Function at 0x1400093c0
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x2c0
mov rdi, rsp
mov ecx, reloc.OLEAUT32.dll_VarDecAdd
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2d0]
mov dword [rsp + 0x224], 0
mov r8d, 2
mov edx, 1
mov ecx, dword [rsp + 0x2d8]
call fcn.140009ec0
mov dword [rsp + 0x2d8], eax
mov rcx, qword [rsp + 0x2f0]
call fcn.14006d090
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x58]
call sub.bcrypt.dll_BCryptOpenAlgorithmProvider
mov dword [rsp + 0x84], eax
cmp dword [rsp + 0x84], 0
jge 0x140009478
mov rcx, qword [rsp + 0x2d0]
call fcn.140059d00
nop
mov eax, dword [rsp + 0x224]
or eax, 1
mov dword [rsp + 0x224], eax
mov rax, qword [rsp + 0x2d0]
jmp 0x140009e9c
mov rcx, qword [rsp + 0x300]
call fcn.14006d120
lea eax, [rax + rax + 2]
mov dword [rsp + 0x228], eax
mov rcx, qword [rsp + 0x300]
call fcn.14006d090
mov dword [rsp + 0x20], 0
mov ecx, dword [rsp + 0x228]
mov r9d, ecx
mov r8, rax
lea rdx, str.ChainingMode
mov rcx, qword [rsp + 0x58]
call sub.bcrypt.dll_BCryptSetProperty
mov dword [rsp + 0x84], eax
cmp dword [rsp + 0x84], 0
jge 0x14000950c
xor edx, edx
mov rcx, qword [rsp + 0x58]
call sub.bcrypt.dll_BCryptCloseAlgorithmProvider
mov rcx, qword [rsp + 0x2d0]
call fcn.140059d00
nop
mov eax, dword [rsp + 0x224]
or eax, 1
mov dword [rsp + 0x224], eax
mov rax, qword [rsp + 0x2d0]
jmp 0x140009e9c
lea rdx, [0x1402520e0]
mov rcx, qword [rsp + 0x2f0]
call fcn.140009f70
test eax, eax
je 0x140009594
mov dword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0x2f8]
lea rdx, str.EffectiveKeyLength
mov rcx, qword [rsp + 0x58]
call sub.bcrypt.dll_BCryptSetProperty
mov dword [rsp + 0x84], eax
cmp dword [rsp + 0x84], 0
jge 0x140009594
xor edx, edx
mov rcx, qword [rsp + 0x58]
call sub.bcrypt.dll_BCryptCloseAlgorithmProvider
mov rcx, qword [rsp + 0x2d0]
call fcn.140059d00
nop
mov eax, dword [rsp + 0x224]
or eax, 1
mov dword [rsp + 0x224], eax
mov rax, qword [rsp + 0x2d0]
jmp 0x140009e9c
lea rdx, [0x140252c20]
mov rcx, qword [rsp + 0x300]
call fcn.140009f70
test eax, eax
je 0x14000961c
mov dword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0x320]
lea rdx, str.MessageBlockLength
mov rcx, qword [rsp + 0x58]
call sub.bcrypt.dll_BCryptSetProperty
mov dword [rsp + 0x84], eax
cmp dword [rsp + 0x84], 0
jge 0x14000961c
xor edx, edx
mov rcx, qword [rsp + 0x58]
call sub.bcrypt.dll_BCryptCloseAlgorithmProvider
mov rcx, qword [rsp + 0x2d0]
call fcn.140059d00
nop
mov eax, dword [rsp + 0x224]
or eax, 1
mov dword [rsp + 0x224], eax
mov rax, qword [rsp + 0x2d0]
jmp 0x140009e9c
mov dword [rsp + 0x28], 0
lea rax, [rsp + 0xb4]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rsp + 0x94]
lea rdx, str.BlockLength
mov rcx, qword [rsp + 0x58]
call sub.bcrypt.dll_BCryptGetProperty
mov dword [rsp + 0x84], eax
cmp dword [rsp + 0x84], 0
jge 0x140009699
xor edx, edx
mov rcx, qword [rsp + 0x58]
call sub.bcrypt.dll_BCryptCloseAlgorithmProvider
mov rcx, qword [rsp + 0x2d0]
call fcn.140059d00
nop
mov eax, dword [rsp + 0x224]
or eax, 1
mov dword [rsp + 0x224], eax
mov rax, qword [rsp + 0x2d0]
jmp 0x140009e9c
mov rdx, qword [rsp + 0x310]
lea rcx, [rsp + 0xd8]
call fcn.140007940
nop
mov rcx, qword [rsp + 0x310]
call fcn.14000a090
movsxd rcx, dword [rsp + 0x318]
cmp rax, rcx
jle 0x1400096e3
movsxd rax, dword [rsp + 0x318]
mov rdx, rax
lea rcx, [rsp + 0xd8]
call fcn.14000a0b0
jmp 0x140009724
movsxd rax, dword [rsp + 0x318]
mov qword [rsp + 0x230], rax
mov rcx, qword [rsp + 0x310]
call fcn.14000a090
mov rcx, qword [rsp + 0x230]
sub rcx, rax
mov rax, rcx
mov r8d, 1
mov rdx, rax
lea rcx, [rsp + 0xd8]
call fcn.14005a7c0
mov rdx, qword [rsp + 0x2e8]
lea rcx, [rsp + 0x128]
call fcn.140007940
nop
mov rcx, qword [rsp + 0x2e8]
call fcn.14000a090
mov qword [rsp + 0x238], rax
mov eax, dword [rsp + 0x2f8]
cdq
and edx, 7
add eax, edx
sar eax, 3
cdqe
mov rcx, qword [rsp + 0x238]
cmp rcx, rax
jle 0x140009792
mov eax, dword [rsp + 0x2f8]
cdq
and edx, 7
add eax, edx
sar eax, 3
cdqe
mov rdx, rax
lea rcx, [rsp + 0x128]
call fcn.14000a0b0
jmp 0x1400097dd
mov eax, dword [rsp + 0x2f8]
cdq
and edx, 7
add eax, edx
sar eax, 3
cdqe
mov qword [rsp + 0x240], rax
mov rcx, qword [rsp + 0x2e8]
call fcn.14000a090
mov rcx, qword [rsp + 0x240]
sub rcx, rax
mov rax, rcx
mov r8d, 1
mov rdx, rax
lea rcx, [rsp + 0x128]
call fcn.14005a7c0
lea rcx, [rsp + 0x128]
call fcn.14000a090
mov qword [rsp + 0x248], rax
lea rcx, [rsp + 0x128]
call fcn.14000a040
mov dword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x248]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
call sub.bcrypt.dll_BCryptGenerateSymmetricKey
mov dword [rsp + 0x84], eax
cmp dword [rsp + 0x84], 0
jge 0x140009890
xor edx, edx
mov rcx, qword [rsp + 0x58]
call sub.bcrypt.dll_BCryptCloseAlgorithmProvider
mov rcx, qword [rsp + 0x2d0]
call fcn.140059d00
mov eax, dword [rsp + 0x224]
or eax, 1
mov dword [rsp + 0x224], eax
lea rcx, [rsp + 0x128]
call fcn.140007c70
nop
lea rcx, [rsp + 0xd8]
call fcn.140007c70
mov rax, qword [rsp + 0x2d0]
jmp 0x140009e9c
lea rcx, [rsp + 0x178]
call fcn.140059d00
nop
cmp dword [rsp + 0x308], 0
jge 0x1400098b5
mov dword [rsp + 0x250], 0
jmp 0x1400098c3
mov eax, dword [rsp + 0x308]
mov dword [rsp + 0x250], eax
mov eax, dword [rsp + 0x250]
mov dword [rsp + 0x1d4], eax
cmp dword [rsp + 0x2d8], 1
jne 0x140009b8e
mov rdx, qword [rsp + 0x2e0]
lea rcx, [rsp + 0x1e8]
call fcn.140007940
nop
mov eax, dword [0x1401759a0]
cmp dword [rsp + 0x308], eax
jne 0x14000993e
mov rcx, qword [rsp + 0x2e0]
call fcn.14000a090
xor edx, edx
div dword [rsp + 0x94]
mov eax, edx
mov ecx, dword [rsp + 0x94]
sub ecx, eax
mov eax, ecx
mov eax, eax
mov r8d, 1
mov edx, eax
lea rcx, [rsp + 0x1e8]
call fcn.14005a7c0
lea rcx, [rsp + 0x178]
call fcn.14000a040
mov qword [rsp + 0x258], rax
lea rcx, [rsp + 0x1e8]
call fcn.14000a090
mov qword [rsp + 0x260], rax
lea rcx, [rsp + 0x1e8]
call fcn.14000a040
mov ecx, dword [rsp + 0x1d4]
mov dword [rsp + 0x48], ecx
lea rcx, [rsp + 0x1c4]
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], 0
mov rcx, qword [rsp + 0x258]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov rcx, qword [rsp + 0x260]
mov r8d, ecx
mov rdx, rax
mov rcx, qword [rsp + 0x78]
call sub.bcrypt.dll_BCryptEncrypt
mov dword [rsp + 0x84], eax
cmp dword [rsp + 0x84], 0
jge 0x140009a57
mov rcx, qword [rsp + 0x78]
call sub.bcrypt.dll_BCryptDestroyKey
xor edx, edx
mov rcx, qword [rsp + 0x58]
call sub.bcrypt.dll_BCryptCloseAlgorithmProvider
mov rcx, qword [rsp + 0x2d0]
call fcn.140059d00
mov eax, dword [rsp + 0x224]
or eax, 1
mov dword [rsp + 0x224], eax
lea rcx, [rsp + 0x1e8]
call fcn.140007c70
nop
lea rcx, [rsp + 0x178]
call fcn.140007c70
nop
lea rcx, [rsp + 0x128]
call fcn.140007c70
nop
lea rcx, [rsp + 0xd8]
call fcn.140007c70
mov rax, qword [rsp + 0x2d0]
jmp 0x140009e9c
mov eax, dword [rsp + 0x1c4]
mov r8d, 1
mov edx, eax
lea rcx, [rsp + 0x178]
call fcn.140009fe0
mov rcx, qword [rsp + 0x310]
call fcn.1400086f0
test rax, rax
je 0x140009a92
mov dword [rsp + 0x268], 0
jmp 0x140009aa6
lea rcx, [rsp + 0xd8]
call fcn.14000a090
mov dword [rsp + 0x268], eax
mov rcx, qword [rsp + 0x310]
call fcn.1400086f0
test rax, rax
je 0x140009ac6
mov qword [rsp + 0x270], 0
jmp 0x140009adb
lea rcx, [rsp + 0xd8]
call fcn.14000a040
mov qword [rsp + 0x270], rax
lea rcx, [rsp + 0x178]
call fcn.14000a040
mov qword [rsp + 0x278], rax
lea rcx, [rsp + 0x1e8]
call fcn.14000a090
mov qword [rsp + 0x280], rax
lea rcx, [rsp + 0x1e8]
call fcn.14000a040
mov ecx, dword [rsp + 0x1d4]
mov dword [rsp + 0x48], ecx
lea rcx, [rsp + 0x1c4]
mov qword [rsp + 0x40], rcx
mov ecx, dword [rsp + 0x1c4]
mov dword [rsp + 0x38], ecx
mov rcx, qword [rsp + 0x278]
mov qword [rsp + 0x30], rcx
mov ecx, dword [rsp + 0x268]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x270]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov rcx, qword [rsp + 0x280]
mov r8d, ecx
mov rdx, rax
mov rcx, qword [rsp + 0x78]
call sub.bcrypt.dll_BCryptEncrypt
mov dword [rsp + 0x84], eax
lea rcx, [rsp + 0x1e8]
call fcn.140007c70
jmp 0x140009dbe
lea rcx, [rsp + 0x178]
call fcn.14000a040
mov qword [rsp + 0x288], rax
mov rcx, qword [rsp + 0x2e0]
call fcn.14000a090
mov qword [rsp + 0x290], rax
mov rcx, qword [rsp + 0x2e0]
call fcn.14000a040
mov ecx, dword [rsp + 0x1d4]
mov dword [rsp + 0x48], ecx
lea rcx, [rsp + 0x1c4]
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], 0
mov rcx, qword [rsp + 0x288]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov rcx, qword [rsp + 0x290]
mov r8d, ecx
mov rdx, rax
mov rcx, qword [rsp + 0x78]
call sub.bcrypt.dll_BCryptDecrypt
mov dword [rsp + 0x84], eax
cmp dword [rsp + 0x84], 0
jge 0x140009c99
mov rcx, qword [rsp + 0x78]
call sub.bcrypt.dll_BCryptDestroyKey
xor edx, edx
mov rcx, qword [rsp + 0x58]
call sub.bcrypt.dll_BCryptCloseAlgorithmProvider
mov rcx, qword [rsp + 0x2d0]
call fcn.140059d00
mov eax, dword [rsp + 0x224]
or eax, 1
mov dword [rsp + 0x224], eax
lea rcx, [rsp + 0x178]
call fcn.140007c70
nop
lea rcx, [rsp + 0x128]
call fcn.140007c70
nop
lea rcx, [rsp + 0xd8]
call fcn.140007c70
mov rax, qword [rsp + 0x2d0]
jmp 0x140009e9c
mov eax, dword [rsp + 0x1c4]
mov r8d, 1
mov edx, eax
lea rcx, [rsp + 0x178]
call fcn.140009fe0
mov rcx, qword [rsp + 0x310]
call fcn.1400086f0
test rax, rax
je 0x140009cd4
mov dword [rsp + 0x298], 0
jmp 0x140009ce8
lea rcx, [rsp + 0xd8]
call fcn.14000a090
mov dword [rsp + 0x298], eax
mov rcx, qword [rsp + 0x310]
call fcn.1400086f0
test rax, rax
je 0x140009d08
mov qword [rsp + 0x2a0], 0
jmp 0x140009d1d
lea rcx, [rsp + 0xd8]
call fcn.14000a040
mov qword [rsp + 0x2a0], rax
lea rcx, [rsp + 0x178]
call fcn.14000a040
mov qword [rsp + 0x2a8], rax
mov rcx, qword [rsp + 0x2e0]
call fcn.14000a090
mov qword [rsp + 0x2b0], rax
mov rcx, qword [rsp + 0x2e0]
call fcn.14000a040
mov ecx, dword [rsp + 0x1d4]
mov dword [rsp + 0x48], ecx
lea rcx, [rsp + 0x1c4]
mov qword [rsp + 0x40], rcx
mov ecx, dword [rsp + 0x1c4]
mov dword [rsp + 0x38], ecx
mov rcx, qword [rsp + 0x2a8]
mov qword [rsp + 0x30], rcx
mov ecx, dword [rsp + 0x298]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x2a0]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov rcx, qword [rsp + 0x2b0]
mov r8d, ecx
mov rdx, rax
mov rcx, qword [rsp + 0x78]
call sub.bcrypt.dll_BCryptDecrypt
mov dword [rsp + 0x84], eax
mov rcx, qword [rsp + 0x78]
call sub.bcrypt.dll_BCryptDestroyKey
xor edx, edx
mov rcx, qword [rsp + 0x58]
call sub.bcrypt.dll_BCryptCloseAlgorithmProvider
cmp dword [rsp + 0x84], 0
jge 0x140009e2f
mov rcx, qword [rsp + 0x2d0]
call fcn.140059d00
mov eax, dword [rsp + 0x224]
or eax, 1
mov dword [rsp + 0x224], eax
lea rcx, [rsp + 0x178]
call fcn.140007c70
nop
lea rcx, [rsp + 0x128]
call fcn.140007c70
nop
lea rcx, [rsp + 0xd8]
call fcn.140007c70
mov rax, qword [rsp + 0x2d0]
jmp 0x140009e9c
mov eax, dword [rsp + 0x1c4]
mov edx, eax
lea rcx, [rsp + 0x178]
call fcn.14000a0b0
lea rdx, [rsp + 0x178]
mov rcx, qword [rsp + 0x2d0]
call fcn.140007940
mov eax, dword [rsp + 0x224]
or eax, 1
mov dword [rsp + 0x224], eax
lea rcx, [rsp + 0x178]
call fcn.140007c70
nop
lea rcx, [rsp + 0x128]
call fcn.140007c70
nop
lea rcx, [rsp + 0xd8]
call fcn.140007c70
mov rax, qword [rsp + 0x2d0]
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.OLEAUT32.dll_VariantCopy
call fcn.1400a1e60
mov rax, rdi
add rsp, 0x2c0
pop rdi
ret