Function at 0x1800085f8
Capabilities:
Encrypt or decrypt via wincrypt
Enumerate pe sections
Generate random numbers via winapi

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax + 0x18]
sub rsp, 0x138
and dword [rbp - 0x10], 0
and qword [rbp - 0x78], 0
mov rbx, rcx
lea rcx, str._ENC__Preparing_for_encryption_...
mov r15, r9
mov rdi, r8
mov rsi, rdx
call fcn.180007e94
mov rcx, rsi
call fcn.18000760c
mov r8, qword [rbx + 0x20]
mov r14d, reloc.WS2_32.dll_recv
lea rcx, [rsi + 4]
mov r9d, r14d
mov edx, r14d
add r8, 0x20
call fcn.18001ad08
mov rax, qword [rbx + 0xa0]
test rax, rax
je 0x180008922
cmp dword [rax + 0x14], 0
je 0x180008922
lea rcx, str._ENC__Context_is_valid__moving_on_...
call fcn.180007e94
mov rax, qword [rbx + 0xa0]
cmp dword [rax + 0x44], 0
je 0x180008906
lea rcx, str._ENC__Context_is_enabled__doing_the_AES_encryption
call fcn.180007e94
mov rcx, qword [rbx + 0xa0]
lea r9, [rbp - 0x78]
mov rcx, qword [rcx + 8]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDuplicateKey]
test eax, eax
jne 0x1800086e4
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str._ENC__Failed_to_duplicate_AES_key:__d___x_
mov edx, eax
mov r8d, eax
mov dword [rbp - 0x10], eax
call fcn.180007e94
jmp 0x18000892e
mov rcx, qword [rbp - 0x78]
xor r9d, r9d
lea r8, [rbp - 0x80]
lea edx, [r9 + 4]
mov dword [rbp - 0x80], 1
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
jne 0x180008713
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str._ENC__Failed_to_set_mode_to_CBC:__d___x_
jmp 0x1800086d2
mov rcx, qword [rbx + 0xa0]
lea r8, [rbp - 0x70]
mov edx, r14d
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x180008748
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str._ENC__Failed_to_generate_random_IV:__d___x_
mov r8d, eax
mov edx, eax
mov dword [rbp - 0x10], eax
call fcn.180007e94
movzx eax, byte [rbp - 0x61]
movzx ecx, byte [rbp - 0x62]
movzx r10d, byte [rbp - 0x63]
movzx r11d, byte [rbp - 0x64]
movzx ebx, byte [rbp - 0x65]
movzx edi, byte [rbp - 0x66]
movzx esi, byte [rbp - 0x67]
movzx r14d, byte [rbp - 0x68]
movzx r15d, byte [rbp - 0x69]
movzx r12d, byte [rbp - 0x6a]
movzx r13d, byte [rbp - 0x6b]
movzx r9d, byte [rbp - 0x6e]
movzx r8d, byte [rbp - 0x6f]
movzx edx, byte [rbp - 0x70]
mov dword [rsp + 0x80], eax
movzx eax, byte [rbp - 0x6c]
mov dword [rsp + 0x78], ecx
mov dword [rsp + 0x70], r10d
mov dword [rsp + 0x68], r11d
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x58], edi
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x48], r14d
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], eax
movzx eax, byte [rbp - 0x6d]
lea rcx, str._ENC__IV:__02X_02X_02X_02X_02X_02X_02X_02X_02X_02X_02X_02X_02X_02X_02X_02X
mov dword [rsp + 0x20], eax
call fcn.180007e94
mov rcx, qword [rbp - 0x78]
xor r9d, r9d
lea r8, [rbp - 0x70]
lea r14d, [r9 + 1]
mov edx, r14d
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
jne 0x18000881c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str._ENC__Failed_to_set_IV:__d___x_
mov r8d, eax
mov edx, eax
mov dword [rbp - 0x10], eax
call fcn.180007e94
mov rsi, qword [rbp - 8]
mov r15, qword [rbp + 8]
jmp 0x180008900
lea rcx, str._ENC__IV_Set_successfully
call fcn.180007e94
mov ecx, r14d
call qword [sym.imp.WS2_32.dll_htonl]
mov rsi, qword [rbp - 8]
mov edi, dword [rsi + 0x28]
mov dword [rsi + 0x14], eax
shr edi, 4
add edi, r14d
shl edi, 4
lea ecx, [rdi + 0x30]
call fcn.180018f98
mov rdx, qword [rbp]
mov r15, qword [rbp + 8]
mov qword [rdx], rax
lea rbx, [rax + 0x30]
mov r13, rax
mov eax, dword [rsi + 0x28]
mov rcx, rbx
mov dword [r15], eax
mov edx, dword [rsi + 0x28]
mov r8, qword [rsi + 0x20]
mov r9d, edx
call fcn.18001ad08
mov rcx, qword [rbp - 0x78]
mov dword [rsp + 0x30], edi
xor r9d, r9d
mov r8d, r14d
xor edx, edx
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x1800088b6
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str._ENC__Failed_to_encrypt:__d___x_
mov r8d, eax
mov edx, eax
mov dword [rbp - 0x10], eax
call fcn.180007e94
jmp 0x1800088c5
mov edx, dword [r15]
lea rcx, str._ENC__Data_encrypted_successfully__size_is__u
call fcn.180007e94
mov ecx, dword [r15]
add ecx, 0x18
call qword [sym.imp.WS2_32.dll_ntohl]
mov edx, 0x20
mov r8, rsi
mov dword [rsi + 0x18], eax
add dword [r15], 0x30
mov r9d, edx
mov rcx, r13
call fcn.18001ad08
mov edx, reloc.WS2_32.dll_recv
lea r8, [rbp - 0x70]
lea rcx, [r13 + 0x20]
mov r9d, edx
call fcn.18001ad08
mov rdi, qword [rbp]
jmp 0x18000892e
lea rcx, str._ENC__Enabling_the_context
call fcn.180007e94
mov rax, qword [rbx + 0xa0]
mov dword [rax + 0x44], 1
jmp 0x18000892e
lea rcx, str._ENC__No_encryption_context_present
call fcn.180007e94
cmp qword [rdi], 0
jne 0x18000897c
mov eax, dword [rsi + 0x28]
add eax, 0x20
mov ecx, eax
mov dword [r15], eax
call fcn.180018f98
xor ecx, ecx
mov rbx, rax
mov qword [rdi], rax
call qword [sym.imp.WS2_32.dll_htonl]
mov r9d, 0x20
mov r8, rsi
mov rcx, rbx
mov edx, r9d
mov dword [rsi + 0x14], eax
call fcn.18001ad08
mov edx, dword [rsi + 0x28]
mov r8, qword [rsi + 0x20]
lea rcx, [rbx + 0x20]
mov r9d, edx
call fcn.18001ad08
mov edx, dword [r15]
lea rcx, str._ENC__Packet_buffer_size_is:__u
call fcn.180007e94
mov r8, qword [rdi]
movzx eax, byte [r8 + 0x1f]
movzx ecx, byte [r8 + 0x1e]
movzx r10d, byte [r8 + 0x1d]
mov dword [rsp + 0x100], eax
movzx r11d, byte [r8 + 0x1c]
movzx ebx, byte [r8 + 0x1b]
movzx edi, byte [r8 + 0x1a]
movzx esi, byte [r8 + 0x19]
movzx r14d, byte [r8 + 0x18]
movzx r15d, byte [r8 + 0x17]
movzx r12d, byte [r8 + 0x16]
movzx r13d, byte [r8 + 0x15]
movzx r9d, byte [r8 + 2]
mov dword [rsp + 0xf8], ecx
mov dword [rsp + 0xf0], r10d
mov dword [rsp + 0xe8], r11d
mov dword [rsp + 0xe0], ebx
mov dword [rsp + 0xd8], edi
mov dword [rsp + 0xd0], esi
mov dword [rsp + 0xc8], r14d
mov dword [rsp + 0xc0], r15d
mov dword [rsp + 0xb8], r12d
mov dword [rsp + 0xb0], r13d
mov qword [rbp - 0x80], r8
mov rcx, qword [rbp - 0x80]
mov rdx, qword [rbp - 0x80]
movzx r8d, byte [r8 + 1]
movzx eax, byte [rcx + 0x14]
movzx edx, byte [rdx]
mov dword [rsp + 0xa8], eax
movzx eax, byte [rcx + 0x13]
mov dword [rsp + 0xa0], eax
movzx eax, byte [rcx + 0x12]
mov dword [rsp + 0x98], eax
movzx eax, byte [rcx + 0x11]
mov dword [rsp + 0x90], eax
movzx eax, byte [rcx + 0x10]
mov dword [rsp + 0x88], eax
movzx eax, byte [rcx + 0xf]
mov dword [rsp + 0x80], eax
movzx eax, byte [rcx + 0xe]
mov dword [rsp + 0x78], eax
movzx eax, byte [rcx + 0xd]
mov dword [rsp + 0x70], eax
movzx eax, byte [rcx + 0xc]
mov dword [rsp + 0x68], eax
movzx eax, byte [rcx + 0xb]
mov dword [rsp + 0x60], eax
movzx eax, byte [rcx + 0xa]
mov dword [rsp + 0x58], eax
movzx eax, byte [rcx + 9]
mov dword [rsp + 0x50], eax
movzx eax, byte [rcx + 8]
mov dword [rsp + 0x48], eax
movzx eax, byte [rcx + 7]
mov dword [rsp + 0x40], eax
movzx eax, byte [rcx + 6]
mov dword [rsp + 0x38], eax
movzx eax, byte [rcx + 5]
mov dword [rsp + 0x30], eax
movzx eax, byte [rcx + 4]
mov dword [rsp + 0x28], eax
movzx eax, byte [rcx + 3]
lea rcx, str._ENC__Sending_header__before_XOR_:__0x_02X_0x_02X_0x_02X_0x_02X___0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X___0x_02X_0x_02X_0x_02X_0x_02X___0x_02X_0x_02X_0x_02X_0x_02X___0x_02X_0x_02X_0x_02X_0x_02X_
mov dword [rsp + 0x20], eax
call fcn.180007e94
mov rax, qword [rbp + 8]
mov r8d, dword [rax]
mov rdx, qword [rbp]
mov rcx, qword [rbp - 8]
mov rdx, qword [rdx]
sub r8d, 4
add rdx, 4
call fcn.180007568
lea rcx, str._ENC__Packet_encoded_and_ready_for_transmission
call fcn.180007e94
mov r8, qword [rbp - 0x80]
movzx eax, byte [r8 + 0x1f]
movzx ecx, byte [r8 + 0x1e]
movzx r10d, byte [r8 + 0x1d]
mov dword [rsp + 0x100], eax
movzx r11d, byte [r8 + 0x1c]
movzx ebx, byte [r8 + 0x1b]
movzx edi, byte [r8 + 0x1a]
movzx esi, byte [r8 + 0x19]
movzx r14d, byte [r8 + 0x18]
movzx r15d, byte [r8 + 0x17]
movzx r12d, byte [r8 + 0x16]
movzx r13d, byte [r8 + 0x15]
mov rdx, qword [rbp - 0x80]
movzx r9d, byte [r8 + 2]
mov dword [rsp + 0xf8], ecx
mov rcx, qword [rbp - 0x80]
movzx r8d, byte [r8 + 1]
movzx edx, byte [rdx]
movzx eax, byte [rcx + 0x14]
mov dword [rsp + 0xf0], r10d
mov dword [rsp + 0xe8], r11d
mov dword [rsp + 0xe0], ebx
mov dword [rsp + 0xd8], edi
mov dword [rsp + 0xd0], esi
mov dword [rsp + 0xc8], r14d
mov dword [rsp + 0xc0], r15d
mov dword [rsp + 0xb8], r12d
mov dword [rsp + 0xb0], r13d
mov dword [rsp + 0xa8], eax
movzx eax, byte [rcx + 0x13]
mov dword [rsp + 0xa0], eax
movzx eax, byte [rcx + 0x12]
mov dword [rsp + 0x98], eax
movzx eax, byte [rcx + 0x11]
mov dword [rsp + 0x90], eax
movzx eax, byte [rcx + 0x10]
mov dword [rsp + 0x88], eax
movzx eax, byte [rcx + 0xf]
mov dword [rsp + 0x80], eax
movzx eax, byte [rcx + 0xe]
mov dword [rsp + 0x78], eax
movzx eax, byte [rcx + 0xd]
mov dword [rsp + 0x70], eax
movzx eax, byte [rcx + 0xc]
mov dword [rsp + 0x68], eax
movzx eax, byte [rcx + 0xb]
mov dword [rsp + 0x60], eax
movzx eax, byte [rcx + 0xa]
mov dword [rsp + 0x58], eax
movzx eax, byte [rcx + 9]
mov dword [rsp + 0x50], eax
movzx eax, byte [rcx + 8]
mov dword [rsp + 0x48], eax
movzx eax, byte [rcx + 7]
mov dword [rsp + 0x40], eax
movzx eax, byte [rcx + 6]
mov dword [rsp + 0x38], eax
movzx eax, byte [rcx + 5]
mov dword [rsp + 0x30], eax
movzx eax, byte [rcx + 4]
mov dword [rsp + 0x28], eax
movzx eax, byte [rcx + 3]
lea rcx, str._ENC__Sending_header__after_XOR_:__0x_02X_0x_02X_0x_02X_0x_02X___0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X___0x_02X_0x_02X_0x_02X_0x_02X___0x_02X_0x_02X_0x_02X_0x_02X___0x_02X_0x_02X_0x_02X_0x_02X_
mov dword [rsp + 0x20], eax
call fcn.180007e94
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x180008c6a
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov eax, dword [rbp - 0x10]
add rsp, 0x138
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret