Function at 0x18008dee0
Capabilities:
Encrypt data using dpapi
Encrypt or decrypt data via bcrypt

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2250]
mov eax, 0x2350
call fcn.1800f5030
sub rsp, rax
mov rax, qword [0x180126010]
xor rax, rsp
mov qword [rbp + 0x2240], rax
cmp qword [0x180128f90], 0x10
mov r15d, 0xf
mov rbx, rdx
mov qword [rsp + 0x78], rdx
mov rdi, rcx
mov qword [rsp + 0x50], rcx
lea rcx, [0x180128f78]
mov qword [rbp + 0x1d8], r15
cmovae rcx, qword [0x180128f78]
mov r13d, r15d
xor edx, edx
mov qword [rbp + 0x238], r15
mov r12d, edx
mov qword [rbp + 0x1c0], rdx
mov esi, edx
mov qword [rbp + 0x1d0], rdx
mov r14d, edx
mov qword [rbp + 0x220], rdx
mov qword [rbp + 0x230], rdx
xor r9d, r9d
mov qword [rbp + 0x1e0], rdx
lea r8d, [r12 + 6]
mov qword [rbp + 0x1f0], rdx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x200], rdx
mov qword [rbp + 0x210], rdx
mov edx, r15d
mov qword [rbp + 0x218], rdx
lea rdx, [rbp + 0x130]
mov qword [rbp + 0x1f8], r15
call fcn.180087680
test eax, eax
je 0x18008e05b
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x18008e001
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x18008dffc
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18008f6d6
mov rcx, r8
call fcn.1800cd2cc
mov qword [rdi + 0x10], rsi
mov byte [rdi], sil
mov qword [rdi + 0x18], r13
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x18008e046
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x18008e041
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18008f6d6
mov rcx, r8
call fcn.1800cd2cc
mov qword [rbx + 0x10], rsi
mov eax, 0xffffffff
mov qword [rbx + 0x18], r13
mov byte [rbx], sil
jmp 0x18008f676
lea rdx, [0x180129198]
lea rcx, [rbp + 0xe8]
call fcn.1800bf440
mov rdx, rax
lea rcx, [rbp + 0x88]
call fcn.18008aa30
cmp qword [rax + 0x18], 0x10
jb 0x18008e087
mov rax, qword [rax]
xor edx, edx
lea rcx, [rbp + 0x128]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x130]
lea r9d, [rdx + 1]
mov qword [rsp + 0x20], rdx
lea r8d, [rdx - 1]
mov rdx, rax
call fcn.1800638c0
mov rdx, qword [rbp + 0xa0]
test eax, eax
setne bl
cmp rdx, 0x10
jb 0x18008e0fc
mov rcx, qword [rbp + 0x88]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18008e0f7
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008f6ac
call fcn.1800cd2cc
test bl, bl
je 0x18008e144
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x18008e13a
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x18008e135
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18008f6d6
mov rcx, r8
call fcn.1800cd2cc
mov rbx, qword [rsp + 0x78]
jmp 0x18008e001
mov rcx, qword [rbp + 0x128]
call fcn.18002bb80
cmp eax, 0x64
jne 0x18008f632
nop dword [rax]
mov rcx, qword [rbp + 0x128]
xor edx, edx
call fcn.18002c780
mov rcx, qword [rbp + 0x128]
mov edx, 1
mov rbx, rax
call fcn.18002c780
mov rcx, qword [rbp + 0x128]
mov edx, 2
mov rdi, rax
call fcn.18002c780
mov qword [rbp - 0x60], rax
mov rdx, rax
test rbx, rbx
je 0x18008f62d
test rdi, rdi
je 0x18008f62d
test rax, rax
je 0x18008f62d
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp byte [rbx + rcx], 0
jne 0x18008e1c0
test rcx, rcx
je 0x18008f474
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rdi + rax], 0
jne 0x18008e1e0
test rax, rax
je 0x18008f474
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rdx + rax], 0
jne 0x18008e200
test rax, rax
je 0x18008f474
xor eax, eax
mov qword [rsp + 0x70], 0xf
mov qword [rsp + 0x58], rax
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x68], rax
nop
inc r8
cmp byte [rbx + r8], al
jne 0x18008e230
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.1800bfba0
cmp r15, 0x10
jb 0x18008e27d
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x18008e275
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008f6d6
mov rcx, rsi
call fcn.1800cd2cc
movups xmm0, xmmword [rsp + 0x58]
xor ebx, ebx
lea rdx, [rbp + 0x1c0]
movups xmm1, xmmword [rsp + 0x68]
mov qword [rbp - 0x80], rbx
movq rcx, xmm0
mov qword [rbp - 0x70], rbx
movups xmmword [rbp + 0x1c0], xmm0
mov qword [rbp - 0x68], 0xf
movdqa xmm0, xmm1
movq r8, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0x10
movups xmmword [rbp + 0x1d0], xmm1
cmovae rdx, rcx
lea rcx, [rbp - 0x80]
call fcn.1800bfba0
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0x10
jb 0x18008e318
mov rcx, qword [rbp + 0x1c0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18008e313
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008f6d6
call fcn.1800cd2cc
movups xmm0, xmmword [rbp - 0x80]
mov qword [rbp - 0x38], rbx
mov r8, 0xffffffffffffffff
movups xmm1, xmmword [rbp - 0x70]
mov qword [rbp - 0x28], rbx
movups xmmword [rbp + 0x1c0], xmm0
mov qword [rbp - 0x20], 0xf
movups xmmword [rbp + 0x1d0], xmm1
inc r8
cmp byte [rdi + r8], bl
jne 0x18008e345
mov rdx, rdi
lea rcx, [rbp - 0x38]
call fcn.1800bfba0
cmp r13, 0x10
jb 0x18008e391
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x18008e389
mov r14, qword [r14 - 8]
add rdx, 0x27
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008f6d6
mov rcx, r14
call fcn.1800cd2cc
mov r15, qword [rbp - 0x68]
lea rsi, [rbp + 0x1c0]
movups xmm0, xmmword [rbp - 0x38]
mov r14, qword [rbp - 0x80]
cmp r15, 0x10
movups xmm1, xmmword [rbp - 0x28]
mov rbx, qword [rbp - 0x70]
cmovae rsi, r14
movups xmmword [rbp + 0x220], xmm0
movups xmmword [rbp + 0x230], xmm1
cmp rbx, 0x10
jae 0x18008e3d9
movups xmm0, xmmword [rsi]
mov qword [rbp + 0x20], 0xf
movups xmmword [rbp + 8], xmm0
jmp 0x18008e452
movabs rax, 0x7fffffffffffffff
mov rdi, rbx
or rdi, 0xf
cmp rdi, rax
cmova rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x18008e42d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18008f6b8
mov rcx, rax
call fcn.1800cd2d4
mov rcx, rax
test rax, rax
je 0x18008f6d6
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x18008e43b
test rcx, rcx
je 0x18008e439
call fcn.1800cd2d4
jmp 0x18008e43b
xor eax, eax
lea r8, [rbx + 1]
mov qword [rbp + 8], rax
mov rdx, rsi
mov rcx, rax
call fcn.1800d03a0
mov qword [rbp + 0x20], rdi
xor r13d, r13d
mov qword [rbp + 0x18], rbx
lea rdx, [0x180115184]
mov qword [rbp + 0x48], r13
lea rcx, [rbp + 0x48]
mov qword [rbp + 0x58], r13
mov qword [rbp + 0x60], 0xf
lea r8d, [r13 + 2]
call fcn.1800bfba0
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x48]
call fcn.18008c5f0
test eax, eax
jle 0x18008eb8a
cmp r15, 0x10
lea rsi, [rbp + 0x1c0]
cmovae rsi, r14
cmp rbx, 0x10
jae 0x18008e4ba
movups xmm0, xmmword [rsi]
mov qword [rsp + 0x70], 0xf
movups xmmword [rsp + 0x58], xmm0
jmp 0x18008e536
movabs rax, 0x7fffffffffffffff
mov rdi, rbx
or rdi, 0xf
cmp rdi, rax
cmova rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x18008e50e
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18008f6b8
mov rcx, rax
call fcn.1800cd2d4
mov rcx, rax
test rax, rax
je 0x18008f6d6
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x18008e51d
test rcx, rcx
je 0x18008e51a
call fcn.1800cd2d4
jmp 0x18008e51d
mov rax, r13
lea r8, [rbx + 1]
mov qword [rsp + 0x58], rax
mov rdx, rsi
mov rcx, rax
call fcn.1800d03a0
mov qword [rsp + 0x70], rdi
lea rsi, [0x180115184]
mov qword [rsp + 0x68], rbx
mov rdx, rsi
mov qword [rbp - 0x18], r13
mov r8d, 2
mov qword [rbp - 8], r13
lea rcx, [rbp - 0x18]
mov qword [rbp], 0xf
call fcn.1800bfba0
lea rdx, [rsp + 0x58]
mov qword [rbp - 0x80], r13
lea rcx, [rbp - 0x18]
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], 0xf
call fcn.18008c5f0
dec eax
lea rdx, [rbp + 0x1c0]
movsxd r8, eax
lea rcx, [rbp - 0x80]
cmp rbx, r8
cmovb r8, rbx
cmp r15, 0x10
cmovae rdx, r14
call fcn.1800bfba0
mov rax, qword [rbp + 0x218]
cmp rax, 0x10
jb 0x18008e5e5
mov rcx, qword [rbp + 0x28]
lea rdx, [rax + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18008e5e0
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008f6d6
call fcn.1800cd2cc
movups xmm0, xmmword [rbp - 0x80]
cmp qword [rbp + 0x1d8], 0x10
lea rdi, [rbp + 0x1c0]
movups xmm1, xmmword [rbp - 0x70]
cmovae rdi, qword [rbp + 0x1c0]
lea rcx, [rbp - 0x18]
mov r8d, 2
mov qword [rbp - 0x18], r13
mov rdx, rsi
mov qword [rbp - 8], r13
movups xmmword [rbp + 0x200], xmm0
mov qword [rbp], 0xf
movups xmmword [rbp + 0x210], xmm1
call fcn.1800bfba0
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp byte [rdi + rbx], r13b
jne 0x18008e640
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0xe8]
call fcn.1800bf440
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.18008c5f0
inc eax
mov qword [rsp + 0x58], r13
movsxd rcx, eax
mov rax, qword [rbp + 0x1d0]
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], 0xf
cmp rax, rcx
jb 0x18008f6d0
sub rax, rcx
lea rdx, [rbp + 0x1c0]
cmp rax, rbx
cmovb rbx, rax
cmp qword [rbp + 0x1d8], 0x10
mov r8, rbx
cmovae rdx, qword [rbp + 0x1c0]
add rdx, rcx
lea rcx, [rsp + 0x58]
call fcn.1800bfba0
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0x10
jb 0x18008e702
mov rcx, qword [rbp + 0x1c0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18008e6fd
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008f6b2
call fcn.1800cd2cc
movups xmm0, xmmword [rsp + 0x58]
lea rsi, [rbp + 0x1c0]
movups xmm1, xmmword [rsp + 0x68]
movq r14, xmm0
movups xmmword [rbp + 0x1c0], xmm0
movdqa xmm0, xmm1
movq rbx, xmm1
psrldq xmm0, 8
movq r15, xmm0
cmp r15, 0x10
movups xmmword [rbp + 0x1d0], xmm1
cmovae rsi, r14
cmp rbx, 0x10
jae 0x18008e75a
movups xmm0, xmmword [rsi]
mov qword [rsp + 0x70], 0xf
movups xmmword [rsp + 0x58], xmm0
jmp 0x18008e7d6
movabs rax, 0x7fffffffffffffff
mov rdi, rbx
or rdi, 0xf
cmp rdi, rax
cmova rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x18008e7ae
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18008f6b8
mov rcx, rax
call fcn.1800cd2d4
mov rcx, rax
test rax, rax
je 0x18008f6d6
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x18008e7bd
test rcx, rcx
je 0x18008e7ba
call fcn.1800cd2d4
jmp 0x18008e7bd
mov rax, r13
lea r8, [rbx + 1]
mov qword [rsp + 0x58], rax
mov rdx, rsi
mov rcx, rax
call fcn.1800d03a0
mov qword [rsp + 0x70], rdi
mov r8d, 1
mov qword [rsp + 0x68], rbx
lea rdx, [0x180115188]
mov qword [rbp - 0x18], r13
lea rcx, [rbp - 0x18]
mov qword [rbp - 8], r13
mov qword [rbp], 0xf
call fcn.1800bfba0
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x18]
call fcn.18008c5f0
test eax, eax
jle 0x18008ea5f
cmp r15, 0x10
lea rsi, [rbp + 0x1c0]
cmovae rsi, r14
cmp rbx, 0x10
jae 0x18008e83d
movups xmm0, xmmword [rsi]
mov qword [rbp + 0x20], 0xf
movups xmmword [rbp + 8], xmm0
jmp 0x18008e8b7
movabs rax, 0x7fffffffffffffff
mov rdi, rbx
or rdi, 0xf
cmp rdi, rax
cmova rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x18008e891
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18008f6b8
mov rcx, rax
call fcn.1800cd2d4
mov rcx, rax
test rax, rax
je 0x18008f6d6
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x18008e8a0
test rcx, rcx
je 0x18008e89d
call fcn.1800cd2d4
jmp 0x18008e8a0
mov rax, r13
lea r8, [rbx + 1]
mov qword [rbp + 8], rax
mov rdx, rsi
mov rcx, rax
call fcn.1800d03a0
mov qword [rbp + 0x20], rdi
mov r8d, 1
mov qword [rbp + 0x18], rbx
lea rdx, [0x180115188]
mov qword [rbp + 0x48], r13
lea rcx, [rbp + 0x48]
mov qword [rbp + 0x58], r13
mov qword [rbp + 0x60], 0xf
call fcn.1800bfba0
lea rdx, [rbp + 8]
mov qword [rbp + 0x28], r13
lea rcx, [rbp + 0x48]
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], 0xf
call fcn.18008c5f0
dec eax
lea rdx, [rbp + 0x1c0]
movsxd r8, eax
lea rcx, [rbp + 0x28]
cmp rbx, r8
cmovb r8, rbx
cmp r15, 0x10
cmovae rdx, r14
call fcn.1800bfba0
mov rcx, qword [rbp - 0x70]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 2
jb 0x18008f6be
cmp qword [rbp - 0x68], 0x10
lea rax, [0x180115184]
mov qword [rsp + 0x30], 2
lea r9, [rbp + 0x200]
cmovae r9, qword [rbp - 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x58]
call fcn.1800c27f0
lea r9, [rbp + 0x28]
lea r8, [rbp - 0x58]
lea rcx, [rbp + 0x68]
call fcn.1800c2600
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0x10
jb 0x18008e9c3
mov rcx, qword [rbp + 0x1c0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18008e9be
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008f6d6
call fcn.1800cd2cc
movups xmm0, xmmword [rbp + 0x68]
mov rdx, qword [rbp - 0x40]
movups xmm1, xmmword [rbp + 0x78]
movups xmmword [rbp + 0x1c0], xmm0
movups xmmword [rbp + 0x1d0], xmm1
cmp rdx, 0x10
jb 0x18008ea14
mov rcx, qword [rbp - 0x58]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18008ea0f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008f6d6
call fcn.1800cd2cc
mov rdx, qword [rbp + 0x40]
cmp rdx, 0x10
jb 0x18008ea4f
mov rcx, qword [rbp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18008ea4a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008f6d6
call fcn.1800cd2cc
mov r14, qword [rbp + 0x200]
mov qword [rbp + 0x28], r14
jmp 0x18008eb8e
mov rcx, qword [rbp - 0x70]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 2
jb 0x18008f6ca
cmp qword [rbp - 0x68], 0x10
lea rax, [0x180115184]
mov qword [rsp + 0x30], 2
lea r9, [rbp + 0x200]
cmovae r9, qword [rbp - 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x58]
call fcn.1800c27f0
cmp r15, 0x10
lea rdx, [rbp + 0x1c0]
mov r8, rbx
lea rcx, [rbp - 0x58]
cmovae rdx, r14
call fcn.1800bf270
mov rdx, qword [rbp + 0x1d8]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], r13b
movups xmmword [rbp + 0x28], xmm0
movups xmmword [rbp - 0x80], xmm1
cmp rdx, 0x10
jb 0x18008eb30
mov rcx, qword [rbp + 0x1c0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18008eb23
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008f6c4
call fcn.1800cd2cc
movups xmm0, xmmword [rbp + 0x28]
movups xmm1, xmmword [rbp - 0x80]
mov rdx, qword [rbp - 0x40]
movups xmmword [rbp + 0x1c0], xmm0
movups xmmword [rbp + 0x1d0], xmm1
cmp rdx, 0x10
jb 0x18008ea4f
mov rcx, qword [rbp - 0x58]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18008eb78
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008f6c4
call fcn.1800cd2cc
mov r14, qword [rbp + 0x200]
mov qword [rbp + 0x28], r14
jmp 0x18008eb8e
mov r14, qword [rbp + 0x28]
mov rdi, qword [rbp + 0x128]
mov edx, 2
mov rcx, rdi
call fcn.18002c2d0
mov rbx, rax
movzx eax, word [rax + 8]
test al, 0x10
jne 0x18008ebe1
mov edx, 0x202
movzx ecx, ax
and cx, dx
cmp cx, dx
jne 0x18008ebc9
cmp byte [rbx + 0xa], 1
jne 0x18008ebc9
mov rax, qword [rbx + 0x10]
jmp 0x18008ebd7
test al, 1
jne 0x18008ebdc
mov dl, 1
mov rcx, rbx
call fcn.180025d30
test rax, rax
jne 0x18008ebe1
mov esi, r13d
jmp 0x18008ebf1
mov esi, dword [rbx + 0xc]
mov eax, 0x4000
test word [rbx + 8], ax
je 0x18008ebf1
add esi, dword [rbx]
test rdi, rdi
je 0x18008ec3b
mov rcx, qword [rdi]
mov edx, dword [rdi + 0x84]
test rcx, rcx
jne 0x18008ec09
movzx eax, dl
jmp 0x18008ec23
cmp byte [rcx + 0x50], r13b
jne 0x18008ec1e
cmp edx, 0xc0a
je 0x18008ec1e
mov eax, dword [rcx + 0x48]
and eax, edx
jmp 0x18008ec23
call fcn.1800066c0
mov rcx, qword [rdi]
mov dword [rdi + 0x84], eax
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x18008ec3b
call qword [0x180126fd8]
mov rdi, qword [rbp - 0x60]
cmp byte [rdi], 0x76
jne 0x18008ee87
cmp byte [rdi + 1], 0x31
jne 0x18008ee87
cmp byte [rdi + 2], 0x30
je 0x18008ec62
cmp byte [rdi + 2], 0x31
jne 0x18008ee87
lea rdx, [rbp - 0x60]
mov dword [rbp - 0x60], r13d
call fcn.18008db30
test eax, eax
je 0x18008f493
mov edx, dword [rbp - 0x60]
lea r8, [rbp + 0x240]
call fcn.18008dd20
test eax, eax
je 0x18008f493
lea rax, [rbp + 0x240]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rax + rbx], r13b
jne 0x18008eca0
xor r9d, r9d
lea rdx, [0x180115140]
xor r8d, r8d
lea rcx, [0x18012bae8]
call qword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
test eax, eax
jne 0x18008eceb
mov rcx, qword [0x18012bae8]
lea r9d, [rax + 0x20]
lea r8, str.ChainingModeGCM
mov dword [rsp + 0x20], r13d
lea rdx, str.ChainingMode
call qword [sym.imp.bcrypt.dll_BCryptSetProperty]
mov rcx, qword [0x18012bae8]
lea rax, [rbp + 0x240]
mov dword [rsp + 0x30], r13d
lea rdx, [0x18012ba80]
mov dword [rsp + 0x28], ebx
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.bcrypt.dll_BCryptGenerateSymmetricKey]
mov r9, qword [0x18012bb18]
test r9, r9
jne 0x18008ed43
mov ecx, 0x400
call fcn.1800d5574
mov qword [0x18012bb18], rax
mov r9, rax
test rax, rax
je 0x18008f493
xorps xmm0, xmm0
mov dword [rsp + 0x48], r13d
xor eax, eax
mov dword [rbp + 0x130], r13d
mov qword [rbp + 0x1b0], rax
lea rcx, [rdi - 0x10]
movups xmmword [rbp + 0x160], xmm0
lea rax, [rdi + 3]
mov dword [rbp + 0x160], 0x58
mov qword [rbp + 0x168], rax
lea r8d, [rsi - 0x1f]
movsxd rax, esi
lea rdx, [rdi + 0xf]
add rcx, rax
mov dword [rbp + 0x164], 1
lea rax, [rbp + 0x130]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x400
mov qword [rsp + 0x30], r9
lea r9, [rbp + 0x160]
movups xmmword [rbp + 0x180], xmm0
mov qword [rbp + 0x188], rcx
mov rcx, qword [0x18012ba80]
movups xmmword [rbp + 0x170], xmm0
mov dword [rsp + 0x28], r13d
movups xmmword [rbp + 0x190], xmm0
mov qword [rsp + 0x20], r13
movups xmmword [rbp + 0x1a0], xmm0
mov dword [rbp + 0x170], 0xc
mov dword [rbp + 0x190], 0x10
call qword [sym.imp.bcrypt.dll_BCryptDecrypt]
mov eax, dword [rbp + 0x130]
mov r8, 0xffffffffffffffff
mov rdx, qword [0x18012bb18]
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], 0xf
mov byte [rax + rdx], r13b
nop dword [rax]
inc r8
cmp byte [rdx + r8], r13b
jne 0x18008ee30
lea rcx, [rsp + 0x58]
call fcn.1800bfba0
mov rax, qword [rbp + 0x1f8]
cmp rax, 0x10
jb 0x18008ef79
lea rdx, [rax + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x18008ef71
mov r12, qword [r12 - 8]
add rdx, 0x27
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008f6a6
jmp 0x18008ef71
lea rax, [rbp + 0x148]
mov qword [rbp + 0x140], rdi
mov qword [rsp + 0x30], rax
lea rcx, [rbp + 0x138]
mov dword [rsp + 0x28], r13d
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r13
xor edx, edx
mov dword [rbp + 0x138], esi
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x18008eef2
mov ebx, dword [rbp + 0x148]
test ebx, ebx
je 0x18008eee3
mov rdx, qword [rbp + 0x150]
lea rcx, [rbp + 0x240]
mov r8d, ebx
call fcn.1800d03a0
mov byte [rbp + rbx + 0x240], r13b
mov eax, 1
jmp 0x18008eef5
mov eax, r13d
test eax, eax
je 0x18008ef98
mov qword [rsp + 0x58], r13
lea rax, [rbp + 0x240]
mov qword [rsp + 0x68], r13
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x70], 0xf
nop
inc r8
cmp byte [rax + r8], r13b
jne 0x18008ef20
lea rdx, [rbp + 0x240]
lea rcx, [rsp + 0x58]
call fcn.1800bfba0
mov rax, qword [rbp + 0x1f8]
cmp rax, 0x10
jb 0x18008ef79
lea rdx, [rax + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x18008ef71
mov r12, qword [r12 - 8]
add rdx, 0x27
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008f6d6
mov rcx, r12
call fcn.1800cd2cc
movups xmm0, xmmword [rsp + 0x58]
movups xmm1, xmmword [rsp + 0x68]
movups xmmword [rbp + 0x1e0], xmm0
mov r12, qword [rbp + 0x1e0]
movups xmmword [rbp + 0x1f0], xmm1
mov rdi, qword [rsp + 0x50]
mov rax, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18008efaa
mov rax, qword [rdi]
cmp qword [rdi + 0x10], 1
jne 0x18008efba
cmp byte [rax], 0x30
jne 0x18008efba
mov al, 1
jmp 0x18008efbc
xor al, al
test al, al
je 0x18008f2fb
mov rcx, qword [rbp + 0x1d0]
movabs rbx, 0x7fffffffffffffff
mov rax, rbx
sub rax, rcx
cmp rax, 1
jb 0x18008f6a0
cmp qword [rbp + 0x1d8], 0x10
lea rax, [rbp + 0x1c0]
mov qword [rsp + 0x30], rcx
lea r9, [0x180115190]
cmovae rax, qword [rbp + 0x1c0]
lea rcx, [rbp - 0x58]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 1
call fcn.1800c27f0
mov r8d, 1
lea rdx, [0x18011518c]
lea rcx, [rbp - 0x58]
call fcn.1800bf270
lea rdx, [rbp + 0xa8]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], r13
movq rcx, xmm0
mov qword [rax + 0x18], 0xf
movups xmmword [rbp + 0xa8], xmm0
mov byte [rax], r13b
movdqa xmm0, xmm1
movq r8, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0x10
movups xmmword [rbp + 0xb8], xmm1
cmovae rdx, rcx
lea rcx, [0x180128cb8]
call fcn.1800bf270
mov rdx, qword [rbp + 0xc0]
cmp rdx, 0x10
jb 0x18008f0cd
mov rcx, qword [rbp + 0xa8]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18008f0c8
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008f6dc
call fcn.1800cd2cc
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x18008f108
mov rcx, qword [rbp - 0x58]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18008f103
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008f6dc
call fcn.1800cd2cc
mov rcx, qword [rbp - 0x28]
mov rax, rbx
sub rax, rcx
cmp rax, 1
jb 0x18008f6ee
cmp qword [rbp - 0x20], 0x10
lea rax, [rbp + 0x220]
mov qword [rsp + 0x30], rcx
lea r9, [0x180115190]
cmovae rax, qword [rbp - 0x38]
lea rcx, [rbp - 0x58]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 1
call fcn.1800c27f0
mov r8d, 1
lea rdx, [0x18011518c]
lea rcx, [rbp - 0x58]
call fcn.1800bf270
lea rdx, [rbp + 0xc8]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], r13
movq rcx, xmm0
mov qword [rax + 0x18], 0xf
movups xmmword [rbp + 0xc8], xmm0
mov byte [rax], r13b
movdqa xmm0, xmm1
movq r8, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0x10
movups xmmword [rbp + 0xd8], xmm1
cmovae rdx, rcx
lea rcx, [0x180128cb8]
call fcn.1800bf270
mov rdx, qword [rbp + 0xe0]
cmp rdx, 0x10
jb 0x18008f1fe
mov rcx, qword [rbp + 0xc8]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18008f1f9
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008f6e2
call fcn.1800cd2cc
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x18008f239
mov rcx, qword [rbp - 0x58]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18008f234
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008f6e2
call fcn.1800cd2cc
mov rcx, qword [rbp + 0x1f0]
mov rax, rbx
sub rax, rcx
cmp rax, 1
jb 0x18008f6e8
cmp qword [rbp + 0x1f8], 0x10
lea rax, [rbp + 0x1e0]
mov qword [rsp + 0x30], rcx
lea r9, [0x180115190]
cmovae rax, r12
lea rcx, [rbp + 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 1
call fcn.1800c27f0
mov r8d, 1
lea rdx, [0x18011518c]
lea rcx, [rbp + 0x68]
call fcn.1800bf270
lea rdx, [rbp + 0x88]
lea rcx, [0x180128cb8]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], r13
movups xmmword [rbp + 0x88], xmm0
mov qword [rax + 0x18], 0xf
movups xmmword [rbp + 0x98], xmm1
mov byte [rax], r13b
call fcn.1800bf310
lea rcx, [rbp + 0x88]
call fcn.1800bf350
lea rcx, [rbp + 0x68]
call fcn.1800bf350
lea rcx, [0x180128cb8]
call fcn.1800bf2f0
mov r12, qword [rbp + 0x1e0]
lea rdx, [0x18010a2fc]
mov rcx, rdi
call fcn.1800c00d0
test al, al
je 0x18008f450
lea r8, [0x18011519c]
lea rdx, [0x180128cb8]
lea rcx, [rbp + 0xe8]
call fcn.1800c0310
mov rdx, rax
lea r8, [0x180115198]
lea rcx, [rbp + 0x108]
call fcn.1800c02b0
mov r8, qword [rsp + 0x78]
lea rcx, [rbp - 0x80]
mov rdx, rax
call fcn.1800c0120
mov rdx, rax
lea r8, [0x180115198]
lea rcx, [rbp - 0x38]
call fcn.1800c02b0
mov rdx, rax
lea r8, [rbp + 0x1c0]
lea rcx, [rbp + 8]
call fcn.1800c0120
mov rdx, rax
lea r8, [0x180115198]
lea rcx, [rsp + 0x58]
call fcn.1800c02b0
mov rdx, rax
lea r8, [rbp + 0x220]
lea rcx, [rbp + 0x48]
call fcn.1800c0120
mov rdx, rax
lea r8, [0x180115198]
lea rcx, [rbp - 0x18]
call fcn.1800c02b0
mov rdx, rax
lea r8, [rbp + 0x1e0]
lea rcx, [rbp - 0x58]
call fcn.1800c0120
mov rdx, rax
lea r8, [0x180115194]
lea rcx, [rbp + 0x68]
call fcn.1800c02b0
mov rdx, rax
lea rcx, [0x180128cb8]
call fcn.1800bf3b0
lea rcx, [rbp + 0x68]
call fcn.1800bf350
lea rcx, [rbp - 0x58]
call fcn.1800bf350
lea rcx, [rbp - 0x18]
call fcn.1800bf350
lea rcx, [rbp + 0x48]
call fcn.1800bf350
lea rcx, [rsp + 0x58]
call fcn.1800bf350
lea rcx, [rbp + 8]
call fcn.1800bf350
lea rcx, [rbp - 0x38]
call fcn.1800bf350
lea rcx, [rbp - 0x80]
call fcn.1800bf350
lea rcx, [rbp + 0x108]
call fcn.1800bf350
lea rcx, [rbp + 0xe8]
call fcn.1800bf350
mov r12, qword [rbp + 0x1e0]
inc dword [0x18012bb10]
mov r15, qword [rbp + 0x1d8]
mov rsi, qword [rbp + 0x1c0]
mov r13, qword [rbp + 0x238]
mov r14, qword [rbp + 0x220]
jmp 0x18008f479
mov rdi, qword [rsp + 0x50]
mov rcx, qword [rbp + 0x128]
call fcn.18002bb80
cmp eax, 0x64
je 0x18008e160
jmp 0x18008f632
mov rdx, qword [rbp + 0x218]
cmp rdx, 0x10
jb 0x18008f4d0
inc rdx
mov rax, r14
cmp rdx, 0x1000
jb 0x18008f4c8
mov r14, qword [r14 - 8]
add rdx, 0x27
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008f6a6
mov rcx, r14
call fcn.1800cd2cc
mov rdx, qword [rbp + 0x1f8]
cmp rdx, 0x10
jb 0x18008f50e
inc rdx
mov rax, r12
cmp rdx, 0x1000
jb 0x18008f506
mov r12, qword [r12 - 8]
add rdx, 0x27
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008f6a6
mov rcx, r12
call fcn.1800cd2cc
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x18008f549
mov rcx, qword [rbp - 0x38]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18008f544
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008f6a6
call fcn.1800cd2cc
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0x10
jb 0x18008f58a
mov rcx, qword [rbp + 0x1c0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18008f585
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008f6a6
call fcn.1800cd2cc
mov rbx, qword [rsp + 0x50]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x18008f5c9
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x18008f5c4
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18008f6a6
mov rcx, r8
call fcn.1800cd2cc
mov qword [rbx + 0x10], r13
mov byte [rbx], r13b
mov qword [rbx + 0x18], 0xf
mov rbx, qword [rsp + 0x78]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x18008f617
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x18008f612
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18008f6a6
mov rcx, r8
call fcn.1800cd2cc
mov qword [rbx + 0x10], r13
mov eax, 0xffffffff
mov qword [rbx + 0x18], 0xf
mov byte [rbx], r13b
jmp 0x18008f676
mov rdi, qword [rsp + 0x50]
lea rcx, [rbp + 0x200]
call fcn.1800bf350
lea rcx, [rbp + 0x1e0]
call fcn.1800bf350
lea rcx, [rbp + 0x220]
call fcn.1800bf350
lea rcx, [rbp + 0x1c0]
call fcn.1800bf350
mov rcx, rdi
call fcn.1800bf350
mov rcx, qword [rsp + 0x78]
call fcn.1800bf350
xor eax, eax
mov rcx, qword [rbp + 0x2240]
xor rcx, rsp
call fcn.1800cd010
mov rbx, qword [rsp + 0x23a0]
add rsp, 0x2350
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.180088c60
int3
call fcn.1800dc358
int3
call fcn.1800dc358
int3
call fcn.1800dc358
int3
call fcn.180088bc0
int3
call fcn.180088c60
int3
call fcn.1800dc358
int3
call fcn.180088c60
int3
call fcn.1800bfe50
int3
call fcn.1800dc358
int3
call fcn.1800dc358
int3
call fcn.1800dc358
int3
call fcn.180088c60
int3
call fcn.180088c60
int3