Function at 0x1401f1970
Capabilities:
Encrypt or decrypt data via bcrypt
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x18], r8
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
movsxd rax, dword [0x140361030]
xor ebx, ebx
mov r10, qword [0x140361028]
mov r13, r9
mov r12, r8
mov r14, rdx
mov rdi, rcx
test r10, r10
je 0x1401f1c47
mov qword [rbp - 0x10], rax
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x1401f1c47
nop word [rax + rax]
mov r9d, dword [r12 + 8]
mov ecx, r9d
mov r8d, dword [r13 + 8]
mov eax, dword [rbp + 0x50]
cdq
and edx, 7
add eax, edx
and eax, 0xfffffff8
cmp r9d, r8d
cmovbe ecx, r8d
cmp eax, ecx
ja 0x1401f19fd
cmp r9d, r8d
mov eax, r8d
cmova eax, r9d
lea r8d, [rax*8]
mov dword [rbp - 0x20], eax
xor r9d, r9d
mov rdx, rdi
mov rcx, r10
call sub.bcrypt.dll_BCryptGenerateKeyPair
test eax, eax
js 0x1401f1f24
mov eax, dword [rbp - 0x20]
lea esi, [rax*2 + 0xc]
mov ecx, esi
call fcn.140203764
mov rbx, rax
test rax, rax
je 0x1401f1f24
mov dword [rax], esi
mov dword [rax + 4], 0x4d504844
mov ecx, dword [rbp - 0x20]
mov dword [rax + 8], ecx
lea rcx, [rax + 0xc]
mov r9d, dword [r13 + 8]
mov r8, qword [r13]
mov edx, dword [rbp - 0x20]
call fcn.1401f4bf0
mov edx, dword [rbp - 0x20]
mov r9d, dword [r12 + 8]
mov r8, qword [r12]
lea rcx, [rdx + 0xc]
add rcx, rbx
call fcn.1401f4bf0
mov rcx, qword [rdi]
lea rdx, str.DHParameters
mov r9d, esi
mov dword [rsp + 0x20], 0
mov r8, rbx
call sub.bcrypt.dll_BCryptSetProperty
mov qword [rdi + 8], rbx
test eax, eax
js 0x1401f1f24
mov rcx, qword [rdi]
xor edx, edx
call sub.bcrypt.dll_BCryptFinalizeKeyPair
test eax, eax
js 0x1401f1f24
mov rcx, qword [rdi]
lea rax, str.DHPRIVATEBLOB
cmp r15, 1
mov dword [rbp - 0x20], 0
lea rsi, str.DHPUBLICBLOB
cmovne rsi, rax
xor r15d, r15d
lea rax, [rbp - 0x20]
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov r8, rsi
mov dword [rsp + 0x20], r15d
xor edx, edx
call sub.bcrypt.dll_BCryptExportKey
test eax, eax
js 0x1401f1f24
mov ecx, dword [rbp - 0x20]
call fcn.140203764
mov rbx, rax
test rax, rax
je 0x1401f1f24
mov rcx, qword [rdi]
lea rax, [rbp - 0x20]
mov dword [rsp + 0x30], r15d
mov r9, rbx
mov qword [rsp + 0x28], rax
mov r8, rsi
mov eax, dword [rbp - 0x20]
xor edx, edx
mov dword [rsp + 0x20], eax
call sub.bcrypt.dll_BCryptExportKey
test eax, eax
js 0x1401f1c33
mov esi, dword [rbx + 4]
test r14, r14
je 0x1401f1c33
cmp esi, dword [r14 + 8]
je 0x1401f1b69
mov rcx, qword [r14]
mov edx, esi
call fcn.140204114
test rax, rax
je 0x1401f1c33
mov qword [r14], rax
mov dword [r14 + 8], esi
mov eax, dword [rbx + 4]
mov rcx, qword [r14]
mov r8d, eax
lea edx, [rax + rax]
add rdx, 8
add rdx, rbx
call fcn.14021a580
cmp dword [rbx], 0x56504844
jne 0x1401f1c40
mov ecx, 0x10
call fcn.140203764
mov rsi, rax
test rax, rax
je 0x1401f1c2f
mov qword [rax], r15
mov dword [rax + 8], r15d
mov qword [rdi + 0x10], rax
mov r15d, dword [rbx + 4]
cmp r15d, dword [rax + 8]
je 0x1401f1bcf
mov rcx, qword [rax]
mov edx, r15d
call fcn.140204114
test rax, rax
je 0x1401f1c33
mov qword [rsi], rax
mov dword [rsi + 8], r15d
mov eax, dword [rbx + 4]
mov rcx, qword [rdi + 0x10]
mov r8d, eax
lea edx, [rax + rax*2]
mov rcx, qword [rcx]
add rdx, 8
add rdx, rbx
call fcn.14021a580
mov rdx, qword [rdi + 0x10]
mov ecx, dword [rdx + 8]
mov rax, qword [rdx]
dec ecx
test byte [rcx + rax], 1
jne 0x1401f1c40
mov rcx, rbx
call fcn.140204100
mov rcx, rdi
call fcn.1401f18f0
xor ebx, ebx
mov qword [rdi], rbx
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], rbx
mov r10, qword [0x140361028]
test r10, r10
je 0x1401f1c47
mov r15, qword [rbp - 0x10]
jmp 0x1401f19d0
mov qword [rdi + 0x10], rsi
mov rcx, rbx
call fcn.140204100
jmp 0x1401f1f24
xor eax, eax
jmp 0x1401f1f29
mov ecx, 0x10
call fcn.140203764
mov rsi, rax
test rax, rax
je 0x1401f1f20
mov qword [rax], rbx
mov dword [rax + 8], ebx
mov qword [rdi + 0x10], rax
mov eax, dword [rbp + 0x50]
lea ebx, [rax*8 - 1]
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x140266898]
call fcn.14020960c
cvttsd2si r15, xmm0
cmp r15d, dword [rsi + 8]
je 0x1401f1cac
mov rcx, qword [rsi]
mov edx, r15d
call fcn.140204114
test rax, rax
je 0x1401f1f24
mov qword [rsi], rax
mov dword [rsi + 8], r15d
mov rsi, qword [rsi]
xor r9d, r9d
mov rcx, qword [0x140360fa0]
mov rdx, rsi
mov r8d, r15d
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x1401f1f24
and ebx, 0x80000007
jge 0x1401f1cdb
dec ebx
or ebx, 0xfffffff8
inc ebx
test ebx, ebx
mov eax, 1
mov edx, 8
cmovne edx, ebx
mov ecx, edx
shl al, cl
dec al
movzx ecx, al
movzx eax, byte [rsi]
and ecx, eax
lea eax, [rdx - 1]
bts ecx, eax
mov byte [rsi], cl
lea eax, [r15 - 1]
or byte [rax + rsi], 1
mov rbx, qword [rdi + 0x10]
test r14, r14
je 0x1401f1f24
test r12, r12
je 0x1401f1f24
test rbx, rbx
je 0x1401f1f24
test r13, r13
je 0x1401f1f24
mov esi, dword [r13 + 8]
add esi, 0x18
mov dword [rbp - 0x20], 0x18
add esi, dword [rbx + 8]
mov ecx, esi
call fcn.140203764
mov rdi, rax
test rax, rax
je 0x1401f1f24
mov dword [rax], 0x31415352
mov ecx, dword [r13 + 8]
shl ecx, 3
mov dword [rax + 4], ecx
mov ecx, dword [rbx + 8]
mov dword [rax + 8], ecx
mov ecx, dword [r13 + 8]
mov dword [rax + 0xc], ecx
xor eax, eax
mov qword [rdi + 0x10], rax
mov ecx, dword [rbp - 0x20]
mov r8d, dword [rbx + 8]
add rcx, rdi
mov rdx, qword [rbx]
call fcn.14021a580
mov ecx, dword [rbx + 8]
add ecx, dword [rbp - 0x20]
mov r8d, dword [r13 + 8]
add rcx, rdi
mov rdx, qword [r13]
call fcn.14021a580
mov rcx, qword [0x140360ff8]
lea r9, [rbp - 0x18]
xor r13d, r13d
lea r8, str.RSAPUBLICBLOB
mov dword [rsp + 0x30], r13d
xor edx, edx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rdi
mov dword [rbp - 0x20], r13d
call sub.bcrypt.dll_BCryptImportKeyPair
mov ebx, eax
test eax, eax
js 0x1401f1f0f
mov r8d, dword [r12 + 8]
lea rax, [rbp - 0x1c]
mov rdx, qword [r12]
lea r15, [r12 + 8]
mov rcx, qword [rbp - 0x18]
xor r9d, r9d
mov dword [rsp + 0x48], 1
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call sub.bcrypt.dll_BCryptEncrypt
mov ebx, eax
test eax, eax
js 0x1401f1f06
mov ebx, dword [rbp - 0x1c]
cmp ebx, dword [r14 + 8]
jne 0x1401f1e2e
mov rax, r15
jmp 0x1401f1e51
mov rcx, qword [r14]
mov rdx, rbx
call fcn.140204114
test rax, rax
je 0x1401f1f01
mov qword [r14], rax
lea rax, [r12 + 8]
mov dword [r14 + 8], ebx
mov ebx, dword [rbp - 0x1c]
mov edx, dword [r15]
lea rcx, [r14 + 8]
lea r12, [r14 + 8]
cmp edx, ebx
jbe 0x1401f1e6b
mov ebx, edx
mov dword [rbp - 0x1c], edx
mov r15, rax
mov r12, rcx
mov ecx, ebx
call fcn.140203764
mov r13, rax
test rax, rax
je 0x1401f1f01
mov r8, qword [rbp + 0x40]
mov rcx, rax
mov r9d, dword [r15]
mov edx, dword [rbp - 0x1c]
mov r8, qword [r8]
call fcn.1401f4bf0
mov ecx, dword [r14 + 8]
lea rax, [rbp - 0x20]
mov r8d, dword [rbp - 0x1c]
xor r9d, r9d
mov dword [rsp + 0x48], 1
mov rdx, r13
mov qword [rsp + 0x40], rax
xor eax, eax
mov dword [rsp + 0x38], ecx
mov rcx, qword [r14]
mov qword [rsp + 0x30], rcx
mov rcx, qword [rbp - 0x18]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
call sub.bcrypt.dll_BCryptEncrypt
mov rcx, r13
mov ebx, eax
call fcn.140204100
test ebx, ebx
js 0x1401f1f06
mov esi, dword [rbp - 0x20]
cmp esi, dword [r12]
je 0x1401f1f06
mov rcx, qword [r14]
mov edx, esi
call fcn.140204114
test rax, rax
je 0x1401f1f06
mov qword [r14], rax
mov dword [r12], esi
jmp 0x1401f1f06
mov ebx, 0xc0000017
mov rcx, qword [rbp - 0x18]
call sub.bcrypt.dll_BCryptDestroyKey
mov rcx, rdi
call fcn.140204100
sar ebx, 0x1f
neg ebx
sbb eax, eax
jmp 0x1401f1f29
mov qword [rdi + 0x10], rsi
mov eax, 0xffffffff
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret