Function at 0x180007484
Capabilities:
Encrypt or decrypt via wincrypt
Import public key

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov dword [r11 + 0x20], r9d
push rbp
push rdi
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
xor ebx, ebx
xor edi, edi
and qword [rbp - 8], rbx
mov r15, r8
and qword [rbp - 0x10], rbx
and qword [rbp - 0x18], rbx
test rcx, rcx
je 0x180007690
test edx, edx
je 0x180007690
and dword [rbp - 0x20], ebx
lea rax, [rbp - 0x20]
mov qword [r11 - 0x50], rax
lea esi, [rbx + 8]
lea rax, [rbp - 8]
mov r9d, edx
mov qword [r11 - 0x58], rax
lea r13d, [rbx + 1]
and qword [r11 - 0x60], rbx
mov r8, rcx
mov edx, esi
mov dword [rsp + 0x20], 0x8000
mov ecx, r13d
call qword [sym.imp.CRYPT32.dll_CryptDecodeObjectEx]
test eax, eax
jne 0x18000750e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x18000767d
mov r9d, r13d
mov dword [rsp + 0x20], 0xf0000000
lea r8, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
xor edx, edx
lea rcx, [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x18000754e
mov r9d, r13d
mov dword [rsp + 0x20], esi
lea r8, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
xor edx, edx
lea rcx, [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x180007501
mov r8, qword [rbp - 8]
lea r9, [rbp - 0x18]
mov rcx, qword [rbp - 0x10]
mov edx, r13d
call qword [sym.imp.CRYPT32.dll_CryptImportPublicKeyInfo]
test eax, eax
je 0x180007501
mov eax, dword [rbp + 0x48]
xor r9d, r9d
mov rcx, qword [rbp - 0x18]
mov r8d, r13d
mov dword [rsp + 0x30], eax
xor edx, edx
mov dword [rbp + 0x30], eax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov edx, dword [rbp + 0x30]
mov rcx, r13
call fcn.1800178f8
mov rdi, rax
test rax, rax
jne 0x1800075ac
lea ebx, [rax + 0xe]
jmp 0x180007695
mov esi, dword [rbp + 0x48]
mov r14d, dword [rbp + 0x30]
test rsi, rsi
je 0x180007606
test r15, r15
je 0x1800075d2
cmp r14, rsi
jb 0x1800075d2
mov r8d, esi
mov rdx, r15
mov rcx, rdi
call fcn.180015fd0
jmp 0x180007606
mov r8, r14
xor edx, edx
mov rcx, rdi
call fcn.180016890
test r15, r15
jne 0x1800075f1
call fcn.18001b880
mov dword [rax], socket
jmp 0x180007601
cmp r14, rsi
jae 0x180007606
call fcn.18001b880
mov dword [rax], 0x22
call fcn.18001b760
mov eax, dword [rbp + 0x30]
xor r9d, r9d
mov rcx, qword [rbp - 0x18]
mov r8d, r13d
mov dword [rsp + 0x30], eax
xor edx, edx
lea rax, [rbp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x180007501
mov ecx, dword [rbp + 0x30]
xor r9d, r9d
test ecx, 0xfffffffe
jbe 0x180007670
mov r8b, byte [r9 + rdi]
sub ecx, r9d
sub ecx, r13d
mov cl, byte [rcx + rdi]
mov byte [r9 + rdi], cl
mov eax, dword [rbp + 0x30]
sub eax, r9d
add r9d, r13d
sub eax, r13d
mov byte [rax + rdi], r8b
mov ecx, dword [rbp + 0x30]
mov eax, ecx
shr eax, 1
cmp r9d, eax
jb 0x180007643
mov rax, qword [rbp + 0x50]
mov qword [rax], rdi
mov rax, qword [rbp + 0x58]
mov dword [rax], ecx
test ebx, ebx
je 0x180007695
test rdi, rdi
je 0x180007695
mov rcx, rdi
call fcn.1800178e8
jmp 0x180007695
mov ebx, 0xa0
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x1800076a4
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1800076b3
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1800076c4
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret