Function at 0x18004a154
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rsi, rcx
mov r12, r9
mov ebx, r8d
mov rdi, rdx
xor r14d, r14d
lea rcx, [rbp - 0x30]
lea r13d, [r14 + 0x18]
xor r8d, r8d
xor edx, edx
mov r9d, r13d
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x18004a56e
mov rcx, qword [rbp - 0x30]
lea rax, [rbp - 0x28]
xor r9d, r9d
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], r14d
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x18004a562
mov eax, dword [rsi + 4]
lea edi, [r14 + 0x40]
mov edx, eax
mov ecx, edi
mov dword [rbp - 0x40], eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x18004a558
mov r8d, dword [rbp - 0x40]
mov rdx, qword [rsi + 0x1c]
mov rcx, rax
call fcn.1800ca790
mov rcx, qword [rbp - 0x28]
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
lea r15d, [r14 + 1]
xor r9d, r9d
xor edx, edx
mov r8d, r15d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x18004a53b
lea rcx, str._nRSA_decrypt_is_a_success_n
call fcn.18004d68c
mov edx, dword [rbx]
lea rcx, str.__MasterKey_len:__u_n
call fcn.18004d68c
mov edx, dword [rbx]
lea rcx, [rbx + 8]
mov r8d, 0x100001
call fcn.180053168
mov edx, dword [rbx + 4]
lea rcx, str.__SuppKey___len:__u_n
call fcn.18004d68c
mov ecx, dword [rbx]
mov edx, dword [rbx + 4]
add rcx, 8
mov r8d, 0x100001
add rcx, rbx
call fcn.180053168
mov r8d, dword [rbx]
mov rcx, qword [rbp - 0x30]
lea rax, [rbp - 0x20]
add r8, 8
mov r9d, r13d
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x38]
add r8, rbx
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], r14d
mov edx, 0x6603
call fcn.180043e88
test eax, eax
je 0x18004a54f
mov r8d, dword [rbx]
mov rcx, qword [rbp - 0x38]
xor r9d, r9d
add r8, 0x20
mov edx, r15d
add r8, rbx
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x18004a501
mov eax, dword [rsi + 8]
mov ecx, edi
mov edx, eax
mov dword [rbp - 0x40], eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x18004a515
mov r8d, dword [rbp - 0x40]
mov rdx, qword [rsi + 0x24]
mov rcx, rax
call fcn.1800ca790
mov rcx, qword [rbp - 0x38]
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x18004a4e2
mov eax, dword [rdi + 4]
lea r13, [rdi + 8]
lea rcx, str._n3DES_decrypt_is_a_success_too_n
add r13, rax
call fcn.18004d68c
mov edx, dword [rbp - 0x40]
mov r8d, 0x100001
mov rcx, rdi
call fcn.180053168
lea rsi, reloc.Cabinet.dll_FCICreate
mov rcx, rsi
call fcn.18004d68c
lea rcx, str.__nonce____:
call fcn.18004d68c
mov edx, dword [rdi + 4]
lea rcx, [rdi + 8]
xor r8d, r8d
call fcn.180053168
mov rcx, rsi
call fcn.18004d68c
lea rcx, str.__SID______:
call fcn.18004d68c
mov rcx, r13
call fcn.180053420
mov rcx, rsi
call fcn.18004d68c
lea rcx, str.__SHA1_____:
call fcn.18004d68c
mov ecx, dword [rbp - 0x40]
lea r15d, [r14 + 0x14]
add rcx, 0xffffffffffffffec
xor r8d, r8d
mov edx, r15d
add rcx, rdi
call fcn.180053168
mov rcx, rsi
call fcn.18004d68c
mov r8d, dword [rbp - 0x40]
lea r9, [rbp - 0x18]
add r8d, 0xffffffec
mov rdx, rdi
mov ecx, 0x8004
mov dword [rsp + 0x20], r15d
call fcn.180043cec
test eax, eax
je 0x18004a4f6
lea rcx, str.___Calc_SHA1:
call fcn.18004d68c
lea rcx, [rbp - 0x18]
xor r8d, r8d
mov edx, r15d
call fcn.180053168
mov rcx, rsi
call fcn.18004d68c
mov ecx, dword [rbp - 0x40]
mov rax, qword [rcx + rdi - 0x14]
cmp rax, qword [rbp - 0x18]
jne 0x18004a4f6
mov rax, qword [rcx + rdi - 0xc]
cmp rax, qword [rbp - 0x10]
jne 0x18004a4f6
mov eax, dword [rcx + rdi - 4]
cmp eax, dword [rbp - 8]
jne 0x18004a4f6
mov eax, dword [rbx]
mov r15, qword [rbp + 0x50]
lea ecx, [r14 + 0x40]
mov edx, eax
mov dword [r15], eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [r12], rax
test rax, rax
je 0x18004a4f6
mov r8d, dword [r15]
lea rdx, [rbx + 8]
mov rcx, rax
call fcn.1800ca790
mov rsi, qword [rbp + 0x58]
mov rcx, r13
and qword [rsi], r14
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
lea ecx, [r14 + 0x40]
mov edx, eax
mov dword [rbp - 0x40], eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsi], rax
test rax, rax
je 0x18004a4b8
mov ecx, dword [rbp - 0x40]
mov r8, r13
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_CopySid]
mov r14d, eax
test eax, eax
jne 0x18004a4f6
mov rcx, qword [r12]
test rcx, rcx
je 0x18004a4cb
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [r12], rax
mov rcx, qword [rsi]
test rcx, rcx
je 0x18004a4dc
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsi], rax
and dword [r15], 0
jmp 0x18004a4f6
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_dpapi_unprotect_domainkey_with_key___CryptDecrypt__0x_08x__n
mov edx, eax
call fcn.18004d68c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x18004a515
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_dpapi_unprotect_domainkey_with_key___CryptSetKeyParam__0x_08x__n
mov edx, eax
call fcn.18004d68c
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbp - 0x20]
call fcn.1800446d0
test eax, eax
jne 0x18004a54f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_dpapi_unprotect_domainkey_with_key___kull_m_crypto_close_hprov_delete_container__0x_08x__n
jmp 0x18004a548
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_dpapi_unprotect_domainkey_with_key___CryptDecrypt__0x_08x__n
mov edx, eax
call fcn.18004d68c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbp - 0x30]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea r11, [rsp + 0x80]
mov eax, r14d
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret