - 0x5c]
sub eax, 0x8580ad3e
je 0x18002eb36
jmp 0x18002e2cc
mov eax, dword [rbp - 0x5c]
sub eax, 0x94694655
je 0x18002eb0d
jmp 0x18002e2df
mov eax, dword [rbp - 0x5c]
sub eax, 0x984bca07
je 0x18002e6c9
jmp 0x18002e2f2
mov eax, dword [rbp - 0x5c]
sub eax, 0x9cbc22e9
je 0x18002e7de
jmp 0x18002e305
mov eax, dword [rbp - 0x5c]
sub eax, 0x9f3c3994
je 0x18002ea89
jmp 0x18002e318
mov eax, dword [rbp - 0x5c]
sub eax, 0x9ff6ac7b
je 0x18002eb69
jmp 0x18002e32b
mov eax, dword [rbp - 0x5c]
sub eax, 0xa0e934e5
je 0x18002e997
jmp 0x18002e33e
mov eax, dword [rbp - 0x5c]
sub eax, 0xa5d0cbd9
je 0x18002e923
jmp 0x18002e351
mov eax, dword [rbp - 0x5c]
sub eax, 0xad994dea
je 0x18002eb75
jmp 0x18002e364
mov eax, dword [rbp - 0x5c]
sub eax, 0xaefe0483
je 0x18002e718
jmp 0x18002e377
mov eax, dword [rbp - 0x5c]
sub eax, 0xb8eea88d
je 0x18002e6f9
jmp 0x18002e38a
mov eax, dword [rbp - 0x5c]
sub eax, 0xb96d56cc
je 0x18002e615
jmp 0x18002e39d
mov eax, dword [rbp - 0x5c]
sub eax, 0xba226590
je 0x18002e64c
jmp 0x18002e3b0
mov eax, dword [rbp - 0x5c]
sub eax, 0xbe28c43d
je 0x18002e95c
jmp 0x18002e3c3
mov eax, dword [rbp - 0x5c]
sub eax, 0xc34682aa
je 0x18002ea6c
jmp 0x18002e3d6
mov eax, dword [rbp - 0x5c]
sub eax, 0xcb4b4e41
je 0x18002eb9b
jmp 0x18002e3e9
mov eax, dword [rbp - 0x5c]
sub eax, 0xd1761cc9
je 0x18002e9fc
jmp 0x18002e3fc
mov eax, dword [rbp - 0x5c]
sub eax, 0xd26cf302
je 0x18002e811
jmp 0x18002e40f
mov eax, dword [rbp - 0x5c]
sub eax, 0xd4917dcc
je 0x18002e83d
jmp 0x18002e422
mov eax, dword [rbp - 0x5c]
sub eax, 0xe1828b30
je 0x18002ea2c
jmp 0x18002e435
mov eax, dword [rbp - 0x5c]
sub eax, 0xe68a9d7d
je 0x18002e6e5
jmp 0x18002e448
mov eax, dword [rbp - 0x5c]
sub eax, 0xe784f5a8
je 0x18002e6a9
jmp 0x18002e45b
mov eax, dword [rbp - 0x5c]
sub eax, 0xf5ae2b19
je 0x18002e72f
jmp 0x18002e46e
mov eax, dword [rbp - 0x5c]
sub eax, 0xffbd978a
je 0x18002e7c8
jmp 0x18002e481
mov eax, dword [rbp - 0x5c]
sub eax, 0x57f37b
je 0x18002e826
jmp 0x18002e494
mov eax, dword [rbp - 0x5c]
sub eax, 0xd7afb8d
je 0x18002ea08
jmp 0x18002e4a7
mov eax, dword [rbp - 0x5c]
sub eax, 0x18cfc715
je 0x18002e9c9
jmp 0x18002e4ba
mov eax, dword [rbp - 0x5c]
sub eax, 0x18e68247
je 0x18002e894
jmp 0x18002e4cd
mov eax, dword [rbp - 0x5c]
sub eax, 0x1a823dc2
je 0x18002e799
jmp 0x18002e4e0
mov eax, dword [rbp - 0x5c]
sub eax, 0x27d7df2c
je 0x18002e9e6
jmp 0x18002e4f3
mov eax, dword [rbp - 0x5c]
sub eax, 0x2929602b
je 0x18002e8c8
jmp 0x18002e506
mov eax, dword [rbp - 0x5c]
sub eax, 0x2f7664d7
je 0x18002e968
jmp 0x18002e519
mov eax, dword [rbp - 0x5c]
sub eax, 0x33ad9183
je 0x18002eaab
jmp 0x18002e52c
mov eax, dword [rbp - 0x5c]
sub eax, 0x33d9bb14
je 0x18002e8a6
jmp 0x18002e53f
mov eax, dword [rbp - 0x5c]
sub eax, 0x35b92e47
je 0x18002e8ed
jmp 0x18002e552
mov eax, dword [rbp - 0x5c]
sub eax, 0x3dfb9293
je 0x18002eb4c
jmp 0x18002e565
mov eax, dword [rbp - 0x5c]
sub eax, 0x3e1af284
je 0x18002e908
jmp 0x18002e578
mov eax, dword [rbp - 0x5c]
sub eax, 0x3e2c33d4
je 0x18002e940
jmp 0x18002e58b
mov eax, dword [rbp - 0x5c]
sub eax, 0x477b3d67
je 0x18002e980
jmp 0x18002e59e
mov eax, dword [rbp - 0x5c]
sub eax, 0x4bd875da
je 0x18002e7ea
jmp 0x18002e5b1
mov eax, dword [rbp - 0x5c]
sub eax, 0x52664d7c
je 0x18002e8bc
jmp 0x18002e5c4
mov eax, dword [rbp - 0x5c]
sub eax, 0x5ce844e4
je 0x18002ea4e
jmp 0x18002e5d7
mov eax, dword [rbp - 0x5c]
sub eax, 0x61e598a0
je 0x18002ea9f
jmp 0x18002e5ea
mov eax, dword [rbp - 0x5c]
sub eax, 0x6e1d4755
je 0x18002e77e
jmp 0x18002e5fd
mov eax, dword [rbp - 0x5c]
sub eax, 0x7c099e00
je 0x18002e877
jmp 0x18002e610
jmp 0x18002ebc3
mov eax, 0x10
mov qword [rbp - 0x68], rax
call fcn.18008acc0
sub rsp, rax
mov rax, qword [rbp - 0x68]
mov rcx, rsp
mov qword [rbp], rcx
call fcn.18008acc0
sub rsp, rax
mov rax, rsp
mov qword [rbp + 8], rax
mov dword [rbp - 0x2c], 0xba226590
jmp 0x18002ebc3
mov eax, 0x10
mov qword [rbp - 0x70], rax
call fcn.18008acc0
sub rsp, rax
mov rax, qword [rbp - 0x70]
mov rcx, rsp
mov qword [rbp + 0x10], rcx
call fcn.18008acc0
sub rsp, rax
mov rax, qword [rbp - 0x70]
mov rcx, rsp
mov qword [rbp + 0x18], rcx
call fcn.18008acc0
sub rsp, rax
mov rax, qword [rbp - 0x70]
mov rcx, rsp
mov qword [rbp + 0x20], rcx
call fcn.18008acc0
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0x28], rax
mov dword [rbp - 0x2c], 0xe784f5a8
jmp 0x18002ebc3
mov eax, 0x10
call fcn.18008acc0
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0x30], rax
mov dword [rbp - 0x2c], 0x984bca07
jmp 0x18002ebc3
mov rax, qword [rbp - 0x58]
mov rcx, qword [rbp - 0x38]
mov qword [rbp - 0x10], rcx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0x2c], 0xe68a9d7d
jmp 0x18002ebc3
mov rax, qword [rbp - 0x50]
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x2c], 0xb8eea88d
jmp 0x18002ebc3
mov rcx, qword [rbp - 0x40]
mov rax, qword [rbp - 0x48]
mov qword [rbp - 0x28], rax
mov rax, qword [rbp]
mov qword [rax], rcx
mov dword [rbp - 0x2c], 0xaefe0483
jmp 0x18002ebc3
mov rax, qword [rbp]
mov rax, qword [rax]
mov qword [rbp + 0x38], rax
mov dword [rbp - 0x2c], 0xf5ae2b19
jmp 0x18002ebc3
mov rax, qword [rbp + 8]
mov dword [rax], 0
mov rcx, qword [rbp + 0x10]
mov edx, 0x18
mov r8d, 0xf0000000
sub rsp, 0x20
call fcn.180031d40
add rsp, 0x20
mov rcx, qword [rbp + 0x10]
sub rsp, 0x20
call fcn.180031f30
add rsp, 0x20
cmp rax, 0
sete al
and al, 1
mov byte [rbp + 0x47], al
mov dword [rbp - 0x2c], 0x6e1d4755
jmp 0x18002ebc3
mov dl, byte [rbp + 0x47]
mov eax, 0x4bd875da
mov ecx, 0x1a823dc2
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x2c], eax
jmp 0x18002ebc3
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
mov dword [rbp + 0x48], eax
mov dword [rbp - 0x2c], 0x849142b3
jmp 0x18002ebc3
mov eax, dword [rbp + 0x48]
mov dword [rbp - 4], eax
mov dword [rbp - 0x2c], 0xffbd978a
jmp 0x18002ebc3
mov rax, qword [rbp + 0x18]
mov dword [rax], 1
mov dword [rbp - 0x2c], 0x9cbc22e9
jmp 0x18002ebc3
mov dword [rbp - 0x2c], 0xad994dea
jmp 0x18002ebc3
mov rcx, qword [rbp + 0x20]
sub rsp, 0x20
call fcn.180033060
add rsp, 0x20
mov rax, qword [rbp + 0x38]
mov eax, dword [rax + 8]
mov dword [rbp + 0x4c], eax
mov dword [rbp - 0x2c], 0xd26cf302
jmp 0x18002ebc3
mov eax, dword [rbp + 0x4c]
mov eax, eax
mov qword [rbp + 0x50], rax
mov dword [rbp - 0x2c], 0x57f37b
jmp 0x18002ebc3
mov rax, qword [rbp + 0x38]
mov rax, qword [rax]
mov qword [rbp + 0x58], rax
mov dword [rbp - 0x2c], 0xd4917dcc
jmp 0x18002ebc3
mov rdx, qword [rbp + 0x10]
mov rcx, qword [rbp + 0x20]
mov r9, qword [rbp + 0x50]
mov r8, qword [rbp + 0x58]
sub rsp, 0x20
call fcn.180033150
add rsp, 0x20
mov r8d, eax
xor edx, edx
mov eax, 0x2929602b
mov ecx, 0x7c099e00
cmp edx, r8d
cmovne eax, ecx
mov dword [rbp - 0x2c], eax
jmp 0x18002ebc3
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
mov dword [rbp + 0x60], eax
mov dword [rbp - 0x2c], 0x18e68247
jmp 0x18002ebc3
mov eax, dword [rbp + 0x60]
mov dword [rbp - 4], eax
mov dword [rbp - 0x2c], 0x33d9bb14
jmp 0x18002ebc3
mov rax, qword [rbp + 0x18]
mov dword [rax], 1
mov dword [rbp - 0x2c], 0x52664d7c
jmp 0x18002ebc3
mov dword [rbp - 0x2c], 0x3dfb9293
jmp 0x18002ebc3
mov rcx, qword [rbp + 0x20]
mov edx, 1
sub rsp, 0x20
call fcn.180033620
add rsp, 0x20
mov dword [rbp + 0x64], eax
mov dword [rbp - 0x2c], 0x35b92e47
jmp 0x18002ebc3
mov ecx, dword [rbp + 0x64]
xor eax, eax
cmp eax, ecx
setne al
and al, 1
mov byte [rbp + 0x6b], al
mov dword [rbp - 0x2c], 0x3e1af284
jmp 0x18002ebc3
mov dl, byte [rbp + 0x6b]
mov eax, 0x2f7664d7
mov ecx, 0xa5d0cbd9
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x2c], eax
jmp 0x18002ebc3
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
mov dword [rbp + 0x6c], eax
mov dword [rbp - 0x2c], 0x3e2c33d4
jmp 0x18002ebc3
mov eax, dword [rbp + 0x6c]
mov dword [rbp - 4], eax
mov rax, qword [rbp + 0x18]
mov dword [rax], 1
mov dword [rbp - 0x2c], 0xbe28c43d
jmp 0x18002ebc3
mov dword [rbp - 0x2c], 0x3dfb9293
jmp 0x18002ebc3
mov rax, qword [rbp + 0x38]
add rax, 0x10
mov qword [rbp + 0x70], rax
mov dword [rbp - 0x2c], 0x477b3d67
jmp 0x18002ebc3
mov rax, qword [rbp + 0x70]
mov rax, qword [rax]
mov qword [rbp + 0x78], rax
mov dword [rbp - 0x2c], 0xa0e934e5
jmp 0x18002ebc3
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x78]
sub rsp, 0x20
call fcn.180033800
add rsp, 0x20
mov r8d, eax
xor edx, edx
mov eax, 0xd7afb8d
mov ecx, 0x18cfc715
cmp edx, r8d
cmovne eax, ecx
mov dword [rbp - 0x2c], eax
jmp 0x18002ebc3
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
mov dword [rbp - 4], eax
mov dword [rbp - 0x2c], 0x27d7df2c
jmp 0x18002ebc3
mov rax, qword [rbp + 0x18]
mov dword [rax], 1
mov dword [rbp - 0x2c], 0xd1761cc9
jmp 0x18002ebc3
mov dword [rbp - 0x2c], 0x3dfb9293
jmp 0x18002ebc3
mov rcx, qword [rbp + 0x20]
sub rsp, 0x20
call fcn.180033980
add rsp, 0x20
mov qword [rbp + 0x80], rax
mov dword [rbp - 0x2c], 0xe1828b30
jmp 0x18002ebc3
mov rax, qword [rbp + 0x80]
cmp rax, 0
sete al
and al, 1
mov byte [rbp + 0x8f], al
mov dword [rbp - 0x2c], 0x5ce844e4
jmp 0x18002ebc3
mov dl, byte [rbp + 0x8f]
mov eax, 0x33ad9183
mov ecx, 0xc34682aa
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x2c], eax
jmp 0x18002ebc3
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
mov dword [rbp - 4], eax
mov dword [rbp - 0x2c], 0x9f3c3994
jmp 0x18002ebc3
mov rax, qword [rbp + 0x18]
mov dword [rax], 1
mov dword [rbp - 0x2c], 0x61e598a0
jmp 0x18002ebc3
mov dword [rbp - 0x2c], 0x3dfb9293
jmp 0x18002ebc3
mov rax, qword [rbp - 0x18]
mov ecx, eax
mov rax, qword [rbp + 0x28]
mov dword [rax], ecx
mov rax, qword [rbp - 0x28]
mov qword [rbp - 0x78], rax
mov rcx, qword [rbp + 0x20]
sub rsp, 0x20
call fcn.180033980
mov r10, qword [rbp - 0x78]
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp + 0x28]
xor edx, edx
xor r9d, r9d
sub rsp, 0x30
mov r8d, r9d
mov qword [rsp + 0x20], r10
mov qword [rsp + 0x28], rax
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
add rsp, 0x30
mov dword [rbp + 0x90], eax
mov dword [rbp - 0x2c], 0x94694655
jmp 0x18002ebc3
mov rax, qword [rbp + 0x30]
mov ecx, dword [rbp + 0x90]
mov dword [rax], ecx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
mov dword [rbp - 4], eax
mov dword [rbp - 0x2c], 0x8580ad3e
jmp 0x18002ebc3
mov rax, qword [rbp + 0x18]
mov dword [rax], 1
mov dword [rbp - 0x2c], 0x3dfb9293
jmp 0x18002ebc3
mov rcx, qword [rbp + 0x20]
sub rsp, 0x20
call fcn.180033a70
add rsp, 0x20
mov dword [rbp - 0x2c], 0x9ff6ac7b
jmp 0x18002ebc3
mov dword [rbp - 0x2c], 0xad994dea
jmp 0x18002ebc3
mov rcx, qword [rbp + 0x10]
sub rsp, 0x20
call fcn.180032fa0
add rsp, 0x20
mov eax, dword [rbp - 4]
mov dword [rbp + 0x94], eax
mov dword [rbp - 0x2c], 0xcb4b4e41
jmp 0x18002ebc3
mov eax, dword [rbp + 0x94]
mov dword [rbp - 0x7c], eax
mov rcx, qword [rbp + 0x98]
xor rcx, rbp
sub rsp, 0x20
call fcn.18008ac40
mov eax, dword [rbp - 0x7c]
lea rsp, [rbp + 0xa0]
pop rbp
ret
jmp 0x18002e2a3