Function at 0x18001f560
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push rbp
sub rsp, 0x130
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x58], r9
mov qword [rbp - 0x50], r8
mov qword [rbp - 0x48], rdx
mov qword [rbp - 0x40], rcx
mov rax, qword [rbp + 0xe0]
mov qword [rbp - 0x38], rax
mov rax, qword [0x1800760a8]
xor rax, rbp
mov qword [rbp + 0xa8], rax
mov dword [rbp - 0x2c], 0x17d4d4ae
mov eax, dword [rbp - 0x2c]
mov dword [rbp - 0x5c], eax
sub eax, 0x88aad679
je 0x18001fb6d
jmp 0x18001f5b9
mov eax, dword [rbp - 0x5c]
sub eax, 0x8f14e108
je 0x18001fc8c
jmp 0x18001f5cc
mov eax, dword [rbp - 0x5c]
sub eax, 0x901710a0
je 0x18001fba3
jmp 0x18001f5df
mov eax, dword [rbp - 0x5c]
sub eax, 0x944bd8e1
je 0x18001fd2f
jmp 0x18001f5f2
mov eax, dword [rbp - 0x5c]
sub eax, 0xa22af49c
je 0x18001fc80
jmp 0x18001f605
mov eax, dword [rbp - 0x5c]
sub eax, 0xa735f6e2
je 0x18001fe10
jmp 0x18001f618
mov eax, dword [rbp - 0x5c]
sub eax, 0xad21499f
je 0x18001fc00
jmp 0x18001f62b
mov eax, dword [rbp - 0x5c]
sub eax, 0xc0a7238e
je 0x18001fadc
jmp 0x18001f63e
mov eax, dword [rbp - 0x5c]
sub eax, 0xc8edc0f8
je 0x18001fb48
jmp 0x18001f651
mov eax, dword [rbp - 0x5c]
sub eax, 0xcc290530
je 0x18001fa5a
jmp 0x18001f664
mov eax, dword [rbp - 0x5c]
sub eax, 0xcd86dacb
je 0x18001fa66
jmp 0x18001f677
mov eax, dword [rbp - 0x5c]
sub eax, 0xd65a12da
je 0x18001fcd2
jmp 0x18001f68a
mov eax, dword [rbp - 0x5c]
sub eax, 0xf55fa83b
je 0x18001fcf0
jmp 0x18001f69d
mov eax, dword [rbp - 0x5c]
sub eax, 0xf62757c3
je 0x18001fc32
jmp 0x18001f6b0
mov eax, dword [rbp - 0x5c]
sub eax, 0x1bbe9d3
je 0x18001fa44
jmp 0x18001f6c3
mov eax, dword [rbp - 0x5c]
sub eax, 0x9850318
je 0x18001fd10
jmp 0x18001f6d6
mov eax, dword [rbp - 0x5c]
sub eax, 0x11cf3249
je 0x18001fe1c
jmp 0x18001f6e9
mov eax, dword [rbp - 0x5c]
sub eax, 0x14cb9c0a
je 0x18001faa5
jmp 0x18001f6fc
mov eax, dword [rbp - 0x5c]
sub eax, 0x1642438a
je 0x18001fb26
jmp 0x18001f70f
mov eax, dword [rbp - 0x5c]
sub eax, 0x17c83ada
je 0x18001fdf3
jmp 0x18001f722
mov eax, dword [rbp - 0x5c]
sub eax, 0x17d4d4ae
je 0x18001f8a3
jmp 0x18001f735
mov eax, dword [rbp - 0x5c]
sub eax, 0x193509b9
je 0x18001fa32
jmp 0x18001f748
mov eax, dword [rbp - 0x5c]
sub eax, 0x1c2db962
je 0x18001faf7
jmp 0x18001f75b
mov eax, dword [rbp - 0x5c]
sub eax, 0x27702d5c
je 0x18001fcb0
jmp 0x18001f76e
mov eax, dword [rbp - 0x5c]
sub eax, 0x2ced49cc
je 0x18001fbdc
jmp 0x18001f781
mov eax, dword [rbp - 0x5c]
sub eax, 0x36d8cfff
je 0x18001fbe8
jmp 0x18001f794
mov eax, dword [rbp - 0x5c]
sub eax, 0x3ceffeb7
je 0x18001fd7c
jmp 0x18001f7a7
mov eax, dword [rbp - 0x5c]
sub eax, 0x4a1e10c0
je 0x18001fb3c
jmp 0x18001f7ba
mov eax, dword [rbp - 0x5c]
sub eax, 0x50ca9ce2
je 0x18001fb88
jmp 0x18001f7cd
mov eax, dword [rbp - 0x5c]
sub eax, 0x53a4ee47
je 0x18001fc4d
jmp 0x18001f7e0
mov eax, dword [rbp - 0x5c]
sub eax, 0x5ba5bfc1
je 0x18001f9ac
jmp 0x18001f7f3
mov eax, dword [rbp - 0x5c]
sub eax, 0x5bafa887
je 0x18001fa15
jmp 0x18001f806
mov eax, dword [rbp - 0x5c]
sub eax, 0x5c74bc0e
je 0x18001fdc0
jmp 0x18001f819
mov eax, dword [rbp - 0x5c]
sub eax, 0x5d105f5a
je 0x18001fe39
jmp 0x18001f82c
mov eax, dword [rbp - 0x5c]
sub eax, 0x5e3154e3
je 0x18001fb14
jmp 0x18001f83f
mov eax, dword [rbp - 0x5c]
sub eax, 0x5fb49f20
je 0x18001fd3b
jmp 0x18001f852
mov eax, dword [rbp - 0x5c]
sub eax, 0x6634e6a4
je 0x18001fa83
jmp 0x18001f865
mov eax, dword [rbp - 0x5c]
sub eax, 0x6d2ad65e
je 0x18001f8ed
jmp 0x18001f878
mov eax, dword [rbp - 0x5c]
sub eax, 0x7685284b
je 0x18001fc6a
jmp 0x18001f88b
mov eax, dword [rbp - 0x5c]
sub eax, 0x78d18f99
je 0x18001fbc0
jmp 0x18001f89e
jmp 0x18001fe5e
mov eax, 0x10
mov qword [rbp - 0x68], rax
call fcn.18006c5e0
sub rsp, rax
mov rax, qword [rbp - 0x68]
mov rcx, rsp
mov qword [rbp - 0x18], rcx
call fcn.18006c5e0
sub rsp, rax
mov rax, qword [rbp - 0x68]
mov rcx, rsp
mov qword [rbp - 0x10], rcx
call fcn.18006c5e0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 8], rax
mov dword [rbp - 0x2c], 0x6d2ad65e
jmp 0x18001fe5e
mov rcx, qword [rbp - 0x48]
mov rdx, qword [rbp - 0x50]
mov r8, qword [rbp - 0x58]
mov eax, 0x10
mov qword [rbp - 0x70], rax
call fcn.18006c5e0
sub rsp, rax
mov rax, qword [rbp - 0x70]
mov r9, rsp
mov qword [rbp], r9
call fcn.18006c5e0
sub rsp, rax
mov rax, qword [rbp - 0x70]
mov r9, rsp
mov qword [rbp + 8], r9
call fcn.18006c5e0
sub rsp, rax
mov rax, qword [rbp - 0x70]
mov r9, rsp
mov qword [rbp + 0x10], r9
call fcn.18006c5e0
sub rsp, rax
mov rax, qword [rbp - 0x70]
mov r9, rsp
mov qword [rbp + 0x18], r9
call fcn.18006c5e0
sub rsp, rax
mov rax, qword [rbp - 0x70]
mov r9, rsp
mov qword [rbp + 0x20], r9
call fcn.18006c5e0
sub rsp, rax
mov rax, qword [rbp - 0x70]
mov r9, rsp
mov qword [rbp + 0x28], r9
call fcn.18006c5e0
sub rsp, rax
mov rax, qword [rbp - 0x38]
mov r9, rsp
mov qword [rbp + 0x30], r9
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x18]
mov qword [rax], r8
mov rax, qword [rbp - 0x10]
mov qword [rax], rdx
mov rax, qword [rbp - 8]
mov qword [rax], rcx
mov dword [rbp - 0x2c], 0x5ba5bfc1
jmp 0x18001fe5e
mov rcx, qword [rbp - 0x40]
mov rax, qword [rbp]
mov qword [rax], rcx
mov rax, qword [rbp]
mov rax, qword [rax]
mov qword [rbp + 0x38], rax
mov rax, qword [rbp + 8]
mov dword [rax], 0
mov rcx, qword [rbp + 0x10]
mov edx, 0x18
mov r8d, 0xf0000000
sub rsp, 0x20
call fcn.180022000
add rsp, 0x20
mov rcx, qword [rbp + 0x10]
sub rsp, 0x20
call fcn.1800220d0
add rsp, 0x20
mov rdx, rax
mov eax, 0xcd86dacb
mov ecx, 0x5bafa887
cmp rdx, 0
cmove eax, ecx
mov dword [rbp - 0x2c], eax
jmp 0x18001fe5e
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
mov dword [rbp + 0x44], eax
mov dword [rbp - 0x2c], 0x193509b9
jmp 0x18001fe5e
mov eax, dword [rbp + 0x44]
mov dword [rbp - 0x1c], eax
mov dword [rbp - 0x2c], 0x1bbe9d3
jmp 0x18001fe5e
mov rax, qword [rbp + 0x18]
mov dword [rax], 1
mov dword [rbp - 0x2c], 0xcc290530
jmp 0x18001fe5e
mov dword [rbp - 0x2c], 0x11cf3249
jmp 0x18001fe5e
mov rcx, qword [rbp + 0x20]
sub rsp, 0x20
call fcn.180022e50
add rsp, 0x20
mov dword [rbp - 0x2c], 0x6634e6a4
jmp 0x18001fe5e
mov rax, qword [rbp + 0x38]
mov eax, dword [rax + 8]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x38]
mov rax, qword [rax]
mov qword [rbp + 0x50], rax
mov dword [rbp - 0x2c], 0x14cb9c0a
jmp 0x18001fe5e
mov rdx, qword [rbp + 0x10]
mov rcx, qword [rbp + 0x20]
mov r9, qword [rbp + 0x48]
mov r8, qword [rbp + 0x50]
sub rsp, 0x20
call fcn.180022ef0
add rsp, 0x20
mov ecx, eax
xor eax, eax
cmp eax, ecx
setne al
and al, 1
mov byte [rbp + 0x5f], al
mov dword [rbp - 0x2c], 0xc0a7238e
jmp 0x18001fe5e
mov dl, byte [rbp + 0x5f]
mov eax, 0xc8edc0f8
mov ecx, 0x1c2db962
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x2c], eax
jmp 0x18001fe5e
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
mov dword [rbp + 0x60], eax
mov dword [rbp - 0x2c], 0x5e3154e3
jmp 0x18001fe5e
mov eax, dword [rbp + 0x60]
mov dword [rbp - 0x1c], eax
mov dword [rbp - 0x2c], 0x1642438a
jmp 0x18001fe5e
mov rax, qword [rbp + 0x18]
mov dword [rax], 1
mov dword [rbp - 0x2c], 0x4a1e10c0
jmp 0x18001fe5e
mov dword [rbp - 0x2c], 0x17c83ada
jmp 0x18001fe5e
mov rcx, qword [rbp + 0x20]
mov edx, 1
sub rsp, 0x20
call fcn.1800232d0
add rsp, 0x20
mov dword [rbp + 0x64], eax
mov dword [rbp - 0x2c], 0x88aad679
jmp 0x18001fe5e
mov ecx, dword [rbp + 0x64]
xor eax, eax
cmp eax, ecx
setne al
and al, 1
mov byte [rbp + 0x6b], al
mov dword [rbp - 0x2c], 0x50ca9ce2
jmp 0x18001fe5e
mov dl, byte [rbp + 0x6b]
mov eax, 0x36d8cfff
mov ecx, 0x901710a0
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x2c], eax
jmp 0x18001fe5e
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
mov dword [rbp + 0x6c], eax
mov dword [rbp - 0x2c], 0x78d18f99
jmp 0x18001fe5e
mov eax, dword [rbp + 0x6c]
mov dword [rbp - 0x1c], eax
mov rax, qword [rbp + 0x18]
mov dword [rax], 1
mov dword [rbp - 0x2c], 0x2ced49cc
jmp 0x18001fe5e
mov dword [rbp - 0x2c], 0x17c83ada
jmp 0x18001fe5e
mov rax, qword [rbp + 0x38]
add rax, 0x10
mov qword [rbp + 0x70], rax
mov dword [rbp - 0x2c], 0xad21499f
jmp 0x18001fe5e
mov rax, qword [rbp + 0x70]
mov rdx, qword [rax]
mov rcx, qword [rbp + 0x20]
sub rsp, 0x20
call fcn.1800233c0
add rsp, 0x20
mov ecx, eax
xor eax, eax
cmp eax, ecx
setne al
and al, 1
mov byte [rbp + 0x7f], al
mov dword [rbp - 0x2c], 0xf62757c3
jmp 0x18001fe5e
mov dl, byte [rbp + 0x7f]
mov eax, 0x8f14e108
mov ecx, 0x53a4ee47
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x2c], eax
jmp 0x18001fe5e
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
mov dword [rbp - 0x1c], eax
mov dword [rbp - 0x2c], 0x7685284b
jmp 0x18001fe5e
mov rax, qword [rbp + 0x18]
mov dword [rax], 1
mov dword [rbp - 0x2c], 0xa22af49c
jmp 0x18001fe5e
mov dword [rbp - 0x2c], 0x17c83ada
jmp 0x18001fe5e
mov rcx, qword [rbp + 0x20]
sub rsp, 0x20
call fcn.180023470
add rsp, 0x20
mov qword [rbp + 0x80], rax
mov dword [rbp - 0x2c], 0x27702d5c
jmp 0x18001fe5e
mov rax, qword [rbp + 0x80]
cmp rax, 0
sete al
and al, 1
mov byte [rbp + 0x8b], al
mov dword [rbp - 0x2c], 0xd65a12da
jmp 0x18001fe5e
mov dl, byte [rbp + 0x8b]
mov eax, 0x5fb49f20
mov ecx, 0xf55fa83b
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x2c], eax
jmp 0x18001fe5e
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
mov dword [rbp + 0x8c], eax
mov dword [rbp - 0x2c], 0x9850318
jmp 0x18001fe5e
mov eax, dword [rbp + 0x8c]
mov dword [rbp - 0x1c], eax
mov rax, qword [rbp + 0x18]
mov dword [rax], 1
mov dword [rbp - 0x2c], 0x944bd8e1
jmp 0x18001fe5e
mov dword [rbp - 0x2c], 0x17c83ada
jmp 0x18001fe5e
mov rax, qword [rbp - 0x18]
mov rax, qword [rax]
mov ecx, eax
mov rax, qword [rbp + 0x28]
mov dword [rax], ecx
mov rax, qword [rbp - 8]
mov rax, qword [rax]
mov qword [rbp + 0x90], rax
mov rcx, qword [rbp + 0x20]
sub rsp, 0x20
call fcn.180023470
add rsp, 0x20
mov qword [rbp + 0x98], rax
mov dword [rbp - 0x2c], 0x3ceffeb7
jmp 0x18001fe5e
mov rax, qword [rbp + 0x28]
mov r10, qword [rbp + 0x90]
mov rcx, qword [rbp + 0x98]
xor edx, edx
xor r9d, r9d
sub rsp, 0x30
mov r8d, r9d
mov qword [rsp + 0x20], r10
mov qword [rsp + 0x28], rax
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
add rsp, 0x30
mov dword [rbp + 0xa4], eax
mov dword [rbp - 0x2c], 0x5c74bc0e
jmp 0x18001fe5e
mov rax, qword [rbp + 0x30]
mov ecx, dword [rbp + 0xa4]
mov dword [rax], ecx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
mov dword [rbp - 0x1c], eax
mov rax, qword [rbp + 0x18]
mov dword [rax], 1
mov dword [rbp - 0x2c], 0x17c83ada
jmp 0x18001fe5e
mov rcx, qword [rbp + 0x20]
sub rsp, 0x20
call fcn.180023510
add rsp, 0x20
mov dword [rbp - 0x2c], 0xa735f6e2
jmp 0x18001fe5e
mov dword [rbp - 0x2c], 0x11cf3249
jmp 0x18001fe5e
mov rcx, qword [rbp + 0x10]
sub rsp, 0x20
call fcn.180022db0
add rsp, 0x20
mov dword [rbp - 0x2c], 0x5d105f5a
jmp 0x18001fe5e
mov eax, dword [rbp - 0x1c]
mov dword [rbp - 0x74], eax
mov rcx, qword [rbp + 0xa8]
xor rcx, rbp
sub rsp, 0x20
call fcn.18006c560
mov eax, dword [rbp - 0x74]
lea rsp, [rbp + 0xb0]
pop rbp
ret
jmp 0x18001f5a3