Function at 0x140002980
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
mov r11, rsp
push rbp
push rsi
lea rbp, [r11 - 0x18]
sub rsp, 0x108
mov rax, qword [0x140093010]
xor rax, rsp
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x70], r8
mov rax, r9
mov qword [rbp - 0x80], rax
mov rsi, rcx
mov dword [rsp + 0x70], edx
test r8, r8
je 0x140002ded
test rax, rax
je 0x140002ded
movzx eax, byte [rcx]
mov byte [rbp - 0x50], al
movzx eax, byte [rcx + 1]
mov byte [rbp - 0x4c], al
movzx eax, byte [rcx + 2]
mov byte [rbp - 0x4f], al
movzx eax, byte [rcx + 3]
mov byte [rbp - 0x4b], al
movzx eax, byte [rcx + 4]
mov qword [r11 - 0x18], rbx
mov qword [r11 - 0x20], rdi
xor edi, edi
mov byte [rbp - 0x4e], al
movzx eax, byte [rcx + 5]
mov byte [rbp - 0x4a], al
movzx eax, byte [rcx + 6]
lea ebx, [rdi + 8]
mov qword [r11 - 0x28], r12
mov r12d, edi
mov qword [r11 - 0x30], r13
mov byte [rbp - 0x4d], al
movzx eax, byte [rcx + 7]
mov byte [rbp - 0x49], al
mov eax, dword [rbp - 0x50]
mov r13d, dword [rbp - 0x4c]
mov qword [r11 - 0x38], r14
mov r14d, edi
mov qword [r11 - 0x40], r15
mov r15d, edi
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], rdi
mov dword [rbp - 0x64], edi
mov dword [rbp - 0x48], edi
mov dword [rbp - 0x68], edi
test eax, eax
je 0x140002d9b
test r13d, r13d
je 0x140002d9b
mov ecx, eax
mov qword [rbp - 0x78], rax
call fcn.14001f888
mov ecx, r13d
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x78], r13
call fcn.14001f888
mov r13, rax
cmp qword [rsp + 0x68], rdi
je 0x140002dcf
test rax, rax
je 0x140002dcf
mov r12, qword [rsp + 0x68]
xor edx, edx
mov r8, qword [rbp - 0x78]
mov rcx, r12
call fcn.140043ce0
mov r8, qword [rsp + 0x78]
xor edx, edx
mov rcx, r13
call fcn.140043ce0
mov r10d, dword [rbp - 0x4c]
mov edx, r10d
mov r11d, dword [rbp - 0x50]
cmp r11d, r10d
cmovb edx, r11d
test edx, edx
je 0x140002ae7
nop dword [rax]
nop dword [rax + rax]
mov eax, ebx
inc ebx
mov ecx, r15d
inc r15d
movzx eax, byte [rax + rsi]
mov byte [rcx + r12], al
movzx eax, byte [rbx + rsi]
inc ebx
mov ecx, r14d
inc r14d
mov byte [rcx + r13], al
cmp r14d, edx
jb 0x140002ac0
cmp r11d, r10d
jbe 0x140002afa
mov edx, r11d
mov ecx, r15d
sub edx, r15d
add rcx, r12
jmp 0x140002b08
jae 0x140002b1b
mov edx, r10d
mov ecx, r14d
sub edx, r14d
add rcx, r13
mov r9d, dword [rsp + 0x70]
mov r8d, ebx
sub r9d, ebx
add r8, rsi
call fcn.1400022e0
mov rsi, qword [rbp - 0x78]
mov rcx, rsi
call fcn.14001f888
mov rbx, qword [rsp + 0x68]
mov r12, rax
test rax, rax
je 0x140002dd4
mov r9, rsi
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call fcn.1400022e0
xor r9d, r9d
lea rdx, [0x140080500]
xor r8d, r8d
lea rcx, [rbp - 0x60]
call qword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
test eax, eax
js 0x140002dd4
mov rcx, qword [rbp - 0x60]
lea rax, [rbp - 0x48]
mov dword [rsp + 0x28], edi
lea r8, [rbp - 0x64]
mov r9d, 4
mov qword [rsp + 0x20], rax
lea rdx, str.ObjectLength
call qword [sym.imp.bcrypt.dll_BCryptGetProperty]
test eax, eax
js 0x140002dd4
mov eax, dword [rbp - 0x64]
test eax, eax
je 0x140002dd4
mov ecx, eax
call fcn.14001f888
mov qword [rsp + 0x58], rax
mov r15, rax
test rax, rax
je 0x140002de2
mov rcx, qword [rbp - 0x60]
lea rax, [rbp - 0x48]
mov dword [rsp + 0x28], edi
lea r8, [rbp - 0x68]
mov r9d, 4
mov qword [rsp + 0x20], rax
lea rdx, str.BlockLength
call qword [sym.imp.bcrypt.dll_BCryptGetProperty]
test eax, eax
js 0x140002de2
mov ecx, dword [rbp - 0x68]
lea eax, [rcx - 1]
cmp eax, 0xf
ja 0x140002de2
call fcn.14001f888
mov rsi, rax
test rax, rax
je 0x140002de5
mov r8d, dword [rbp - 0x68]
test r8, r8
je 0x140002c23
lea rdx, [0x1400805a0]
mov rcx, rax
call fcn.140043f90
mov eax, dword [rbp - 0x50]
lea r9, [rbp - 0x58]
mov rcx, qword [rbp - 0x60]
lea r8, str.OpaqueKeyBlob
mov dword [rsp + 0x40], edi
xor edx, edx
mov dword [rsp + 0x38], eax
mov eax, dword [rbp - 0x64]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r15
call qword [sym.imp.bcrypt.dll_BCryptImportKey]
test eax, eax
js 0x140002de5
mov rcx, qword [rsp + 0x78]
call fcn.14001f888
mov r14, rax
test rax, rax
je 0x140002d2d
mov r9, qword [rsp + 0x78]
mov r8, r13
mov rdx, r9
mov rcx, rax
call fcn.1400022e0
mov r15d, dword [rbp - 0x4c]
mov eax, 1
mov rcx, qword [rbp - 0x58]
xor r9d, r9d
mov dword [rsp + 0x48], eax
mov r8d, r15d
mov rax, qword [rbp - 0x80]
mov rdx, r14
mov qword [rsp + 0x40], rax
mov eax, dword [rbp - 0x68]
mov dword [rsp + 0x38], edi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.bcrypt.dll_BCryptDecrypt]
test eax, eax
js 0x140002d28
mov rax, qword [rbp - 0x80]
mov ecx, dword [rax]
call fcn.14001f888
mov rcx, rax
mov rax, qword [rbp - 0x70]
mov qword [rax], rcx
test rcx, rcx
je 0x140002d28
mov rax, qword [rbp - 0x80]
xor r9d, r9d
mov dword [rsp + 0x48], 1
mov r8d, r15d
mov qword [rsp + 0x40], rax
mov rdx, r14
mov eax, dword [rax]
mov dword [rsp + 0x38], eax
mov eax, dword [rbp - 0x68]
mov qword [rsp + 0x30], rcx
mov rcx, qword [rbp - 0x58]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.bcrypt.dll_BCryptDecrypt]
test eax, eax
mov eax, 1
cmovns edi, eax
mov r15, qword [rsp + 0x58]
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x140002d3c
call qword [sym.imp.bcrypt.dll_BCryptDestroyKey]
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x140002d4d
xor edx, edx
call qword [sym.imp.bcrypt.dll_BCryptCloseAlgorithmProvider]
test rbx, rbx
je 0x140002d5a
mov rcx, rbx
call fcn.14001f854
test r13, r13
je 0x140002d67
mov rcx, r13
call fcn.14001f854
test r12, r12
je 0x140002d74
mov rcx, r12
call fcn.14001f854
test r15, r15
je 0x140002d81
mov rcx, r15
call fcn.14001f854
test rsi, rsi
je 0x140002d8e
mov rcx, rsi
call fcn.14001f854
test r14, r14
je 0x140002d9b
mov rcx, r14
call fcn.14001f854
mov r15, qword [rsp + 0xd8]
mov eax, edi
mov rdi, qword [rsp + 0xf8]
mov r14, qword [rsp + 0xe0]
mov r13, qword [rsp + 0xe8]
mov r12, qword [rsp + 0xf0]
mov rbx, qword [rsp + 0x100]
jmp 0x140002def
mov rbx, qword [rsp + 0x68]
mov rsi, rdi
mov r14, rdi
mov r15, rdi
jmp 0x140002d2d
mov rsi, rdi
mov r14, rdi
jmp 0x140002d2d
xor eax, eax
mov rcx, qword [rbp - 0x40]
xor rcx, rsp
call fcn.14001f4e0
add rsp, 0x108
pop rsi
pop rbp
ret