Function at 0x18001ec80
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push rbp
sub rsp, 0x120
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x58], r9
mov qword [rbp - 0x50], r8
mov qword [rbp - 0x48], rdx
mov qword [rbp - 0x40], rcx
mov rax, qword [rbp + 0xd0]
mov qword [rbp - 0x38], rax
mov rax, qword [0x1800760a8]
xor rax, rbp
mov qword [rbp + 0x98], rax
mov dword [rbp - 0x2c], 0x54624ff
mov eax, dword [rbp - 0x2c]
mov dword [rbp - 0x5c], eax
sub eax, 0x89ef25dc
je 0x18001f223
jmp 0x18001ecd9
mov eax, dword [rbp - 0x5c]
sub eax, 0x8de33e76
je 0x18001f514
jmp 0x18001ecec
mov eax, dword [rbp - 0x5c]
sub eax, 0x914ff444
je 0x18001f41c
jmp 0x18001ecff
mov eax, dword [rbp - 0x5c]
sub eax, 0x920fea0f
je 0x18001f172
jmp 0x18001ed12
mov eax, dword [rbp - 0x5c]
sub eax, 0x98bc9d19
je 0x18001f351
jmp 0x18001ed25
mov eax, dword [rbp - 0x5c]
sub eax, 0x9b99a46e
je 0x18001f39d
jmp 0x18001ed38
mov eax, dword [rbp - 0x5c]
sub eax, 0xa4bc91dd
je 0x18001f1de
jmp 0x18001ed4b
mov eax, dword [rbp - 0x5c]
sub eax, 0xa7f7be85
je 0x18001f191
jmp 0x18001ed5e
mov eax, dword [rbp - 0x5c]
sub eax, 0xa998c0a5
je 0x18001f379
jmp 0x18001ed71
mov eax, dword [rbp - 0x5c]
sub eax, 0xaaf5766d
je 0x18001f104
jmp 0x18001ed84
mov eax, dword [rbp - 0x5c]
sub eax, 0xacb03b0c
je 0x18001f1c0
jmp 0x18001ed97
mov eax, dword [rbp - 0x5c]
sub eax, 0xb81ba94b
je 0x18001f22f
jmp 0x18001edaa
mov eax, dword [rbp - 0x5c]
sub eax, 0xba180868
je 0x18001f149
jmp 0x18001edbd
mov eax, dword [rbp - 0x5c]
sub eax, 0xbad42ca0
je 0x18001f4d5
jmp 0x18001edd0
mov eax, dword [rbp - 0x5c]
sub eax, 0xbe543bc3
je 0x18001f2a7
jmp 0x18001ede3
mov eax, dword [rbp - 0x5c]
sub eax, 0xc4547dd0
je 0x18001f319
jmp 0x18001edf6
mov eax, dword [rbp - 0x5c]
sub eax, 0xcadc91a0
je 0x18001f084
jmp 0x18001ee09
mov eax, dword [rbp - 0x5c]
sub eax, 0xd52a92f9
je 0x18001f2cf
jmp 0x18001ee1c
mov eax, dword [rbp - 0x5c]
sub eax, 0xf0670850
je 0x18001f3dd
jmp 0x18001ee2f
mov eax, dword [rbp - 0x5c]
sub eax, 0xf0b1e38d
je 0x18001f28a
jmp 0x18001ee42
mov eax, dword [rbp - 0x5c]
sub eax, 0xf228d750
je 0x18001f254
jmp 0x18001ee55
mov eax, dword [rbp - 0x5c]
sub eax, 0xf407266d
je 0x18001f3fd
jmp 0x18001ee68
mov eax, dword [rbp - 0x5c]
sub eax, 0xfa82f473
je 0x18001f4eb
jmp 0x18001ee7b
mov eax, dword [rbp - 0x5c]
sub eax, 0x4a88459
je 0x18001f531
jmp 0x18001ee8e
mov eax, dword [rbp - 0x5c]
sub eax, 0x54624ff
je 0x18001efc3
jmp 0x18001eea1
mov eax, dword [rbp - 0x5c]
sub eax, 0x1918afe8
je 0x18001f3bf
jmp 0x18001eeb4
mov eax, dword [rbp - 0x5c]
sub eax, 0x3157e196
je 0x18001f1fb
jmp 0x18001eec7
mov eax, dword [rbp - 0x5c]
sub eax, 0x32c75d6d
je 0x18001f155
jmp 0x18001eeda
mov eax, dword [rbp - 0x5c]
sub eax, 0x3999f0d4
je 0x18001f2b9
jmp 0x18001eeed
mov eax, dword [rbp - 0x5c]
sub eax, 0x39fa658f
je 0x18001f133
jmp 0x18001ef00
mov eax, dword [rbp - 0x5c]
sub eax, 0x43ce625b
je 0x18001f0bb
jmp 0x18001ef13
mov eax, dword [rbp - 0x5c]
sub eax, 0x4f41a3df
je 0x18001f20d
jmp 0x18001ef26
mov eax, dword [rbp - 0x5c]
sub eax, 0x54742c81
je 0x18001f4c0
jmp 0x18001ef39
mov eax, dword [rbp - 0x5c]
sub eax, 0x56dcc236
je 0x18001f363
jmp 0x18001ef4c
mov eax, dword [rbp - 0x5c]
sub eax, 0x606ebc74
je 0x18001f508
jmp 0x18001ef5f
mov eax, dword [rbp - 0x5c]
sub eax, 0x70c87ede
je 0x18001f121
jmp 0x18001ef72
mov eax, dword [rbp - 0x5c]
sub eax, 0x7383ac34
je 0x18001f26f
jmp 0x18001ef85
mov eax, dword [rbp - 0x5c]
sub eax, 0x7d55edfc
je 0x18001f428
jmp 0x18001ef98
mov eax, dword [rbp - 0x5c]
sub eax, 0x7d68a9e1
je 0x18001f2e7
jmp 0x18001efab
mov eax, dword [rbp - 0x5c]
sub eax, 0x7eebef7f
je 0x18001f334
jmp 0x18001efbe
jmp 0x18001f556
mov rcx, qword [rbp - 0x58]
mov rdx, qword [rbp - 0x38]
mov eax, 0x10
mov qword [rbp - 0x68], rax
call fcn.18006c5e0
sub rsp, rax
mov rax, qword [rbp - 0x68]
mov r8, rsp
mov qword [rbp - 8], r8
call fcn.18006c5e0
sub rsp, rax
mov rax, qword [rbp - 0x68]
mov r8, rsp
mov qword [rbp], r8
call fcn.18006c5e0
sub rsp, rax
mov rax, qword [rbp - 0x68]
mov r8, rsp
mov qword [rbp + 8], r8
call fcn.18006c5e0
sub rsp, rax
mov rax, qword [rbp - 0x68]
mov r8, rsp
mov qword [rbp + 0x10], r8
call fcn.18006c5e0
sub rsp, rax
mov rax, qword [rbp - 0x68]
mov r8, rsp
mov qword [rbp + 0x18], r8
call fcn.18006c5e0
sub rsp, rax
mov rax, qword [rbp - 0x68]
mov r8, rsp
mov qword [rbp + 0x20], r8
call fcn.18006c5e0
sub rsp, rax
mov rax, qword [rbp - 0x68]
mov r8, rsp
mov qword [rbp + 0x28], r8
call fcn.18006c5e0
sub rsp, rax
mov rax, qword [rbp - 0x50]
mov r8, rsp
mov qword [rbp + 0x30], r8
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x28], rax
mov dword [rbp - 0x2c], 0xcadc91a0
jmp 0x18001f556
mov rcx, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x48]
mov rax, qword [rbp - 8]
mov qword [rax], rdx
mov rax, qword [rbp]
mov qword [rax], rcx
mov rax, qword [rbp]
mov rax, qword [rax]
mov qword [rbp + 0x38], rax
mov rax, qword [rbp + 8]
mov dword [rax], 0
mov dword [rbp - 0x2c], 0x43ce625b
jmp 0x18001f556
mov rcx, qword [rbp + 0x10]
mov edx, 0x18
mov r8d, 0xf0000000
sub rsp, 0x20
call fcn.180022000
add rsp, 0x20
mov rcx, qword [rbp + 0x10]
sub rsp, 0x20
call fcn.1800220d0
add rsp, 0x20
mov rdx, rax
mov eax, 0x32c75d6d
mov ecx, 0xaaf5766d
cmp rdx, 0
cmove eax, ecx
mov dword [rbp - 0x2c], eax
jmp 0x18001f556
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
mov dword [rbp + 0x44], eax
mov dword [rbp - 0x2c], 0x70c87ede
jmp 0x18001f556
mov eax, dword [rbp + 0x44]
mov dword [rbp - 0xc], eax
mov dword [rbp - 0x2c], 0x39fa658f
jmp 0x18001f556
mov rax, qword [rbp + 0x18]
mov dword [rax], 1
mov dword [rbp - 0x2c], 0xba180868
jmp 0x18001f556
mov dword [rbp - 0x2c], 0x8de33e76
jmp 0x18001f556
mov rcx, qword [rbp + 0x20]
sub rsp, 0x20
call fcn.180022e50
add rsp, 0x20
mov dword [rbp - 0x2c], 0x920fea0f
jmp 0x18001f556
mov rax, qword [rbp + 0x38]
mov eax, dword [rax + 8]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x38]
mov qword [rbp + 0x50], rax
mov dword [rbp - 0x2c], 0xa7f7be85
jmp 0x18001f556
mov rax, qword [rbp + 0x50]
mov r8, qword [rax]
mov rdx, qword [rbp + 0x10]
mov rcx, qword [rbp + 0x20]
mov r9, qword [rbp + 0x48]
sub rsp, 0x20
call fcn.180022ef0
add rsp, 0x20
mov dword [rbp + 0x5c], eax
mov dword [rbp - 0x2c], 0xacb03b0c
jmp 0x18001f556
mov r8d, dword [rbp + 0x5c]
xor edx, edx
mov eax, 0xb81ba94b
mov ecx, 0xa4bc91dd
cmp edx, r8d
cmovne eax, ecx
mov dword [rbp - 0x2c], eax
jmp 0x18001f556
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
mov dword [rbp + 0x60], eax
mov dword [rbp - 0x2c], 0x3157e196
jmp 0x18001f556
mov eax, dword [rbp + 0x60]
mov dword [rbp - 0xc], eax
mov dword [rbp - 0x2c], 0x4f41a3df
jmp 0x18001f556
mov rax, qword [rbp + 0x18]
mov dword [rax], 1
mov dword [rbp - 0x2c], 0x89ef25dc
jmp 0x18001f556
mov dword [rbp - 0x2c], 0xfa82f473
jmp 0x18001f556
mov rcx, qword [rbp + 0x20]
mov edx, 1
sub rsp, 0x20
call fcn.1800232d0
add rsp, 0x20
mov dword [rbp + 0x64], eax
mov dword [rbp - 0x2c], 0xf228d750
jmp 0x18001f556
mov ecx, dword [rbp + 0x64]
xor eax, eax
cmp eax, ecx
setne al
and al, 1
mov byte [rbp + 0x6b], al
mov dword [rbp - 0x2c], 0x7383ac34
jmp 0x18001f556
mov dl, byte [rbp + 0x6b]
mov eax, 0xd52a92f9
mov ecx, 0xf0b1e38d
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x2c], eax
jmp 0x18001f556
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
mov dword [rbp + 0x6c], eax
mov dword [rbp - 0x2c], 0xbe543bc3
jmp 0x18001f556
mov eax, dword [rbp + 0x6c]
mov dword [rbp - 0xc], eax
mov dword [rbp - 0x2c], 0x3999f0d4
jmp 0x18001f556
mov rax, qword [rbp + 0x18]
mov dword [rax], 1
mov dword [rbp - 0x2c], 0xfa82f473
jmp 0x18001f556
mov rax, qword [rbp + 0x38]
add rax, 0x10
mov qword [rbp + 0x70], rax
mov dword [rbp - 0x2c], 0x7d68a9e1
jmp 0x18001f556
mov rax, qword [rbp + 0x70]
mov rdx, qword [rax]
mov rcx, qword [rbp + 0x20]
sub rsp, 0x20
call fcn.1800233c0
add rsp, 0x20
mov ecx, eax
xor eax, eax
cmp eax, ecx
setne al
and al, 1
mov byte [rbp + 0x7b], al
mov dword [rbp - 0x2c], 0xc4547dd0
jmp 0x18001f556
mov dl, byte [rbp + 0x7b]
mov eax, 0xa998c0a5
mov ecx, 0x7eebef7f
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x2c], eax
jmp 0x18001f556
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
mov dword [rbp + 0x7c], eax
mov dword [rbp - 0x2c], 0x98bc9d19
jmp 0x18001f556
mov eax, dword [rbp + 0x7c]
mov dword [rbp - 0xc], eax
mov dword [rbp - 0x2c], 0x56dcc236
jmp 0x18001f556
mov rax, qword [rbp + 0x18]
mov dword [rax], 1
mov dword [rbp - 0x2c], 0xfa82f473
jmp 0x18001f556
mov rcx, qword [rbp + 0x20]
sub rsp, 0x20
call fcn.180023470
add rsp, 0x20
mov qword [rbp + 0x80], rax
mov dword [rbp - 0x2c], 0x9b99a46e
jmp 0x18001f556
mov rax, qword [rbp + 0x80]
cmp rax, 0
sete al
and al, 1
mov byte [rbp + 0x8f], al
mov dword [rbp - 0x2c], 0x1918afe8
jmp 0x18001f556
mov dl, byte [rbp + 0x8f]
mov eax, 0x7d55edfc
mov ecx, 0xf0670850
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x2c], eax
jmp 0x18001f556
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
mov dword [rbp + 0x90], eax
mov dword [rbp - 0x2c], 0xf407266d
jmp 0x18001f556
mov eax, dword [rbp + 0x90]
mov dword [rbp - 0xc], eax
mov rax, qword [rbp + 0x18]
mov dword [rax], 1
mov dword [rbp - 0x2c], 0x914ff444
jmp 0x18001f556
mov dword [rbp - 0x2c], 0xfa82f473
jmp 0x18001f556
mov rax, qword [rbp - 0x20]
mov ecx, eax
mov rax, qword [rbp + 0x28]
mov dword [rax], ecx
mov rax, qword [rbp - 0x28]
mov dword [rbp - 0x6c], eax
mov rax, qword [rbp - 8]
mov rax, qword [rax]
mov qword [rbp - 0x78], rax
mov rcx, qword [rbp + 0x20]
sub rsp, 0x20
call fcn.180023470
mov r11, qword [rbp - 0x78]
add rsp, 0x20
mov rcx, rax
mov eax, dword [rbp - 0x6c]
mov r10, qword [rbp + 0x28]
xor edx, edx
xor r9d, r9d
sub rsp, 0x40
mov r8d, r9d
mov qword [rsp + 0x20], r11
mov qword [rsp + 0x28], r10
mov dword [rsp + 0x30], eax
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
add rsp, 0x40
mov ecx, eax
mov rax, qword [rbp + 0x30]
mov dword [rax], ecx
mov rax, qword [rbp + 0x28]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [rbp - 0x18]
mov qword [rax], rcx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
mov dword [rbp + 0x94], eax
mov dword [rbp - 0x2c], 0x54742c81
jmp 0x18001f556
mov eax, dword [rbp + 0x94]
mov dword [rbp - 0xc], eax
mov dword [rbp - 0x2c], 0xbad42ca0
jmp 0x18001f556
mov rax, qword [rbp + 0x18]
mov dword [rax], 1
mov dword [rbp - 0x2c], 0xfa82f473
jmp 0x18001f556
mov rcx, qword [rbp + 0x20]
sub rsp, 0x20
call fcn.180023510
add rsp, 0x20
mov dword [rbp - 0x2c], 0x606ebc74
jmp 0x18001f556
mov dword [rbp - 0x2c], 0x8de33e76
jmp 0x18001f556
mov rcx, qword [rbp + 0x10]
sub rsp, 0x20
call fcn.180022db0
add rsp, 0x20
mov dword [rbp - 0x2c], 0x4a88459
jmp 0x18001f556
mov eax, dword [rbp - 0xc]
mov dword [rbp - 0x7c], eax
mov rcx, qword [rbp + 0x98]
xor rcx, rbp
sub rsp, 0x20
call fcn.18006c560
mov eax, dword [rbp - 0x7c]
lea rsp, [rbp + 0xa0]
pop rbp
ret
jmp 0x18001ecc3