Function at 0x1002d694c
Capabilities:
Encrypt data using aes via winapi

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
xor r15d, r15d
mov rax, r9
mov r13, r8
mov r14, rdx
mov rbp, rcx
mov rbx, r15
mov dword [r11 - 0x58], r15d
mov rsi, r15
mov dword [r11 + 0x10], r15d
mov r12, r15
mov qword [r11 - 0x48], r15
cmp rdx, r15
je 0x1002d6c12
cmp r8, r15
je 0x1002d6c12
cmp rax, r15
je 0x1002d6c12
cmp dword [rcx + 0xc], 4
je 0x1002d69b5
mov edi, 0x80049e2f
jmp 0x1002d6c27
cmp qword [rcx + 0x30], r15
je 0x1002d6c0b
cmp qword [rcx + 0x38], r15
je 0x1002d6c0b
mov ecx, 0x48
call fcn.10004c2c0
cmp rax, r15
je 0x1002d69e7
mov rdx, qword [rbp + 0x38]
mov rcx, rax
call fcn.1002d5ec4
mov rbx, rax
cmp rbx, r15
jne 0x1002d69f6
mov edi, 0x8007000e
jmp 0x1002d6c27
mov rax, qword [r13]
lea rdx, [rsp + 0x30]
xor r8d, r8d
mov rcx, r13
call qword [rax + 0x28]
mov edi, eax
cmp eax, r15d
jne 0x1002d6c19
mov ecx, dword [rsp + 0x30]
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.10004c2c0
mov rsi, rax
mov qword [rsp + 0x38], rax
cmp rax, r15
jne 0x1002d6a49
mov edi, 0x8007000e
jmp 0x1002d6c19
mov rax, qword [r13]
lea rdx, [rsp + 0x30]
mov r8, rsi
mov rcx, r13
call qword [rax + 0x28]
mov edi, eax
cmp eax, r15d
jne 0x1002d6c19
lea rdi, [0x10001f040]
mov ecx, 0x30
repe cmpsw word [rsi], word [rdi]
je 0x1002d6a81
mov edi, 0x80049e5b
jmp 0x1002d6bd5
mov rax, qword [r13]
lea rdx, [rsp + 0x98]
xor r8d, r8d
mov rcx, r13
call qword [rax + 0x38]
mov edi, eax
cmp eax, r15d
jne 0x1002d6bd5
mov r15d, dword [rsp + 0x98]
add r15d, 0xc
mov ecx, r15d
call fcn.10004c2c0
mov r12, rax
xor eax, eax
cmp r12, rax
jne 0x1002d6ac9
mov edi, 0x8007000e
jmp 0x1002d6c01
mov word [r12 + 2], ax
mov eax, 0x2c
lea rdi, [0x10001efe0]
mov rsi, r14
mov rcx, rax
mov byte [r12], 1
mov byte [r12 + 1], 2
repe cmpsw word [rsi], word [rdi]
jne 0x1002d6b03
mov dword [r12 + 4], 0x660e
mov dword [rbx + 0xc], 1
jmp 0x1002d6b4d
lea rdi, [0x10001ef80]
mov rsi, r14
mov rcx, rax
repe cmpsw word [rsi], word [rdi]
jne 0x1002d6b27
mov dword [r12 + 4], 0x660f
mov dword [rbx + 0xc], 2
jmp 0x1002d6b4d
lea rdi, [0x10001ef20]
mov rsi, r14
mov rcx, rax
repe cmpsw word [rsi], word [rdi]
jne 0x1002d6bfc
mov dword [r12 + 4], 0x6610
mov dword [rbx + 0xc], 3
mov dword [r12 + 8], 0xa400
mov rax, qword [r13]
lea r8, [r12 + 0xc]
lea rdx, [rsp + 0x98]
mov rcx, r13
call qword [rax + 0x38]
mov edi, eax
test eax, eax
jne 0x1002d6c01
mov r8d, dword [rsp + 0x98]
lea rdx, [r12 + 0xc]
mov rcx, rbp
call fcn.1002d5350
mov edi, eax
test eax, eax
jne 0x1002d6c01
mov r9, qword [rbp + 0x30]
mov rcx, qword [rbp + 0x38]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov r8d, r15d
mov rdx, r12
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
xor r15d, r15d
cmp eax, r15d
jne 0x1002d6bdc
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
cmp eax, r15d
cmovle edi, eax
mov rsi, qword [rsp + 0x38]
jmp 0x1002d6c19
mov rax, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov qword [rbx + 0x30], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x40], r15
mov qword [rax], rbx
jmp 0x1002d6c27
mov edi, 0x80049e5b
mov rsi, qword [rsp + 0x38]
xor r15d, r15d
jmp 0x1002d6c19
mov edi, 0x80049e51
jmp 0x1002d6c27
mov edi, 0x80070057
jmp 0x1002d6c19
cmp rbx, r15
je 0x1002d6c27
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov rcx, rsi
call fcn.10004c2e4
mov rcx, r12
call fcn.10004c2e4
mov rcx, qword [rsp + 0x40]
cmp rcx, r15
je 0x1002d6c47
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov eax, edi
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret