Function at 0x1400869c4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x60
lea rax, [r11 - 0x38]
mov rdi, rcx
mov rdx, rcx
mov qword [r11 - 0x48], rax
lea rax, [0x14013b140]
lea rcx, [r11 - 0x48]
mov r8d, Ordinal_36
mov qword [r11 - 0x40], rax
call fcn.14000b6c8
xor ebp, ebp
cmp eax, ebp
je 0x140086ef5
mov rax, qword [rsp + 0x50]
mov qword [rdi], rax
cmp rax, rbp
je 0x140086ef5
lea rax, [rsp + 0x20]
lea r8d, [rbp + 0xc]
lea rcx, [rsp + 0x30]
mov rdx, rdi
mov qword [rsp + 0x30], rax
call fcn.14000b6c8
cmp eax, ebp
je 0x140086ef5
mov edx, dword [rsp + 0x20]
lea ecx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
cmp rax, rbp
je 0x140086ef5
mov r8d, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov rdx, rdi
mov qword [rsp + 0x30], rax
call fcn.14000b6c8
cmp eax, ebp
je 0x140086eec
movzx esi, word [rsp + 0x28]
lea rcx, str._nAlgId_____:
call fcn.14000c020
mov r8d, dword [rsp + 0x28]
lea r12d, [rbp + 1]
mov eax, r8d
shr eax, 0x10
sub eax, r12d
je 0x140086ce6
cmp eax, 2
je 0x140086ab7
lea rcx, str.ERROR_kuhl_m_crypto_extractor_bcrypt64___Unsupported_interface_alg__0x_x__n
mov edx, r8d
call fcn.14000c020
jmp 0x140086eec
movzx eax, si
cmp eax, ebp
je 0x140086ad6
cmp eax, 0xb
ja 0x140086ad6
lea rsi, [0x140000000]
dec eax
mov rdx, qword [rsi + rax*8 + 0xddec0]
jmp 0x140086ad9
mov rdx, rbp
lea rcx, str._s__0x_x__n
call fcn.14000c020
cmp dword [rsp + 0x24], 0x4d534b59
je 0x140086eec
cmp dword [rsp + 0x24], 0x4d53524b
je 0x140086b13
lea rdx, [rsp + 0x24]
lea rcx, str.ERROR_kuhl_m_crypto_extractor_bcrypt64___Tag__.4S_not_supported_n
call fcn.14000c020
jmp 0x140086eec
mov eax, dword [0x14013b73c]
cmp eax, 0x24b8
jae 0x140086b85
mov rdx, qword [rbx + 0x40]
mov rcx, qword [rdi + 8]
lea r9, str.PubExp
mov r8d, 8
call fcn.140086920
mov r8d, dword [rbx + 0x28]
mov rdx, qword [rbx + 0x50]
mov rcx, qword [rdi + 8]
lea r9, str.Modulus
shl r8d, 3
call fcn.140086920
mov r8d, dword [rbx + 0x78]
mov rdx, qword [rbx + 0xb0]
mov rcx, qword [rdi + 8]
lea r9, str.Prime1
shl r8d, 3
call fcn.140086920
mov r8d, dword [rbx + 0xe8]
mov rdx, qword [rbx + 0x120]
jmp 0x140086bef
cmp eax, 0x3ad7
jae 0x140086c08
mov rdx, qword [rbx + 0x40]
mov rcx, qword [rdi + 8]
lea r9, str.PubExp
mov r8d, 8
call fcn.140086920
mov r8d, dword [rbx + 0x28]
mov rdx, qword [rbx + 0x50]
mov rcx, qword [rdi + 8]
lea r9, str.Modulus
shl r8d, 3
call fcn.140086920
mov r8d, dword [rbx + 0x78]
mov rdx, qword [rbx + 0xb0]
mov rcx, qword [rdi + 8]
lea r9, str.Prime1
shl r8d, 3
call fcn.140086920
mov r8d, dword [rbx + 0xf8]
mov rdx, qword [rbx + reloc.WLDAP32.dll_Ordinal_304]
mov rcx, qword [rdi + 8]
lea r9, str.Prime2
shl r8d, 3
call fcn.140086920
jmp 0x140086eec
mov rax, qword [rbx + 0x20]
mov qword [rdi], rax
cmp rax, rbp
je 0x140086eec
lea rax, [rsp + 0x88]
lea rcx, [rsp + 0x30]
mov r8d, 4
mov rdx, rdi
mov qword [rsp + 0x30], rax
call fcn.14000b6c8
cmp eax, ebp
je 0x140086eec
mov edx, dword [rsp + 0x88]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
cmp rax, rbp
je 0x140086eec
mov r8d, dword [rsp + 0x88]
lea rcx, [rsp + 0x30]
mov rdx, rdi
mov qword [rsp + 0x30], rax
call fcn.14000b6c8
cmp eax, ebp
je 0x140086cd8
mov r8, qword [rsi + 0x58]
mov rdx, qword [rbx + 0x20]
lea r9, str.PubExp
mov rcx, rsi
call fcn.1400868dc
mov r8, qword [rsi + 0x78]
mov rdx, qword [rbx + 0x20]
lea r9, str.Modulus
mov rcx, rsi
call fcn.1400868dc
mov r8, qword [rsi + 0x38]
mov rdx, qword [rbx + 0x20]
lea r9, str.Prime1
mov rcx, rsi
call fcn.1400868dc
mov r8, qword [rsi + 0x40]
mov rdx, qword [rbx + 0x20]
lea r9, str.Prime2
mov rcx, rsi
call fcn.1400868dc
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140086eec
movzx eax, si
lea rsi, [0x140000000]
cmp eax, ebp
je 0x140086d05
cmp eax, 8
ja 0x140086d05
dec eax
mov rdx, qword [rsi + rax*8 + 0xdde80]
jmp 0x140086d08
mov rdx, rbp
lea rcx, str._s__0x_x__n
call fcn.14000c020
mov r11d, dword [0x14013b73c]
mov r8d, dword [rbx + 0xc]
cmp r11d, 0x1f40
jae 0x140086dcb
cmp r8d, 6
jae 0x140086d3c
mov rdx, qword [rsi + r8*8 + 0xddf18]
jmp 0x140086d3f
mov rdx, rbp
lea rcx, str.Mode______:__s__0x_x__n
call fcn.14000c020
movzx r9d, bp
mov r8b, bpl
movzx eax, r9w
cmp eax, dword [rbx + 0x10]
jae 0x140086d7a
mov eax, dword [rbx + 0x10]
mov ecx, dword [rsp + 0x20]
movzx edx, r9w
sub rdx, rax
add r9w, r12w
lea rax, [rbx + rdx]
or r8b, byte [rcx + rax]
cmp r8b, bpl
je 0x140086d52
cmp r8b, bpl
je 0x140086db0
lea rcx, str.IV________:
call fcn.14000c020
mov r11d, dword [rbx + 0x10]
mov ecx, dword [rsp + 0x20]
sub rcx, r11
xor r8d, r8d
mov edx, r11d
add rcx, rbx
call fcn.140012c94
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.14000c020
mov edx, dword [rbx + 0x18]
lea rcx, str.Key___3u__:
call fcn.14000c020
mov edx, dword [rbx + 0x18]
lea rcx, [rbx + 0x1c]
jmp 0x140086ed8
cmp r11d, 0x24b8
jae 0x140086e59
cmp r8d, 6
jae 0x140086de8
mov rdx, qword [rsi + r8*8 + 0xddf18]
jmp 0x140086deb
mov rdx, rbp
lea rcx, str.Mode______:__s__0x_x__n
call fcn.14000c020
movzx edx, bp
mov cl, bpl
movzx eax, dx
cmp eax, dword [rbx + 0x10]
jae 0x140086e15
movzx eax, dx
add dx, r12w
or cl, byte [rax + rbx + 0x6c]
cmp cl, bpl
je 0x140086dfd
cmp cl, bpl
je 0x140086e41
lea rcx, str.IV________:
call fcn.14000c020
mov edx, dword [rbx + 0x10]
lea rcx, [rbx + 0x6c]
xor r8d, r8d
call fcn.140012c94
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.14000c020
mov edx, dword [rbx + 0x28]
lea rcx, str.Key___3u__:
call fcn.14000c020
mov edx, dword [rbx + 0x28]
lea rcx, [rbx + 0x2c]
jmp 0x140086ed8
cmp r8d, 6
jae 0x140086e69
mov rdx, qword [rsi + r8*8 + 0xddf18]
jmp 0x140086e6c
mov rdx, rbp
lea rcx, str.Mode______:__s__0x_x__n
call fcn.14000c020
movzx edx, bp
mov cl, bpl
movzx eax, dx
cmp eax, dword [rbx + 0x10]
jae 0x140086e96
movzx eax, dx
add dx, r12w
or cl, byte [rax + rbx + 0x28]
cmp cl, bpl
je 0x140086e7e
cmp cl, bpl
je 0x140086ec2
lea rcx, str.IV________:
call fcn.14000c020
mov edx, dword [rbx + 0x10]
lea rcx, [rbx + 0x28]
xor r8d, r8d
call fcn.140012c94
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.14000c020
mov edx, dword [rbx + 0x38]
lea rcx, str.Key___3u__:
call fcn.14000c020
mov edx, dword [rbx + 0x38]
lea rcx, [rbx + 0x3c]
xor r8d, r8d
call fcn.140012c94
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.14000c020
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret