Function at 0x140103260
Capabilities:
Create new key via cryptacquirecontext
Encrypt or decrypt via wincrypt

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1402b7040]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rcx, [rsp + 0x78]
mov qword [rcx], rax
mov qword [rsp + 0x70], rax
movaps xmm0, xmmword [0x140275a70]
movaps xmmword [rsp + 0x80], xmm0
mov dword [rsp + 0x90], 0xaaaaaaaa
mov dword [rsp + 0x6c], 8
mov dword [rsp + 0x20], 0xf0000040
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1401036b5
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rsi
movabs rax, 0x660100000208
lea rcx, [rsp + 0x80]
mov qword [rcx], rax
mov dword [rcx + 8], 8
mov r10, rcx
mov al, byte [rbx]
mov dil, byte [rbx + 1]
mov ecx, edi
shr cl, 1
mov r8d, eax
shl r8b, 7
or r8b, cl
mov r12b, byte [rbx + 2]
mov r13d, r12d
mov byte [rsp + 0x39], r12b
shr r13b, 2
mov ecx, edi
shl cl, 6
mov byte [rsp + 0x38], cl
or r13b, cl
mov r14b, byte [rbx + 3]
mov r15d, r14d
shr r15b, 3
shl r12b, 5
or r15b, r12b
mov cl, byte [rbx + 4]
mov ebp, ecx
mov rdx, rcx
mov qword [rsp + 0x58], rcx
shr bpl, 4
mov ecx, r14d
shl cl, 4
mov byte [rsp + 0x3b], cl
or bpl, cl
mov cl, byte [rbx + 5]
mov r9d, ecx
mov qword [rsp + 0x60], rcx
shr r9b, 5
lea edx, [rdx*8]
mov dword [rsp + 0x40], edx
or r9b, dl
mov byte [rsp + 0x3a], r9b
mov byte [r10 + 0x11], r9b
mov r11, r10
mov sil, byte [rbx + 6]
lea r10d, [rcx*4]
mov dword [rsp + 0x3c], r10d
lea ecx, [rsi + rsi]
mov dword [rsp + 0x44], ecx
mov ecx, eax
shr cl, 7
mov edx, eax
shr dl, 6
xor dl, cl
mov ecx, eax
shr cl, 5
mov r9d, eax
shr r9b, 4
xor r9b, cl
xor r9b, dl
mov ecx, eax
shr cl, 3
mov edx, eax
shr dl, 2
xor dl, cl
mov ecx, eax
shr cl, 1
xor cl, dl
xor cl, r9b
and cl, 1
mov edx, eax
and dl, 0xfe
or dl, cl
xor dl, 1
mov byte [r11 + 0xc], dl
mov r9, r11
and al, 1
mov ecx, r8d
shr cl, 6
xor cl, al
mov eax, r8d
shr al, 5
mov edx, r8d
shr dl, 4
xor dl, al
xor dl, cl
mov eax, r8d
xor al, dil
shr al, 3
mov r11d, edi
shr r11b, 2
xor r11b, al
xor r11b, dl
mov rax, rsi
mov ebx, eax
mov ecx, eax
shr cl, 2
mov edx, eax
shr dl, 1
xor dl, cl
xor dl, al
mov ecx, eax
shr cl, 6
or cl, r10b
and r11b, 1
and r8b, 0xfe
or r8b, r11b
xor r8b, 1
mov r10, r9
mov byte [r9 + 0xd], r8b
mov al, byte [rsp + 0x38]
shr al, 7
and dil, 3
xor dil, al
mov r8d, r13d
shr r8b, 5
xor r8b, dil
mov r11d, r13d
shr r11b, 4
mov edi, r13d
shr dil, 3
xor dil, r11b
xor dil, r8b
mov r9b, byte [rsp + 0x39]
mov eax, r9d
shr al, 4
mov r11d, r9d
shr r11b, 3
xor r11b, al
xor r11b, dil
and r11b, 1
and r13b, 0xfe
or r13b, r11b
xor r13b, 1
mov byte [r10 + 0xe], r13b
mov r8d, r12d
shr r8b, 7
shr r12b, 6
xor r12b, r8b
and r9b, 7
xor r9b, r12b
mov r8d, r15d
shr r8b, 4
mov r11d, r15d
shr r11b, 3
xor r11b, r8b
xor r11b, r9b
mov r8d, r14d
shr r8b, 5
mov edi, r14d
shr dil, 4
xor dil, r8b
xor dil, r11b
and dil, 1
and r15b, 0xfe
or r15b, dil
xor r15b, 1
mov r12, r10
mov byte [r10 + 0xf], r15b
mov r10b, byte [rsp + 0x3b]
mov r8d, r10d
shr r8b, 7
mov r11d, r10d
shr r11b, 6
xor r11b, r8b
shr r10b, 5
and r14b, 0xf
xor r14b, r10b
xor r14b, r11b
mov r8d, ebp
shr r8b, 3
mov rdi, qword [rsp + 0x58]
mov r11d, edi
shr r11b, 6
xor r11b, r8b
xor r11b, r14b
mov r8d, edi
mov r13, rdi
shr r8b, 5
xor r8b, r11b
and r8b, 1
and bpl, 0xfe
or bpl, r8b
xor bpl, 1
mov byte [r12 + 0x10], bpl
mov r10d, dword [rsp + 0x40]
mov r8d, r10d
shr r8b, 7
mov r11d, r10d
shr r11b, 6
xor r11b, r8b
mov r8d, r10d
shr r8b, 5
shr r10b, 4
xor r10b, r8b
xor r10b, r11b
and r13b, 0x1f
mov r15, qword [rsp + 0x60]
mov r8d, r15d
mov eax, dword [rsp + 0x3c]
mov r11d, eax
mov edi, eax
mov ebp, eax
mov r14d, eax
shr al, 3
xor al, r15b
mov r9d, eax
shr r15b, 7
xor r15b, r13b
shr r8b, 6
xor r8b, r15b
xor r8b, r10b
and r8b, 1
mov al, byte [rsp + 0x3a]
and al, 0xfe
or al, r8b
xor al, 1
mov byte [r12 + 0x11], al
shr r11b, 7
shr dil, 6
xor dil, r11b
shr bpl, 5
shr r14b, 4
xor r14b, bpl
xor r14b, dil
shr sil, 7
xor sil, r9b
xor sil, r14b
and sil, 1
and cl, 0xfe
or cl, sil
xor cl, 1
mov byte [r12 + 0x12], cl
mov r10d, dword [rsp + 0x44]
mov ecx, r10d
shr cl, 7
mov r8d, r10d
shr r8b, 6
xor r8b, cl
mov ecx, r10d
shr cl, 5
shr bl, 3
xor bl, cl
xor bl, r8b
xor dl, bl
and dl, 1
or dl, r10b
xor dl, 1
mov byte [r12 + 0x13], dl
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov rdx, r12
mov r8d, 0x14
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x1401036a8
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov r8, qword [rsp + 0x50]
mov qword [r8], rax
lea rax, [rsp + 0x6c]
mov edx, dword [rax]
mov rcx, qword [rsp + 0x70]
mov dword [rsp + 0x30], edx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x78]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
cmp rcx, qword [0x1402b7040]
je 0x1401036cf
call fcn.14019f290
int3
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret