Function at 0x1400148a0
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x90
mov r15, rdx
mov rbx, rcx
xor r14d, r14d
mov qword [rbp - 0x11], r14
mov qword [rbp - 0x21], r14
mov r13d, r14d
mov dword [rbp + 0x77], r14d
mov dword [rbp + 0x7f], 4
mov dword [rsp + 0x20], 0xf0000040
lea r9d, [r14 + 1]
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x11]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov edi, eax
test eax, eax
je 0x140014b59
mov rdx, qword [rbx]
mov r8, qword [rbx + 8]
sub r8, rdx
lea rax, [rbp - 0x21]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
xor r9d, r9d
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov edi, eax
test eax, eax
je 0x140014b59
mov dword [rsp + 0x20], r14d
lea r9, [rbp + 0x7f]
lea r8, [rbp + 0x77]
lea edx, [r14 + 8]
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.ADVAPI32.dll_CryptGetKeyParam]
mov edi, eax
test eax, eax
je 0x140014b59
mov eax, dword [rbp + 0x77]
shr eax, 3
add eax, 0xfffffff5
mov dword [rbp + 0x77], eax
mov edi, eax
mov ebx, r14d
mov qword [rbp - 9], rbx
mov esi, r14d
mov qword [rbp - 1], r14
mov qword [rbp + 7], r14
je 0x1400149a1
mov edx, edi
lea rcx, [rbp - 9]
call fcn.140009770
mov r8d, edi
xor edx, edx
mov rbx, qword [rbp - 9]
mov rcx, rbx
call fcn.140027290
lea rsi, [rdi + rbx]
mov qword [rbp - 1], rsi
mov eax, dword [rbp + 0x77]
mov r14, qword [rbp + 7]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xf], xmm0
xor edi, edi
mov qword [rbp + 0x1f], rdi
mov r12d, edi
nop dword [rax]
nop word [rax + rax]
mov r9, qword [r15]
mov r8, qword [r15 + 8]
sub r8, r9
mov rdx, r8
sub rdx, r12
mov ecx, eax
cmp rcx, rdx
jb 0x1400149dd
mov eax, r8d
sub eax, r13d
mov dword [rbp - 0x29], eax
mov r8d, eax
lea rdx, [r12 + r9]
mov rcx, rbx
call fcn.140026bf0
mov eax, dword [rbp - 0x29]
add r13d, eax
mov dword [rbp - 0x25], r13d
mov r13, qword [r15 + 8]
sub r13, qword [r15]
mov r12d, dword [rbp - 0x25]
mov dword [rbp + 0x7f], eax
mov eax, edi
cmp r12, r13
sete al
mov dword [rbp - 0x19], eax
mov dword [rsp + 0x30], edi
lea rcx, [rbp + 0x7f]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdi
xor r9d, r9d
mov r8d, eax
xor edx, edx
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov edi, eax
test eax, eax
je 0x140014ae1
mov rcx, rsi
sub rcx, rbx
mov edi, dword [rbp + 0x7f]
cmp rdi, rcx
jbe 0x140014a89
mov rax, r14
sub rax, rbx
cmp rdi, rax
jbe 0x140014a72
mov edx, edi
lea rcx, [rbp - 9]
call fcn.140015000
mov r14, qword [rbp + 7]
mov rsi, qword [rbp - 1]
mov rbx, qword [rbp - 9]
jmp 0x140014a89
sub rdi, rcx
mov r8, rdi
xor edx, edx
mov rcx, rsi
call fcn.140027290
add rsi, rdi
mov qword [rbp - 1], rsi
mov rax, rsi
sub rax, rbx
mov dword [rsp + 0x30], eax
lea rax, [rbp - 0x29]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
mov r8d, dword [rbp - 0x19]
xor edx, edx
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov edi, eax
test eax, eax
je 0x140014ae1
mov r9d, dword [rbp - 0x29]
mov r8, rbx
mov rdx, qword [rbp + 0x17]
lea rcx, [rbp + 0xf]
call fcn.140014dc0
cmp r12, r13
je 0x140014ae1
mov eax, dword [rbp + 0x77]
mov r13d, dword [rbp - 0x25]
xor edi, edi
jmp 0x1400149c0
lea rdx, [rbp + 0xf]
mov rcx, r15
call fcn.140014c80
nop
mov rcx, qword [rbp + 0xf]
test rcx, rcx
je 0x140014b25
mov rdx, qword [rbp + 0x1f]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014b1f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140014b9c
call fcn.140024d14
nop
test rbx, rbx
je 0x140014b59
sub r14, rbx
mov rax, rbx
cmp r14, 0x1000
jb 0x140014b4e
add r14, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140014b96
mov rdx, r14
mov rcx, rbx
call fcn.140024d14
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x140014b68
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbp - 0x11]
test rcx, rcx
je 0x140014b79
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, edi
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140035a34
nop
call fcn.140035a34
nop
int3