Function at 0x1400d0880
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov r12d, dword [rbp + 0x60]
mov r15, r9
movsxd rax, dword [0x14015ff50]
mov r14, r8
mov dword [rbp - 0x1c], eax
mov r13, rdx
mov rsi, rcx
test r12d, r12d
js 0x1400d0e7d
mov rdi, qword [0x14015ff48]
test rdi, rdi
je 0x1400d0b15
mov qword [rbp - 0x10], rax
cmp rax, 0xffffffffffffffff
je 0x1400d0b15
mov edx, dword [r14 + 8]
mov r8d, r12d
mov ecx, dword [r15 + 8]
and r8d, 0xfffffff8
cmp edx, ecx
mov eax, edx
cmovbe eax, ecx
cmp r8d, eax
ja 0x1400d0906
cmp edx, ecx
mov r8d, ecx
cmova r8d, edx
mov dword [rbp + 0x60], r8d
xor r9d, r9d
lea r8d, [r8*8]
mov rdx, rsi
mov rcx, rdi
call sub.bcrypt.dll_BCryptGenerateKeyPair
test eax, eax
js 0x1400d0e7d
mov eax, dword [rbp + 0x60]
lea ebx, [rax*2 + 0xc]
mov ecx, ebx
call fcn.14002c3bc
mov rdi, rax
test rax, rax
je 0x1400d0e7d
mov dword [rax], ebx
mov dword [rax + 4], 0x4d504844
mov ecx, dword [rbp + 0x60]
mov dword [rax + 8], ecx
lea rcx, [rax + 0xc]
mov r9d, dword [r15 + 8]
mov r8, qword [r15]
mov edx, dword [rbp + 0x60]
call fcn.1400d1250
mov edx, dword [rbp + 0x60]
mov r9d, dword [r14 + 8]
mov r8, qword [r14]
lea rcx, [rdx + 0xc]
add rcx, rdi
call fcn.1400d1250
mov rcx, qword [rsi]
lea rdx, str.DHParameters
xor eax, eax
mov r9d, ebx
mov r8, rdi
mov dword [rsp + 0x20], eax
call sub.bcrypt.dll_BCryptSetProperty
mov qword [rsi + 8], rdi
test eax, eax
js 0x1400d0e7d
mov rcx, qword [rsi]
xor edx, edx
call sub.bcrypt.dll_BCryptFinalizeKeyPair
test eax, eax
js 0x1400d0e7d
xor ecx, ecx
lea rax, str.DHPRIVATEBLOB
cmp qword [rbp - 0x10], 1
lea rdi, str.DHPUBLICBLOB
mov dword [rsp + 0x30], ecx
cmovne rdi, rax
mov dword [rbp + 0x60], ecx
lea rax, [rbp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov r8, rdi
mov dword [rsp + 0x20], ecx
xor edx, edx
mov rcx, qword [rsi]
call sub.bcrypt.dll_BCryptExportKey
test eax, eax
js 0x1400d0e7d
mov ecx, dword [rbp + 0x60]
call fcn.14002c3bc
mov rbx, rax
test rax, rax
je 0x1400d0e7d
mov rcx, qword [rsi]
xor eax, eax
mov dword [rsp + 0x30], eax
mov r9, rbx
lea rax, [rbp + 0x60]
mov r8, rdi
mov qword [rsp + 0x28], rax
xor edx, edx
mov eax, dword [rbp + 0x60]
mov dword [rsp + 0x20], eax
call sub.bcrypt.dll_BCryptExportKey
test eax, eax
js 0x1400d0bd4
mov edx, dword [rbx + 4]
mov rcx, r13
call fcn.1400d1d20
test eax, eax
jne 0x1400d0bb2
mov eax, dword [rbx + 4]
mov rcx, qword [r13]
mov r8d, eax
lea edx, [rax + rax]
add rdx, 8
add rdx, rbx
call fcn.140019020
cmp dword [rbx], 0x56504844
jne 0x1400d0b94
mov ecx, reloc.WS2_32.dll_recv
call fcn.14002c3bc
test rax, rax
je 0x1400d0b74
xor edi, edi
mov rcx, rax
mov qword [rax], rdi
mov dword [rax + 8], edi
mov qword [rsi + 0x10], rax
mov edx, dword [rbx + 4]
call fcn.1400d1d20
test eax, eax
jne 0x1400d0b78
mov eax, dword [rbx + 4]
mov rcx, qword [rsi + 0x10]
mov r8d, eax
lea edx, [rax + rax*2]
mov rcx, qword [rcx]
add rdx, 8
add rdx, rbx
call fcn.140019020
mov rdx, qword [rsi + 0x10]
mov ecx, dword [rdx + 8]
mov rax, qword [rdx]
dec ecx
test byte [rcx + rax], 1
jne 0x1400d0b94
mov ecx, dword [rbp + 0x60]
test rcx, rcx
je 0x1400d0aea
xor eax, eax
mov rdi, rbx
rep stosb byte [rdi], al
xor edi, edi
mov rcx, rbx
call fcn.14002c3a8
mov rcx, rsi
call fcn.1400d1140
mov qword [rsi], rdi
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], rdi
mov rdi, qword [0x14015ff48]
test rdi, rdi
jne 0x1400d08e2
mov ecx, reloc.WS2_32.dll_recv
call fcn.14002c3bc
mov r14, rax
test rax, rax
je 0x1400d0e79
mov qword [rax], 0
lea ebx, [r12*8 - 1]
mov dword [rax + 8], 0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
mov qword [rsi + 0x10], rax
mulsd xmm0, qword [0x1400f0cf0]
call fcn.1400706c8
mov eax, dword [r14 + 8]
cvttsd2si r15, xmm0
cmp r15d, eax
jne 0x1400d0bf6
mov r12d, r15d
jmp 0x1400d0c34
mov qword [rsi + 0x10], rax
mov ecx, dword [rbp + 0x60]
test rcx, rcx
je 0x1400d0b87
xor eax, eax
mov rdi, rbx
rep stosb byte [rdi], al
mov rcx, rbx
call fcn.14002c3a8
jmp 0x1400d0e7d
mov ecx, dword [rbp + 0x60]
test rcx, rcx
je 0x1400d0ba3
mov rdi, rbx
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rbx
call fcn.14002c3a8
xor eax, eax
jmp 0x1400d0e82
cmp dword [rbp - 0x1c], 1
je 0x1400d0bc7
mov ecx, dword [rbp + 0x60]
test rcx, rcx
je 0x1400d0bc7
mov rdi, rbx
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rbx
call fcn.14002c3a8
jmp 0x1400d0e7d
cmp dword [rbp - 0x1c], 1
je 0x1400d0be9
mov ecx, dword [rbp + 0x60]
test rcx, rcx
je 0x1400d0be9
mov rdi, rbx
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rbx
call fcn.14002c3a8
jmp 0x1400d0e7d
mov rdx, qword [r14]
test rdx, rdx
je 0x1400d0c16
test eax, eax
je 0x1400d0c16
cmp r15d, eax
jae 0x1400d0c16
sub eax, r15d
mov edi, r15d
add rdi, rdx
mov ecx, eax
xor eax, eax
rep stosb byte [rdi], al
mov rcx, qword [r14]
mov edx, r15d
mov r12d, r15d
call fcn.14008bf84
test rax, rax
je 0x1400d0e7d
mov qword [r14], rax
mov dword [r14 + 8], r15d
mov rdi, qword [r14]
mov rdx, r12
mov rcx, rdi
call fcn.1400ce8f0
test eax, eax
jne 0x1400d0e7d
and ebx, 0x80000007
jge 0x1400d0c59
dec ebx
or ebx, 0xfffffff8
inc ebx
mov eax, 1
test ebx, ebx
mov edx, 8
cmovne edx, ebx
mov ecx, edx
shl al, cl
dec al
movzx ecx, al
movzx eax, byte [rdi]
and ecx, eax
lea eax, [rdx - 1]
bts ecx, eax
mov byte [rdi], cl
lea eax, [r15 - 1]
or byte [rax + rdi], 1
mov rdi, qword [rsi + 0x10]
test r13, r13
je 0x1400d0e7d
mov r12, qword [rbp + 0x50]
test r12, r12
je 0x1400d0e7d
test rdi, rdi
je 0x1400d0e7d
mov r14, qword [rbp + 0x58]
test r14, r14
je 0x1400d0e7d
mov ebx, dword [r14 + 8]
add ebx, 0x18
mov dword [rbp + 0x60], 0x18
add ebx, dword [rdi + 8]
mov ecx, ebx
mov r15d, ebx
call fcn.14002c3bc
mov rsi, rax
test rax, rax
je 0x1400d0e7d
mov dword [rax], 0x31415352
mov ecx, dword [r14 + 8]
shl ecx, 3
mov dword [rax + 4], ecx
mov ecx, dword [rdi + 8]
mov dword [rax + 8], ecx
mov ecx, dword [r14 + 8]
mov dword [rax + 0xc], ecx
xor eax, eax
mov qword [rsi + 0x10], rax
mov ecx, dword [rbp + 0x60]
mov r8d, dword [rdi + 8]
add rcx, rsi
mov rdx, qword [rdi]
call fcn.140019020
mov ecx, dword [rdi + 8]
add ecx, dword [rbp + 0x60]
mov r8d, dword [r14 + 8]
add rcx, rsi
mov rdx, qword [r14]
call fcn.140019020
mov rcx, qword [0x14015ff18]
lea r9, [rbp - 0x18]
xor edi, edi
lea r8, str.RSAPUBLICBLOB
mov dword [rsp + 0x30], edi
xor edx, edx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rsi
mov dword [rbp + 0x60], edi
call sub.bcrypt.dll_BCryptImportKeyPair
mov ebx, eax
test eax, eax
js 0x1400d0e59
mov r8d, dword [r12 + 8]
lea rax, [rbp - 0x20]
mov rdx, qword [r12]
xor r9d, r9d
mov rcx, qword [rbp - 0x18]
mov dword [rsp + 0x48], 1
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], edi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call sub.bcrypt.dll_BCryptEncrypt
mov ebx, eax
test eax, eax
js 0x1400d0e50
mov edx, dword [rbp - 0x20]
mov rcx, r13
call fcn.1400d1d20
test eax, eax
jne 0x1400d0e4b
mov ecx, dword [rbp - 0x20]
cmp dword [r12 + 8], ecx
cmova ecx, dword [r12 + 8]
mov dword [rbp - 0x20], ecx
call fcn.14002c3bc
mov r14, rax
test rax, rax
je 0x1400d0e4b
mov r9d, dword [r12 + 8]
mov rcx, rax
mov r8, qword [r12]
mov edx, dword [rbp - 0x20]
call fcn.1400d1250
mov ecx, dword [r13 + 8]
lea rax, [rbp + 0x60]
mov r8d, dword [rbp - 0x20]
xor r9d, r9d
mov dword [rsp + 0x48], 1
mov rdx, r14
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], ecx
mov rcx, qword [r13]
mov qword [rsp + 0x30], rcx
mov rcx, qword [rbp - 0x18]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call sub.bcrypt.dll_BCryptEncrypt
mov ecx, dword [rbp - 0x20]
mov ebx, eax
test rcx, rcx
je 0x1400d0e32
mov rdi, r14
xor eax, eax
rep stosb byte [rdi], al
mov rcx, r14
call fcn.14002c3a8
test ebx, ebx
js 0x1400d0e50
mov edx, dword [rbp + 0x60]
mov rcx, r13
call fcn.1400d1d20
jmp 0x1400d0e50
mov ebx, 0xc0000017
mov rcx, qword [rbp - 0x18]
call sub.bcrypt.dll_BCryptDestroyKey
test r15, r15
je 0x1400d0e68
mov rdi, rsi
xor eax, eax
mov rcx, r15
rep stosb byte [rdi], al
mov rcx, rsi
call fcn.14002c3a8
sar ebx, 0x1f
neg ebx
sbb eax, eax
jmp 0x1400d0e82
mov qword [rsi + 0x10], r14
mov eax, 0xffffffff
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret