Function at 0x140003c30
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x150
mov rax, qword [0x140051098]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x60], r8
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
mov qword [r11 - 0x100], rdx
xor ebx, ebx
mov qword [rsp + 0x78], rbx
mov qword [r11 - 0x108], rbx
mov r12, qword [rdx + 0x10]
mov dword [rsp + 0xf0], ebx
xorps xmm1, xmm1
movdqu xmmword [r11 - 0x78], xmm1
mov r15d, ebx
mov qword [r11 - 0x68], rbx
test r12, r12
je 0x140003cd3
mov rdx, r12
lea rcx, [r11 - 0x78]
call fcn.14000f8b0
mov r8, r12
xor edx, edx
mov r14, qword [rsp + 0x110]
mov rcx, r14
call fcn.140017670
lea rax, [r14 + r12]
mov qword [rsp + 0x118], rax
mov r15, qword [rsp + 0x120]
jmp 0x140003cdb
mov r14, qword [rsp + 0x110]
xorps xmm1, xmm1
movdqu xmmword [rsp + 0xf8], xmm1
mov rax, rbx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x108], rbx
movdqu xmmword [rsp + 0x128], xmm1
mov qword [rsp + 0x138], rbx
mov ecx, 0xc
call fcn.140014fb8
mov rbx, rax
mov qword [rsp + 0x128], rax
lea r13, [rax + 0xc]
mov qword [rsp + 0x138], r13
xor eax, eax
mov qword [rbx], rax
mov dword [rbx + 8], eax
mov qword [rsp + 0x130], r13
cmp qword [rsi + 0x18], 0x10
jb 0x140003d48
mov r8, qword [rsi]
mov rdx, r8
jmp 0x140003d4e
mov rdx, rsi
mov r8, rsi
add r8, 0xf
add rdx, 3
sub r8, rdx
mov rcx, rbx
call fcn.140016fb0
mov rax, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x140003d73
mov rax, qword [rsi]
mov rdx, rax
jmp 0x140003d76
mov rdx, rsi
lea r8, [rax + r12]
add rdx, 0xf
sub r8, rdx
mov rcx, r14
call fcn.140016fb0
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140048980]
lea rcx, [rsp + 0x78]
call qword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
mov dword [rsp + 0x50], eax
test eax, eax
jns 0x140003ebb
lea rdx, str.BCryptOpenAlgorithmProvider_failed_with_status:
lea rcx, [0x1400527d0]
call fcn.14000c390
mov edx, dword [rsp + 0x50]
mov rcx, rax
call fcn.140006170
mov rcx, rax
call fcn.14000c300
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
xor r12d, r12d
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], r12
xor r8d, r8d
lea rdx, [0x1400486fd]
mov rcx, rdi
call fcn.14000cf10
nop
test rbx, rbx
je 0x140003e31
sub r13, rbx
cmp r13, 0x1000
jb 0x140003e25
add r13, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x14000479a
mov rbx, rcx
mov rdx, r13
mov rcx, rbx
call fcn.140014fb0
nop
test r14, r14
je 0x140003e6a
sub r15, r14
mov rax, r14
cmp r15, 0x1000
jb 0x140003e5e
add r15, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400047a0
mov rdx, r15
mov rcx, r14
call fcn.140014fb0
nop
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x140003ea4
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x140003e9f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000477d
mov rcx, r8
call fcn.140014fb0
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov rax, rdi
jmp 0x14000475a
mov dword [rsp + 0x20], 0
mov r9d, 0x20
lea r8, str.ChainingModeGCM
lea rdx, str.ChainingMode
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.bcrypt.dll_BCryptSetProperty]
mov dword [rsp + 0x50], eax
test eax, eax
jns 0x140004009
lea rdx, str.BCryptSetProperty_failed_with_status:
lea rcx, [0x1400527d0]
call fcn.14000c390
mov edx, dword [rsp + 0x50]
mov rcx, rax
call fcn.140006170
mov rcx, rax
call fcn.14000c300
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.bcrypt.dll_BCryptCloseAlgorithmProvider]
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
xor r12d, r12d
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], r12
xor r8d, r8d
lea rdx, [0x1400486fd]
mov rcx, rdi
call fcn.14000cf10
nop
test rbx, rbx
je 0x140003f7f
sub r13, rbx
cmp r13, 0x1000
jb 0x140003f73
add r13, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x14000479a
mov rbx, rcx
mov rdx, r13
mov rcx, rbx
call fcn.140014fb0
nop
test r14, r14
je 0x140003fb8
sub r15, r14
mov rax, r14
cmp r15, 0x1000
jb 0x140003fac
add r15, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400047a0
mov rdx, r15
mov rcx, r14
call fcn.140014fb0
nop
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x140003ff2
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x140003fed
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000477d
mov rcx, r8
call fcn.140014fb0
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov rax, rdi
jmp 0x14000475a
mov dword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x60]
mov eax, dword [rcx]
mov dword [rsp + 0x28], eax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.bcrypt.dll_BCryptGenerateSymmetricKey]
mov dword [rsp + 0x50], eax
test eax, eax
jns 0x140004165
lea rdx, str.BcryptGenertaeSymmetricKey_failed_with_status:
lea rcx, [0x1400527d0]
call fcn.14000c390
mov edx, dword [rsp + 0x50]
mov rcx, rax
call fcn.140006170
mov rcx, rax
call fcn.14000c300
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.bcrypt.dll_BCryptCloseAlgorithmProvider]
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
xor r12d, r12d
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], r12
xor r8d, r8d
lea rdx, [0x1400486fd]
mov rcx, rdi
call fcn.14000cf10
nop
test rbx, rbx
je 0x1400040db
sub r13, rbx
cmp r13, 0x1000
jb 0x1400040cf
add r13, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x14000479a
mov rbx, rcx
mov rdx, r13
mov rcx, rbx
call fcn.140014fb0
nop
test r14, r14
je 0x140004114
sub r15, r14
mov rax, r14
cmp r15, 0x1000
jb 0x140004108
add r15, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400047a0
mov rdx, r15
mov rcx, r14
call fcn.140014fb0
nop
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x14000414e
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x140004149
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000477d
mov rcx, r8
call fcn.140014fb0
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov rax, rdi
jmp 0x14000475a
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
movups xmmword [rsp + 0xc0], xmm0
movups xmmword [rsp + 0xd0], xmm0
mov qword [rsp + 0xe0], rax
mov dword [rsp + 0x90], 0x58
mov dword [rsp + 0x94], 1
lea rcx, [r12 - 0x1f]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x98], rbx
mov dword [rsp + 0xa0], 0xc
lea rax, [r14 + rcx]
mov qword [rsp + 0xb8], rax
mov dword [rsp + 0xc0], 0x10
xor edx, edx
mov dword [rsp + 0x48], edx
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], edx
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x90]
mov r8d, ecx
mov rdx, r14
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.bcrypt.dll_BCryptDecrypt]
mov r12d, eax
test eax, eax
jns 0x14000433d
lea rdx, str.BCryptDecrypt__1__failed_with_status:
lea rcx, [0x1400527d0]
call fcn.14000c390
mov edx, r12d
mov rcx, rax
call fcn.140006170
mov rcx, rax
call fcn.14000c300
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
xor r12d, r12d
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], r12
xor r8d, r8d
lea rdx, [0x1400486fd]
mov rcx, rdi
call fcn.14000cf10
nop
test rbx, rbx
je 0x1400042b3
sub r13, rbx
cmp r13, 0x1000
jb 0x1400042a7
add r13, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x14000479a
mov rbx, rcx
mov rdx, r13
mov rcx, rbx
call fcn.140014fb0
nop
test r14, r14
je 0x1400042ec
sub r15, r14
mov rax, r14
cmp r15, 0x1000
jb 0x1400042e0
add r15, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400047a0
mov rdx, r15
mov rcx, r14
call fcn.140014fb0
nop
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x140004326
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x140004321
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000477d
mov rcx, r8
call fcn.140014fb0
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov rax, rdi
jmp 0x14000475a
mov ecx, dword [rsp + 0xf0]
mov edx, ecx
test ecx, ecx
je 0x14000436b
lea rcx, [rsp + 0xf8]
call fcn.1400102e0
mov ecx, dword [rsp + 0xf0]
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0x58], rax
xor edx, edx
mov dword [rsp + 0x48], edx
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], ecx
mov r12, qword [rsp + 0xf8]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x90]
mov r8d, dword [rsp + 0x60]
mov rdx, r14
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.bcrypt.dll_BCryptDecrypt]
mov dword [rsp + 0x50], eax
test eax, eax
jns 0x140004512
lea rdx, str.BCrypt_Decrypt__2__failed_with_status:
lea rcx, [0x1400527d0]
call fcn.14000c390
mov edx, dword [rsp + 0x50]
mov rcx, rax
call fcn.140006170
mov rcx, rax
call fcn.14000c300
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
xor eax, eax
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], rax
xor r8d, r8d
lea rdx, [0x1400486fd]
mov rcx, rdi
call fcn.14000cf10
nop
test rbx, rbx
je 0x140004445
sub r13, rbx
cmp r13, 0x1000
jb 0x140004439
add r13, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x14000479a
mov rbx, rcx
mov rdx, r13
mov rcx, rbx
call fcn.140014fb0
nop
test r12, r12
je 0x140004484
mov rcx, qword [rsp + 0x58]
sub rcx, r12
mov rax, r12
cmp rcx, 0x1000
jb 0x140004478
add rcx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004794
mov rdx, rcx
mov rcx, r12
call fcn.140014fb0
nop
test r14, r14
je 0x1400044bd
sub r15, r14
mov rax, r14
cmp r15, 0x1000
jb 0x1400044b1
add r15, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400047a0
mov rdx, r15
mov rcx, r14
call fcn.140014fb0
nop
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x1400044f7
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x1400044f2
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000477d
mov rcx, r8
call fcn.140014fb0
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov rax, rdi
jmp 0x14000475a
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.bcrypt.dll_BCryptCloseAlgorithmProvider]
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
xor edx, edx
mov qword [rdi + 0x10], rdx
mov qword [rdi + 0x18], 0xf
mov r9, qword [rsp + 0x100]
cmp r12, r9
jne 0x140004547
mov byte [rdi], dl
jmp 0x140004649
mov rax, r9
sub rax, r12
mov r8, r12
movabs rcx, 0x7fffffffffffffff
mov qword [rsp + 0x50], rcx
cmp rax, rcx
ja 0x140004783
cmp rax, 0x10
jb 0x140004610
or rax, 0xf
cmp rax, rcx
ja 0x140004591
mov rcx, rax
mov edx, 0x16
cmp rax, rdx
cmovb rcx, rdx
mov qword [rsp + 0x50], rcx
xor edx, edx
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x1400045e3
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140004789
mov rcx, rax
call fcn.140014fb8
mov rcx, rax
test rax, rax
je 0x14000478e
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov r8, r12
mov r9, qword [rsp + 0x100]
jmp 0x1400045fd
test rcx, rcx
je 0x1400045fa
call fcn.140014fb8
mov r8, r12
mov r9, qword [rsp + 0x100]
jmp 0x1400045fd
mov rax, rdx
mov qword [rdi], rax
mov rax, qword [rsp + 0x50]
mov qword [rdi + 0x18], rax
nop dword [rax]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14000461d
mov rdx, qword [rdi]
movzx ecx, byte [r8]
mov rax, qword [rdi + 0x10]
mov byte [rdx + rax], cl
inc qword [rdi + 0x10]
mov rax, qword [rdi + 0x10]
inc r8
cmp r8, r9
jne 0x140004610
mov rcx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x140004645
mov rcx, qword [rdi]
mov byte [rax + rcx], 0
test rbx, rbx
je 0x140004682
sub r13, rbx
cmp r13, 0x1000
jb 0x140004676
add r13, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x14000479a
mov rbx, rcx
mov rdx, r13
mov rcx, rbx
call fcn.140014fb0
nop
test r12, r12
je 0x1400046c1
mov rcx, qword [rsp + 0x58]
sub rcx, r12
mov rax, r12
cmp rcx, 0x1000
jb 0x1400046b5
add rcx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004794
mov rdx, rcx
mov rcx, r12
call fcn.140014fb0
nop
test r14, r14
je 0x1400046fa
sub r15, r14
mov rax, r14
cmp r15, 0x1000
jb 0x1400046ee
add r15, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400047a0
mov rdx, r15
mov rcx, r14
call fcn.140014fb0
nop
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x140004730
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x14000472b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000477d
mov rcx, r8
call fcn.140014fb0
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov rax, rdi
jmp 0x14000475a
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140014f90
add rsp, 0x150
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.140023880
nop
call fcn.1400016e0
nop
call fcn.140001640
call fcn.140023880
nop
call fcn.140023880
nop
call fcn.140023880
nop
call fcn.140023880
int3