Function at 0x7fffb6d88f84
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x58
xor r13d, r13d
or eax, 0xffffffff
mov r14, rcx
mov dword [rbp - 0x20], eax
mov rcx, qword [r8]
mov ebx, r13d
mov qword [rbp - 0x10], rbx
mov r15, r9
mov dword [rbp - 0x28], eax
mov r12, r8
mov qword [rbp - 0x18], r13
mov edi, r13d
test rcx, rcx
jne 0x7fffb6d88fe1
mov esi, 0x8007000d
mov ecx, esi
call fcn.7fffb6d8b038
jmp 0x7fffb6d89078
lea r8, [rbp + 0x80]
lea rdx, [rbp - 0x10]
call fcn.7fffb6d89724
mov esi, eax
test eax, eax
jns 0x7fffb6d89004
mov ecx, eax
call fcn.7fffb6d8b038
mov rbx, qword [rbp - 0x10]
jmp 0x7fffb6d89078
mov r15d, dword [rbp + 0x80]
lea r13d, [r15 + 0xc]
call qword [sym.imp.KernelBase.dll_GetProcessHeap]
mov r8d, r13d
xor edx, edx
mov rcx, rax
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov r14, rax
test rax, rax
jne 0x7fffb6d8903d
mov esi, 0x8007000e
mov ecx, esi
call fcn.7fffb6d8b038
mov rbx, qword [rbp - 0x10]
jmp 0x7fffb6d8906d
mov rbx, qword [rbp - 0x10]
lea rcx, [r14 + 0xc]
mov dword [rax + 8], r15d
mov rdx, rbx
mov dword [rax], 0x208
mov r8, r15
mov eax, dword [r12 + 8]
mov dword [r14 + 4], eax
call sub.msvcrt.dll_memcpy
mov dword [rbp + 0x80], r13d
mov rdi, r14
mov r15, qword [rbp + 0x60]
xor r13d, r13d
mov r14, qword [rbp + 0x48]
mov ecx, esi
call fcn.7fffb6d8b1d8
test rbx, rbx
je 0x7fffb6d89098
call qword [sym.imp.KernelBase.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
test esi, esi
jns 0x7fffb6d890a8
mov ecx, esi
call fcn.7fffb6d8b038
jmp 0x7fffb6d891de
mov r8d, dword [rbp + 0x80]
lea rax, [rbp - 0x18]
mov rcx, qword [r14]
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov rdx, rdi
mov dword [rsp + 0x20], r13d
call qword [sym.imp.cryptsp.dll_CryptImportKey]
test eax, eax
jne 0x7fffb6d890f1
call qword [sym.imp.KernelBase.dll_GetLastError]
test eax, eax
jne 0x7fffb6d890e1
mov esi, 0x80004005
jmp 0x7fffb6d8909c
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x7fffb6d8909c
mov rcx, qword [rbp - 0x18]
lea r9, [rbp + 0x50]
mov r12d, 4
mov dword [rsp + 0x20], r13d
lea r8, [rbp + 0x78]
mov dword [rbp + 0x50], r12d
lea edx, [r12 + 4]
call qword [sym.imp.cryptsp.dll_CryptGetKeyParam]
test eax, eax
je 0x7fffb6d890d0
cmp dword [rbp + 0x50], r12d
je 0x7fffb6d8912b
mov esi, 0x8000ffff
jmp 0x7fffb6d8909c
mov rsi, qword [rbp + 0x68]
mov ebx, dword [rsi]
shl ebx, 3
cmp ebx, dword [rbp + 0x78]
jae 0x7fffb6d89143
mov esi, 0x8007007a
jmp 0x7fffb6d8909c
or r14d, 0xffffffff
cmp dword [rbp - 0x28], r14d
je 0x7fffb6d89169
mov rcx, qword [rbp - 0x18]
lea r8, [rbp - 0x28]
xor r9d, r9d
mov edx, r12d
call qword [sym.imp.cryptsp.dll_CryptSetKeyParam]
test eax, eax
je 0x7fffb6d890d0
cmp dword [rbp - 0x20], r14d
je 0x7fffb6d8918c
mov rcx, qword [rbp - 0x18]
lea r8, [rbp - 0x20]
xor r9d, r9d
lea edx, [r9 + 3]
call qword [sym.imp.cryptsp.dll_CryptSetKeyParam]
test eax, eax
je 0x7fffb6d890d0
mov eax, ebx
xor edx, edx
div dword [rbp + 0x78]
mov r8, r15
sub ebx, edx
mov edx, dword [rsi]
add ebx, 7
mov r9d, edx
shr ebx, 3
mov dword [rbp + 0x58], ebx
mov rbx, qword [rbp + 0x70]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_memcpy_s]
mov rcx, qword [rbp - 0x18]
lea rax, [rbp + 0x58]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
call qword [sym.imp.cryptsp.dll_CryptDecrypt]
test eax, eax
je 0x7fffb6d890d0
mov esi, r13d
mov ecx, esi
call fcn.7fffb6d8b1d8
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x7fffb6d891f8
call qword [sym.imp.cryptsp.dll_CryptDestroyKey]
mov qword [rbp - 0x18], r13
test rdi, rdi
je 0x7fffb6d89211
call qword [sym.imp.KernelBase.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, esi
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret