Function at 0x18000f6b0
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x230]
sub rsp, 0x330
mov rax, qword [0x180066008]
xor rax, rsp
mov qword [rbp + 0x220], rax
mov rbx, r8
mov r15, rdx
movzx r8d, word [r8 + 0x22]
mov rdi, rcx
xor r14b, r14b
mov r9, qword [rbx + 8]
lea r11, [r8 + r9]
call fcn.180038a90
test al, al
je 0x18000f721
test byte [rbx + 0x2c], 4
je 0x18000f721
movzx edx, word [rbx + 0x24]
lea ecx, [rdx + r8]
cmp ecx, 0x15
jb 0x18000f721
movups xmm0, xmmword [rdx + r11 - 0x10]
mov r14b, 1
movups xmmword [rbp + 0x190], xmm0
movsxd rax, dword [rbx + 0x28]
xor esi, esi
lea rdx, [rdi + rax*8]
mov rcx, qword [rdx + 0x810]
movzx eax, byte [rcx + 0x18]
mov byte [rbp + 0x160], al
movzx eax, byte [rcx + 0x19]
mov byte [rbp + 0x161], al
movzx eax, byte [rcx + 0x1a]
mov byte [rbp + 0x162], al
movzx eax, byte [rcx + 0x1b]
mov byte [rbp + 0x163], al
movzx eax, byte [rbx + 7]
xor al, byte [rcx + 0x1c]
mov byte [rbp + 0x164], al
movzx eax, byte [rbx + 6]
xor al, byte [rcx + 0x1d]
mov byte [rbp + 0x165], al
movzx eax, byte [rbx + 5]
xor al, byte [rcx + 0x1e]
mov byte [rbp + 0x166], al
movzx eax, byte [rbx + 4]
xor al, byte [rcx + 0x1f]
mov byte [rbp + 0x167], al
movzx eax, byte [rbx + 3]
xor al, byte [rcx + 0x20]
mov byte [rbp + 0x168], al
movzx eax, byte [rbx + 2]
xor al, byte [rcx + 0x21]
mov byte [rbp + 0x169], al
movzx eax, byte [rbx + 1]
xor al, byte [rcx + 0x22]
mov byte [rbp + 0x16a], al
movzx eax, byte [rcx + 0x23]
xor al, byte [rbx]
test byte [rbx + 0x2c], 0x40
mov byte [rbp + 0x16b], al
je 0x18000fa2e
mov rax, qword [rdx + 0x810]
xorps xmm0, xmm0
movzx ecx, word [rbx + 0x24]
mov rdx, r11
mov dword [rsp + 0x48], esi
movups xmmword [rbp + 0x1a0], xmm0
mov r10, qword [rax + 8]
xor eax, eax
mov qword [rbp + 0x1f0], rax
lea rax, [rcx - 0x10]
add rax, r11
mov dword [rbp + 0x1a0], 0x58
movups xmmword [rbp + 0x1c0], xmm0
mov qword [rbp + 0x1c8], rax
lea rax, [rbp + 0x160]
movups xmmword [rbp + 0x1b0], xmm0
mov qword [rbp + 0x1a8], rax
lea rax, [rbp + 0x158]
mov qword [rsp + 0x40], rax
mov dword [rbp + 0x1c0], r8d
lea r8d, [rcx - 0x10]
mov dword [rsp + 0x38], r8d
mov rcx, r10
mov qword [rsp + 0x30], r11
mov qword [rbp + 0x1b8], r9
lea r9, [rbp + 0x1a0]
movups xmmword [rbp + 0x1d0], xmm0
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
movups xmmword [rbp + 0x1e0], xmm0
mov dword [rbp + 0x1a4], 1
mov dword [rbp + 0x1d0], shutdown
mov dword [rbp + 0x1b0], setsockopt
call qword [sym.imp.bcrypt.dll_BCryptDecrypt]
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jle 0x18000f8ab
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x18000fa2e
test r14b, r14b
je 0x18000f8f9
lea rdx, [rdi + 0x368]
mov rax, qword [rdx]
cmp rax, rdx
je 0x18000f8f9
mov r8, qword [rbp + 0x198]
mov r9, qword [rbp + 0x190]
movzx ecx, byte [rax + 0x20]
test cl, 0x40
je 0x18000f8f1
test cl, 0x20
jne 0x18000f8f1
cmp qword [rax + 0x10], r9
jne 0x18000f8f1
cmp qword [rax + 0x18], r8
je 0x18000f981
mov rax, qword [rax]
cmp rax, rdx
jne 0x18000f8d3
test byte [0x180067c76], 1
je 0x18000f93f
test byte [rdi + 0xe3], 2
je 0x18000f912
movzx esi, byte [0x180067d74]
mov eax, dword [rdi + 0xaec]
movzx r8d, sil
mov r9, qword [rbx]
mov dl, 1
mov dword [rsp + 0x30], eax
mov rcx, rdi
mov rax, qword [rbx + 8]
mov qword [rsp + 0x28], rax
movzx eax, word [rbx + 0x22]
mov word [rsp + 0x20], ax
call fcn.1800443ec
inc qword [rdi + 0xb88]
lea r8, str.Decryption_failure
mov rdx, rbx
mov rcx, rdi
call fcn.18001d760
mov edx, 1
lea ecx, [rdx + 0xa]
call fcn.180015470
cmp qword [rdi + 0xb88], 0xb504f3
jb 0x18000fd13
mov r8d, 0xf
jmp 0x18000fa5f
test byte [0x180067c76], 1
je 0x18000f9d5
mov r8b, 0x10
lea rdx, [rbp + 0x190]
lea rcx, [rsp + 0x58]
call fcn.18004318c
lea r9, str._S__RX_____SR__s
mov qword [rsp + 0x20], rax
mov edx, 0x80
lea rcx, [rbp + 0x1a0]
mov r8, 0xffffffffffffffff
call fcn.180042088
lea r8, [rbp + 0x1a0]
lea rdx, [0x180056df8]
call fcn.1800417fc
test byte [0x180067c73], 4
je 0x18000fa13
lea r9, str.Received_stateless_reset
mov edx, 0x80
mov r8, 0xffffffffffffffff
lea rcx, [rbp + 0x1a0]
call fcn.180042088
lea r9, [rbp + 0x1a0]
mov r8, rdi
lea rdx, [0x180056cc8]
call fcn.180041678
xor r9d, r9d
mov r8, 0xffffffff80004004
mov rcx, rdi
lea edx, [r9 + 0x13]
call fcn.180002830
jmp 0x18000fd13
inc qword [rdi + 0xb90]
movzx ecx, byte [rbx + 0x2c]
mov rax, qword [rbx + 8]
test cl, 4
je 0x18000fa74
test byte [rax], 0x18
je 0x18000fa82
lea r8, str.Invalid_SH_Reserved_bits_values
mov rdx, rbx
mov rcx, rdi
call fcn.18001d760
mov r8d, 0xa
mov edx, 2
xor r9d, r9d
mov rcx, rdi
call fcn.180002830
jmp 0x18000fd13
test byte [rax], 0xc
je 0x18000fa82
lea r8, str.Invalid_LH_Reserved_bits_values
jmp 0x18000fa4e
test cl, 0x40
je 0x18000fa90
mov eax, 0xfff0
add word [rbx + 0x24], ax
mov ecx, dword [rbx + 0x28]
test ecx, ecx
je 0x18000faaf
sub ecx, 1
je 0x18000faa1
cmp ecx, 1
je 0x18000faa8
mov ecx, 0x7b0
jmp 0x18000fab4
mov ecx, 0x7a8
jmp 0x18000fab4
mov ecx, 0x7a0
mov rcx, qword [rcx + rdi]
lea r9, [rsp + 0x50]
mov rdx, qword [rbx]
add rcx, 0x20
mov r8d, 1
call fcn.18000cb30
test rax, rax
je 0x18000fcb4
cmp byte [rsp + 0x50], sil
je 0x18000fcb4
test byte [0x180067c76], 1
je 0x18000fb55
test byte [rdi + 0xe3], 2
je 0x18000fafc
movzx esi, byte [0x180067d74]
mov eax, dword [rdi + 0xaec]
movzx r8d, sil
movzx ecx, word [rbx + 0x24]
mov dl, 1
add cx, word [rbx + 0x22]
mov r9, qword [rbx]
mov dword [rsp + 0x30], eax
mov rax, qword [rbx + 8]
mov qword [rsp + 0x28], rax
mov word [rsp + 0x20], cx
mov rcx, rdi
call fcn.1800443ec
movzx eax, word [rbx + 0x22]
mov dl, 1
mov r8, qword [rbx]
movzx r9d, ax
add r9w, word [rbx + 0x24]
mov rcx, rdi
mov word [rsp + 0x28], ax
mov rax, qword [rbx + 8]
mov qword [rsp + 0x20], rax
call fcn.1800499b0
test byte [0x180067c72], 0x80
je 0x18000fb9a
test byte [rbx + 0x2c], 4
je 0x18000fb68
mov cl, 5
jmp 0x18000fb77
mov rax, qword [rbx + 8]
movzx ecx, byte [rax]
shr cl, 4
and cl, 3
inc cl
movzx eax, word [rbx + 0x24]
lea rdx, [0x180056d18]
add ax, word [rbx + 0x22]
mov r8, rdi
mov r9, qword [rbx]
mov word [rsp + 0x28], ax
mov byte [rsp + 0x20], cl
call fcn.180044f3c
movzx edx, byte [rbx + 0x2c]
test dl, 4
jne 0x18000fbe4
mov rax, qword [rbx + 8]
movzx ecx, byte [rax]
shr ecx, 4
and ecx, 3
je 0x18000fbbf
cmp ecx, 1
jne 0x18000fbe4
or dl, 0x80
mov byte [rbx + 0x2c], dl
jmp 0x18000fbe4
test byte [rdi + 0xe0], 8
jne 0x18000fbe4
mov rcx, rdi
call fcn.180038a90
test al, al
je 0x18000fbe4
mov rdx, rbx
call fcn.180023f78
test al, al
je 0x18000fd13
test byte [rbx + 0x2c], 4
je 0x18000fc7f
mov eax, dword [rbx + 0x28]
mov rsi, qword [rdi + 0x7b0]
cmp eax, 5
jne 0x18000fc0c
xor edx, edx
mov rcx, rdi
call fcn.180047dc0
mov rax, qword [rbx]
jmp 0x18000fc32
cmp eax, 3
jne 0x18000fc7f
mov rax, qword [rbx + 8]
movzx ecx, byte [rax]
shr cl, 2
xor cl, byte [rsi + 0x198]
test cl, 1
jne 0x18000fc7f
mov rax, qword [rbx]
cmp rax, qword [rsi + 0x188]
jae 0x18000fc7f
mov qword [rsi + 0x188], rax
test byte [0x180067c73], 8
je 0x18000fc7f
mov rax, qword [rbx]
lea r9, str.Updating_current_read_key_phase_and_packet_number__llu_
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
mov edx, 0x80
lea rcx, [rbp + 0x1a0]
call fcn.180042088
lea r9, [rbp + 0x1a0]
mov r8, rdi
lea rdx, [0x180056c18]
call fcn.180041678
cmp dword [rbx + 0x28], 2
jne 0x18000fcb0
mov rcx, rdi
call fcn.18000f100
test al, al
je 0x18000fcb0
lea rcx, [rdi + 0x7b8]
xor edx, edx
call fcn.1800176e8
mov r8d, 1
mov rdx, r15
mov rcx, rdi
call fcn.180023bc0
mov al, 1
jmp 0x18000fd15
test byte [0x180067c76], 1
je 0x18000fcfa
test byte [rdi + 0xe3], 2
je 0x18000fccd
movzx esi, byte [0x180067d74]
mov eax, dword [rdi + 0xaec]
movzx r8d, sil
mov r9, qword [rbx]
mov dl, 1
mov dword [rsp + 0x30], eax
mov rcx, rdi
mov rax, qword [rbx + 8]
mov qword [rsp + 0x28], rax
movzx eax, word [rbx + 0x20]
mov word [rsp + 0x20], ax
call fcn.1800443ec
lea r8, str.Duplicate_packet_number
mov rdx, rbx
mov rcx, rdi
call fcn.18001d760
inc qword [rdi + 0xb80]
xor al, al
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.180028c10
mov rbx, qword [rsp + 0x378]
add rsp, 0x330
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret