Function at 0x180008f6c
Capabilities:
Encrypt or decrypt via wincrypt
Import public key

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov dword [r11 + 0x20], r9d
push rbp
push rsi
push rdi
push r12
push r14
mov rbp, rsp
sub rsp, 0x60
xor ebx, ebx
xor edi, edi
mov r14, r8
and qword [rbp - 0x18], rbx
and qword [rbp - 8], rbx
and qword [rbp - 0x10], rbx
test rcx, rcx
je 0x1800091ae
test edx, edx
je 0x1800091ae
and dword [rbp - 0x20], ebx
lea rax, [rbp - 0x20]
mov r9d, edx
mov qword [r11 - 0x50], rax
lea rax, [rbp - 0x18]
mov r8, rcx
mov qword [r11 - 0x58], rax
and qword [r11 - 0x60], rbx
lea esi, [rbx + 8]
lea r12d, [rbx + 1]
mov edx, esi
mov dword [rsp + 0x20], 0x8000
mov ecx, r12d
call qword [sym.imp.CRYPT32.dll_CryptDecodeObjectEx]
test eax, eax
jne 0x180009002
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str._ENC__Failed_to_decode:__u___x_
mov edx, eax
mov r8d, eax
mov ebx, eax
call fcn.180007e94
jmp 0x1800091b3
mov rdx, qword [rbp - 0x18]
lea rcx, str._ENC__Key_algo:__s
mov rdx, qword [rdx]
call fcn.180007e94
lea r8, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
lea rcx, [rbp - 8]
mov r9d, r12d
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x180009079
lea rcx, str._ENC__Failed_to_create_the_RSA_provider_with_CRYPT_VERIFYCONTEXT
call fcn.180007e94
lea r8, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
lea rcx, [rbp - 8]
mov r9d, r12d
xor edx, edx
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x180009070
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str._ENC__Failed_to_create_the_RSA_provider_with_CRYPT_NEWKEYSET:__u___x_
jmp 0x180008ff1
lea rcx, str._ENC__Created_the_RSA_provider_with_CRYPT_NEWKEYSET
jmp 0x180009080
lea rcx, str._ENC__Created_the_RSA_provider_with_CRYPT_VERIFYCONTEXT
call fcn.180007e94
mov r8, qword [rbp - 0x18]
mov rcx, qword [rbp - 8]
lea r9, [rbp - 0x10]
mov edx, r12d
call qword [sym.imp.CRYPT32.dll_CryptImportPublicKeyInfo]
test eax, eax
jne 0x1800090b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str._ENC__Failed_to_import_the_key:__u___x_
jmp 0x180008ff1
mov eax, dword [rbp + 0x48]
mov rcx, qword [rbp - 0x10]
xor r9d, r9d
mov dword [rsp + 0x30], eax
mov dword [rbp + 0x30], eax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], rbx
mov r8d, r12d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov edx, dword [rbp + 0x30]
lea rcx, str._ENC__Encrypted_data_length:__u___x_
mov r8d, edx
call fcn.180007e94
mov esi, dword [rbp + 0x30]
mov rcx, r12
mov edx, esi
call fcn.1800199bc
mov rdi, rax
test rax, rax
jne 0x180009109
lea ebx, [rax + 0xe]
jmp 0x1800091c4
mov r9d, dword [rbp + 0x48]
mov r8, r14
mov rdx, rsi
mov rcx, rax
call fcn.18001ad08
mov eax, dword [rbp + 0x30]
mov rcx, qword [rbp - 0x10]
mov dword [rsp + 0x30], eax
lea rax, [rbp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov r8d, r12d
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x180009158
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str._ENC__Failed_to_encrypt:__u___x_
jmp 0x180008ff1
lea rcx, str._ENC__Encryption_witih_RSA_succeded__byteswapping_because_MS_is_stupid_and_does_stuff_in_little_endian.
call fcn.180007e94
mov ecx, dword [rbp + 0x30]
xor r9d, r9d
test ecx, 0xfffffffe
jbe 0x18000919f
mov r8b, byte [r9 + rdi]
sub ecx, r9d
sub ecx, r12d
mov cl, byte [rcx + rdi]
mov byte [r9 + rdi], cl
mov eax, dword [rbp + 0x30]
sub eax, r9d
add r9d, r12d
sub eax, r12d
mov byte [rax + rdi], r8b
mov ecx, dword [rbp + 0x30]
mov eax, ecx
shr eax, 1
cmp r9d, eax
jb 0x180009172
mov rax, qword [rbp + 0x50]
mov qword [rax], rdi
mov rax, qword [rbp + 0x58]
mov dword [rax], ecx
jmp 0x1800091b3
mov ebx, 0xa0
test ebx, ebx
je 0x1800091c4
test rdi, rdi
je 0x1800091c4
mov rcx, rdi
call fcn.180018f58
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1800091d3
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1800091e2
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x1800091f3
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, ebx
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret