Function at 0x140006580
Capabilities:
Create new key via cryptacquirecontext
Delete file
Encrypt or decrypt via wincrypt
Read file on windows
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x888
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x7f0], xmm6
mov qword [rbp + 0x7e8], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
call fcn.140016430
test al, al
je 0x1400072fb
lea rcx, [rbp - 0x48]
mov rdx, rdi
mov r8, rsi
call fcn.140001010
mov esi, dword [rbp - 0x38]
mov rdi, qword [rbp - 0x48]
cmp esi, 2
je 0x1400072fd
mov rbx, qword [rbp - 0x40]
lea rdx, [rbp - 0x34]
lea rcx, [rbp + 0x234]
mov r8d, 0x254
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp + 0x220], rdi
mov qword [rbp + 0x228], rbx
mov dword [rbp + 0x230], esi
lea r14, [rbp + 0x4bc]
lea rsi, [rbp + 0x7a0]
xor eax, eax
mov qword [rbp + 0x758], rax
xorps xmm6, xmm6
nop word [rax + rax]
lea rcx, [rbp - 0x48]
lea rdx, [rbp + 0x220]
call fcn.1400155d0
cmp qword [rbp - 0x48], 0
je 0x1400072d5
mov r15, qword [rbp - 0x40]
mov rdi, qword [rbp - 0x38]
test r15, r15
je 0x140007354
mov r8d, 0x248
lea rcx, [rbp + 0x498]
lea rdx, [rbp - 0x30]
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp + 0x488], r15
mov qword [rbp + 0x490], rdi
mov rbx, qword [r15 + 0x18]
mov rdi, qword [r15 + 0x20]
mov ecx, 0x104
mov rax, r14
cmp word [rax], 0
je 0x140006770
cmp word [rax + 2], 0
je 0x140006739
cmp word [rax + 4], 0
je 0x14000673f
cmp word [rax + 6], 0
je 0x140006745
cmp word [rax + 8], 0
je 0x14000674b
cmp word [rax + 0xa], 0
je 0x140006751
cmp word [rax + 0xc], 0
je 0x140006757
cmp word [rax + 0xe], 0
je 0x14000675d
add rcx, 0xfffffffffffffff8
add rax, 0x10
cmp rcx, 7
ja 0x140006690
cmp word [rbp + 0x6bc], 0
lea rax, [rbp + 0x6bc]
je 0x140006770
cmp word [rbp + 0x6be], 0
lea rax, [rbp + 0x6be]
je 0x140006770
cmp word [rbp + 0x6c0], 0
lea rax, [rbp + 0x6c0]
je 0x140006770
mov r8d, 0x104
cmp word [rbp + 0x6c2], 0
lea rax, [rbp + 0x6c2]
jne 0x140006785
jmp 0x140006770
add rax, 2
jmp 0x140006770
add rax, 4
jmp 0x140006770
add rax, 6
jmp 0x140006770
add rax, 8
jmp 0x140006770
add rax, 0xa
jmp 0x140006770
add rax, 0xc
jmp 0x140006770
add rax, 0xe
nop word cs:[rax + rax]
sub rax, r14
mov r8, rax
shr r8, 1
cmp rax, 0x20a
jae 0x14000737c
lea rcx, [rbp + 0x780]
mov rdx, r14
call fcn.140012720
mov rax, qword [rbp + 0x788]
mov qword [rbp + 0x7d8], rax
mov r15, qword [rbp + 0x790]
test rdi, rdi
je 0x1400067e0
js 0x1400073a4
movzx eax, byte [0x140027150]
mov rcx, rdi
call fcn.140017900
test rax, rax
je 0x140007398
mov r12, rax
jmp 0x1400067e6
mov r12d, 1
mov rcx, r12
mov rdx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp + 0x7a0], rdi
mov qword [rbp + 0x7a8], r12
mov qword [rbp + 0x7b0], rdi
mov byte [rbp + 0x7b8], 0
mov rcx, rsi
mov rdx, qword [rbp + 0x7d8]
mov r8, r15
call fcn.1400157e0
mov rax, qword [rbp + 0x7a0]
mov qword [rbp + 0x710], rax
mov rax, qword [rbp + 0x7a8]
mov qword [rbp + 0x770], rax
mov rbx, qword [rbp + 0x7b0]
cmp qword [rbp + 0x780], 0
je 0x140006865
mov rcx, qword [0x1400271e8]
xor edx, edx
mov r8, qword [rbp + 0x7d8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp + 0x770]
mov rdx, rbx
call fcn.140016430
test al, al
je 0x1400068b0
mov rcx, rsi
mov rdx, qword [rbp + 0x770]
mov r8, rbx
call fcn.140004200
cmp qword [rbp + 0x7a0], 0
je 0x14000698e
mov ecx, 1
xor edx, edx
jmp 0x14000699c
mov rcx, qword [rbp + 0x770]
mov rdx, rbx
call fcn.1400172e0
test rax, rax
je 0x1400069ad
cmp rdx, 2
jne 0x1400068dd
movzx ecx, word [rax]
cmp ecx, 0x2e2e
je 0x1400069ad
mov r8, rdx
test r8, r8
je 0x1400069ad
mov rcx, r8
dec r8
cmp byte [rax + rcx - 1], 0x2e
jne 0x1400068e0
test r8, r8
je 0x1400069ad
sub rdx, rcx
cmp rdx, 6
jne 0x1400069ad
mov edx, dword [rax + rcx]
mov r8d, 0x6b636f6c
xor edx, r8d
movzx eax, word [rax + rcx + 4]
xor eax, 0x6465
or eax, edx
jne 0x1400069ad
mov rcx, rsi
mov rdx, qword [rbp + 0x770]
mov r8, rbx
call fcn.140004200
cmp qword [rbp + 0x7a0], 0
je 0x1400069ef
mov eax, 1
xor ecx, ecx
mov qword [rbp + 0x6f8], rax
mov qword [rbp + 0x700], rcx
test rbx, rbx
je 0x140006a14
js 0x140007460
movzx eax, byte [0x140027150]
mov rcx, rbx
call fcn.140017900
test rax, rax
je 0x14000744d
mov rdi, rax
jmp 0x140006a19
mov rcx, qword [rbp + 0x7a8]
mov rdx, qword [rbp + 0x7b0]
call fcn.140006580
mov rdi, rax
test rax, rax
jne 0x14000731b
cmp qword [rbp + 0x710], 0
je 0x1400069cd
mov rcx, qword [0x1400271e8]
xor edx, edx
mov r8, qword [rbp + 0x770]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rbp + 0x488]
lock dec qword [rax]
jne 0x140006630
mov rcx, qword [rbp + 0x488]
call fcn.140001c20
jmp 0x140006630
mov rax, qword [rbp + 0x7a8]
mov rcx, qword [rbp + 0x7b0]
mov qword [rbp + 0x6f8], rax
mov qword [rbp + 0x700], rcx
test rbx, rbx
jne 0x140006968
mov edi, 1
mov rcx, rdi
mov rdx, qword [rbp + 0x770]
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp + 0x748], rdi
mov rcx, rdi
mov qword [rbp + 0x718], rbx
mov rdx, rbx
call fcn.1400172e0
mov r11, qword [rbp + 0x718]
mov r8, r11
test rax, rax
mov r10, qword [rbp + 0x748]
je 0x140006ad6
cmp rdx, 2
jne 0x140006a79
movzx ecx, word [rax]
cmp ecx, 0x2e2e
jne 0x140006a79
mov ecx, 2
xor r9d, r9d
jmp 0x140006ab0
mov rcx, rdx
nop dword [rax]
test rcx, rcx
je 0x140006aa3
mov r8, rcx
dec rcx
cmp byte [rax + r8 - 1], 0x2e
jne 0x140006a80
test rcx, rcx
je 0x140006aaa
sub rdx, r8
mov r9, rax
add r9, r8
jmp 0x140006ab0
mov r9, rax
xor eax, eax
jmp 0x140006ab0
xor r9d, r9d
mov rcx, rdx
test rax, rax
cmovne r9, rax
mov r8, r11
test r9, r9
je 0x140006ad6
test rax, rax
cmove rcx, rdx
add r9, rcx
sub r9, r10
cmp r11, r9
cmovb r9, r11
mov r8, r9
mov rcx, rsi
mov rdx, r10
call fcn.140004200
cmp qword [rbp + 0x7a0], 0
je 0x140006af4
mov eax, 1
xor ecx, ecx
jmp 0x140006b02
mov rax, qword [rbp + 0x7a8]
mov rcx, qword [rbp + 0x7b0]
mov qword [rbp + 0x6e8], rax
mov qword [rbp + 0x6f0], rcx
lea rax, [rbp + 0x6f8]
mov qword [rbp + 0x780], rax
lea rax, [0x1400019d0]
mov qword [rbp + 0x788], rax
lea rcx, [rbp + 0x6e8]
mov qword [rbp + 0x790], rcx
mov qword [rbp + 0x798], rax
lea rax, str.Decrypting:
mov qword [rbp + 0x7a0], rax
mov qword [rbp + 0x7a8], 3
mov qword [rbp + 0x7c0], 0
lea rax, [rbp + 0x780]
mov qword [rbp + 0x7b0], rax
mov qword [rbp + 0x7b8], 2
mov rcx, rsi
call fcn.140017060
mov rdx, qword [rbp + 0x6f8]
mov r8, qword [rbp + 0x700]
lea rcx, [rbp + 0x780]
call fcn.140002880
movabs rax, 0x8000000000000000
cmp qword [rbp + 0x780], rax
jne 0x1400073b8
mov rax, qword [rbp + 0x788]
mov qword [rbp + 0x740], rax
mov rax, qword [rbp + 0x790]
mov qword [rbp + 0x7d8], rax
mov rdx, qword [rbp + 0x6e8]
mov r8, qword [rbp + 0x6f0]
lea rcx, [rbp + 0x780]
call fcn.140002880
movabs rax, 0x8000000000000000
cmp qword [rbp + 0x780], rax
jne 0x140007404
mov rax, qword [rbp + 0x788]
mov qword [rbp + 0x768], rax
mov rax, qword [rbp + 0x790]
mov qword [rbp + 0x738], rax
cmp qword [rbp + 0x7d8], 0
mov rdi, qword [rbp + 0x740]
je 0x140006c5b
js 0x14000748a
movzx eax, byte [0x140027150]
mov rcx, qword [rbp + 0x7d8]
call fcn.140017900
test rax, rax
lea r12, [rbp + 0x77c]
jne 0x140006c67
jmp 0x140007475
mov eax, 1
lea r12, [rbp + 0x77c]
mov qword [rbp + 0x750], rax
mov rcx, rax
mov rdx, rdi
mov r8, qword [rbp + 0x7d8]
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp + 0x730], 0
mov qword [rbp + 0x708], 0
mov dword [rsp + 0x20], 0xf0000000
lea rcx, [rbp + 0x708]
xor edx, edx
xor r8d, r8d
mov r9d, 0x18
call sub.ADVAPI32.dll_CryptAcquireContextA
test eax, eax
je 0x140006f40
lea rax, str.A_cryptographic_provider_has_been_acquired._n
mov qword [rbp + 0x7a0], rax
mov qword [rbp + 0x7a8], 1
mov qword [rbp + 0x7b0], 8
movups xmmword [rbp + 0x7b8], xmm6
mov rcx, rsi
call fcn.140017060
mov rcx, qword [rbp + 0x708]
lea rax, [rbp + 0x730]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea rdx, [0x14001e610]
mov r8d, 0x84
xor r9d, r9d
call sub.ADVAPI32.dll_CryptImportKey
test eax, eax
je 0x140006fe1
lea rax, [rbp + 0x730]
mov qword [rbp + 0x780], rax
lea rax, [fcn.140002f30]
mov qword [rbp + 0x788], rax
lea rax, str.Import_successful._Key_is
mov qword [rbp + 0x7a0], rax
mov qword [rbp + 0x7a8], 2
mov qword [rbp + 0x7c0], 0
lea rax, [rbp + 0x780]
mov qword [rbp + 0x7b0], rax
mov qword [rbp + 0x7b8], 1
mov rcx, rsi
call fcn.140017060
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov rcx, qword [rbp + 0x750]
mov edx, 1
mov r8d, 1
xor r9d, r9d
call sub.KERNEL32.dll_CreateFileA
mov r13, rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov rcx, qword [rbp + 0x768]
mov edx, 2
mov r8d, 1
xor r9d, r9d
call sub.KERNEL32.dll_CreateFileA
mov rbx, rax
mov dword [rbp + 0x77c], 0
mov qword [rbp + 0x780], 0
mov qword [rbp + 0x788], 1
mov qword [rbp + 0x790], 0
mov r8d, 0x3c0
lea rcx, [rbp + 0x780]
xor edx, edx
call fcn.14001c910
mov rdi, qword [rbp + 0x788]
mov qword [rbp + 0x6e0], rbx
mov r15, qword [rbp + 0x790]
lea rcx, [rdi + r15]
add r15, 0x3c0
xor ebx, ebx
mov r8d, 0x3c0
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov qword [rbp + 0x790], r15
mov r15, qword [rbp + 0x6e0]
nop word cs:[rax + rax]
test ebx, ebx
jne 0x1400071e0
mov qword [rsp + 0x20], 0
mov rcx, r13
mov rdx, rdi
mov r8d, 0x3c0
mov r9, r12
call sub.KERNEL32.dll_ReadFile
test eax, eax
je 0x140007106
xor ebx, ebx
cmp dword [rbp + 0x77c], 0x3c0
setb bl
mov rcx, qword [rbp + 0x730]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rdi
xor edx, edx
mov r8d, ebx
xor r9d, r9d
call sub.ADVAPI32.dll_CryptDecrypt
test eax, eax
je 0x140007174
mov r8d, dword [rbp + 0x77c]
mov qword [rsp + 0x20], 0
mov rcx, r15
mov rdx, rdi
mov r9, r12
call sub.KERNEL32.dll_WriteFile
test eax, eax
jne 0x140006e80
lea rax, str.Fail_to_write_n
mov qword [rbp + 0x7a0], rax
mov qword [rbp + 0x7a8], 1
mov qword [rbp + 0x7b0], 8
movups xmmword [rbp + 0x7b8], xmm6
mov rcx, rsi
call fcn.140017060
jmp 0x1400071e0
lea rax, str.Error_during_CryptAcquireContext__n
mov qword [rbp + 0x7a0], rax
mov qword [rbp + 0x7a8], 1
mov qword [rbp + 0x7b0], 8
movups xmmword [rbp + 0x7b8], xmm6
mov rcx, rsi
call fcn.140017060
call sub.KERNEL32.dll_GetLastError
mov dword [rbp + 0x720], eax
lea rax, [rbp + 0x720]
mov qword [rbp + 0x780], rax
lea rax, [0x140003e00]
mov qword [rbp + 0x788], rax
lea rax, str.Error_code:
mov qword [rbp + 0x7a0], rax
mov qword [rbp + 0x7a8], 2
mov qword [rbp + 0x7c0], 0
lea rax, [rbp + 0x780]
mov qword [rbp + 0x7b0], rax
mov qword [rbp + 0x7b8], 1
mov rcx, rsi
call fcn.140017060
jmp 0x14000704d
call sub.KERNEL32.dll_GetLastError
mov dword [rbp + 0x720], eax
lea rax, [rbp + 0x720]
mov qword [rbp + 0x780], rax
lea rax, [0x1400019f0]
mov qword [rbp + 0x788], rax
lea rax, str.Import_fail
mov qword [rbp + 0x7a0], rax
mov qword [rbp + 0x7a8], 2
mov qword [rbp + 0x7c0], 0
lea rax, [rbp + 0x780]
mov qword [rbp + 0x7b0], rax
mov qword [rbp + 0x7b8], 1
mov rcx, rsi
call fcn.140017060
mov r8, qword [rbp + 0x768]
mov byte [r8], 0
cmp qword [rbp + 0x738], 0
mov r13, qword [rbp + 0x750]
je 0x140007078
mov rcx, qword [0x1400271e8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [r13], 0
cmp qword [rbp + 0x7d8], 0
je 0x140007099
mov rcx, qword [0x1400271e8]
xor edx, edx
mov r8, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rax, [rbp + 0x6f8]
mov qword [rbp + 0x780], rax
lea rax, [0x1400019d0]
mov qword [rbp + 0x788], rax
lea rax, str.Error_decrypting_file:
mov qword [rbp + 0x7a0], rax
mov qword [rbp + 0x7a8], 2
mov qword [rbp + 0x7c0], 0
lea rax, [rbp + 0x780]
mov qword [rbp + 0x7b0], rax
mov qword [rbp + 0x7b8], 1
mov byte [rbp + 0x7e7], 0
mov rcx, rsi
call fcn.140017060
jmp 0x140007288
call sub.KERNEL32.dll_GetLastError
mov dword [rbp + 0x764], eax
lea rax, [rbp + 0x764]
mov qword [rbp + 0x720], rax
lea rax, [0x1400062c0]
mov qword [rbp + 0x728], rax
lea rax, str.Error_reading_0x
mov qword [rbp + 0x7a0], rax
mov qword [rbp + 0x7a8], 2
mov qword [rbp + 0x7c0], 0
lea rax, [rbp + 0x720]
mov qword [rbp + 0x7b0], rax
mov qword [rbp + 0x7b8], 1
mov rcx, rsi
call fcn.140017060
jmp 0x1400071e0
call sub.KERNEL32.dll_GetLastError
mov dword [rbp + 0x764], eax
lea rax, [rbp + 0x764]
mov qword [rbp + 0x720], rax
lea rax, [0x1400062c0]
mov qword [rbp + 0x728], rax
lea rax, str.Fail_to_decrypt_0x
mov qword [rbp + 0x7a0], rax
mov qword [rbp + 0x7a8], 2
mov qword [rbp + 0x7c0], 0
lea rax, [rbp + 0x720]
mov qword [rbp + 0x7b0], rax
mov qword [rbp + 0x7b8], 1
mov rcx, rsi
call fcn.140017060
mov rcx, qword [rbp + 0x730]
call sub.ADVAPI32.dll_CryptDestroyKey
mov rcx, qword [rbp + 0x708]
xor edx, edx
call sub.ADVAPI32.dll_CryptReleaseContext
mov rcx, r13
call sub.KERNEL32.dll_CloseHandle
mov rcx, r15
call sub.KERNEL32.dll_CloseHandle
cmp qword [rbp + 0x780], 0
je 0x140007226
mov rcx, qword [0x1400271e8]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, qword [rbp + 0x768]
mov byte [r8], 0
cmp qword [rbp + 0x738], 0
mov r13, qword [rbp + 0x750]
mov rdi, qword [rbp + 0x740]
je 0x140007258
mov rcx, qword [0x1400271e8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [r13], 0
cmp qword [rbp + 0x7d8], 0
je 0x140007279
mov rcx, qword [0x1400271e8]
xor edx, edx
mov r8, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [rbp + 0x7e7], 0
mov rcx, rdi
call sub.KERNEL32.dll_DeleteFileA
mov r8, qword [rbp + 0x740]
mov byte [r8], 0
cmp qword [rbp + 0x7d8], 0
je 0x1400072ac
mov rcx, qword [0x1400271e8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rbp + 0x718], 0
mov r8, qword [rbp + 0x748]
je 0x1400069ad
mov rcx, qword [0x1400271e8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400069ad
mov rcx, qword [rbp + 0x228]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rax, qword [rbp + 0x220]
lock dec qword [rax]
jne 0x1400072fb
mov rcx, qword [rbp + 0x220]
call fcn.140001c20
xor edi, edi
mov rax, rdi
movaps xmm6, xmmword [rbp + 0x7f0]
add rsp, 0x888
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
cmp qword [rbp + 0x710], 0
je 0x14000733b
mov rcx, qword [0x1400271e8]
xor edx, edx
mov r8, qword [rbp + 0x770]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rbp + 0x488]
lock dec qword [rax]
jne 0x140007354
mov rcx, qword [rbp + 0x488]
call fcn.140001c20
mov rcx, qword [rbp + 0x228]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rax, qword [rbp + 0x220]
lock dec qword [rax]
jne 0x1400072fd
mov rcx, qword [rbp + 0x220]
call fcn.140001c20
jmp 0x1400072fd
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x104
mov rcx, r8
mov r8, rax
call fcn.14001c4f0
jmp 0x1400074a0
mov eax, 1
mov qword [rbp + 0x758], rax
mov rcx, qword [rbp + 0x758]
mov rdx, rdi
call fcn.14001c350
jmp 0x1400074a0
movups xmm0, xmmword [rbp + 0x780]
movups xmm1, xmmword [rbp + 0x790]
movaps xmmword [rbp + 0x7b0], xmm1
movaps xmmword [rbp + 0x7a0], xmm0
lea rax, [0x14001fa38]
mov qword [rsp + 0x20], rax
lea rcx, str.CString::new_failed
lea r9, [0x14001f918]
lea r8, [rbp + 0x7a0]
mov edx, 0x13
call fcn.14001c6f0
jmp 0x1400074a0
movups xmm0, xmmword [rbp + 0x780]
movups xmm1, xmmword [rbp + 0x790]
movaps xmmword [rbp + 0x7b0], xmm1
movaps xmmword [rbp + 0x7a0], xmm0
lea rax, [0x14001fa50]
mov qword [rsp + 0x20], rax
lea rcx, str.CString::new_failed
lea r9, [0x14001f918]
lea r8, [rbp + 0x7a0]
mov edx, 0x13
call fcn.14001c6f0
jmp 0x1400074a0
mov eax, 1
mov qword [rbp + 0x758], rax
mov qword [rbp + 0x748], rbx
mov rcx, qword [rbp + 0x758]
mov rdx, qword [rbp + 0x748]
call fcn.14001c350
jmp 0x1400074a0
mov eax, 1
mov qword [rbp + 0x758], rax
mov rdx, qword [rbp + 0x7d8]
jmp 0x14000748d
mov rdx, r13
mov byte [rbp + 0x7e7], 1
mov rcx, qword [rbp + 0x758]
call fcn.14001c350
ud2