Function at 0x14000fd11
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rbx, r9
mov r13d, r8d
mov r12, rdx
mov r15, rcx
mov eax, dword [rcx + 0x18]
cmp eax, 0x8009
mov ebp, 0x8004
cmovne ebp, eax
mov ecx, ebp
call fcn.140007c2e
mov dword [rsp + 0x54], eax
mov ecx, dword [r15 + 0x1c]
call fcn.140007d67
mov r14d, eax
mov ecx, dword [r15 + 0x1c]
call fcn.140007cc8
mov edi, eax
add edi, r14d
mov ecx, 0x40
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
je 0x14000ffd2
mov rsi, rax
mov eax, dword [r15 + 0x14]
lea r9, [r15 + 4]
mov dword [rsp + 0x38], edi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x20], 0x10
mov ecx, ebp
mov rdx, r12
mov r8d, r13d
call fcn.140007578
test eax, eax
je 0x14000ffea
mov qword [rsp + 0x68], rbx
mov ecx, dword [r15 + 0x1c]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor ebx, ebx
mov rdx, rsi
mov r8d, r14d
xor r9d, r9d
call fcn.140006dde
test eax, eax
je 0x14000ffd6
mov eax, r14d
mov r8, rsi
add r8, rax
mov rcx, qword [rsp + 0x60]
mov edx, 1
xor r9d, r9d
call qword [sym.imp.advapi32.dll_CryptSetKeyParam]
test eax, eax
je 0x14000ffa3
mov edi, dword [r15 + 0x28]
mov dword [rsp + 0x50], edi
mov ecx, 0x40
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
je 0x14000ffa3
mov r14, rax
mov rdx, qword [r15 + 0x20]
mov rcx, rax
mov r8, rdi
call fcn.1400eeb30
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
xor ebx, ebx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.advapi32.dll_CryptDecrypt]
test eax, eax
je 0x14000ff9a
mov rdx, qword [rsp + 0xe0]
mov eax, dword [rsp + 0x50]
xor ecx, ecx
cmp dword [r15 + 0x1c], 0x6603
setne cl
mov edi, dword [rsp + 0x54]
sub eax, edi
lea eax, [rax + rcx*4]
add eax, 0xffffffec
mov dword [rdx], eax
mov r15d, edi
mov ecx, 0x40
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
je 0x14000ff9a
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x10
mov ecx, ebp
mov rdx, r12
mov r8d, r13d
mov r9, r14
call fcn.1400073ab
xor ebx, ebx
test eax, eax
je 0x14000ff8c
mov ecx, 0x40
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
mov rdx, qword [rsp + 0x58]
je 0x14000ff91
mov r12, rax
mov r13, qword [rsp + 0xe0]
mov eax, dword [r13]
mov r9d, dword [rsp + 0x50]
mov rdi, r14
add r9, r14
sub r9, rax
mov r8d, dword [rsp + 0x54]
mov dword [rsp + 0x30], r8d
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], eax
mov ecx, ebp
call fcn.1400073ab
xor ebx, ebx
test eax, eax
je 0x14000ff83
lea rdx, [rdi + 0x10]
mov rcx, r12
mov r8, r15
call fcn.1400eea30
test eax, eax
jne 0x14000ff83
mov edx, dword [r13]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rcx, qword [rsp + 0x68]
mov qword [rcx], rax
mov ebx, 1
test rax, rax
je 0x14000ff83
mov ecx, dword [rsp + 0x50]
mov rdx, r14
add rdx, rcx
mov r8d, dword [r13]
sub rdx, r8
mov rcx, rax
call fcn.1400eeb30
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdx, qword [rsp + 0x58]
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.advapi32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x70]
call fcn.14000723a
test eax, eax
jne 0x14000ffec
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__2_2___2__________v_
mov edx, eax
call fcn.140016430
jmp 0x14000ffec
xor ebx, ebx
jmp 0x14000fff5
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x140141870]
mov edx, eax
call fcn.140016430
xor ebx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebx
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret