Function at 0x14009fa48
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
xor ebx, ebx
mov rdi, r9
mov r12, r8
mov rsi, rdx
mov r14, rcx
test rcx, rcx
je 0x14009fc63
test rdx, rdx
je 0x14009fc63
test r8, r8
je 0x14009fc63
test r9, r9
je 0x14009fc63
mov ecx, dword [r9 + 8]
mov r13d, dword [r8 + 8]
mov dword [rbp + 0x30], reloc.OLEAUT32.dll_SafeArrayGetElement
add ecx, 0x18
add r13d, ecx
mov ecx, r13d
call qword [sym.imp.msvcrt.dll_malloc]
mov r15, rax
test rax, rax
je 0x14009fc63
mov dword [rax], 0x31415352
mov eax, dword [rdi + 8]
shl eax, 3
mov dword [r15 + 4], eax
mov eax, dword [r12 + 8]
mov dword [r15 + 8], eax
mov eax, dword [rdi + 8]
mov qword [r15 + 0x10], rbx
mov dword [r15 + 0xc], eax
mov ecx, dword [rbp + 0x30]
mov r8d, dword [r12 + 8]
mov rdx, qword [r12]
add rcx, r15
call qword [sym.imp.msvcrt.dll_memcpy]
mov eax, dword [rbp + 0x30]
mov r8d, dword [rdi + 8]
add eax, dword [r12 + 8]
mov rdx, qword [rdi]
mov ecx, eax
mov dword [rbp + 0x30], eax
add rcx, r15
call qword [sym.imp.msvcrt.dll_memcpy]
mov rcx, qword [0x14017a1d0]
mov dword [rsp + 0x30], 8
lea r9, [rbp - 0x10]
lea r8, str.RSAPUBLICBLOB
xor edx, edx
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r15
call qword [sym.imp.bcrypt.dll_BCryptImportKeyPair]
mov edi, eax
lea r13d, [rbx + 1]
test eax, eax
js 0x14009fc4e
mov r8d, dword [rsi + 8]
mov rdx, qword [rsi]
mov rcx, qword [rbp - 0x10]
mov dword [rsp + 0x48], r13d
lea rax, [rbp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.bcrypt.dll_BCryptEncrypt]
mov edi, eax
test eax, eax
js 0x14009fc44
mov edx, dword [rbp + 0x50]
mov rcx, r14
call fcn.14009f958
test eax, eax
jne 0x14009fc3f
mov edi, dword [rbp + 0x50]
cmp dword [rsi + 8], edi
cmova edi, dword [rsi + 8]
mov ecx, edi
mov dword [rbp + 0x50], edi
call qword [sym.imp.msvcrt.dll_malloc]
mov r12, rax
test rax, rax
je 0x14009fc3f
sub edi, dword [rsi + 8]
xor edx, edx
mov rcx, rax
mov r8d, edi
mov dword [rbp + 0x30], edi
call qword [sym.imp.msvcrt.dll_memset]
mov ecx, dword [rbp + 0x30]
mov r8d, dword [rsi + 8]
mov rdx, qword [rsi]
add rcx, r12
call qword [sym.imp.msvcrt.dll_memcpy]
mov r8d, dword [rbp + 0x50]
mov rcx, qword [rbp - 0x10]
mov dword [rsp + 0x48], r13d
lea rax, [rbp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov eax, dword [r14 + 8]
mov rdx, r12
mov dword [rsp + 0x38], eax
mov rax, qword [r14]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.bcrypt.dll_BCryptEncrypt]
mov rcx, r12
mov edi, eax
call qword [sym.imp.msvcrt.dll_free]
test edi, edi
js 0x14009fc44
mov edx, dword [rbp + 0x30]
mov rcx, r14
call fcn.14009f958
jmp 0x14009fc44
mov edi, 0xc0000017
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.bcrypt.dll_BCryptDestroyKey]
mov rcx, r15
call qword [sym.imp.msvcrt.dll_free]
test edi, edi
setns bl
sub ebx, r13d
mov eax, ebx
jmp 0x14009fc66
or eax, 0xffffffff
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret