Function at 0x14005aa72
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push r15
mov rax, reloc.WS2_32.dll_listen
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x14005aa8f
sub rsp, 0x28
call fcn.14012b830
mov rcx, qword [rsp + 0xc0]
call fcn.1400bd588
mov rdx, qword [rsp + 0xa0]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.14012b8a0
add rsp, 0x10
mov rdx, qword [rsp + 0xa8]
lea rcx, [rsp + 0x30]
sub rsp, 0x10
call fcn.14012b8a0
add rsp, 0x10
mov dword [section..data], 0x14000aa
mov dword [section..data], 0x14000ac
push qword [rsp + 0xb0]
mov dword [section..data], 0x14000ad
xor r15, r15
cmp r15, qword [rsp]
jne 0x14005ab27
mov dword [section..data], 0x14000b3
jmp 0x14005abd0
mov dword [section..data], 0x14000b3
mov r15, 0x6801
cmp r15, qword [rsp]
jne 0x14005abd0
mov dword [section..data], 0x14000b4
sub rsp, 8
mov rcx, qword [rsp + 0x38]
sub rsp, 0x20
call fcn.140129360
add rsp, 0x28
mov r15, rax
and r15, r15
jne 0x14005abc6
mov dword [section..data], 0x14000b4
mov rcx, qword [rsp + 0xc8]
push rax
sub rsp, 8
call fcn.1400bd588
add rsp, 8
pop rax
movabs rcx, 0x140211776
push rcx
sub rsp, 0x20
call fcn.14012b4a0
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.14012b5d0
add rsp, 0x20
pop rax
push rax
call fcn.14012b6a0
pop rdx
add rax, rdx
add rsp, 8
jmp 0x14005b201
mov dword [section..data], 0x14000b4
mov dword [section..data], 0x14000b5
add rsp, 8
mov dword [section..data], 0x14000b7
mov qword [rsp + 0x38], 0
mov dword [section..data], 0x14000b7
mov qword [rsp + 0x40], 0
mov dword [section..data], 0x14000b7
movabs rdx, 0x140207502
lea rcx, [rsp + 0x48]
call fcn.14012b3b0
mov dword [section..data], 0x14000ba
call fcn.14004fc9f
and rax, rax
je 0x14005ac3b
xor rax, rax
jmp 0x14005ac42
mov rax, 1
and rax, rax
je 0x14005ac88
mov dword [section..data], 0x14000ba
movabs rcx, 0x140211776
push rcx
sub rsp, 0x28
call fcn.14012b4a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14012b5d0
add rsp, 0x28
pop rax
push rax
call fcn.14012b6a0
pop rdx
add rax, rdx
jmp 0x14005b201
mov dword [section..data], 0x14000ba
mov dword [section..data], 0x14000bd
mov r15, qword [rsp + 0xb0]
and r15, r15
je 0x14005ad51
mov dword [section..data], 0x14000be
movabs r8, 0x8003
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x30]
call fcn.14009d7c3
mov qword [rsp + 0x50], rax
mov dword [section..data], 0x14000bf
mov r15, qword [rsp + 0x50]
cmp r15, 0xffffffffffffffff
jne 0x14005ad47
mov dword [section..data], 0x14000c0
movabs rdx, 0x140211776
lea rcx, [rsp + 0x48]
call fcn.14012b3b0
mov dword [section..data], 0x14000c1
mov rcx, qword [rsp + 0x48]
push rcx
sub rsp, 0x28
call fcn.14012b4a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14012b5d0
add rsp, 0x28
pop rax
push rax
call fcn.14012b6a0
pop rdx
add rax, rdx
jmp 0x14005b201
mov dword [section..data], 0x14000c2
mov dword [section..data], 0x14000c3
mov dword [section..data], 0x14000c5
movabs rcx, 0x400
call fcn.140129ad0
mov qword [rsp + 0x58], rax
mov dword [section..data], 0x14000cc
movabs rdx, 0x140207502
lea rcx, [rsp + 0x60]
call fcn.14012b3b0
mov dword [section..data], 0x14000cd
mov dword [rsp + 0x68], 0
mov dword [section..data], 0x14000ce
mov qword [rsp + 0x70], 1
jmp 0x14005adc8
mov dword [section..data], 0x14000ce
mov rcx, qword [rsp + 0x28]
call fcn.140127510
cmp rax, qword [rsp + 0x70]
jl 0x14005b00f
mov dword [section..data], 0x14000cf
push rcx
sub rsp, 0x28
call fcn.14012b4a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14012b4a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14012b4a0
add rsp, 0x28
pop rcx
mov r9, rax
movabs r8, 1
mov rdx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x48]
sub rsp, 0x20
call fcn.140127570
add rsp, 0x28
push rax
call fcn.14012b6d0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.140128340
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400bd588
add rsp, 0x28
pop rax
mov r15, rax
add r15, 0xffffffffffffffd0
mov rax, r15
mov dword [rsp + 0x78], eax
mov dword [section..data], 0x14000d0
movsxd r15, dword [rsp + 0x78]
cmp r15, 9
jle 0x14005aeae
mov dword [section..data], 0x14000d1
movsxd r15, dword [rsp + 0x78]
add r15, 0xfffffffffffffff9
mov rax, r15
mov dword [rsp + 0x78], eax
mov dword [section..data], 0x14000d2
mov dword [section..data], 0x14000d3
push rcx
sub rsp, 0x28
call fcn.14012b4a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14012b4a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14012b4a0
add rsp, 0x28
pop rcx
push rax
push 1
mov r15, qword [rsp + 0xa0]
inc r15
mov rax, r15
mov rdx, rax
mov rcx, qword [rsp + 0x58]
pop r8
pop r9
sub rsp, 0x20
call fcn.140127570
add rsp, 0x28
push rax
call fcn.14012b6d0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.140128340
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400bd588
add rsp, 0x28
pop rax
mov r15, rax
add r15, 0xffffffffffffffd0
mov rax, r15
mov dword [rsp + 0x80], eax
mov dword [section..data], 0x14000d4
movsxd r15, dword [rsp + 0x80]
cmp r15, 9
jle 0x14005af9b
mov dword [section..data], 0x14000d5
movsxd r15, dword [rsp + 0x80]
add r15, 0xfffffffffffffff9
mov rax, r15
mov dword [rsp + 0x80], eax
mov dword [section..data], 0x14000d6
mov dword [section..data], 0x14000d7
movsxd r15, dword [rsp + 0x78]
shl r15, 4
movsxd rcx, dword [rsp + 0x80]
add r15, rcx
mov rax, r15
push rax
mov r15, qword [rsp + 0x60]
movsxd rcx, dword [rsp + 0x70]
add r15, rcx
mov rax, r15
mov rcx, rax
pop rdx
call fcn.14012a0a0
mov dword [section..data], 0x14000d8
movsxd r15, dword [rsp + 0x68]
inc r15
mov rax, r15
mov dword [rsp + 0x68], eax
mov dword [section..data], 0x14000d9
add qword [rsp + 0x70], 2
jno 0x14005adbe
mov dword [section..data], 0x14000da
mov rcx, qword [rsp + 0x28]
call fcn.140127510
mov r15, rax
mov rax, r15
mov rcx, 2
cqo
idiv rcx
mov r15, rax
mov rax, r15
mov dword [rsp + 0x88], eax
mov dword [section..data], 0x14000df
lea rax, [rsp + 0x88]
push rax
push qword [rsp + 0x60]
movabs r9, 0
mov r8, qword [rsp + 0xc8]
movabs rdx, 0
mov rcx, qword [rsp + 0x60]
sub rsp, 0x20
call sub.ADVAPI32.dll_CryptDecrypt
add rsp, 0x30
mov qword [rsp + 0x40], rax
mov dword [section..data], 0x14000e1
mov r15, qword [rsp + 0x40]
and r15, r15
jne 0x14005b0fa
mov dword [section..data], 0x14000e2
movabs rdx, 0x140211776
lea rcx, [rsp + 0x48]
call fcn.14012b3b0
mov dword [section..data], 0x14000e3
mov rcx, qword [rsp + 0x48]
push rcx
sub rsp, 0x28
call fcn.14012b4a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14012b5d0
add rsp, 0x28
pop rax
push rax
call fcn.14012b6a0
pop rdx
add rax, rdx
jmp 0x14005b201
mov dword [section..data], 0x14000e4
mov dword [section..data], 0x14000e6
push rcx
sub rsp, 0x28
call fcn.14012b4a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14012b4a0
add rsp, 0x28
pop rcx
push rax
movsxd rax, dword [rsp + 0xa0]
mov rdx, rax
mov rcx, qword [rsp + 0x70]
pop r8
sub rsp, 0x20
call fcn.140129b20
add rsp, 0x28
lea rcx, [rsp + 0x50]
pop rdx
call fcn.14012b4f0
mov dword [section..data], 0x14000e8
mov r15, qword [rsp + 0xb0]
and r15, r15
je 0x14005b187
mov dword [section..data], 0x14000e8
mov rcx, qword [rsp + 0x50]
call fcn.140094edb
mov dword [section..data], 0x14000e8
mov dword [section..data], 0x14000e9
call fcn.14002d1a4
mov dword [section..data], 0x14000eb
mov rcx, qword [rsp + 0x58]
call fcn.140129bb0
mov dword [section..data], 0x14000ed
mov rcx, qword [rsp + 0x48]
push rcx
sub rsp, 0x28
call fcn.14012b4a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14012b5d0
add rsp, 0x28
pop rax
push rax
call fcn.14012b6a0
pop rdx
add rax, rdx
jmp 0x14005b201
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.14012b910
add rsp, 0x28
mov rcx, qword [rsp + 0x50]
sub rsp, 0x28
call fcn.14012b910
add rsp, 0x28
mov rcx, qword [rsp + 0x38]
sub rsp, 0x28
call fcn.14012b910
add rsp, 0x28
mov rcx, qword [rsp + 0x68]
sub rsp, 0x28
call fcn.14012b910
add rsp, 0x28
pop rax
add rsp, 0x90
pop r15
ret