Function at 0x140012f50
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
mov byte [rsp + 0x20], r9b
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0x88
movzx ebx, r9b
mov rdi, r8
mov rsi, rdx
xor eax, eax
mov dword [rbp - 0xd], eax
mov qword [rbp - 9], rax
mov qword [rbp - 1], rax
mov dword [rbp - 0x19], eax
mov dword [rbp - 0x15], eax
mov r12d, eax
mov r15d, eax
mov rcx, rdx
call fcn.140014a30
mov dword [rbp - 0xd], 1
mov rcx, rdi
call fcn.140018540
mov dword [rbp - 0x11], eax
test bl, bl
je 0x140012fc7
lea r13d, [rax + 0x10]
mov rdi, qword [rbp + 0x77]
jmp 0x140012fca
mov r13d, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, r13d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r14, rax
mov rcx, rdi
call fcn.140018540
mov ebx, eax
mov rcx, rdi
call fcn.140006720
mov rdx, rax
mov r8d, ebx
mov rcx, r14
call fcn.140037860
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14003b790]
lea rcx, [rbp - 9]
call sub.bcrypt.dll_BCryptOpenAlgorithmProvider
test eax, eax
js 0x1400131af
xor edi, edi
mov dword [rsp + 0x28], edi
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 0x15]
lea rdx, str.ObjectLength
mov rcx, qword [rbp - 9]
call sub.bcrypt.dll_BCryptGetProperty
test eax, eax
js 0x1400131af
mov ebx, dword [rbp - 0x15]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r12, rax
test rax, rax
je 0x1400131af
mov dword [rsp + 0x20], edi
mov r9d, 0x20
lea r8, str.ChainingModeCBC
lea rdx, str.ChainingMode
mov rcx, qword [rbp - 9]
call sub.bcrypt.dll_BCryptSetProperty
test eax, eax
js 0x1400131af
mov rbx, qword [rbp + 0x67]
lea rcx, [rbx + 0x20]
call fcn.140018540
mov edi, eax
lea rcx, [rbx + 0x20]
call fcn.140006720
xor ebx, ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp - 0x15]
mov r8, r12
lea rdx, [rbp - 1]
mov rcx, qword [rbp - 9]
call sub.bcrypt.dll_BCryptGenerateSymmetricKey
test eax, eax
js 0x1400131af
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8d, 0x10
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15, rax
test rax, rax
je 0x1400131af
mov rdi, qword [rbp + 0x67]
movups xmm0, xmmword [rdi]
movups xmmword [rax], xmm0
lea rax, [rbp - 0x19]
xor r9d, r9d
mov r8d, dword [rbp - 0x11]
mov rdx, r14
mov rcx, qword [rbp - 1]
cmp byte [rbp + 0x7f], bl
je 0x14001312d
mov dword [rsp + 0x48], 1
jmp 0x140013131
mov dword [rsp + 0x48], ebx
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x10
mov qword [rsp + 0x20], r15
call sub.bcrypt.dll_BCryptEncrypt
test eax, eax
js 0x140013165
mov r8d, dword [rbp - 0x19]
mov rdx, r14
mov rcx, rsi
call fcn.140018d00
mov rcx, rsi
call fcn.140018540
cmp eax, 0x10
jb 0x1400131af
mov rcx, rsi
call fcn.140018540
mov ebx, eax
mov rcx, rsi
call fcn.140018540
lea r8d, [rax - 0x10]
mov r9d, ebx
lea rdx, [rbp + 7]
mov rcx, rsi
call fcn.140018d90
nop
mov rcx, rax
call fcn.140006720
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
lea rcx, [rbp + 7]
call fcn.140015200
test r14, r14
je 0x1400131c8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r15, r15
je 0x1400131e1
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, r15
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp - 1]
test rcx, rcx
je 0x1400131ef
call sub.bcrypt.dll_BCryptDestroyKey
test r12, r12
je 0x140013208
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x140013218
xor edx, edx
call sub.bcrypt.dll_BCryptCloseAlgorithmProvider
mov rax, rsi
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret