Function at 0x140063d20
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xa0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r14, rdx
mov r12, qword [rbp + 0x7f]
xor r13d, r13d
mov r15, qword [r9]
mov eax, dword [r8]
mov edi, 0x80004005
test rdx, rdx
je 0x140063dea
mov dword [rbp - 0x51], eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, ebx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
mov edi, 0x8007000e
test rax, rax
cmovne edi, r13d
je 0x140063dea
lfence
test rbx, rbx
je 0x140063da8
mov r8d, ebx
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x51]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 1]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x140063dd1
mov edi, r13d
jmp 0x140063dee
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test eax, eax
jle 0x140063de6
movzx edi, ax
or edi, 0x80070000
test edi, edi
jns 0x140063dee
mov rsi, qword [rbp - 0x51]
mov ebx, dword [rbp - 0x51]
test edi, edi
js 0x140064048
lfence
xorps xmm0, xmm0
movups xmmword [rbp - 0x49], xmm0
mov qword [rbp - 0x39], r13
mov qword [rbp - 0x31], r13
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rsi + r8], r13b
jne 0x140063e12
mov rdx, rsi
lea rcx, [rbp - 0x49]
call fcn.140008de0
nop
mov r9d, ebx
xor r8d, r8d
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x49]
call fcn.14001ac10
mov rbx, rax
lea rax, [rbp - 0x49]
cmp rax, rbx
je 0x140063eac
mov rdx, qword [rbp - 0x31]
cmp rdx, 0xf
jbe 0x140063e7e
inc rdx
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140063e79
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140063ede
call fcn.1400688bc
mov qword [rbp - 0x39], r13
mov qword [rbp - 0x31], 0xf
mov byte [rbp - 0x49], 0
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x49], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x39], xmm1
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [rbp - 0x11]
cmp rdx, 0xf
jbe 0x140063eea
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140063ee5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140063ee5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400688bc
movdqa xmm0, xmmword [0x1400b1990]
movdqu xmmword [rbp - 0x19], xmm0
mov byte [rbp - 0x29], 0
cmp qword [rbp - 0x39], 0
jne 0x140063f20
xorps xmm0, xmm0
movups xmmword [rbp - 9], xmm0
movdqa xmm1, xmmword [0x1400b1980]
movdqu xmmword [rbp + 7], xmm1
mov word [rbp - 9], r13w
jmp 0x140063f9e
lea r8, [rbp - 0x49]
cmp qword [rbp - 0x31], 0xf
cmova r8, qword [rbp - 0x49]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
mov r9d, dword [rbp - 0x39]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov rdx, rbx
lea rcx, [rbp - 0x29]
call fcn.14001abe0
lea rcx, [rbp - 0x29]
cmp qword [rbp - 0x11], 7
cmova rcx, qword [rbp - 0x29]
lea r8, [rbp - 0x49]
cmp qword [rbp - 0x31], 0xf
cmova r8, qword [rbp - 0x49]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rcx
mov r9d, dword [rbp - 0x39]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movups xmm0, xmmword [rbp - 0x29]
movups xmmword [rbp - 9], xmm0
movups xmm1, xmmword [rbp - 0x19]
movups xmmword [rbp + 7], xmm1
lea rdx, [rbp - 9]
mov rcx, r12
call fcn.140009f60
mov rdx, qword [rbp + 0xf]
cmp rdx, 7
jbe 0x140063fed
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140063fe8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140063fe8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400688bc
test rsi, rsi
je 0x14006400a
lfence
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov rdx, qword [rbp - 0x31]
cmp rdx, 0xf
jbe 0x140064048
inc rdx
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140064043
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140064043
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400688bc
mov eax, edi
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140068870
mov rbx, qword [rsp + 0xe0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret