Function at 0x1400065e0
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xf8
mov r13, r9
mov rdi, rcx
xor ebx, ebx
mov dword [rsp + 0x50], ebx
cmp qword [r9 + 0x28], rbx
jne 0x140006657
lea rsi, vtable.CVolObject.0
mov qword [rcx], rsi
mov qword [rcx + 8], rbx
mov qword [rcx + 0x10], rbx
lea r14, vtable.CVolMem.0
mov qword [rcx], r14
mov qword [rcx + 0x18], rbx
mov qword [rcx + 0x28], rbx
mov qword [rcx + 0x20], rbx
mov r12d, 0x40
mov qword [rcx + 0x30], r12
mov dword [rsp + 0x50], 1
jmp 0x140006ca1
mov rdx, qword [0x140059138]
test rdx, rdx
jne 0x140006679
lea rdx, [0x140047278]
cmp qword [0x140059168], rbx
cmovne rdx, qword [0x140059158]
xor r9d, r9d
xor r8d, r8d
lea rcx, [rbp + 0x6f]
call qword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
test eax, eax
jns 0x1400066cc
lea rsi, vtable.CVolObject.0
mov qword [rdi], rsi
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], rbx
lea r14, vtable.CVolMem.0
mov qword [rdi], r14
mov qword [rdi + 0x18], rbx
mov qword [rdi + 0x28], rbx
mov qword [rdi + 0x20], rbx
mov r12d, 0x40
mov qword [rdi + 0x30], r12
mov dword [rsp + 0x50], 1
jmp 0x140006ca1
mov r15, qword [0x140059cd8]
test r15, r15
jne 0x1400066ee
lea r15, [0x140047278]
cmp qword [0x140059d08], rbx
cmovne r15, qword [0x140059cf8]
lea rdx, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp - 0x61], rdx
lea rsi, vtable.CVolObject.0
mov qword [rbp - 0x61], rsi
mov qword [rbp - 0x59], rbx
mov qword [rbp - 0x51], rbx
lea rcx, vtable.CWString.0
mov qword [rbp - 0x61], rcx
lea rax, [rbp - 0x41]
mov qword [rbp + 0x77], rax
mov qword [rbp - 0x41], rdx
mov qword [rbp - 0x41], rsi
mov qword [rbp - 0x39], rbx
mov qword [rbp - 0x31], rbx
lea r14, vtable.CVolMem.0
mov qword [rbp - 0x41], r14
mov qword [rbp - 0x29], rbx
mov qword [rbp - 0x19], rbx
mov qword [rbp - 0x21], rbx
mov r12d, 0x40
mov qword [rbp - 0x11], r12
mov qword [rbp - 0x49], rbx
mov qword [rbp - 0x11], 0xfe
mov qword [rbp - 0x61], rcx
mov rdx, qword [rbp - 0x29]
mov rbx, qword [rbp - 0x19]
cmp rbx, 2
jb 0x14000677e
cmp word [rdx + rbx - 2], 0
jne 0x14000677e
sub rbx, 2
mov qword [rbp - 0x19], rbx
mov rax, qword [rbp - 0x21]
sub rax, rbx
cmp rax, 8
jl 0x1400067a0
movabs rcx, 0x4100530052
mov qword [rdx + rbx], rcx
add qword [rbp - 0x19], 8
jmp 0x1400067bb
lea rdx, [rbx + 8]
lea rcx, [rbp - 0x41]
call fcn.14001e380
movabs rcx, 0x4100530052
mov qword [rax + rbx], rcx
mov rdx, qword [rbp - 0x49]
test rdx, rdx
jne 0x1400067d5
lea rdx, [0x140047278]
cmp qword [rbp - 0x19], 0
cmovne rdx, qword [rbp - 0x29]
mov rax, qword [0x140059138]
test rax, rax
jne 0x1400067f8
lea rax, [0x140047278]
cmp qword [0x140059168], 0
cmovne rax, qword [0x140059158]
sub rdx, rax
nop dword [rax + rax]
movzx ebx, word [rax]
movzx ecx, word [rax + rdx]
sub ebx, ecx
jne 0x140006813
add rax, 2
test ecx, ecx
jne 0x140006800
lea rax, [rbp - 0x41]
mov qword [rbp + 0x77], rax
mov qword [rbp - 0x41], r14
mov rdx, qword [rbp - 0x29]
test rdx, rdx
je 0x140006833
lea rcx, [rbp - 0x41]
mov rax, qword [rbp - 0x41]
call qword [rax + 0x18]
xor eax, eax
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x21], rax
mov qword [rbp - 0x41], rsi
mov qword [rbp - 0x61], rsi
test ebx, ebx
jne 0x140006887
cmp qword [r13 + 0x28], rax
je 0x140006857
mov rax, qword [r13 + 0x18]
mov eax, dword [rax]
cmp eax, 0x31415352
je 0x140006880
cmp eax, 0x32415352
je 0x140006877
cmp eax, 0x33415352
jne 0x140006887
lea r15, str.RSAFULLPRIVATEBLOB
jmp 0x140006887
lea r15, str.RSAPRIVATEBLOB
jmp 0x140006887
lea r15, str.RSAPUBLICBLOB
mov rcx, qword [r13 + 0x28]
xor ebx, ebx
test rcx, rcx
mov eax, ebx
je 0x140006898
mov rax, qword [r13 + 0x18]
mov dword [rsp + 0x30], 8
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x67]
mov r8, r15
xor edx, edx
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.bcrypt.dll_BCryptImportKeyPair]
test eax, eax
jns 0x1400068f7
xor edx, edx
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.bcrypt.dll_BCryptCloseAlgorithmProvider]
mov qword [rdi], rsi
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], rbx
mov qword [rdi], r14
mov qword [rdi + 0x18], rbx
mov qword [rdi + 0x28], rbx
mov qword [rdi + 0x20], rbx
mov qword [rdi + 0x30], r12
mov dword [rsp + 0x50], 1
jmp 0x140006ca1
lea rax, vtable.CVolCommonBaseWithMemManager.0
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x70], rbx
mov qword [rbp - 0x71], rbx
mov qword [rbp - 0x79], rbx
mov qword [rbp - 0x69], r12
mov r13, qword [rbp + 0x5f]
mov rax, qword [r13 + 0x28]
test rax, rax
mov rdx, rbx
je 0x14000693c
mov rdx, qword [r13 + 0x18]
mov dword [rsp + 0x48], 2
lea rcx, [rbp + 0x57]
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
mov r8d, eax
mov rcx, qword [rbp + 0x67]
call qword [sym.imp.bcrypt.dll_BCryptEncrypt]
test eax, eax
jns 0x1400069dd
mov rcx, qword [rbp + 0x67]
call qword [sym.imp.bcrypt.dll_BCryptDestroyKey]
xor edx, edx
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.bcrypt.dll_BCryptCloseAlgorithmProvider]
mov qword [rdi], rsi
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], rbx
mov qword [rdi], r14
mov qword [rdi + 0x18], rbx
mov qword [rdi + 0x28], rbx
mov qword [rdi + 0x20], rbx
mov qword [rdi + 0x30], r12
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x58], r14
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x1400069cb
lea rcx, [rsp + 0x58]
mov rax, qword [rsp + 0x58]
call qword [rax + 0x18]
mov qword [rsp + 0x70], rbx
mov qword [rbp - 0x71], rbx
mov qword [rbp - 0x79], rbx
jmp 0x140006c9c
mov r15d, dword [rbp + 0x57]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140006a88
mov r8, qword [rbp - 0x71]
cmp r15, r8
je 0x140006abb
test r15, r15
jne 0x140006a29
mov rdx, rcx
lea rcx, [rsp + 0x58]
mov rax, qword [rsp + 0x58]
call qword [rax + 0x18]
mov rcx, rbx
mov qword [rsp + 0x70], rbx
mov r8, rbx
mov qword [rbp - 0x71], rbx
mov qword [rbp - 0x79], rbx
jmp 0x140006abb
mov rbx, qword [rbp - 0x69]
test rbx, rbx
cmovle rbx, r12
mov rax, qword [rbp - 0x79]
cmp rax, r15
jl 0x140006a50
sub rax, r15
cmp rax, rbx
jg 0x140006a50
mov r8, r15
mov qword [rbp - 0x71], r15
xor ebx, ebx
jmp 0x140006abb
mov rax, r15
cqo
idiv rbx
sub rbx, rdx
add rbx, r15
mov r8, rbx
mov rdx, rcx
lea rcx, [rsp + 0x58]
mov rax, qword [rsp + 0x58]
call qword [rax + 0x10]
mov rcx, rax
mov qword [rsp + 0x70], rax
mov qword [rbp - 0x79], rbx
mov r8, r15
mov qword [rbp - 0x71], r15
xor ebx, ebx
jmp 0x140006abb
test r15, r15
je 0x140006ab7
mov rbx, qword [rbp - 0x69]
test rbx, rbx
cmovle rbx, r12
mov rax, r15
cqo
idiv rbx
sub rbx, rdx
add rbx, r15
mov rdx, rbx
lea rcx, [rsp + 0x58]
mov rax, qword [rsp + 0x58]
call qword [rax]
jmp 0x140006a71
mov r8, qword [rbp - 0x71]
xor edx, edx
call fcn.140023920
mov rcx, qword [rsp + 0x70]
cmp qword [rbp - 0x71], 0
cmove rcx, rbx
mov r8, qword [r13 + 0x28]
test r8, r8
mov rdx, rbx
je 0x140006ae0
mov rdx, qword [r13 + 0x18]
mov dword [rsp + 0x48], 2
lea rax, [rbp + 0x57]
mov qword [rsp + 0x40], rax
mov eax, dword [rbp + 0x57]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
mov rcx, qword [rbp + 0x67]
call qword [sym.imp.bcrypt.dll_BCryptEncrypt]
mov ebx, eax
mov rcx, qword [rbp + 0x67]
call qword [sym.imp.bcrypt.dll_BCryptDestroyKey]
xor edx, edx
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.bcrypt.dll_BCryptCloseAlgorithmProvider]
test ebx, ebx
jns 0x140006b85
mov qword [rdi], rsi
xor ebx, ebx
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], rbx
mov qword [rdi], r14
mov qword [rdi + 0x18], rbx
mov qword [rdi + 0x28], rbx
mov qword [rdi + 0x20], rbx
mov qword [rdi + 0x30], r12
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x58], r14
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x140006b73
lea rcx, [rsp + 0x58]
mov rax, qword [rsp + 0x58]
call qword [rax + 0x18]
mov qword [rsp + 0x70], rbx
mov qword [rbp - 0x71], rbx
mov qword [rbp - 0x79], rbx
jmp 0x140006c9c
mov r15d, dword [rbp + 0x57]
cmp r15, qword [rbp - 0x71]
je 0x140006c3a
test r15, r15
jne 0x140006bc0
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x140006baf
lea rcx, [rsp + 0x58]
mov rax, qword [rsp + 0x58]
call qword [rax + 0x18]
xor ebx, ebx
mov qword [rsp + 0x70], rbx
mov qword [rbp - 0x71], rbx
mov qword [rbp - 0x79], rbx
jmp 0x140006c3c
mov rcx, qword [rsp + 0x70]
mov rbx, qword [rbp - 0x69]
test rcx, rcx
jne 0x140006bf4
test rbx, rbx
cmovle rbx, r12
mov rax, r15
cqo
idiv rbx
sub rbx, rdx
add rbx, r15
mov rdx, rbx
lea rcx, [rsp + 0x58]
mov rax, qword [rsp + 0x58]
call qword [rax]
jmp 0x140006c2d
test rbx, rbx
cmovle rbx, r12
mov rax, qword [rbp - 0x79]
cmp rax, r15
jl 0x140006c0c
sub rax, r15
cmp rax, rbx
jle 0x140006c36
mov rax, r15
cqo
idiv rbx
sub rbx, rdx
add rbx, r15
mov r8, rbx
mov rdx, rcx
lea rcx, [rsp + 0x58]
mov rax, qword [rsp + 0x58]
call qword [rax + 0x10]
mov qword [rbp - 0x79], rbx
mov qword [rsp + 0x70], rax
mov qword [rbp - 0x71], r15
xor ebx, ebx
mov qword [rdi], rsi
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], rbx
mov qword [rdi], r14
mov qword [rdi + 0x18], rbx
mov qword [rdi + 0x28], rbx
mov qword [rdi + 0x20], rbx
mov qword [rdi + 0x30], r12
mov qword [rdi], r14
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.140004ca0
nop
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x58], r14
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x140006c8f
lea rcx, [rsp + 0x58]
mov rax, qword [rsp + 0x58]
call qword [rax + 0x18]
mov qword [rsp + 0x70], rbx
mov qword [rbp - 0x71], rbx
mov qword [rbp - 0x79], rbx
mov qword [rsp + 0x58], rsi
mov rax, rdi
add rsp, 0xf8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret