Function at 0x140026c50
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x230
xor r12d, r12d
mov dword [rsp + 0x60], r12d
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x68], r12
mov qword [rcx], r12
mov qword [rcx + 8], r12
mov qword [rcx + 0x10], r12
mov dword [rsp + 0x60], 1
mov rax, qword [rsp + 0x298]
mov rdi, qword [rax + 8]
sub rdi, qword [rax]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov esi, r12d
mov qword [rsp + 0x88], r12
movabs r15, 0x7fffffffffffffff
je 0x140026d36
cmp rdi, r15
ja 0x140027348
cmp rdi, 0x1000
jb 0x140026d00
lea rcx, [rdi + 0x27]
cmp rcx, rdi
jbe 0x14002734e
call fcn.140029830
test rax, rax
je 0x14002750f
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140026d0b
mov rcx, rdi
call fcn.140029830
mov rbx, rax
mov qword [rsp + 0x78], rbx
lea rsi, [rbx + rdi]
mov qword [rsp + 0x88], rsi
mov r8, rdi
xor edx, edx
mov rcx, rbx
call fcn.140053330
mov rax, rsi
mov qword [rsp + 0x80], rax
jmp 0x140026d43
mov rax, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x78]
mov qword [rsp + 0x70], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xd8], xmm0
mov qword [rsp + 0xe8], r12
movdqu xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xd0], r12
mov dword [rsp + 0x50], r12d
xor r9d, r9d
lea r8, str.Microsoft_Primitive_Provider
lea rdx, [0x1400596b8]
lea rcx, [rsp + 0x58]
call sub.bcrypt.dll_BCryptOpenAlgorithmProvider
mov edi, eax
test eax, eax
jns 0x140026de5
lea rdx, str.BCryptOpenAlgorithmProvider_FAILED_::_0x
lea rcx, [0x14006fd70]
call fcn.1400017c0
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov ecx, dword [rdx + rax + 0x18]
and ecx, 0xfffff9ff
bts ecx, 0xb
mov dword [rdx + rax + 0x18], ecx
mov edx, edi
mov rcx, rax
call fcn.140026a40
lea rdx, [0x1400596c0]
mov rcx, rax
call fcn.1400017c0
mov rcx, rax
call fcn.140007890
jmp 0x1400273a1
mov dword [rsp + 0x20], r12d
mov r9d, 0x20
lea r8, str.ChainingModeGCM
lea rdx, str.ChainingMode
mov rcx, qword [rsp + 0x58]
call sub.bcrypt.dll_BCryptSetProperty
mov edi, eax
test eax, eax
js 0x140027354
lea r8, str.ObjectLength
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0xa8]
call fcn.140027bb0
nop
mov rax, qword [rsp + 0xb0]
sub rax, qword [rsp + 0xa8]
cmp rax, 4
jne 0x1400273ca
mov rcx, qword [rsp + 0x278]
mov rdi, qword [rcx + 8]
sub rdi, qword [rcx]
add rdi, 0xc
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xf0], xmm0
mov r13, r12
mov qword [rsp + 0x100], r12
mov r14, r12
je 0x140026ef4
cmp rdi, r15
ja 0x140027402
cmp rdi, 0x1000
jb 0x140026eb0
lea rcx, [rdi + 0x27]
cmp rcx, rdi
jbe 0x140027407
call fcn.140029830
test rax, rax
je 0x1400274cb
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x140026ebb
mov rcx, rdi
call fcn.140029830
mov r14, rax
mov r15, r14
mov qword [rsp + 0xf0], r14
lea r13, [r14 + rdi]
mov r12, r13
mov qword [rsp + 0x100], r13
mov r8, rdi
xor edx, edx
mov rcx, r14
call fcn.140053330
mov qword [rsp + 0xf8], r13
mov rcx, qword [rsp + 0x278]
jmp 0x140026efc
mov r15, qword [rsp + 0xf0]
mov dword [rsp + 0x60], 3
mov dword [r15], 0x4d42444b
mov dword [r15 + 4], 1
mov eax, dword [rcx + 8]
sub eax, dword [rcx]
mov dword [r15 + 8], eax
mov rdx, qword [rcx]
mov r8, qword [rcx + 8]
sub r8, rdx
lea rcx, [r15 + 0xc]
call fcn.140052c90
nop
cmp r14, r12
je 0x14002740d
mov rax, qword [rsp + 0xa8]
movsxd rdx, dword [rax]
lea rcx, [rsp + 0xd8]
call fcn.1400223b0
sub r12d, r14d
mov eax, dword [rsp + 0xe0]
mov r14, qword [rsp + 0xd8]
sub eax, r14d
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x68]
lea r8, str.KeyDataBlob
xor edx, edx
mov rcx, qword [rsp + 0x58]
call sub.bcrypt.dll_BCryptImportKey
test eax, eax
js 0x140027435
mov dword [rsp + 0x114], 1
mov rax, qword [rsp + 0x280]
mov rcx, qword [rax]
mov qword [rsp + 0x118], rcx
mov eax, dword [rax + 8]
sub eax, ecx
mov dword [rsp + 0x120], eax
mov rax, qword [rsp + 0x298]
mov rcx, qword [rax]
mov qword [rsp + 0x138], rcx
mov eax, dword [rax + 8]
sub eax, ecx
mov dword [rsp + 0x140], eax
mov qword [rsp + 0x148], rbx
mov rax, qword [rsp + 0x70]
sub eax, ebx
mov dword [rsp + 0x150], eax
xor r12d, r12d
mov dword [rsp + 0x154], r12d
mov qword [rsp + 0x158], r12
mov dword [rsp + 0x160], r12d
mov dword [rsp + 0x130], r12d
mov qword [rsp + 0x128], r12
mov dword [rsp + 0x110], 0x58
lea r8, str.AuthTagLength
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x90]
call fcn.140027bb0
nop
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x90]
sub rax, rcx
cmp rax, 9
jb 0x140027461
mov edx, dword [rcx + 4]
lea rcx, [rsp + 0xc0]
call fcn.1400223b0
mov rax, qword [rsp + 0x290]
mov r8d, dword [rax + 8]
sub r8d, dword [rax]
mov ecx, dword [rsp + 0xc8]
mov rdi, qword [rsp + 0xc0]
sub ecx, edi
mov dword [rsp + 0x298], ecx
mov dword [rsp + 0x48], r12d
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x40], rdx
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x110]
mov rdx, qword [rax]
mov rcx, qword [rsp + 0x68]
call sub.bcrypt.dll_BCryptDecrypt
test eax, eax
js 0x1400274d7
mov ecx, dword [rsp + 0x50]
test ecx, ecx
je 0x1400274d7
mov edx, ecx
mov r12, qword [rsp + 0x270]
mov rcx, r12
call fcn.1400223b0
mov ecx, dword [r12 + 8]
sub ecx, dword [r12]
mov rax, qword [r12]
mov rdx, qword [rsp + 0x290]
mov r8d, dword [rdx + 8]
sub r8d, dword [rdx]
mov dword [rsp + 0x48], 0
lea r9, [rsp + 0x50]
mov qword [rsp + 0x40], r9
mov dword [rsp + 0x38], ecx
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x298]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x110]
mov rdx, qword [rdx]
mov rcx, qword [rsp + 0x68]
call sub.bcrypt.dll_BCryptDecrypt
test eax, eax
js 0x140027499
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x1400271bf
mov rdx, qword [rsp + 0xa0]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400271a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400274c5
call fcn.14002986c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xa0], 0
sub r13, r15
mov rax, r15
cmp r13, 0x1000
jb 0x1400271e7
add r13, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400274cb
mov rdx, r13
mov rcx, r15
call fcn.14002986c
nop
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x140027236
mov rdx, qword [rsp + 0xb8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027230
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400274d1
call fcn.14002986c
nop
jmp 0x14002725d
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14002726c
call sub.bcrypt.dll_BCryptDestroyKey
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14002727e
xor edx, edx
call sub.bcrypt.dll_BCryptCloseAlgorithmProvider
nop
test rdi, rdi
je 0x1400272bc
mov rdx, qword [rsp + 0xd0]
sub rdx, rdi
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400272b3
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027503
mov rcx, rdi
call fcn.14002986c
nop
test r14, r14
je 0x1400272fa
mov rdx, qword [rsp + 0xe8]
sub rdx, r14
mov rax, r14
cmp rdx, 0x1000
jb 0x1400272f1
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027509
mov rcx, r14
call fcn.14002986c
nop
test rbx, rbx
je 0x140027332
sub rsi, rbx
mov rax, rbx
cmp rsi, 0x1000
jb 0x140027327
add rsi, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002750f
mov rdx, rsi
mov rcx, rbx
call fcn.14002986c
mov rax, r12
add rsp, 0x230
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.14001a630
int3
call fcn.14001a090
nop
lea rdx, str.BCryptSetProperty_FAILED_::_0x
lea rcx, [0x14006fd70]
call fcn.1400017c0
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov ecx, dword [rdx + rax + 0x18]
and ecx, 0xfffff9ff
bts ecx, 0xb
mov dword [rdx + rax + 0x18], ecx
mov edx, edi
mov rcx, rax
call fcn.140026a40
lea rdx, [0x1400596c0]
mov rcx, rax
call fcn.1400017c0
mov rcx, rax
call fcn.140007890
lea rdx, str.BCryptGetProperty_failed
lea rcx, [rsp + 0x188]
call fcn.140011700
lea rdx, [0x14006cbf0]
lea rcx, [rsp + 0x188]
call fcn.14002a9d4
nop
lea rcx, [rsp + 0xa8]
call fcn.140024af0
lea rdx, str.Invalid_PropertySize::
add rdx, rax
lea rcx, [rsp + 0x1a0]
call fcn.140011700
lea rdx, [0x14006cbf0]
lea rcx, [rsp + 0x1a0]
call fcn.14002a9d4
call fcn.14001a630
call fcn.14001a090
nop
lea rdx, str.Invalid_Blob_Size
lea rcx, [rsp + 0x1b8]
call fcn.140011700
lea rdx, [0x14006cbf0]
lea rcx, [rsp + 0x1b8]
call fcn.14002a9d4
mov r8d, eax
lea rdx, str.BCryptImportKey_FAILED_
lea rcx, [rsp + 0x1d0]
call fcn.140011740
lea rdx, [0x14006cbf0]
lea rcx, [rsp + 0x1d0]
call fcn.14002a9d4
nop
lea rcx, [rsp + 0x90]
call fcn.140024af0
mov r8, rax
lea rdx, str.Invalid_PropertySize::_FAILED_
lea rcx, [rsp + 0x1e8]
call fcn.140011740
lea rdx, [0x14006cbf0]
lea rcx, [rsp + 0x1e8]
call fcn.14002a9d4
mov r8d, eax
lea rdx, str.BCryptDecrypt2_FAILED_
lea rcx, [rsp + 0x200]
call fcn.140011740
lea rdx, [0x14006cbf0]
lea rcx, [rsp + 0x200]
call fcn.14002a9d4
nop
call fcn.14002f614
nop
call fcn.14002f614
nop
call fcn.14002f614
nop
mov r8d, eax
lea rdx, str.BCryptDecrypt_FAILED__or_ptext_sz_FAILED_0_
lea rcx, [rsp + 0x218]
call fcn.140011740
lea rdx, [0x14006cbf0]
lea rcx, [rsp + 0x218]
call fcn.14002a9d4
nop
call fcn.14002f614
nop
call fcn.14002f614
nop
call fcn.14002f614
int3