Function at 0x140179b20
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x588
lea rdi, [rsp + 0x50]
mov ecx, 0x14e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x5a0]
mov rax, qword [0x1401db040]
xor rax, rsp
mov qword [rsp + 0x578], rax
mov rcx, qword [rsp + 0x5b0]
call fcn.140002ac0
cmp rax, 0xf
ja 0x140179c21
lea rcx, [rsp + 0x308]
call fcn.140004010
mov qword [rsp + 0x4a0], rax
mov byte [rsp + 0x2f8], 0
lea rax, [rsp + 0x2f9]
mov r8, rax
lea rdx, [rsp + 0x2f8]
lea rcx, [rsp + 0x310]
call fcn.140014290
lea rcx, [rsp + 0x320]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x480]
lea rcx, [rsp + 0x320]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov r8, qword [rsp + 0x4a0]
lea rdx, [rsp + 0x480]
mov rcx, qword [rsp + 0x5a8]
call fcn.1400144a0
mov rcx, qword [rsp + 0x5b0]
call fcn.140002650
nop
mov rax, qword [rsp + 0x5a8]
jmp 0x14017a5d8
lea rcx, [rsp + 0x330]
call fcn.140004010
mov qword [rsp + 0x4a8], rax
lea rax, [rsp + 0x338]
mov qword [rsp + 0x350], rax
lea rdx, [rsp + 0x358]
mov rcx, qword [rsp + 0x5b0]
call fcn.140014440
mov qword [rsp + 0x4b0], rax
mov r8d, 0xf
mov rdx, qword [rsp + 0x350]
mov rcx, qword [rsp + 0x4b0]
call fcn.140011950
mov qword [rsp + 0x4b8], rax
lea rax, [rsp + 0x370]
mov qword [rsp + 0x388], rax
lea rdx, [rsp + 0x390]
mov rcx, qword [rsp + 0x5b0]
call fcn.140014440
mov qword [rsp + 0x4c0], rax
mov r8d, 3
mov rdx, qword [rsp + 0x388]
mov rcx, qword [rsp + 0x4c0]
call fcn.140011950
mov qword [rsp + 0x4c8], rax
mov r9, qword [rsp + 0x4a8]
mov r8, qword [rsp + 0x4b8]
mov rdx, qword [rsp + 0x4c8]
lea rcx, [rsp + 0x58]
call fcn.1400194b0
lea rcx, [rsp + 0x390]
call fcn.140011730
lea rcx, [rsp + 0x358]
call fcn.140011730
nop
mov edx, 0x20
lea rcx, [rsp + 0x98]
call fcn.140011670
lea rcx, [rsp + 0x3a8]
call fcn.1400133f0
mov qword [rsp + 0x4d0], rax
lea rax, [rsp + 0x3b0]
mov qword [rsp + 0x3c8], rax
mov rdx, qword [rsp + 0x3c8]
mov rcx, qword [rsp + 0x5b0]
call fcn.140014390
mov qword [rsp + 0x4d8], rax
lea rax, [rsp + 0x3d0]
mov qword [rsp + 0x3e8], rax
lea rdx, [rsp + 0x3f0]
mov rcx, qword [rsp + 0x5b0]
call fcn.140014440
mov qword [rsp + 0x4e0], rax
mov r8d, 0xf
mov rdx, qword [rsp + 0x3e8]
mov rcx, qword [rsp + 0x4e0]
call fcn.140011950
mov qword [rsp + 0x4e8], rax
mov r9, qword [rsp + 0x4d0]
mov r8, qword [rsp + 0x4d8]
mov rdx, qword [rsp + 0x4e8]
lea rcx, [rsp + 0x98]
call fcn.140019580
lea rcx, [rsp + 0x3f0]
call fcn.140011730
nop
lea rcx, [rsp + 0x98]
call fcn.140013190
mov dword [rsp + 0xc4], eax
lea rcx, [rsp + 0x98]
call fcn.140013190
mov dword [rsp + 0xc8], eax
jmp 0x140179e24
mov eax, dword [rsp + 0xc8]
inc eax
mov dword [rsp + 0xc8], eax
cmp dword [rsp + 0xc8], 0x80
jge 0x140179e51
mov byte [rsp + 0x408], 0
lea rdx, [rsp + 0x408]
lea rcx, [rsp + 0x98]
call fcn.1400132c0
nop
jmp 0x140179e14
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xf8], 0
lea rax, [rsp + 0x118]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov dword [rsp + 0x144], 0
mov dword [rsp + 0x164], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140197ae0]
lea rcx, [rsp + 0xd8]
call qword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
mov dword [rsp + 0xcc], eax
cmp dword [rsp + 0xcc], 0
jge 0x140179ec4
jmp 0x14017a381
mov dword [rsp + 0x20], 0
mov r9d, 0x20
lea r8, [0x140197ae8]
lea rdx, [0x140197b08]
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.bcrypt.dll_BCryptSetProperty]
mov dword [rsp + 0xcc], eax
cmp dword [rsp + 0xcc], 0
jge 0x140179f04
jmp 0x14017a381
mov dword [rsp + 0x28], 0
lea rax, [rsp + 0x164]
mov qword [rsp + 0x20], rax
mov r9d, 0xc
lea r8, [rsp + 0x118]
lea rdx, [0x140197b28]
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.bcrypt.dll_BCryptGetProperty]
mov dword [rsp + 0xcc], eax
cmp dword [rsp + 0xcc], 0
jge 0x140179f52
jmp 0x14017a381
mov dword [rsp + 0x28], 0
lea rax, [rsp + 0x164]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rsp + 0x144]
lea rdx, [0x140197b48]
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.bcrypt.dll_BCryptGetProperty]
mov dword [rsp + 0xcc], eax
cmp dword [rsp + 0xcc], 0
jge 0x140179fa0
jmp 0x14017a381
mov dword [rsp + 0x30], 0
mov rax, qword [rsp + 0x5a0]
mov eax, dword [rax + 0x28]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x5a0]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0xf8]
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.bcrypt.dll_BCryptGenerateSymmetricKey]
mov dword [rsp + 0xcc], eax
cmp dword [rsp + 0xcc], 0
jge 0x140179ffa
jmp 0x14017a381
mov edx, 0x20
lea rcx, [rsp + 0x188]
call fcn.140011670
lea rcx, [rsp + 0x409]
call fcn.1400133f0
mov ecx, dword [rsp + 0x11c]
mov r8, rax
mov edx, ecx
lea rcx, [rsp + 0x188]
call fcn.1400133a0
nop
mov edx, 0x20
lea rcx, [rsp + 0x1c8]
call fcn.140011670
lea rcx, [rsp + 0x40a]
call fcn.1400133f0
mov ecx, dword [rsp + 0x118]
mov r8, rax
mov edx, ecx
lea rcx, [rsp + 0x1c8]
call fcn.1400133a0
nop
mov r8d, 0x58
xor edx, edx
lea rcx, [rsp + 0x210]
call qword [sym.imp.VCRUNTIME140D.dll_memset]
mov dword [rsp + 0x210], 0x58
mov dword [rsp + 0x214], 1
lea rcx, [rsp + 0x58]
call fcn.140002630
mov qword [rsp + 0x218], rax
lea rcx, [rsp + 0x58]
call fcn.140002ac0
mov dword [rsp + 0x220], eax
xor edx, edx
lea rcx, [rsp + 0x1c8]
call fcn.1400130c0
mov qword [rsp + 0x238], rax
lea rcx, [rsp + 0x1c8]
call fcn.140013190
mov dword [rsp + 0x240], eax
xor edx, edx
lea rcx, [rsp + 0x188]
call fcn.1400130c0
mov qword [rsp + 0x248], rax
lea rcx, [rsp + 0x188]
call fcn.140013190
mov dword [rsp + 0x250], eax
mov edx, 0x20
lea rcx, [rsp + 0x288]
call fcn.140011670
lea rcx, [rsp + 0x40b]
call fcn.1400133f0
mov qword [rsp + 0x4f0], rax
mov eax, dword [rsp + 0x144]
mov qword [rsp + 0x4f8], rax
mov r8, qword [rsp + 0x4f0]
mov rdx, qword [rsp + 0x4f8]
lea rcx, [rsp + 0x288]
call fcn.1400133a0
nop
mov dword [rsp + 0x260], 1
xor edx, edx
lea rcx, [rsp + 0x98]
call fcn.1400130c0
mov qword [rsp + 0x500], rax
lea rcx, [rsp + 0x288]
call fcn.140013190
mov dword [rsp + 0x508], eax
xor edx, edx
lea rcx, [rsp + 0x288]
call fcn.1400130c0
mov qword [rsp + 0x510], rax
xor edx, edx
lea rcx, [rsp + 0x98]
call fcn.1400130c0
mov qword [rsp + 0x518], rax
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x520], rax
mov dword [rsp + 0x48], 0
lea rax, [rsp + 0x164]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x40
mov rax, qword [rsp + 0x500]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x508]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x510]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x210]
mov r8d, 0x40
mov rdx, qword [rsp + 0x518]
mov rcx, qword [rsp + 0x520]
call qword [sym.imp.bcrypt.dll_BCryptDecrypt]
mov dword [rsp + 0xcc], eax
cmp dword [rsp + 0xcc], 0
jge 0x14017a27d
lea rcx, [rsp + 0x288]
call fcn.1400132f0
lea rcx, [rsp + 0x1c8]
call fcn.1400132f0
lea rcx, [rsp + 0x188]
call fcn.1400132f0
nop
jmp 0x14017a381
mov edx, 0x40
lea rcx, [rsp + 0x98]
call fcn.1400130c0
mov qword [rsp + 0x528], rax
lea rcx, [rsp + 0x288]
call fcn.140013190
mov dword [rsp + 0x530], eax
xor edx, edx
lea rcx, [rsp + 0x288]
call fcn.1400130c0
mov qword [rsp + 0x538], rax
mov edx, 0x40
lea rcx, [rsp + 0x98]
call fcn.1400130c0
mov qword [rsp + 0x540], rax
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x548], rax
mov dword [rsp + 0x48], 0
lea rax, [rsp + 0x164]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x40
mov rax, qword [rsp + 0x528]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x530]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x538]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x210]
mov r8d, 0x40
mov rdx, qword [rsp + 0x540]
mov rcx, qword [rsp + 0x548]
call qword [sym.imp.bcrypt.dll_BCryptDecrypt]
mov dword [rsp + 0xcc], eax
lea rcx, [rsp + 0x288]
call fcn.1400132f0
lea rcx, [rsp + 0x1c8]
call fcn.1400132f0
lea rcx, [rsp + 0x188]
call fcn.1400132f0
nop
cmp qword [rsp + 0xd8], 0
je 0x14017a39d
xor edx, edx
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.bcrypt.dll_BCryptCloseAlgorithmProvider]
nop
cmp qword [rsp + 0xf8], 0
je 0x14017a3b7
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.bcrypt.dll_BCryptDestroyKey]
nop
cmp dword [rsp + 0xcc], 0
jne 0x14017a4f8
lea rcx, [rsp + 0x40c]
call fcn.140004010
mov qword [rsp + 0x550], rax
lea rax, [rsp + 0x410]
mov qword [rsp + 0x428], rax
mov rdx, qword [rsp + 0x428]
lea rcx, [rsp + 0x98]
call fcn.1400131c0
mov qword [rsp + 0x558], rax
lea rax, [rsp + 0x430]
mov qword [rsp + 0x448], rax
mov rdx, qword [rsp + 0x448]
lea rcx, [rsp + 0x98]
call fcn.140013260
mov qword [rsp + 0x560], rax
mov r9, qword [rsp + 0x550]
mov r8, qword [rsp + 0x558]
mov rdx, qword [rsp + 0x560]
lea rcx, [rsp + 0x2c8]
call fcn.140018f90
nop
cmp dword [rsp + 0xc4], 0x10
ja 0x14017a474
mov eax, dword [rsp + 0xc4]
mov dword [rsp + 0x568], eax
jmp 0x14017a485
mov eax, dword [rsp + 0xc4]
sub eax, 0x10
mov dword [rsp + 0x568], eax
mov eax, dword [rsp + 0x568]
mov dword [rsp + 0x2f4], eax
mov eax, dword [rsp + 0x2f4]
mov r9d, eax
xor r8d, r8d
mov rdx, qword [rsp + 0x5a8]
lea rcx, [rsp + 0x2c8]
call fcn.14000a1d0
lea rcx, [rsp + 0x2c8]
call fcn.140002650
lea rcx, [rsp + 0x98]
call fcn.1400132f0
lea rcx, [rsp + 0x58]
call fcn.140002650
mov rcx, qword [rsp + 0x5b0]
call fcn.140002650
mov rax, qword [rsp + 0x5a8]
jmp 0x14017a5d8
lea rcx, [rsp + 0x450]
call fcn.140004010
mov qword [rsp + 0x570], rax
mov byte [rsp + 0x2fa], 0
lea rax, [rsp + 0x2fb]
mov r8, rax
lea rdx, [rsp + 0x2fa]
lea rcx, [rsp + 0x458]
call fcn.140014290
lea rcx, [rsp + 0x468]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x490]
lea rcx, [rsp + 0x468]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov r8, qword [rsp + 0x570]
lea rdx, [rsp + 0x490]
mov rcx, qword [rsp + 0x5a8]
call fcn.1400144a0
lea rcx, [rsp + 0x98]
call fcn.1400132f0
lea rcx, [rsp + 0x58]
call fcn.140002650
mov rcx, qword [rsp + 0x5b0]
call fcn.140002650
nop
mov rax, qword [rsp + 0x5a8]
jmp 0x14017a5d8
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1401adb20]
call fcn.140185b40
mov rax, rdi
mov rcx, qword [rsp + 0x578]
xor rcx, rsp
call fcn.140061a30
add rsp, 0x588
pop rdi
pop rsi
ret