Function at 0x1400f07ec
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
mov r10d, dword [rcx]
test r10d, r10d
je 0x140046af4
dec r10d
je 0x140046aee
dec r10d
je 0x140046ae5
dec r10d
je 0x140046adc
dec r10d
je 0x140046ad0
dec r10d
je 0x140046ac4
xor al, al
ret
add rcx, 0x128
jmp 0x1400f0dac
add rcx, 0x13c
jmp 0x1400f0ab4
add rcx, 0xe0
jmp 0x140046af8
add rcx, 0x98
jmp 0x140046af8
add rcx, 0x50
jmp 0x140046af8
add rcx, 8
jmp 0x1400f07ec
push rbx
sub rsp, 0x50
xor ebx, ebx
mov r11, rdx
mov r10, rcx
mov eax, ebx
cmp byte [rcx + 0x40], bl
je 0x1400f080e
cmp byte [rsp + 0x88], bl
lea ecx, [rbx + 1]
cmovne eax, ecx
mov edx, dword [r10 + 0x28]
mov rcx, qword [r10 + 0x38]
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r8d
mov qword [rsp + 0x30], r9
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rcx
mov rcx, qword [r10 + 0x10]
xor r9d, r9d
mov rdx, r11
call qword [sym.imp.bcrypt.dll_BCryptDecrypt]
test eax, eax
setns al
add rsp, 0x50
pop rbx
ret
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
push r15
mov rax, qword [rsp + 0x48]
mov rdi, rdx
xor edx, edx
mov dword [rax], r8d
movsxd r15, dword [rcx + 0x400]
movzx esi, byte [rdi]
mov ebp, r8d
lea eax, [rdx + 0x34]
mov r13d, 0x9e3779b9
div rbp
mov r14, rcx
lea r12, [rbp - 1]
lea r11, [rax + 6]
imul r11, r13
mov r10, r11
mov rbx, r12
shr r10, 2
and r10, r15
test r12, r12
je 0x1400f0b70
movzx r9d, byte [rbx + rdi - 1]
mov rax, rsi
shr rax, 3
mov dl, r9b
mov ecx, r9d
shr rcx, 5
shl dl, 4
xor dl, al
mov al, sil
shl al, 2
xor cl, al
mov rax, rbx
and eax, 3
add dl, cl
xor rax, r10
movzx r8d, dl
mov cl, byte [rax + r14]
mov al, r11b
xor al, sil
xor cl, r9b
add cl, al
movzx eax, cl
xor r8d, eax
movzx eax, byte [rbx + rdi]
sub eax, r8d
mov byte [rbx + rdi], al
movzx esi, al
dec rbx
jne 0x1400f0b16
movzx r9d, byte [rdi + rbp - 1]
mov rax, rsi
and ebx, 3
shr rax, 3
xor rbx, r10
mov dl, r9b
shl dl, 4
mov ecx, r9d
xor dl, al
shr rcx, 5
mov al, sil
shl al, 2
xor cl, al
add dl, cl
mov cl, r11b
xor cl, sil
movzx r8d, dl
mov dl, byte [rbx + r14]
xor dl, r9b
add dl, cl
movzx ecx, dl
xor r8d, ecx
movzx ecx, byte [rdi]
sub ecx, r8d
mov byte [rdi], cl
movzx esi, cl
sub r11, r13
jne 0x1400f0b04
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov al, 1
pop r15
pop r14
pop r13
pop r12
ret
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r13
mov al, byte [rcx + 0x10]
mov rbx, rcx
mov rdi, rdx
mov byte [r9], al
mov ecx, dword [rcx + 0xc]
mov r11, rdx
xor edx, edx
mov esi, r8d
mov r10, r9
lea r13, [0x140133d80]
test ecx, ecx
je 0x1400f0e00
dec ecx
je 0x1400f0e34
dec ecx
je 0x1400f0e75
dec ecx
je 0x1400f0eb2
mov r10d, edx
jmp 0x1400f0f17
mov rax, rsi
lea r8, [rsi + rdi]
cmp r11, r8
je 0x1400f0f0b
mov al, byte [r11]
sub al, 0x2b
cmp al, 0x50
ja 0x1400f0e24
movsx rax, al
movsx ecx, byte [rax + r13]
jmp 0x1400f0e27
or ecx, 0xffffffff
inc r11
test cl, cl
js 0x1400f0e07
shl cl, 2
mov byte [r10], cl
mov rax, rsi
lea r8, [rsi + rdi]
cmp r11, r8
je 0x1400f0f02
mov al, byte [r11]
sub al, 0x2b
cmp al, 0x50
ja 0x1400f0e58
movsx rax, al
movsx ecx, byte [rax + r13]
jmp 0x1400f0e5b
or ecx, 0xffffffff
inc r11
test cl, cl
js 0x1400f0e3b
mov al, cl
sar al, 4
and al, 3
or byte [r10], al
inc r10
shl cl, 4
mov byte [r10], cl
mov rax, rsi
lea r8, [rsi + rdi]
cmp r11, r8
je 0x1400f0ef9
mov al, byte [r11]
sub al, 0x2b
cmp al, 0x50
ja 0x1400f0e95
movsx rax, al
movsx ecx, byte [rax + r13]
jmp 0x1400f0e98
or ecx, 0xffffffff
inc r11
test cl, cl
js 0x1400f0e7c
mov al, cl
sar al, 2
and al, 0xf
or byte [r10], al
inc r10
shl cl, 6
mov byte [r10], cl
mov rax, rsi
lea r8, [rsi + rdi]
cmp r11, r8
je 0x1400f0eea
mov al, byte [r11]
sub al, 0x2b
cmp al, 0x50
ja 0x1400f0ed2
movsx rax, al
movsx ecx, byte [rax + r13]
jmp 0x1400f0ed5
or ecx, 0xffffffff
inc r11
test cl, cl
js 0x1400f0eb9
and cl, 0x3f
or byte [r10], cl
inc r10
jmp 0x1400f0e00
mov dword [rbx + 0xc], 3
mov al, byte [r10]
mov byte [rbx + 0x10], al
jmp 0x1400f0f14
mov dword [rbx + 0xc], 2
jmp 0x1400f0ef1
mov dword [rbx + 0xc], 1
jmp 0x1400f0ef1
mov dword [rbx + 0xc], edx
mov cl, byte [r10]
mov byte [rbx + 0x10], cl
sub r10d, r9d
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov r13, qword [rsp + 0x20]
test r10d, r10d
mov dword [rcx], r10d
setne al
ret