Function at 0x140076b63
Capabilities:
Encrypt data via sspi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov r12, r9
mov rsi, rdx
mov rdi, rcx
mov qword [rdx + 0x138], r8
lea r14, [rsp + 0x30]
mov rcx, r14
call fcn.140076e88
mov eax, dword [r14]
cmp eax, 2
je 0x140076db5
test eax, eax
je 0x140076d63
mov rax, qword [rsi + 0x1b8]
cmp rax, qword [rsi + 0x1b0]
jne 0x140076d9f
mov rdx, qword [rsp + 0xf0]
mov r15d, dword [rsp + 0x34]
mov r13, qword [rsp + 0x38]
mov rbx, r13
shr rbx, 0x20
cmp rdx, rbx
mov r8, rbx
cmovb r8, rdx
lea r9, str._Users_halo_Desktop_code_phishing_mpclient_dll_hijack_only_cs_vendor_schannel_src_tls_stream.rs
mov rcx, r12
mov qword [rsp + 0x70], r8
call fcn.140002fe6
cmp rdx, rbx
ja 0x140076e27
mov rbp, rdx
mov rbx, rax
mov r12, rdx
add r12, r15
mov eax, r13d
add rax, r12
mov rdx, qword [rsi + 0x1b0]
cmp rdx, rax
jae 0x140076c2f
lea rcx, [rsi + 0x1a0]
mov rdx, rax
call fcn.140012032
mov rdx, qword [rsi + 0x1b0]
mov rcx, qword [rsi + 0x1a0]
lea rax, str._Users_halo_Desktop_code_phishing_mpclient_dll_hijack_only_cs_vendor_schannel_src_tls_stream.rs
mov qword [rsp + 0x20], rax
mov r8, r15
mov r9, r12
call fcn.140077af1
lea rcx, str._Users_halo_Desktop_code_phishing_mpclient_dll_hijack_only_cs_vendor_schannel_src_tls_stream.rs
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov r8, rbx
mov r9, rbp
call fcn.140020ee6
mov rcx, qword [rsi + 0x1a0]
mov rdx, qword [rsi + 0x1b0]
lea r9, str._Users_halo_Desktop_code_phishing_mpclient_dll_hijack_only_cs_vendor_schannel_src_tls_stream.rs
mov r8, r15
call fcn.140077b08
mov r13, rax
mov rbp, rdx
xor eax, eax
test r13, r13
cmove ebp, eax
mov rcx, qword [rsi + 0x1a0]
mov rdx, qword [rsi + 0x1b0]
lea rax, str._Users_halo_Desktop_code_phishing_mpclient_dll_hijack_only_cs_vendor_schannel_src_tls_stream.rs
mov qword [rsp + 0x20], rax
mov r8, r15
mov r9, r12
call fcn.140077af1
mov r15, rax
mov rbx, rdx
test rax, rax
mov eax, 0
cmove ebx, eax
mov rcx, qword [rsi + 0x1a0]
mov rdx, qword [rsi + 0x1b0]
lea r9, str._Users_halo_Desktop_code_phishing_mpclient_dll_hijack_only_cs_vendor_schannel_src_tls_stream.rs
mov r8, r12
call fcn.140077b19
test rax, rax
mov ecx, 0
cmove edx, ecx
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x34], 7
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x44], 1
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x50], edx
mov dword [rsp + 0x54], 6
mov qword [rsp + 0x58], rax
movabs rax, 0x400000000
lea r8, [rsp + 0x78]
mov qword [r8], rax
mov qword [r8 + 8], r14
lea rcx, [rsi + 0x1c0]
xor edx, edx
xor r9d, r9d
call sub.secur32.dll_EncryptMessage
test eax, eax
je 0x140076d6f
mov r14d, eax
shl r14, 0x20
or r14, 2
jmp 0x140076dba
movabs r14, 0x8009031700000002
jmp 0x140076dba
mov eax, dword [rsp + 0x40]
add eax, dword [rsp + 0x30]
add eax, dword [rsp + 0x50]
cmp qword [rsi + 0x1b0], rax
jb 0x140076d8b
mov qword [rsi + 0x1b0], rax
and qword [rsi + 0x1b8], 0
mov rax, qword [rsp + 0x70]
mov qword [rsi + 0x200], rax
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, rsi
call fcn.140077a19
cmp qword [rbx], 0
je 0x140076e16
mov r14, qword [rsp + 0x38]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], 1
mov rcx, r14
call fcn.140076e41
cmp al, 0xd
jne 0x140076def
lea rcx, [rsp + 0x38]
mov qword [rdi], 2
and qword [rsi + 0x138], 0
call fcn.1400361e6
jmp 0x140076e02
mov qword [rdi], 1
mov qword [rdi + 8], r14
and qword [rsi + 0x138], 0
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsi + 0x200]
and qword [rdi], 0
mov qword [rdi + 8], rax
jmp 0x140076dfa
lea rcx, str.assertion_failed:_buf.len_____sizes.cbMaximumMessage_as_usize
lea r8, str._Users_halo_Desktop_code_phishing_mpclient_dll_hijack_only_cs_vendor_schannel_src_tls_stream.rs
mov edx, 0x3e
call fcn.140013970
ud2