Function at 0x140054f90
Capabilities:
Encrypt data via sspi

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x10], 0xfffffffffffffffe
mov r15, r9
mov rsi, rcx
mov qword [rdx + 0x38], r8
lea rcx, [rbp - 0x38]
mov qword [rbp + 8], rdx
call fcn.140050000
mov eax, dword [rbp - 0x38]
cmp eax, 2
jne 0x140054fdf
mov r15, qword [rbp - 0x30]
mov r12, qword [rbp + 8]
jmp 0x140055065
test eax, eax
mov r12, qword [rbp + 8]
je 0x14005505b
mov rdx, qword [r12 + 0x90]
mov rdi, qword [r12 + 0x98]
cmp rdi, rdx
jne 0x1400551dd
mov rax, qword [rbp + 0x80]
mov rbx, qword [rbp - 0x30]
mov r14d, ebx
shr rbx, 0x20
cmp rax, rbx
cmovb rbx, rax
mov r13d, dword [rbp - 0x34]
lea r12, [rbx + r13]
add r14, r12
sub r14, rdi
jbe 0x1400550e0
mov rax, qword [rbp + 8]
lea rcx, [rax + 0x80]
mov rax, qword [rcx]
sub rax, rdi
cmp rax, r14
jae 0x14005509e
mov rdx, rdi
mov r8, r14
call fcn.1401bfef0
mov rax, qword [rbp + 8]
mov rdi, qword [rax + 0x90]
jmp 0x1400550a2
movabs r15, 0x8009031700000002
mov rcx, r15
call fcn.14004d5d0
cmp al, 0xd
jne 0x14005508e
mov qword [rsi], 2
mov qword [r12 + 0x38], 0
mov rcx, r15
call fcn.1400125b0
jmp 0x140055274
mov qword [rsi], 1
mov qword [rsi + 8], r15
jmp 0x14005526b
mov rax, qword [rbp + 8]
mov rax, qword [rax + 0x88]
lea rcx, [rax + rdi]
cmp r14, 2
jb 0x1400550cf
lea r8, [r14 - 1]
xor edx, edx
mov qword [rbp - 0x40], rax
call sub.VCRUNTIME140.dll_memset
add rdi, r14
dec rdi
mov rcx, qword [rbp - 0x40]
add rcx, rdi
mov byte [rcx], 0
inc rdi
mov rax, qword [rbp + 8]
mov qword [rax + 0x90], rdi
cmp r12, rdi
ja 0x1400552c5
mov rdi, qword [rbp + 8]
mov rcx, qword [rdi + 0x88]
add rcx, r13
mov rdx, r15
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rdx, qword [rdi + 0x90]
cmp rdx, r13
jb 0x1400552d9
cmp rdx, r12
jb 0x1400552ea
mov r8, qword [rbp + 8]
mov rax, qword [r8 + 0x88]
lea rcx, [rax + r13]
sub edx, r12d
add r12, rax
mov dword [rbp - 0x38], r13d
mov dword [rbp - 0x34], 7
mov qword [rbp - 0x30], rax
mov dword [rbp - 0x28], ebx
mov dword [rbp - 0x24], 1
mov qword [rbp - 0x20], rcx
mov dword [rbp - 0x18], edx
mov dword [rbp - 0x14], 6
mov qword [rbp - 0x10], r12
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
movabs rax, 0x400000000
mov qword [rbp - 0x50], rax
lea rax, [rbp - 0x38]
mov qword [rbp - 0x48], rax
lea rcx, [r8 + 0xf0]
lea r8, [rbp - 0x50]
xor edx, edx
xor r9d, r9d
call qword [sym.imp.secur32.dll_EncryptMessage]
mov r15d, eax
test eax, eax
je 0x1400551a2
shl r15, 0x20
or r15, 2
jmp 0x140054fd6
mov eax, dword [rbp - 0x28]
add eax, dword [rbp - 0x38]
add eax, dword [rbp - 0x18]
mov r12, qword [rbp + 8]
mov rdx, qword [r12 + 0x90]
cmp rdx, rax
jb 0x1400551c7
mov qword [r12 + 0x90], rax
mov rdx, rax
mov qword [r12 + 0x98], 0
mov qword [r12 + 0x118], rbx
xor edi, edi
cmp rdi, rdx
je 0x140055258
lea rbx, [r12 + 0x10]
lea r14, [rbp - 0x38]
nop dword [rax + rax]
mov rax, rdx
sub rax, rdi
jb 0x14005529a
mov r8, qword [r12 + 0x38]
test r8, r8
je 0x1400552ab
mov r9, qword [r12 + 0x88]
add r9, rdi
mov qword [rsp + 0x20], rax
mov rcx, r14
mov rdx, rbx
call fcn.140149e80
mov rax, qword [rbp - 0x38]
cmp rax, 2
je 0x14005528b
mov r15, qword [rbp - 0x30]
test rax, rax
mov r12, qword [rbp + 8]
jne 0x140055065
add rdi, r15
mov qword [r12 + 0x98], rdi
mov rdx, qword [r12 + 0x90]
cmp rdi, rdx
jne 0x1400551f0
mov rax, qword [r12 + 0x118]
mov qword [rsi], 0
mov qword [rsi + 8], rax
mov qword [r12 + 0x38], 0
mov rax, rsi
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
movabs r15, 0xd00000003
jmp 0x140054fd6
lea r8, str.C:Users_rootkit.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rsassertion_failed:_pos___self.dec_in.get_ref__.len___as_u64
mov rcx, rdi
call fcn.1401ca7a0
jmp 0x1400552f9
lea rcx, str.assertion_failed:__self.context.is_null__
lea r8, [0x1401d2738]
mov edx, 0x29
call fcn.1401ca2f0
jmp 0x1400552f9
lea r8, str.C:Users_rootkit.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rsassertion_failed:_pos___self.dec_in.get_ref__.len___as_u64
mov rcx, r12
mov rdx, rdi
call fcn.1401ca820
jmp 0x1400552f9
lea r8, str.C:Users_rootkit.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rsassertion_failed:_pos___self.dec_in.get_ref__.len___as_u64
mov rcx, r13
call fcn.1401ca820
jmp 0x1400552f9
lea r8, str.C:Users_rootkit.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.23_src_tls_stream.rsassertion_failed:_pos___self.dec_in.get_ref__.len___as_u64
mov rcx, r12
call fcn.1401ca820
ud2