Function at 0x180005d50
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x120]
sub rsp, 0x220
mov rax, qword [0x1800ad828]
xor rax, rsp
mov qword [rbp + 0x110], rax
mov r14, r9
mov qword [rsp + 0x68], r9
mov eax, r8d
mov dword [rsp + 0x60], eax
mov rsi, rdx
mov qword [rsp + 0x70], rdx
mov r9, rcx
mov qword [rsp + 0x50], rcx
mov dword [rsp + 0x58], 0
mov qword [rbp - 0x78], 0
mov qword [rbp - 0x70], ILClone
mov byte [rsp + 0x78], 0
mov ecx, r8d
mov dword [rsp + 0x34], eax
imul edx, r8d, 0xbe
mov dword [rsp + 0x40], edx
movzx ebx, byte [rsp + 0x30]
cmp r8d, edx
ja 0x1800067db
movzx r15d, byte [rsp + 0x30]
movzx r12d, byte [rsp + 0x30]
movzx r13d, byte [rsp + 0x30]
nop
cmp ecx, 0x12fc
ja 0x180006399
je 0x180006388
mov eax, ecx
sub eax, 0x2a
je 0x180006140
sub eax, 0x73
je 0x1800060e7
sub eax, 0x56
je 0x180005edb
sub eax, 0x2d
je 0x180005e50
cmp eax, 0xb24
jne 0x180005eb2
mov dword [rsp + 0x38], 0
lea r8, [rsp + 0x38]
mov rdx, rsi
mov ecx, 0xf6
call fcn.18002a140
mov r9, qword [rsp + 0x50]
jmp 0x180005eaa
movzx ecx, byte [r14]
sub ecx, 0x10
je 0x180005ed5
sub ecx, 8
je 0x180005e71
sub ecx, 8
je 0x180005ecf
sub ecx, 0x60
je 0x180005ed5
cmp ecx, 0x40
jne 0x180006618
mov byte [r14], 0x18
mov dword [rsp + 0x34], 0x1680
movzx r8d, byte [r14]
mov rdx, rsi
mov rcx, r9
call sub.VCRUNTIME140.dll_memcpy
movzx eax, byte [r14]
add al, 0x1c
shl al, 2
mov byte [rsp + 0x30], al
shr al, 4
dec al
mov r9, qword [rsp + 0x50]
mov byte [r9 + 0xf0], al
mov edx, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x34]
imul eax, dword [rsp + 0x60], 0x13
add ecx, eax
mov dword [rsp + 0x34], ecx
cmp ecx, edx
ja 0x1800067db
mov rsi, qword [rsp + 0x70]
jmp 0x180005df0
mov byte [r14], 0x20
jmp 0x180005e75
mov byte [r14], ILClone
jmp 0x180005e75
xor ecx, ecx
mov qword [rsp + 0x48], rcx
cmp qword [rsi + 0x10], 8
jb 0x180005eae
nop dword [rax]
mov qword [rbp - 0x58], 0
mov qword [rbp - 0x50], ILClone
mov byte [rbp - 0x68], 0
mov edi, 0x75
nop dword [rax]
cmp edi, 0x75
je 0x180005f9d
cmp edi, 0x118
je 0x180005f7a
cmp edi, 0x1bb
jne 0x18000607a
mov rdx, qword [r14 + 8]
cmp rdx, qword [r14 + 0x10]
je 0x180005f69
xor eax, eax
mov qword [rdx + 0x10], rax
mov qword [rdx + 0x18], rax
movups xmm0, xmmword [rbp - 0x68]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp - 0x58]
movups xmmword [rdx + 0x10], xmm1
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], ILClone
mov byte [rbp - 0x68], al
add qword [r14 + 8], 0x20
jmp 0x18000607a
lea r8, [rbp - 0x68]
mov rcx, r14
call fcn.180001560
jmp 0x180006075
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x38], eax
mov r9d, 7
lea r8, [rsp + 0x38]
xor edx, edx
lea rcx, [rbp - 0x68]
call fcn.1800922d0
jmp 0x180006075
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x30], ILClone
mov byte [rbp - 0x48], 0
mov rax, qword [rsi + 0x10]
cmp rax, rcx
jb 0x180006816
sub rax, rcx
mov r8d, 8
cmp rax, r8
cmovb r8, rax
mov rax, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x180005fdb
mov rax, qword [rsi]
lea rdx, [rax + rcx]
lea rcx, [rbp - 0x48]
call fcn.180018980
or dword [rsp + 0x58], 1
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x180006029
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006024
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006664
call fcn.180092818
movups xmm0, xmmword [rbp - 0x48]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rbp - 0x38]
movups xmmword [rbp - 0x78], xmm1
add qword [rsp + 0x48], 8
lea rcx, [rsp + 0x78]
movq rdx, xmm0
psrldq xmm1, 8
movq rax, xmm1
cmp rax, 0x10
cmovae rcx, rdx
xor edx, edx
lea r8d, [rdx + 0x10]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtoul]
mov dword [rsp + 0x5c], eax
cmp eax, 0
je 0x18000666b
mov rcx, qword [rsp + 0x48]
add edi, 0xa3
cmp edi, 0x25e
jb 0x180005f10
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x1800060cc
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800060c2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000669d
call fcn.180092818
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsi + 0x10]
sub rax, rcx
cmp rax, 8
jae 0x180005ef0
mov r9, qword [rsp + 0x50]
jmp 0x180005eaa
mov edx, 0x36
mov rcx, rsi
call fcn.180008d80
test eax, eax
je 0x180006703
mov dword [rsp + 0x38], 3
lea r8, [rsp + 0x38]
mov rdx, rsi
mov ecx, 0xf6
call fcn.18002a140
mov edx, 0xffffffff
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r9, rsi
xor r8d, r8d
xor edx, edx
mov ecx, 0xfb
call fcn.1800552c0
mov r9, qword [rsp + 0x50]
jmp 0x180005eaa
mov qword [rsp + 0x20], 0
mov r9d, 0xb6
lea r8, [0x180094a40]
lea rdx, [rbp + 0xa0]
xor ecx, ecx
call fcn.1800139f0
xor esi, esi
nop word [rax + rax]
mov r14d, 0xef
mov eax, r14d
sub eax, 0xed
je 0x1800061d6
sub eax, 1
je 0x1800061b6
cmp eax, 1
jne 0x18000623a
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x20], 0
mov r9d, 0x114
lea r8, [rbp - 0x28]
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.18004e3a0
jmp 0x18000623a
mov r9, qword [0x1800ad9b8]
add r9, 8
mov r8d, 0x7c
lea rdx, [rbp]
lea rcx, [rbp - 0x28]
call fcn.1800113d0
jmp 0x18000623a
xor edi, edi
test esi, esi
je 0x18000621e
nop dword [rax]
lea eax, [rsi - 1]
cmp edi, eax
jne 0x1800061ff
lea r9, [0x180094a40]
mov r8d, 6
lea rdx, [rbp]
xor ecx, ecx
call fcn.180074a50
lea r9, [rbp]
lea r8, [rbp + 0xa0]
mov edx, 0x113
lea rcx, [rbp]
call fcn.18001e440
inc edi
cmp edi, esi
jl 0x1800061e0
mov r9d, 0x36
xor r8d, r8d
lea rdx, [rbp]
xor ecx, ecx
call fcn.180019a70
test eax, eax
je 0x18000673e
dec r14d
cmp r14d, 0xec
ja 0x180006176
inc esi
cmp esi, 0x24
jl 0x180006170
mov esi, 1
nop word [rax + rax]
mov r14d, 0xa2
mov eax, r14d
sub eax, 0xa2
je 0x1800062c8
cmp eax, 1
jne 0x18000635e
lea r9d, [rax + 0x35]
xor r8d, r8d
lea rdx, [rbp]
xor ecx, ecx
call fcn.180019a70
test eax, eax
jne 0x18000635e
lea ecx, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rax, str.Trying_to_extract_an_object_out_from_empty_container
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [0x180096892]
lea rdx, str._s_winhttp
call fcn.180092630
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x20], 0
mov r9d, 0x114
lea r8, [rbp - 0x28]
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.18004e3a0
mov r9d, ILFree
lea r8, [rbp - 0x28]
lea rdx, [rbp - 0x28]
xor ecx, ecx
call fcn.180023f90
mov r9, qword [0x1800ad9b8]
add r9, 8
mov r8d, 0x7c
lea rdx, [rbp]
lea rcx, [rbp - 0x28]
call fcn.1800113d0
xor edi, edi
lea eax, [rsi - 1]
cmp edi, eax
jne 0x18000633f
lea r9, [rbp + 0xa0]
mov r8d, 6
lea rdx, [rbp]
xor ecx, ecx
call fcn.180074a50
lea r9, [rbp]
lea r8, [0x180094a40]
mov edx, 0x113
lea rcx, [rbp]
call fcn.18001e440
inc edi
cmp edi, esi
jl 0x180006320
inc r14d
cmp r14d, 0xa4
jb 0x180006266
inc esi
cmp esi, 0x24
jle 0x180006260
mov r14, qword [rsp + 0x68]
mov r9, qword [rsp + 0x50]
jmp 0x180005eaa
mov rax, qword [rsp + 0x48]
cmp rax, qword [rsi + 0x10]
sete bl
jmp 0x180005eb2
cmp ecx, 0x1680
je 0x180005e75
cmp ecx, 0x2505
je 0x180006775
cmp ecx, 0x2be0
je 0x180006404
cmp ecx, 0x4140
jne 0x180005eb2
mov rax, qword [rbp - 0x70]
cmp rax, 0x10
jb 0x1800067ae
lea rdx, [rax + 1]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800067a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jmp 0x1800067a7
movzx ebx, byte [r14]
mov r8b, 1
cmp bl, byte [rsp + 0x30]
jae 0x180006611
nop word [rax + rax]
mov r10d, 0x63
movzx edi, bl
lea r11, [r9 + rdi]
movzx esi, bl
mov eax, r10d
sub eax, 0x63
je 0x1800065db
sub eax, 1
je 0x18000649d
sub eax, 1
je 0x180006467
cmp eax, 1
jne 0x1800065ef
movzx eax, r15b
movzx ecx, byte [rax + r9 + 3]
xor cl, byte [rsp + 0x31]
mov byte [rsi + r9 + 3], cl
jmp 0x1800065ef
movzx edx, r15b
movzx eax, byte [rdx + r9]
xor al, r12b
mov byte [rsi + r9], al
movzx eax, r15b
movzx ecx, byte [rax + r9 + 1]
xor cl, byte [rsp + 0x32]
mov byte [rsi + r9 + 1], cl
movzx eax, byte [rdx + r9 + 2]
xor al, r13b
mov byte [rsi + r9 + 2], al
jmp 0x1800065ef
movzx ecx, byte [r11 - 1]
mov byte [rsp + 0x31], cl
movzx r9d, byte [r14]
xor edx, edx
mov eax, edi
div r9d
test edx, edx
jne 0x180006550
mov edx, 0xa8
movzx edi, byte [rsp + 0x32]
lea rsi, str.cw
nop word [rax + rax]
cmp edx, 0xa8
je 0x18000650e
cmp edx, 0x1f8
jne 0x180006526
movzx eax, cl
movzx r13d, byte [rax + rsi]
movzx eax, r15b
movzx eax, byte [rax + rsi]
mov byte [rsp + 0x31], al
movzx eax, r8b
shr al, 7
movzx eax, al
imul ecx, eax, 0x1b
add r8b, r8b
xor r8b, cl
movzx ecx, byte [rsp + 0x31]
jmp 0x180006526
movzx r15d, r12b
movzx eax, dil
movzx r12d, byte [rax + rsi]
xor r12b, r8b
movzx eax, r13b
movzx edi, byte [rax + rsi]
add edx, 0x150
cmp edx, 0x2a0
jbe 0x1800064d0
mov byte [rsp + 0x32], dil
movzx edi, bl
movzx esi, bl
movzx r15d, bl
sub r15b, r9b
mov r9, qword [rsp + 0x50]
jmp 0x1800065ef
cmp r9b, 0x18
jbe 0x1800065cd
cmp edx, 0x10
jne 0x1800065cd
mov ecx, 0x115
movzx esi, byte [rsp + 0x32]
movzx r14d, byte [rsp + 0x31]
nop dword [rax + rax]
mov eax, ecx
sub eax, 0x115
je 0x1800065a1
cmp eax, 1
jne 0x1800065b1
movzx eax, sil
lea rdx, str.cw
movzx esi, byte [rax + rdx]
movzx eax, r13b
movzx r13d, byte [rax + rdx]
movzx eax, r14b
movzx r14d, byte [rax + rdx]
jmp 0x1800065b1
movzx eax, r12b
lea rdx, str.cw
movzx r12d, byte [rax + rdx]
inc ecx
cmp ecx, 0x117
jb 0x180006570
mov byte [rsp + 0x31], r14b
mov byte [rsp + 0x32], sil
mov r14, qword [rsp + 0x68]
movzx esi, bl
movzx r15d, bl
sub r15b, r9b
mov r9, qword [rsp + 0x50]
jmp 0x1800065ef
movzx r12d, byte [r11 - 4]
movzx eax, byte [r11 - 3]
mov byte [rsp + 0x32], al
movzx r13d, byte [rsi + r9 - 2]
inc r10d
cmp r10d, 0x67
jb 0x180006430
add bl, 4
cmp bl, byte [rsp + 0x30]
jb 0x180006420
mov ecx, dword [rsp + 0x34]
mov edx, dword [rsp + 0x40]
xor bl, bl
jmp 0x180005eb2
mov byte [r9 + 0xf0], 0
mov rax, qword [rbp - 0x70]
cmp rax, 0x10
jb 0x18000665d
lea rdx, [rax + 1]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006658
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000680f
call fcn.180092818
mov al, 0xff
jmp 0x1800067b1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x1800066a9
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800066a4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800066a4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180092818
mov qword [rbp - 0x58], 0
mov qword [rbp - 0x50], ILClone
mov byte [rbp - 0x68], 0
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x1800066fc
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800066f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800066f7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180092818
xor al, al
jmp 0x1800067b1
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x1800067ae
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800067a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jmp 0x1800067a7
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rax, str.long3___OVERLOADABLE___isordered_double3__double3__
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [0x180096892]
lea rdx, str._bnovara_b
call fcn.180092630
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
nop
mov rax, qword [rbp - 0x70]
cmp rax, 0x10
jb 0x1800067ae
lea rdx, [rax + 1]
mov rcx, qword [rsp + 0x78]
mov r8, rcx
cmp rdx, 0x1000
jb 0x1800067a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub r8, rcx
add r8, 0xfffffffffffffff8
cmp r8, 0x1f
ja 0x18000680f
call fcn.180092818
movzx eax, bl
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.180092fc0
mov rbx, qword [rsp + 0x270]
add rsp, 0x220
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rax, qword [rbp - 0x70]
cmp rax, 0x10
jb 0x1800067ae
lea rdx, [rax + 1]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800067a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800067a9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.180017e50
nop
int3