Function at 0x180025990
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 0x18], rbx
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
lea ebx, [rdx - 0x12]
mov dword [rsp + 0x44], edx
xor r14d, r14d
mov dword [rsp + 0x40], ebx
mov rdi, r8
mov r13, r9
mov r8, rcx
cmp edx, ebx
jbe 0x180025cb4
mov r12, qword [rsp + 0x58]
lea esi, [rdx - 0xed]
mov ebx, dword [rbp + 0x108]
lea r9, [0x180000000]
mov r15d, dword [rbp + 0x108]
lea r10d, [r14 + 0x69]
mov eax, dword [rsp + 0x40]
lea r11d, [r14 + 0x44]
mov dword [rsp + 0x70], esi
cmp esi, 0x36
ja case.default.0x180025a23
movzx eax, byte [r9 + rsi + 0x26048]
mov ecx, dword [r9 + rax*4 + 0x25ffc]
add rcx, r9
jmp rcx
mov byte [rsp + 0x48], 0
jmp case.0x180025a23.18
mov r9, r8
lea rcx, [rbp - 0x38]
mov r8d, 0xe4
xor edx, edx
call fcn.180024590
mov r8, qword [rbp + 0x100]
mov qword [rsp + 0x50], r8
mov edx, dword [rsp + 0x44]
lea r9, [0x180000000]
mov r10d, 0x69
lea r11d, [r10 - 0x25]
jmp case.0x180025a23.18
cmp qword [rdi], 0
mov r12, r8
je 0x180025ae6
nop dword [rax]
nop word [rax + rax]
mov r8d, 0x111
nop word [rax + rax]
mov rax, qword [rdi]
cmp r8d, 0x111
jne 0x180025ac4
movsxd rcx, dword [r13]
xor edx, edx
div rcx
movzx eax, byte [rdx + r9 + 0x61670]
xor edx, edx
mov byte [r12], al
inc r12
movsxd rcx, dword [r13]
mov rax, qword [rdi]
div rcx
mov qword [rdi], rax
add r8d, 0x52
cmp r8d, 0x163
jb 0x180025a90
test rax, rax
jne 0x180025a80
mov edx, dword [rsp + 0x44]
mov r8, qword [rbp + 0x100]
jmp case.0x180025a23.18
mov byte [r8], 0x30
lea r12, [r8 + 1]
jmp case.0x180025a23.18
mov byte [rsp + 0x4f], 0
jmp case.0x180025a23.18
mov r8d, 3
mov byte [rsp + 0x4c], 0
lea rdx, [0x1800624c8]
lea rcx, [rsp + 0x4c]
call fcn.1800474e0
mov r8, qword [rbp + 0x100]
jmp 0x180025a4f
mov word [rbp - 0x6e], r10w
jmp case.0x180025a23.18
mov eax, 0x64
mov word [rbp - 0x78], ax
jmp case.0x180025a23.18
mov r8d, 2
mov word [rbp - 0x72], r14w
lea rdx, [0x18006250c]
lea rcx, [rbp - 0x72]
call fcn.180047124
mov r8, qword [rbp + 0x100]
jmp 0x180025a4f
mov ecx, 0x63
nop dword [rax]
mov eax, ecx
sub eax, 0x63
je 0x180025b82
cmp eax, 1
je case.0x180025a23.14
jmp 0x180025b86
mov dword [rsp + 0x50], ebx
inc ecx
cmp ecx, 0x65
jb 0x180025b70
mov dword [rbp - 0x76], 0x73006e
jmp case.0x180025a23.18
mov r14, r8
test r15d, r15d
je 0x180025c93
nop word [rax + rax]
mov esi, 0x95
nop word [rax + rax]
mov eax, esi
sub eax, 0x95
je 0x180025c56
sub eax, 1
je 0x180025c4d
sub eax, 1
je 0x180025c01
sub eax, 1
je 0x180025beb
cmp eax, 1
jne 0x180025c5e
mov eax, ebx
add r14, rax
sub r15d, ebx
jmp 0x180025c5e
lea rcx, [rdi + 0x44]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x133
call fcn.18003ddf0
jmp 0x180025c5e
mov rcx, qword [rdi + 0x20]
lea rax, [rbp - 0x80]
mov dword [rsp + 0x30], 0x10
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rbp - 0x48]
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov r9, r14
mov dword [rsp + 0x78], r15d
lea r8, [rbp - 0x48]
mov ecx, 0xf7
lea rdx, [rsp + 0x78]
call fcn.180034680
mov rbx, rax
jmp 0x180025c5e
mov dword [rbp - 0x80], 0x10
jmp 0x180025c5e
movups xmm0, xmmword [rdi + 0x44]
movups xmmword [rbp - 0x48], xmm0
inc esi
cmp esi, 0x9a
jb 0x180025bc0
test r15d, r15d
jne 0x180025bb0
mov esi, dword [rsp + 0x70]
lea r9, [0x180000000]
mov edx, dword [rsp + 0x44]
lea r10d, [r15 + 0x69]
mov r8, qword [rbp + 0x100]
lea r11d, [r15 + 0x44]
xor r14d, r14d
mov eax, dword [rsp + 0x40]
dec edx
dec esi
mov dword [rsp + 0x44], edx
mov dword [rsp + 0x70], esi
cmp edx, eax
ja 0x180025a06
mov edx, dword [rbp + 0x108]
lea r14d, [rdx + 0x4fe]
cmp edx, r14d
jae case.0x180025a23.14
mov rbx, qword [rsp + 0x58]
mov ecx, 0x6e
mov r12, qword [rsp + 0x58]
mov esi, dword [rbp + 0x108]
mov r15, qword [rsp + 0x58]
lea eax, [rcx - 2]
lea r9d, [rcx - 0xf]
lea r10d, [rcx - 0x1d]
lea r11d, [rcx + 7]
nop dword [rax]
cmp edx, 0x37e
ja 0x180025e75
je 0x180025e69
cmp edx, 0x21b
ja 0x180025e1b
je 0x180025dff
mov eax, edx
sub eax, 0xff
je 0x180025deb
sub eax, 0x47
je 0x180025dda
sub eax, 0x47
je 0x180025dcd
cmp eax, 0x47
mov eax, 0x6c
jne 0x180025f92
mov word [rsp + 0x68], r9w
jmp 0x180025f92
mov r8d, 4
mov word [rbp - 0x6c], r14w
lea rdx, [0x18006259c]
lea rcx, [rbp - 0x6c]
call fcn.180047124
mov r8, qword [rbp + 0x100]
jmp 0x180025a4f
mov word [rbp - 0x64], r14w
mov word [rsp + 0x60], r11w
jmp case.0x180025a23.18
mov byte [r12], 0
jmp case.0x180025a23.18
mov r15d, dword [r13]
jmp case.0x180025a23.18
mov r8d, 3
lea rdx, [0x1800625b1]
lea rcx, [rsp + 0x48]
call fcn.180047330
mov r8, qword [rbp + 0x100]
mov byte [rsp + 0x4b], 0x46
jmp 0x180025a4f
mov eax, dword [rdi]
bswap eax
mov dword [rsp + 0x50], eax
jmp case.0x180025a23.14
mov dword [rsp + 0x65], 0x797265
jmp 0x180025f8d
mov word [rsp + 0x63], r10w
mov word [rsp + 0x64], r11w
jmp 0x180025f8d
mov eax, 0x73
mov word [rsp + 0x61], cx
mov word [rsp + 0x62], ax
jmp 0x180025f8d
mov r8d, 0x41
mov word [rsp + 0x69], r8w
mov r8d, 0x64
mov word [rbp - 0x60], r8w
jmp 0x180025f92
mov eax, edx
sub eax, 0x262
je 0x180025e60
sub eax, 0x47
je 0x180025e54
sub eax, 0x47
je 0x180025e48
cmp eax, 0x47
mov eax, 0x6c
jne 0x180025f92
mov dword [rbp - 0x54], 0x64002e
jmp 0x180025f92
mov dword [rbp - 0x58], 0x690070
jmp 0x180025f8d
mov dword [rbp - 0x5c], 0x610073
jmp 0x180025f8d
mov word [rbp - 0x5e], cx
jmp 0x180025f8d
mov dword [rbp - 0x50], 0x6c006c
jmp 0x180025f92
cmp edx, 0x4e1
ja 0x180025fcb
je 0x180025f69
mov eax, edx
sub eax, 0x3c5
je 0x180025f61
sub eax, 0x47
je 0x180025f29
sub eax, 0x47
je 0x180025ee3
cmp eax, 0x47
jne 0x180025f8d
test esi, esi
je 0x180025ed9
mov eax, 0xed
cmp eax, 0xed
je 0x180025ec8
cmp eax, 0xae0c
je case.0x180025a23.14
jmp 0x180025ecd
mov byte [rsp + 0x50], 0
add eax, 0xad1f
cmp eax, 0x15a3e
jbe 0x180025eb4
mov rbx, qword [rsp + 0x58]
jmp 0x180025f8d
xor eax, eax
mov dword [r13], 0xffffffff
mov qword [rsp + 0x28], rax
mov edx, 1
lea rax, [rsp + 0x58]
mov r9, r8
mov rcx, rdi
mov qword [rsp + 0x20], rax
lea r8d, [rdx + 0x67]
call r12
mov esi, eax
mov edx, dword [rbp + 0x108]
mov ecx, 0x6e
lea r9d, [rcx - 0xf]
lea r10d, [rcx - 0x1d]
lea r11d, [rcx + 7]
jmp 0x180025f8d
lea r9, [rbp - 0x78]
mov r8d, 0xf5
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x18]
call fcn.180024590
lea r9, [rbp - 0x60]
mov r8d, 0xf5
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x68]
mov r15, qword [rax]
call fcn.180024590
mov r12, qword [rax]
jmp 0x180025f10
xor eax, eax
mov word [rbp - 0x4c], ax
jmp 0x180025f8d
test rbx, rbx
je 0x180025f92
nop
cmp word [rbx + 0x10], 1
je 0x180025f81
mov rbx, qword [rbx]
test rbx, rbx
jne 0x180025f70
jmp 0x180025f92
mov eax, dword [rbx + 0x20]
mov dword [r13], eax
mov edx, 0x528
mov eax, 0x6c
mov r8, qword [rbp + 0x100]
add edx, 0x47
mov dword [rbp + 0x108], edx
cmp edx, r14d
jb 0x180025cf0
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x210]
add rsp, 0x1c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, edx
sub eax, 0x528
je 0x180025f88
sub eax, 0x47
je 0x180025fe0
cmp eax, 0x47
je case.0x180025a23.14
jmp 0x180025f8d
mov rcx, qword [rsp + 0x58]
mov edx, 1
call r15
cmp dword [r13], 0xffffffff
setne byte [rsp + 0x50]
jmp 0x180025f10