Function at 0x140002e90
Capabilities:
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Enumerate gui resources

Disassembly:
push rbp
push rsi
push r14
push r15
lea rbp, [rsp - 0x3f]
sub rsp, 0x98
mov rax, qword [0x140028010]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov r14, rcx
lea rdx, [0x140001ef0]
mov rcx, qword [0x140029e48]
xor r15d, r15d
xor r8d, r8d
mov dword [rbp - 0x29], r15d
call qword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
mov rsi, qword [0x140029ee0]
test rsi, rsi
je 0x1400030e4
mov qword [rsp + 0xc8], rbx
mov qword [rsp + 0xd8], r12
mov r12d, 0x8664
mov qword [rsp + 0x90], r13
mov r13d, 0x2000
mov qword [rsp + 0xd0], rdi
nop
mov rbx, qword [0x140029d18]
lea r8, str.RTID
movzx edx, word [rsi]
mov rcx, rbx
call fcn.140007b20
test rax, rax
je 0x1400030b7
mov edi, dword [rax]
add rdi, qword [rbx + 8]
je 0x1400030b7
mov eax, dword [rax + 4]
mov ecx, eax
mov dword [rbp - 0x29], eax
call fcn.14000c014
mov rbx, rax
test rax, rax
je 0x1400030b7
mov r8d, dword [rbp - 0x29]
mov rdx, rdi
mov rcx, rax
call fcn.14000b3e0
movups xmm1, xmmword [r14 + 0x10]
mov rcx, qword [0x140029f00]
lea rax, [rbp - 0x21]
xorps xmm0, xmm0
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov dword [rbp - 0x19], 1
movups xmmword [rbp + 0x1f], xmm0
lea rdx, [rbp - 0x11]
mov dword [rbp - 0x11], 0x208
movups xmm0, xmmword [r14]
lea r8d, [r9 + 0x2c]
mov dword [rbp - 0xd], 0x6610
mov dword [rbp - 9], 0x20
movups xmmword [rbp - 5], xmm0
mov dword [rsp + 0x20], r15d
movups xmmword [rbp + 0xb], xmm1
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x1400030af
mov rcx, qword [rbp - 0x21]
lea r8, [rbp - 0x19]
xor r9d, r9d
lea edx, [r9 + 4]
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x1400030a5
mov rcx, qword [rbp - 0x21]
lea r8, [rbp + 0x1f]
xor r9d, r9d
lea edx, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x1400030a5
mov rcx, qword [rbp - 0x21]
lea rax, [rbp - 0x29]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x1400030af
mov edx, dword [rbp - 0x29]
cmp edx, 0x130
jb 0x1400030af
movsxd r8, dword [rbx + 0x3c]
mov r9d, dword [r8 + rbx + 0x54]
cmp edx, r9d
jb 0x1400030af
lea rcx, [r8 + 0x108]
cmp rdx, rcx
jb 0x1400030af
cmp word [r8 + rbx + 4], r12w
jne 0x1400030af
test word [r8 + rbx + 0x16], r13w
je 0x1400030af
cmp edx, r9d
jb 0x1400030af
mov rcx, rbx
call fcn.140007550
test rax, rax
je 0x1400030af
lea rdx, [rbp - 0x19]
mov qword [rbp - 0x19], r15
mov rcx, rax
call fcn.140001790
test eax, eax
jne 0x14000309a
call fcn.140003d30
test eax, eax
je 0x1400030af
mov rcx, qword [rbp - 0x19]
call fcn.140002cf0
jmp 0x1400030af
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, rbx
call fcn.14000c000
mov rsi, qword [rsi + 8]
test rsi, rsi
jne 0x140002f10
mov r13, qword [rsp + 0x90]
mov r12, qword [rsp + 0xd8]
mov rdi, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0xc8]
xor eax, eax
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140007c70
add rsp, 0x98
pop r15
pop r14
pop rsi
pop rbp
ret