Function at 0xbef09040
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xe0
mov esi, r8d
mov dword [rsp + 0x20], 0xf0000040
mov r15, rdx
mov r14, rcx
xor r8d, r8d
lea rcx, [0xbef133b0]
xor edx, edx
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov rbx, qword [0xbef133b0]
xor edi, edi
test rbx, rbx
jne 0xbef0909e
xor eax, eax
jmp 0xbef09290
xorps xmm0, xmm0
mov dword [rbp - 0x49], 0x208
lea rcx, [rbp - 0x29]
mov dword [rbp - 0x45], 0x660e
movups xmmword [rbp - 0x3d], xmm0
mov dword [rbp - 0x41], setsockopt
call qword [0xbef0e560]
mov r8d, esi
lea rcx, [rbp - 0x29]
mov rdx, r15
call qword [0xbef0e538]
lea rcx, [rbp - 0x29]
call qword [0xbef0e498]
mov r8d, setsockopt
lea rdx, [rbp + 0x2f]
lea rcx, [rbp - 0x3d]
call qword [sym.imp.KERNEL32.dll_RtlMoveMemory]
lea rax, [rbp - 0x51]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x49]
mov r8d, 0x1c
mov dword [rsp + 0x20], edi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0xbef0928d
mov qword [rsp + 0x38], rdi
mov r9d, 0xffffffff
mov qword [rsp + 0x30], rdi
mov r8, r14
mov dword [rsp + 0x28], edi
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
mov dword [rbp + 0x7f], ebx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0xbef09283
mov edx, dword [rbp + 0x7f]
mov r9d, 0xffffffff
mov qword [rsp + 0x38], rdi
mov r8, r14
mov qword [rsp + 0x30], rdi
mov ecx, 0xfde9
mov dword [rsp + 0x28], edx
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [rbp + 0x7f], eax
mov dword [rbp - 0x59], eax
lea ebx, [rax + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r8d, dword [rbp - 0x59]
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_RtlMoveMemory]
mov ecx, dword [rbp - 0x59]
lea rax, [rbp - 0x59]
add ecx, 0x20
xor r9d, r9d
mov dword [rsp + 0x30], ecx
xor edx, edx
mov rcx, qword [rbp - 0x51]
mov r8d, 1
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0xbef0925b
mov edx, dword [rbp - 0x59]
lea rax, [rbp + 0x7f]
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov r8d, 0x40000001
mov dword [rbp + 0x7f], edi
mov rcx, rbx
call qword [0xbef0e508]
mov eax, dword [rbp + 0x7f]
test eax, eax
je 0xbef0925b
mov rcx, qword [0xbef0e4e0]
mov r8d, eax
add r8, r8
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0xbef0925b
mov edx, dword [rbp - 0x59]
lea rax, [rbp + 0x7f]
mov r9, rdi
mov qword [rsp + 0x20], rax
mov r8d, 0x40000001
mov rcx, rbx
call qword [0xbef0e508]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rax, rdi
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret