Function at 0x18001df70
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], r8
mov qword [rbp - 0x38], rdx
mov qword [rbp - 0x30], rcx
mov rax, qword [rbp + 0x110]
mov qword [rbp - 0x28], rax
mov rax, qword [0x1800760a8]
xor rax, rbp
mov qword [rbp + 0xd8], rax
mov dword [rbp - 0x20], 0x54510bcf
mov eax, dword [rbp - 0x20]
mov dword [rbp - 0x4c], eax
sub eax, 0x98795ffa
je 0x18001e8f4
jmp 0x18001dfc9
mov eax, dword [rbp - 0x4c]
sub eax, 0x9e6f5aa3
je 0x18001e8c5
jmp 0x18001dfdc
mov eax, dword [rbp - 0x4c]
sub eax, 0x9eb775ea
je 0x18001e54b
jmp 0x18001dfef
mov eax, dword [rbp - 0x4c]
sub eax, 0xa4ad501f
je 0x18001e5a0
jmp 0x18001e002
mov eax, dword [rbp - 0x4c]
sub eax, 0xa531c10c
je 0x18001e525
jmp 0x18001e015
mov eax, dword [rbp - 0x4c]
sub eax, 0xaf04514e
je 0x18001e77c
jmp 0x18001e028
mov eax, dword [rbp - 0x4c]
sub eax, 0xc018082e
je 0x18001e75a
jmp 0x18001e03b
mov eax, dword [rbp - 0x4c]
sub eax, 0xc1b171d1
je 0x18001e67f
jmp 0x18001e04e
mov eax, dword [rbp - 0x4c]
sub eax, 0xc4046a3a
je 0x18001e9bf
jmp 0x18001e061
mov eax, dword [rbp - 0x4c]
sub eax, 0xcc310e13
je 0x18001e897
jmp 0x18001e074
mov eax, dword [rbp - 0x4c]
sub eax, 0xd7b69d27
je 0x18001e69a
jmp 0x18001e087
mov eax, dword [rbp - 0x4c]
sub eax, 0xda095f2c
je 0x18001e82e
jmp 0x18001e09a
mov eax, dword [rbp - 0x4c]
sub eax, 0xe32a4cce
je 0x18001e874
jmp 0x18001e0ad
mov eax, dword [rbp - 0x4c]
sub eax, 0xe4d5e21b
je 0x18001e946
jmp 0x18001e0c0
mov eax, dword [rbp - 0x4c]
sub eax, 0xe4f4276e
je 0x18001e9b3
jmp 0x18001e0d3
mov eax, dword [rbp - 0x4c]
sub eax, 0xe554ee72
je 0x18001e770
jmp 0x18001e0e6
mov eax, dword [rbp - 0x4c]
sub eax, 0xe754b856
je 0x18001e7d4
jmp 0x18001e0f9
mov eax, dword [rbp - 0x4c]
sub eax, 0xe76aea4e
je 0x18001e7ee
jmp 0x18001e10c
mov eax, dword [rbp - 0x4c]
sub eax, 0xf0a5429e
je 0x18001e580
jmp 0x18001e11f
mov eax, dword [rbp - 0x4c]
sub eax, 0xf3c35158
je 0x18001e535
jmp 0x18001e132
mov eax, dword [rbp - 0x4c]
sub eax, 0xf81a4567
je 0x18001e98a
jmp 0x18001e145
mov eax, dword [rbp - 0x4c]
sub eax, 0xfbbebe8a
je 0x18001e7fa
jmp 0x18001e158
mov eax, dword [rbp - 0x4c]
sub eax, 0x64129a9
je 0x18001e503
jmp 0x18001e16b
mov eax, dword [rbp - 0x4c]
sub eax, 0x6efd6ac
je 0x18001e964
jmp 0x18001e17e
mov eax, dword [rbp - 0x4c]
sub eax, 0x964a72f
je 0x18001e814
jmp 0x18001e191
mov eax, dword [rbp - 0x4c]
sub eax, 0xe26d343
je 0x18001e92c
jmp 0x18001e1a4
mov eax, dword [rbp - 0x4c]
sub eax, 0x1199eb1c
je 0x18001e5e9
jmp 0x18001e1b7
mov eax, dword [rbp - 0x4c]
sub eax, 0x1bea3b8b
je 0x18001e665
jmp 0x18001e1ca
mov eax, dword [rbp - 0x4c]
sub eax, 0x1d1b4951
je 0x18001e9dc
jmp 0x18001e1dd
mov eax, dword [rbp - 0x4c]
sub eax, 0x1ee06eb6
je 0x18001e90e
jmp 0x18001e1f0
mov eax, dword [rbp - 0x4c]
sub eax, 0x1f0bb707
je 0x18001e659
jmp 0x18001e203
mov eax, dword [rbp - 0x4c]
sub eax, 0x29b90d21
je 0x18001e643
jmp 0x18001e216
mov eax, dword [rbp - 0x4c]
sub eax, 0x2b04f4be
je 0x18001e856
jmp 0x18001e229
mov eax, dword [rbp - 0x4c]
sub eax, 0x3308dbdc
je 0x18001e557
jmp 0x18001e23c
mov eax, dword [rbp - 0x4c]
sub eax, 0x3e447995
je 0x18001e607
jmp 0x18001e24f
mov eax, dword [rbp - 0x4c]
sub eax, 0x402a0f6e
je 0x18001e627
jmp 0x18001e262
mov eax, dword [rbp - 0x4c]
sub eax, 0x45228dbd
je 0x18001e74a
jmp 0x18001e275
mov eax, dword [rbp - 0x4c]
sub eax, 0x46a69428
je 0x18001e707
jmp 0x18001e288
mov eax, dword [rbp - 0x4c]
sub eax, 0x4ee58ad0
je 0x18001e414
jmp 0x18001e29b
mov eax, dword [rbp - 0x4c]
sub eax, 0x54510bcf
je 0x18001e325
jmp 0x18001e2ae
mov eax, dword [rbp - 0x4c]
sub eax, 0x58a84449
je 0x18001e3f4
jmp 0x18001e2c1
mov eax, dword [rbp - 0x4c]
sub eax, 0x60282fa7
je 0x18001e728
jmp 0x18001e2d4
mov eax, dword [rbp - 0x4c]
sub eax, 0x6d0e0ca8
je 0x18001e7b6
jmp 0x18001e2e7
mov eax, dword [rbp - 0x4c]
sub eax, 0x721980fe
je 0x18001e996
jmp 0x18001e2fa
mov eax, dword [rbp - 0x4c]
sub eax, 0x798e24b5
je 0x18001e8e8
jmp 0x18001e30d
mov eax, dword [rbp - 0x4c]
sub eax, 0x7d9c12e6
je 0x18001e974
jmp 0x18001e320
jmp 0x18001ea06
mov eax, 0x10
mov qword [rbp - 0x58], rax
call fcn.18006c5e0
sub rsp, rax
mov rax, qword [rbp - 0x58]
mov rcx, rsp
mov qword [rbp - 0x18], rcx
call fcn.18006c5e0
sub rsp, rax
mov rax, qword [rbp - 0x58]
mov rcx, rsp
mov qword [rbp - 0x10], rcx
call fcn.18006c5e0
sub rsp, rax
mov rax, qword [rbp - 0x58]
mov rcx, rsp
mov qword [rbp - 8], rcx
call fcn.18006c5e0
sub rsp, rax
mov rax, qword [rbp - 0x58]
mov rcx, rsp
mov qword [rbp], rcx
call fcn.18006c5e0
sub rsp, rax
mov rax, qword [rbp - 0x58]
mov rcx, rsp
mov qword [rbp + 8], rcx
call fcn.18006c5e0
sub rsp, rax
mov rax, qword [rbp - 0x58]
mov rcx, rsp
mov qword [rbp + 0x10], rcx
call fcn.18006c5e0
sub rsp, rax
mov rax, qword [rbp - 0x58]
mov rcx, rsp
mov qword [rbp + 0x18], rcx
call fcn.18006c5e0
sub rsp, rax
mov rax, qword [rbp - 0x58]
mov rcx, rsp
mov qword [rbp + 0x20], rcx
call fcn.18006c5e0
sub rsp, rax
mov rax, qword [rbp - 0x58]
mov rcx, rsp
mov qword [rbp + 0x28], rcx
call fcn.18006c5e0
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0x30], rax
mov dword [rbp - 0x20], 0x58a84449
jmp 0x18001ea06
mov eax, 0x10
call fcn.18006c5e0
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0x38], rax
mov dword [rbp - 0x20], 0x4ee58ad0
jmp 0x18001ea06
mov rcx, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x38]
mov r8, qword [rbp - 0x40]
mov r9, qword [rbp - 0x48]
mov r10, qword [rbp - 0x28]
mov eax, 0x10
mov qword [rbp - 0x60], rax
call fcn.18006c5e0
sub rsp, rax
mov rax, qword [rbp - 0x60]
mov r11, rsp
mov qword [rbp + 0x40], r11
call fcn.18006c5e0
sub rsp, rax
mov rax, qword [rbp - 0x60]
mov r11, rsp
mov qword [rbp + 0x48], r11
call fcn.18006c5e0
sub rsp, rax
mov rax, qword [rbp - 0x60]
mov r11, rsp
mov qword [rbp + 0x50], r11
call fcn.18006c5e0
sub rsp, rax
mov rax, qword [rbp - 0x60]
mov r11, rsp
mov qword [rbp + 0x58], r11
call fcn.18006c5e0
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0x60], rax
mov rax, qword [rbp - 0x18]
mov qword [rax], r10
mov rax, qword [rbp - 0x10]
mov qword [rax], r9
mov rax, qword [rbp - 8]
mov qword [rax], r8
mov rax, qword [rbp]
mov qword [rax], rdx
mov rax, qword [rbp + 8]
mov qword [rax], rcx
mov rax, qword [rbp + 8]
mov rax, qword [rax]
mov qword [rbp + 0x68], rax
mov rcx, qword [rbp + 0x10]
mov edx, 1
mov r8d, 0x20
sub rsp, 0x20
call fcn.180022000
add rsp, 0x20
mov rcx, qword [rbp + 0x10]
sub rsp, 0x20
call fcn.1800220d0
add rsp, 0x20
mov rdx, rax
mov eax, 0x3308dbdc
mov ecx, 0x64129a9
cmp rdx, 0
cmove eax, ecx
mov dword [rbp - 0x20], eax
jmp 0x18001ea06
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
mov ecx, eax
mov rax, qword [rbp + 0x18]
mov dword [rax], ecx
mov dword [rbp - 0x20], 0xa531c10c
jmp 0x18001ea06
mov byte [rbp - 0x19], 0
mov dword [rbp - 0x20], 0xf3c35158
jmp 0x18001ea06
mov rax, qword [rbp + 0x20]
mov dword [rax], 1
mov dword [rbp - 0x20], 0x9eb775ea
jmp 0x18001ea06
mov dword [rbp - 0x20], 0xc4046a3a
jmp 0x18001ea06
mov rcx, qword [rbp + 0x28]
sub rsp, 0x20
call fcn.1800226c0
add rsp, 0x20
mov rax, qword [rbp + 0x68]
add rax, 8
mov qword [rbp + 0x70], rax
mov dword [rbp - 0x20], 0xf0a5429e
jmp 0x18001ea06
mov rax, qword [rbp + 0x70]
mov eax, dword [rax]
mov dword [rbp + 0x7c], eax
mov rax, qword [rbp + 0x68]
mov qword [rbp + 0x80], rax
mov dword [rbp - 0x20], 0xa4ad501f
jmp 0x18001ea06
mov rax, qword [rbp + 0x80]
mov r8, qword [rax]
mov rdx, qword [rbp + 0x10]
mov rcx, qword [rbp + 0x28]
mov r9d, dword [rbp + 0x7c]
sub rsp, 0x20
call fcn.180022760
add rsp, 0x20
mov ecx, eax
mov rax, qword [rbp + 0x30]
mov dword [rax], ecx
mov rax, qword [rbp + 0x30]
cmp dword [rax], 0xffffffff
sete al
and al, 1
mov byte [rbp + 0x8b], al
mov dword [rbp - 0x20], 0x1199eb1c
jmp 0x18001ea06
mov dl, byte [rbp + 0x8b]
mov eax, 0x1bea3b8b
mov ecx, 0x3e447995
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x20], eax
jmp 0x18001ea06
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
mov dword [rbp + 0x8c], eax
mov dword [rbp - 0x20], 0x402a0f6e
jmp 0x18001ea06
mov rax, qword [rbp + 0x38]
mov ecx, dword [rbp + 0x8c]
mov dword [rax], ecx
mov byte [rbp - 0x19], 0
mov dword [rbp - 0x20], 0x29b90d21
jmp 0x18001ea06
mov rax, qword [rbp + 0x20]
mov dword [rax], 1
mov dword [rbp - 0x20], 0x1f0bb707
jmp 0x18001ea06
mov dword [rbp - 0x20], 0x721980fe
jmp 0x18001ea06
mov rax, qword [rbp - 0x10]
mov rax, qword [rax]
mov qword [rbp + 0x90], rax
mov dword [rbp - 0x20], 0xc1b171d1
jmp 0x18001ea06
mov rax, qword [rbp + 0x90]
mov ecx, eax
mov rax, qword [rbp + 0x40]
mov dword [rax], ecx
mov dword [rbp - 0x20], 0xd7b69d27
jmp 0x18001ea06
mov rax, qword [rbp - 8]
mov rax, qword [rax]
mov dword [rbp - 0x64], eax
mov rax, qword [rbp]
mov rax, qword [rax]
mov qword [rbp - 0x70], rax
mov rcx, qword [rbp + 0x28]
sub rsp, 0x20
call fcn.180022b80
mov r11, qword [rbp - 0x70]
add rsp, 0x20
mov rcx, rax
mov eax, dword [rbp - 0x64]
mov r10, qword [rbp + 0x40]
xor edx, edx
mov r8d, 1
xor r9d, r9d
sub rsp, 0x40
mov qword [rsp + 0x20], r11
mov qword [rsp + 0x28], r10
mov dword [rsp + 0x30], eax
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
add rsp, 0x40
mov dword [rbp + 0x9c], eax
mov dword [rbp - 0x20], 0x46a69428
jmp 0x18001ea06
mov r8d, dword [rbp + 0x9c]
xor edx, edx
mov eax, 0xaf04514e
mov ecx, 0x60282fa7
cmp edx, r8d
cmove eax, ecx
mov dword [rbp - 0x20], eax
jmp 0x18001ea06
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
mov ecx, eax
mov rax, qword [rbp + 0x48]
mov dword [rax], ecx
mov dword [rbp - 0x20], 0x45228dbd
jmp 0x18001ea06
mov byte [rbp - 0x19], 0
mov dword [rbp - 0x20], 0xc018082e
jmp 0x18001ea06
mov rax, qword [rbp + 0x20]
mov dword [rax], 1
mov dword [rbp - 0x20], 0xe554ee72
jmp 0x18001ea06
mov dword [rbp - 0x20], 0x721980fe
jmp 0x18001ea06
mov rax, qword [rbp + 0x40]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [rbp - 0x18]
mov rax, qword [rax]
mov qword [rax], rcx
mov rax, qword [rbp + 0x50]
mov qword [rax], 0
mov rax, qword [rbp - 0x18]
mov rax, qword [rax]
mov rax, qword [rax]
mov qword [rbp + 0xa0], rax
mov dword [rbp - 0x20], 0x6d0e0ca8
jmp 0x18001ea06
mov rax, qword [rbp + 0xa0]
sub rax, 1
mov qword [rbp + 0xa8], rax
mov dword [rbp - 0x20], 0xe754b856
jmp 0x18001ea06
mov rax, qword [rbp + 0x58]
mov rcx, qword [rbp + 0xa8]
mov qword [rax], rcx
mov dword [rbp - 0x20], 0xe76aea4e
jmp 0x18001ea06
mov dword [rbp - 0x20], 0xfbbebe8a
jmp 0x18001ea06
mov rax, qword [rbp + 0x50]
mov rax, qword [rax]
mov qword [rbp + 0xb0], rax
mov dword [rbp - 0x20], 0x964a72f
jmp 0x18001ea06
mov rax, qword [rbp + 0x58]
mov rax, qword [rax]
mov qword [rbp + 0xb8], rax
mov dword [rbp - 0x20], 0xda095f2c
jmp 0x18001ea06
mov rax, qword [rbp + 0xb0]
mov rcx, qword [rbp + 0xb8]
cmp rax, rcx
setb al
and al, 1
mov byte [rbp + 0xc7], al
mov dword [rbp - 0x20], 0x2b04f4be
jmp 0x18001ea06
mov dl, byte [rbp + 0xc7]
mov eax, 0x6efd6ac
mov ecx, 0xe32a4cce
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x20], eax
jmp 0x18001ea06
mov rax, qword [rbp]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x50]
mov rcx, qword [rcx]
mov cl, byte [rax + rcx]
mov rax, qword [rbp + 0x60]
mov byte [rax], cl
mov dword [rbp - 0x20], 0xcc310e13
jmp 0x18001ea06
mov rax, qword [rbp]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x58]
mov rcx, qword [rcx]
mov dl, byte [rax + rcx]
mov rax, qword [rbp]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x50]
mov rcx, qword [rcx]
mov byte [rax + rcx], dl
mov dword [rbp - 0x20], 0x9e6f5aa3
jmp 0x18001ea06
mov rax, qword [rbp + 0x60]
mov dl, byte [rax]
mov rax, qword [rbp]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x58]
mov rcx, qword [rcx]
mov byte [rax + rcx], dl
mov dword [rbp - 0x20], 0x798e24b5
jmp 0x18001ea06
mov dword [rbp - 0x20], 0x98795ffa
jmp 0x18001ea06
mov rax, qword [rbp + 0x50]
mov rax, qword [rax]
mov qword [rbp + 0xc8], rax
mov dword [rbp - 0x20], 0x1ee06eb6
jmp 0x18001ea06
mov rcx, qword [rbp + 0xc8]
add rcx, 1
mov rax, qword [rbp + 0x50]
mov qword [rax], rcx
mov dword [rbp - 0x20], 0xe26d343
jmp 0x18001ea06
mov rax, qword [rbp + 0x58]
mov rax, qword [rax]
mov qword [rbp + 0xd0], rax
mov dword [rbp - 0x20], 0xe4d5e21b
jmp 0x18001ea06
mov rcx, qword [rbp + 0xd0]
add rcx, 0xffffffffffffffff
mov rax, qword [rbp + 0x58]
mov qword [rax], rcx
mov dword [rbp - 0x20], 0xfbbebe8a
jmp 0x18001ea06
mov byte [rbp - 0x19], 1
mov dword [rbp - 0x20], 0x7d9c12e6
jmp 0x18001ea06
mov rax, qword [rbp + 0x20]
mov dword [rax], 1
mov dword [rbp - 0x20], 0xf81a4567
jmp 0x18001ea06
mov dword [rbp - 0x20], 0x721980fe
jmp 0x18001ea06
mov rcx, qword [rbp + 0x28]
sub rsp, 0x20
call fcn.180022c20
add rsp, 0x20
mov dword [rbp - 0x20], 0xe4f4276e
jmp 0x18001ea06
mov dword [rbp - 0x20], 0xc4046a3a
jmp 0x18001ea06
mov rcx, qword [rbp + 0x10]
sub rsp, 0x20
call fcn.180022db0
add rsp, 0x20
mov dword [rbp - 0x20], 0x1d1b4951
jmp 0x18001ea06
mov al, byte [rbp - 0x19]
and al, 1
movzx eax, al
mov dword [rbp - 0x74], eax
mov rcx, qword [rbp + 0xd8]
xor rcx, rbp
sub rsp, 0x20
call fcn.18006c560
mov eax, dword [rbp - 0x74]
lea rsp, [rbp + 0xe0]
pop rbp
ret
jmp 0x18001dfb3