Function at 0x1400014c0
Capabilities:
Encrypt or decrypt data via bcrypt
Hash data via bcrypt

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x140028580]
xor rax, rsp
mov qword [rbp + 8], rax
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x60], rcx
xor r14d, r14d
mov dword [rsp + 0x54], r14d
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x70], r14
mov dword [rbp - 0x54], r14d
mov dword [rbp - 0x28], r14d
mov dword [rbp - 0x50], r14d
mov dword [rbp - 0x58], r14d
mov qword [rsp + 0x58], r14
mov r13d, r14d
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], 0xf
mov byte [rbp - 0x48], r14b
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx], r14
mov qword [rcx + 8], r14
mov qword [rcx + 0x10], r14
lea ecx, [r14 + 1]
call fcn.140009c0c
mov qword [rdi], rax
mov qword [rdi + 8], rax
inc rax
mov qword [rdi + 0x10], rax
mov rax, qword [rdi]
mov byte [rax], r14b
inc rax
mov qword [rdi + 8], rax
mov dword [rsp + 0x54], 1
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
mov qword [rbp - 0x10], r14
sub rbx, rsi
je 0x1400015fa
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
ja 0x140001ad8
cmp rbx, 0x1000
jb 0x1400015d2
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140001ade
call fcn.140009c0c
mov rcx, rax
test rax, rax
je 0x140001aea
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400015da
mov rcx, rbx
call fcn.140009c0c
mov qword [rbp - 0x20], rax
lea r12, [rax + rbx]
mov qword [rbp - 0x10], r12
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call fcn.14000f230
mov qword [rbp - 0x18], r12
jmp 0x1400015fe
mov r12, qword [rbp - 0x18]
sub r12, qword [rbp - 0x20]
lea rcx, [rsp + 0x68]
call fcn.1400012c0
mov rbx, rax
lea rax, [rbp - 0x48]
cmp rax, rbx
je 0x140001681
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x140001653
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000164e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001ae4
call fcn.140009f70
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], 0xf
mov byte [rbp - 0x48], 0
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x48], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x38], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x1400016bd
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400016b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001ae4
call fcn.140009f70
mov r8, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
sub rax, r8
mov r15d, 0xe
lea r14, str.nksGbbyCvnnbyL
cmp rax, r15
jb 0x140001750
lea rax, [r8 + 0xe]
mov qword [rbp - 0x38], rax
lea rbx, [rbp - 0x48]
cmp rcx, 0x10
cmovae rbx, qword [rbp - 0x48]
lea rax, [0x1400249ee]
cmp rax, rbx
jbe 0x140001718
lea rax, [rbx + r8]
cmp r14, rax
ja 0x140001718
cmp rbx, r14
ja 0x140001710
xor esi, esi
jmp 0x14000171b
mov rsi, rbx
sub rsi, r14
jmp 0x14000171b
mov rsi, r15
inc r8
lea rcx, [rbx + 0xe]
mov rdx, rbx
call fcn.14000f230
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call fcn.14000f230
sub r15, rsi
lea rdx, [r14 + 0xe]
add rdx, rsi
lea rcx, [rbx + rsi]
mov r8, r15
call fcn.14000f230
jmp 0x140001789
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
mov rdx, r15
lea rcx, [rbp - 0x48]
call fcn.1400090c0
lea rcx, [rbp - 0x48]
cmp rcx, rax
je 0x140001789
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x14000177d
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.140008430
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SHA256
lea rcx, [rbp - 0x78]
call qword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
xor r14d, r14d
test eax, eax
js 0x1400019a1
mov dword [rsp + 0x28], r14d
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
lea r9d, [r14 + 4]
lea r8, [rbp - 0x54]
lea rdx, str.ObjectLength
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.bcrypt.dll_BCryptGetProperty]
test eax, eax
js 0x14000199c
mov ebx, dword [rbp - 0x54]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
mov dword [rsp + 0x28], r14d
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
lea r9d, [r14 + 4]
lea r8, [rbp - 0x50]
lea rdx, str.HashDigestLength
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.bcrypt.dll_BCryptGetProperty]
test eax, eax
js 0x1400019a6
mov ebx, dword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r13, rax
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
mov r9d, dword [rbp - 0x54]
mov r8, rsi
lea rdx, [rbp - 0x68]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.bcrypt.dll_BCryptCreateHash]
test eax, eax
js 0x1400019a6
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 0x10
cmovae rdx, qword [rbp - 0x48]
xor r9d, r9d
mov r8d, dword [rbp - 0x38]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.bcrypt.dll_BCryptHashData]
test eax, eax
js 0x1400019a6
xor r9d, r9d
mov r8d, dword [rbp - 0x50]
mov rdx, r13
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.bcrypt.dll_BCryptFinishHash]
test eax, eax
js 0x1400019a6
movups xmm0, xmmword [r13]
movups xmmword [rbp - 8], xmm0
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140024a48]
lea rcx, [rbp - 0x60]
call qword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
test eax, eax
js 0x1400019a6
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], 0x10
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp - 0x70]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.bcrypt.dll_BCryptGenerateSymmetricKey]
test eax, eax
js 0x1400019a6
mov dword [rsp + 0x48], 1
lea rax, [rbp - 0x58]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8d, r12d
mov rdx, qword [rbp - 0x20]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.bcrypt.dll_BCryptDecrypt]
test eax, eax
js 0x1400019a6
mov ecx, dword [rbp - 0x58]
mov edx, ecx
mov rax, qword [rdi + 0x10]
sub rax, qword [rdi]
cmp rcx, rax
jbe 0x14000195f
mov rcx, rdi
call fcn.140008910
mov ecx, dword [rbp - 0x58]
mov rax, qword [rdi]
mov dword [rsp + 0x48], 1
lea rdx, [rbp - 0x58]
mov qword [rsp + 0x40], rdx
mov dword [rsp + 0x38], ecx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8d, r12d
mov rdx, qword [rbp - 0x20]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.bcrypt.dll_BCryptDecrypt]
jmp 0x1400019a6
mov rsi, r14
jmp 0x1400019a6
mov rsi, qword [rsp + 0x58]
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x1400019b7
xor edx, edx
call qword [sym.imp.bcrypt.dll_BCryptCloseAlgorithmProvider]
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x1400019c8
xor edx, edx
call qword [sym.imp.bcrypt.dll_BCryptCloseAlgorithmProvider]
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x1400019d7
call qword [sym.imp.bcrypt.dll_BCryptDestroyKey]
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x1400019e6
call qword [sym.imp.bcrypt.dll_BCryptDestroyHash]
test rsi, rsi
je 0x1400019ff
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r13, r13
je 0x140001a18
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, r13
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [rbp - 0x58]
mov rdx, qword [rdi]
add rdx, rcx
cmp rdx, qword [rdi + 8]
je 0x140001a2b
mov qword [rdi + 8], rdx
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140001a71
mov rdx, qword [rbp - 0x10]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001a60
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001aea
call fcn.140009f70
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r14
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x140001aa8
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001aa3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001ad2
call fcn.140009f70
mov rax, rdi
mov rcx, qword [rbp + 8]
xor rcx, rsp
call fcn.140009950
mov rbx, qword [rsp + 0x168]
add rsp, 0x110
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14001063c
nop
call fcn.1400088f0
int3
call fcn.140001110
nop
call fcn.14001063c
nop
call fcn.14001063c
int3