Function at 0x14007e8b0
Capabilities:
Decrypt data via sspi

Disassembly:
push r15
push rsi
push r13
push rbx
push r14
push rbp
push r12
push rdi
sub rsp, 0x148
lea rax, [0x14008d330]
mov r9d, 0x80
mov r10d, r9d
lea r11, [rsp + 0xa0]
lea rsi, [0x14008d490]
mov r9d, 0x4e771b91
mov edi, r9d
mov bx, word [rsp + 0x136]
mov byte [rsp + 0x135], 0xdf
mov qword [rsp + 0x128], 0x1806c04d
mov dword [rsp + 0x124], 0x47874a40
mov r14, qword [rsp + 0x138]
mov r15, r14
add r15, 0x5e304b7
mov qword [rsp + 0x138], r15
sub rdi, qword [rsp + 0x128]
mov qword [rsp + 0x58], rdi
mov rdi, r14
or rdi, 0xa5bd775
mov bpl, byte [rsp + 0x135]
mov r12b, bpl
xor r12b, 0x29
mov qword [rsp + 0x138], rdi
mov byte [rsp + 0x7f], r12b
mov dword [rsp + 0x64], r8d
mov qword [rsp + 0x90], rdx
mov qword [rsp + 0x138], 0x5db877d4
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x70], rsi
mov rcx, r11
mov rdx, rax
mov r8, r10
mov word [rsp + 0x4e], bx
mov byte [rsp + 0x4d], bpl
mov qword [rsp + 0x40], r14
call fcn.14007ee20
mov r9d, dword [rsp + 0x124]
mov r13d, r9d
xor r13d, 0x47874a60
mov dword [rsp + 0x8c], r13d
mov r13d, dword [rsp + 0x124]
mov bx, word [rsp + 0x4e]
mov word [rsp + 0x136], bx
xor r13d, 0x47874a40
mov dword [rsp + 0x50], r13d
mov dword [rsp + 0x130], 0x44a732cc
mov dword [rsp + 0x3c], r9d
jmp 0x14007ec76
mov rax, qword [rsp + 0x128]
mov rcx, qword [rsp + 0x128]
xor rcx, 0x70bc3eb6
add rax, 0x3e40a07b
mov qword [rsp + 0x98], rcx
mov dl, byte [rsp + 0x4d]
mov byte [rsp + 0x147], dl
mov rcx, qword [rsp + 0x98]
mov r8d, dword [rsp + 0x3c]
imul r9d, r8d, 0x2b36a2ca
mov dword [rsp + 0x130], r9d
cmp rcx, rax
je 0x14007eba0
jmp 0x14007ea7d
add rsp, 0x148
pop rdi
pop r12
pop rbp
pop r14
pop rbx
pop r13
pop rsi
pop r15
ret
mov eax, dword [rsp + 0x64]
mov cl, byte [rsp + 0x4d]
add cl, 0xd7
mov edx, dword [rsp + 0x6c]
mov byte [rsp + 0x147], cl
cmp edx, eax
jb 0x14007ecbe
jmp 0x14007eafc
mov al, 0x37
sub al, byte [rsp + 0x135]
mov rcx, qword [rsp + 0x40]
imul rcx, rcx
mov qword [rsp + 0x138], rcx
mov dl, byte [rsp + 0x7f]
mov rcx, qword [rsp + 0x40]
add rcx, rcx
mov qword [rsp + 0x138], rcx
cmp al, dl
je 0x14007e9f2
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x138], rax
mov ecx, dword [rsp + 0x6c]
mov edx, dword [rsp + 0x3c]
imul r8d, edx, 0x5e77f73f
mov r9d, dword [rsp + 0x8c]
mov dword [rsp + 0x130], r8d
add ecx, r9d
mov dword [rsp + 0x6c], ecx
mov r10b, 0xd9
mov al, byte [rsp + 0x4d]
mul r10b
mov byte [rsp + 0x147], al
jmp 0x14007ea5d
mov rax, qword [rsp + 0x40]
and rax, rax
mov qword [rsp + 0x138], rax
mov ax, word [rsp + 0x4e]
imul cx, ax, 0x8b03
mov word [rsp + 0x136], cx
mov rdx, qword [rsp + 0x58]
mov r8d, dword [rsp + 0x124]
mov word [rsp + 0x136], 0x4bc6
add r8d, 0xb878b5c1
mov r9, qword [rsp + 0x128]
add r9, 0x2b61be8c
mov r10b, byte [rsp + 0x4d]
xor r10b, r10b
mov byte [rsp + 0x147], r10b
mov r11d, dword [rsp + 0x3c]
xor r11d, r11d
mov esi, dword [rsp + 0x50]
mov dword [rsp + 0x130], r11d
mov r11d, dword [rsp + 0x3c]
and r11d, 0xb434401
add esi, r8d
mov dword [rsp + 0x130], r11d
mov dword [rsp + 0x68], esi
mov r10b, byte [rsp + 0x4d]
mov byte [rsp + 0x147], r10b
cmp r9, rdx
jb 0x14007ec20
mov al, byte [rsp + 0x4d]
or al, 0x23
mov byte [rsp + 0x147], al
mov ecx, dword [rsp + 0x68]
mov dword [rsp + 0x50], ecx
jmp 0x14007ec76
mov eax, 0x3014a1d1
mov ecx, eax
mov dx, word [rsp + 0x4e]
sub dx, 0xce14
mov word [rsp + 0x136], dx
mov eax, dword [rsp + 0x50]
mov r8d, eax
mov eax, dword [rsp + 0x3c]
or eax, 0x501469d2
mov dword [rsp + 0x130], eax
mov eax, dword [rsp + r8*4 + 0xa0]
mov dx, word [rsp + 0x4e]
mov word [rsp + 0x136], dx
mov dword [rsp + 0x60], eax
mov r8, qword [rsp + 0x40]
sub rcx, r8
mov qword [rsp + 0x138], rcx
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x6c], eax
jmp 0x14007ea5d
xor eax, eax
mov ecx, eax
mov word [rsp + 0x136], 0xbdad
mov eax, dword [rsp + 0x124]
add eax, 0xfc735161
mov rdx, qword [rsp + 0x40]
mov qword [rsp + 0x138], rdx
mov qword [rsp + 0x30], rcx
mov rdx, qword [rsp + 0x30]
mov r8d, eax
mov r9, qword [rsp + 0x30]
call sub.Secur32.dll_DecryptMessage
mov dword [rsp + 0x2c], eax
add rsp, 0x148
pop rdi
pop r12
pop rbp
pop r14
pop rbx
pop r13
pop rsi
pop r15
ret
mov eax, 0x1806c06d
mov ecx, eax
mov eax, dword [rsp + 0x3c]
xor eax, 0x6aa58dd3
mov rdx, qword [rsp + 0x128]
mov dword [rsp + 0x130], eax
sub rcx, rdx
mov byte [rsp + 0x147], 0x7e
mov eax, dword [rsp + 0x50]
mov edx, eax
mov word [rsp + 0x136], 0x6f55
cmp rdx, rcx
jb 0x14007ebba
jmp 0x14007ea49
mov eax, 0x60958186
mov cx, word [rsp + 0x4e]
imul cx, cx
mov edx, dword [rsp + 0x124]
mov r8d, dword [rsp + 0x124]
mov r9, qword [rsp + 0x70]
mov word [rsp + 0x136], cx
xor r8d, 0x47874a40
mov r10d, dword [rsp + 0x3c]
xor r10d, 0xffffffff
mov dword [rsp + 0x130], r10d
mov r10d, dword [rsp + 0x3c]
imul r11d, r10d, 0x60cc95db
mov esi, dword [rsp + 0x6c]
add edx, 0xb878b5e0
mov dword [rsp + 0x28], eax
mov eax, esi
xor esi, esi
mov dword [rsp + 0x24], edx
mov edx, esi
mov esi, dword [rsp + 0x24]
div esi
mov dword [rsp + 0x130], r11d
add r8d, edx
mov cx, word [rsp + 0x4e]
or cx, cx
mov word [rsp + 0x136], cx
mov rdi, qword [rsp + 0x40]
imul rbx, rdi, 0x5f605e23
mov edx, r8d
mov r14d, edx
mov bpl, byte [r9 + r14]
mov qword [rsp + 0x138], rbx
mov byte [rsp + 0x8b], bpl
mov edx, dword [rsp + 0x28]
sub edx, r10d
mov dword [rsp + 0x130], edx
mov bpl, 0x7b
mov r15b, byte [rsp + 0x4d]
mov al, r15b
mul bpl
mov r9, qword [rsp + 0x90]
mov edx, dword [rsp + 0x6c]
mov ebx, edx
mov byte [rsp + 0x147], al
xor rdi, 0xffffffffffffffff
mov qword [rsp + 0x138], rdi
mov al, byte [r9 + rbx]
mov bpl, byte [rsp + 0x8b]
mov cx, word [rsp + 0x4e]
add cx, 0x7155
movzx edx, al
mov word [rsp + 0x136], cx
movzx r8d, bpl
mov r9, qword [rsp + 0x40]
imul r9, r9
mov qword [rsp + 0x138], r9
sub edx, r8d
mov al, dl
mov byte [rsp + 0x57], al
mov r9, qword [rsp + 0x80]
mov edx, dword [rsp + 0x6c]
add r10d, 0x7c23d7fb
mov edx, edx
mov edi, edx
mov al, byte [rsp + 0x57]
mov dword [rsp + 0x130], r10d
mov byte [r9 + rdi], al
jmp 0x14007e9f2