Function at 0x140092657
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push r15
mov rax, reloc.WS2_32.dll_inet_addr
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x140092674
sub rsp, 0x28
call fcn.14012b830
mov rcx, qword [rsp + 0xb0]
call fcn.1400bd588
mov rdx, qword [rsp + 0x90]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.14012b8a0
add rsp, 0x10
mov rdx, qword [rsp + 0x98]
lea rcx, [rsp + 0x30]
sub rsp, 0x10
call fcn.14012b8a0
add rsp, 0x10
mov dword [section..data], 0x1400071
mov dword [section..data], 0x1400073
push qword [rsp + 0xa0]
mov dword [section..data], 0x1400074
xor r15, r15
cmp r15, qword [rsp]
jne 0x14009270c
mov dword [section..data], 0x140007a
jmp 0x1400927b5
mov dword [section..data], 0x140007a
mov r15, 0x6801
cmp r15, qword [rsp]
jne 0x1400927b5
mov dword [section..data], 0x140007b
sub rsp, 8
mov rcx, qword [rsp + 0x38]
sub rsp, 0x20
call fcn.140127510
add rsp, 0x28
mov r15, rax
and r15, r15
jne 0x1400927ab
mov dword [section..data], 0x140007b
mov rcx, qword [rsp + 0xb8]
push rax
sub rsp, 8
call fcn.1400bd588
add rsp, 8
pop rax
movabs rcx, 0x140211776
push rcx
sub rsp, 0x20
call fcn.14012b4a0
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.14012b5d0
add rsp, 0x20
pop rax
push rax
call fcn.14012b6a0
pop rdx
add rax, rdx
add rsp, 8
jmp 0x140092c86
mov dword [section..data], 0x140007b
mov dword [section..data], 0x140007c
add rsp, 8
mov dword [section..data], 0x140007e
mov qword [rsp + 0x38], 0
mov dword [section..data], 0x140007e
mov qword [rsp + 0x40], 0
mov dword [section..data], 0x140007e
movabs rdx, 0x140207502
lea rcx, [rsp + 0x48]
call fcn.14012b3b0
mov dword [section..data], 0x1400080
call fcn.14004fc9f
and rax, rax
je 0x140092820
xor rax, rax
jmp 0x140092827
mov rax, 1
and rax, rax
je 0x14009286d
mov dword [section..data], 0x1400080
movabs rcx, 0x1402117b0
push rcx
sub rsp, 0x28
call fcn.14012b4a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14012b5d0
add rsp, 0x28
pop rax
push rax
call fcn.14012b6a0
pop rdx
add rax, rdx
jmp 0x140092c86
mov dword [section..data], 0x1400080
mov dword [section..data], 0x1400082
mov r15, qword [rsp + 0xa0]
and r15, r15
je 0x140092936
mov dword [section..data], 0x1400083
movabs r8, 0x8003
mov rdx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x30]
call fcn.14009d7c3
mov qword [rsp + 0x50], rax
mov dword [section..data], 0x1400084
mov r15, qword [rsp + 0x50]
cmp r15, 0xffffffffffffffff
jne 0x14009292c
mov dword [section..data], 0x1400085
movabs rdx, 0x1402117fc
lea rcx, [rsp + 0x48]
call fcn.14012b3b0
mov dword [section..data], 0x1400086
mov rcx, qword [rsp + 0x48]
push rcx
sub rsp, 0x28
call fcn.14012b4a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14012b5d0
add rsp, 0x28
pop rax
push rax
call fcn.14012b6a0
pop rdx
add rax, rdx
jmp 0x140092c86
mov dword [section..data], 0x1400087
mov dword [section..data], 0x1400088
mov dword [section..data], 0x140008a
movabs rcx, 0x1000
call fcn.140129ad0
mov qword [rsp + 0x58], rax
mov dword [section..data], 0x140008b
mov rcx, qword [rsp + 0x28]
call fcn.140129360
mov dword [rsp + 0x60], eax
mov dword [section..data], 0x140008c
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x58]
call fcn.14012a160
mov dword [section..data], 0x140008f
sub rsp, 8
push 0x1000
lea rax, [rsp + 0x70]
push rax
push qword [rsp + 0x70]
movabs r9, 0
mov r8, qword [rsp + 0xc8]
movabs rdx, 0
mov rcx, qword [rsp + 0x70]
sub rsp, 0x20
call sub.ADVAPI32.dll_CryptEncrypt
add rsp, 0x40
mov qword [rsp + 0x40], rax
mov dword [section..data], 0x1400090
mov r15, qword [rsp + 0x40]
and r15, r15
jne 0x140092a4d
mov dword [section..data], 0x1400091
movabs rdx, 0x140211866
lea rcx, [rsp + 0x48]
call fcn.14012b3b0
mov dword [section..data], 0x1400092
mov rcx, qword [rsp + 0x48]
push rcx
sub rsp, 0x28
call fcn.14012b4a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14012b5d0
add rsp, 0x28
pop rax
push rax
call fcn.14012b6a0
pop rdx
add rax, rdx
jmp 0x140092c86
mov dword [section..data], 0x1400093
mov dword [section..data], 0x140009b
movabs rdx, 0x140207502
lea rcx, [rsp + 0x68]
call fcn.14012b3b0
mov dword [section..data], 0x140009c
mov qword [rsp + 0x70], 0
jmp 0x140092a94
mov dword [section..data], 0x140009c
movsxd r15, dword [rsp + 0x60]
dec r15
cmp r15, qword [rsp + 0x70]
jl 0x140092baa
mov dword [section..data], 0x140009d
mov rcx, qword [rsp + 0x68]
push rcx
sub rsp, 0x28
call fcn.14012b4a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14012b5d0
add rsp, 0x28
push rcx
sub rsp, 0x20
call fcn.14012b4a0
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.14012b4a0
add rsp, 0x28
pop rcx
push rax
movabs rax, 0x14020811c
push rax
push 2
push rcx
sub rsp, 0x20
call fcn.14012b4a0
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.14012b4a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov r15, qword [rsp + 0x98]
add r15, qword [rsp + 0xb0]
mov rax, r15
mov rcx, rax
sub rsp, 0x20
call fcn.14012a140
add rsp, 0x28
mov r15, rax
and r15, 0xff
mov rax, r15
mov rcx, rax
pop rdx
sub rsp, 0x20
call fcn.140129190
add rsp, 0x20
push rax
call fcn.14012b6d0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140129450
add rsp, 0x20
pop rax
lea rcx, [rsp + 0x70]
pop rdx
call fcn.14012b4f0
mov dword [section..data], 0x140009e
inc qword [rsp + 0x70]
jno 0x140092a8a
mov dword [section..data], 0x140009f
mov rcx, qword [rsp + 0x68]
push rcx
sub rsp, 0x28
call fcn.14012b4a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14012b5d0
add rsp, 0x28
lea rcx, [rsp + 0x50]
pop rdx
call fcn.14012b4f0
mov dword [section..data], 0x14000a1
mov rcx, qword [rsp + 0x58]
call fcn.140129bb0
mov dword [section..data], 0x14000a3
mov r15, qword [rsp + 0xa0]
and r15, r15
je 0x140092c20
mov dword [section..data], 0x14000a3
mov rcx, qword [rsp + 0x50]
call fcn.140094edb
mov dword [section..data], 0x14000a3
mov dword [section..data], 0x14000a4
call fcn.14002d1a4
mov dword [section..data], 0x14000a6
mov rcx, qword [rsp + 0x48]
push rcx
sub rsp, 0x28
call fcn.14012b4a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14012b5d0
add rsp, 0x28
pop rax
push rax
call fcn.14012b6a0
pop rdx
add rax, rdx
jmp 0x140092c86
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.14012b910
add rsp, 0x28
mov rcx, qword [rsp + 0x50]
sub rsp, 0x28
call fcn.14012b910
add rsp, 0x28
mov rcx, qword [rsp + 0x38]
sub rsp, 0x28
call fcn.14012b910
add rsp, 0x28
mov rcx, qword [rsp + 0x70]
sub rsp, 0x28
call fcn.14012b910
add rsp, 0x28
pop rax
add rsp, 0x80
pop r15
ret