Function at 0x1400393c0
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov rbx, rdx
mov r15, rcx
xor esi, esi
mov dword [rbp + 0x28], esi
cmp byte [rcx + 0x50], sil
je 0x140039416
xor edx, edx
mov rcx, rbx
call fcn.14000b740
lea r12, vtable.Aws::Utils::CryptoBuffer.0
mov qword [rbx], r12
mov rax, rbx
jmp 0x140039a70
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rsi
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rsi
lea r12, vtable.Aws::Utils::CryptoBuffer.0
mov qword [rsp + 0x68], r12
cmp qword [rcx + 0xa0], 0
jbe 0x14003952b
lea rbx, [rcx + 0x98]
cmp rbx, r8
je 0x14003952b
mov qword [rbp], rbx
mov qword [rbp + 8], r8
lea rax, [rbp]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x10]
mov qword [rbp - 8], rax
lea r8, [rbp + 0x1a8]
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x10]
call fcn.140035880
nop
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x50]
call fcn.140036e20
mov rcx, qword [rax + 8]
mov qword [rsp + 0x70], rcx
lea rcx, [rax + 0x10]
lea rax, [rsp + 0x78]
cmp rax, rcx
je 0x1400394c3
mov rax, qword [rcx]
mov qword [rcx], rsi
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x78], rax
test rcx, rcx
je 0x1400394c3
call fcn.140015ad0
nop
mov qword [rsp + 0x50], r12
lea rcx, [rsp + 0x50]
call fcn.140035800
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400394e3
call fcn.140015ad0
nop
lea rcx, [rbp + 0x10]
call fcn.14000e910
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x50], r12
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.1400353b0
nop
mov qword [rsp + 0x50], r12
lea rcx, [rsp + 0x50]
call fcn.140035800
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140039529
call fcn.140015ad0
nop
jmp 0x140039538
mov rdx, r8
lea rcx, [rsp + 0x68]
call fcn.140037550
lea rax, vtable.Aws::Utils::Array_class_Aws::Utils::CryptoBuffer_.0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rsi
mov r14d, esi
mov r8, qword [reloc.WS2_32.dll_recv]
cmp qword [rsp + 0x70], r8
jbe 0x14003958c
lea rdx, [rbp + 0x40]
lea rcx, [rsp + 0x68]
call fcn.1400354d0
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400374b0
nop
lea rcx, [rbp + 0x40]
call fcn.140035350
mov rdi, qword [rsp + 0x60]
jmp 0x1400395c4
mov edx, 1
lea rcx, [rbp + 0x40]
call fcn.1400351c0
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400374b0
nop
lea rcx, [rbp + 0x40]
call fcn.140035350
lea rdx, [rsp + 0x68]
mov rdi, qword [rsp + 0x60]
mov rcx, rdi
call fcn.140037550
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], rsi
mov rbx, qword [rsp + 0x58]
test rbx, rbx
je 0x14003960e
mov rdx, rbx
lea rcx, [rbp - 0x78]
call fcn.14003c380
lea rbx, [rbx*8]
mov r8, rbx
xor edx, edx
mov r13, qword [rbp - 0x78]
mov rcx, r13
call fcn.1400bbac0
lea rax, [rbx + r13]
mov qword [rbp - 0x70], rax
movdqu xmm0, xmmword [rbp - 0x78]
jmp 0x140039616
mov r13, qword [rbp - 0x78]
mov rax, qword [rbp - 0x70]
movups xmmword [rbp - 0x40], xmm0
movsd xmm0, qword [rbp - 0x68]
movsd qword [rbp - 0x30], xmm0
mov r8, rax
sub r8, r13
add r8, 7
shr r8, 3
cmp r13, rax
cmova r8, rsi
test r8, r8
je 0x14003964c
shl r8, 3
xor edx, edx
mov rcx, r13
call fcn.1400bbac0
mov qword [rbp - 0x80], rsi
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x140039942
mov r8, rdi
mov qword [rbp - 0x48], rdi
lea rcx, vtable.Aws::Utils::Array_unsigned_char_.0
mov rsi, qword [rbp + 0x190]
mov rdi, qword [rbp]
mov rbx, qword [rbp + 0x190]
nop
mov rdx, qword [reloc.WS2_32.dll_recv]
cmp qword [r8 + 8], rdx
je 0x140039735
cmp qword [r15 + 0xa0], 0
jbe 0x1400396a5
cmp rax, 1
je 0x140039735
lea rcx, [r15 + 0x98]
mov rdx, r8
call fcn.140037550
mov edx, 0x18
mov rcx, qword [str.BCrypt_AES_CTR_Cipher]
call fcn.14001add0
mov r15, rax
lea rax, vtable.Aws::Utils::Array_unsigned_char_.0
mov qword [r15], rax
xor eax, eax
mov qword [r15 + 8], rax
or r14d, 0x300
mov qword [r15 + 0x10], rax
btr r14d, 9
btr r14d, 8
test r14b, r14b
jns 0x140039705
btr r14d, 7
test rsi, rsi
je 0x140039705
mov rcx, rsi
call fcn.140015ad0
nop
test r14b, 0x40
je 0x14003971d
and r14d, 0xffffffbf
test rdi, rdi
je 0x14003971d
mov rcx, rdi
call fcn.140015ad0
nop
mov qword [r15], r12
mov rax, qword [rbp - 0x80]
mov qword [r13 + rax*8], r15
mov r15, qword [rbp + 0x190]
jmp 0x140039918
mov dword [rbp + 0x1a8], edx
mov qword [rbp - 0x60], rcx
mov qword [rbp - 0x58], rdx
test rdx, rdx
je 0x14003976d
mov r8, qword [str.Aws::Array]
lea rcx, [rbp - 0x10]
call fcn.140008c10
mov rcx, qword [rax]
mov qword [rax], 0
lea rax, [rbp + 0x38]
mov edx, 6
jmp 0x14003977a
xor ebx, ebx
lea rax, [rbp + 0x30]
xor ecx, ecx
mov edx, 0x18
or r14d, edx
mov qword [rax], 0
mov qword [rbp - 0x50], rcx
test r14b, 0x10
je 0x1400397a1
and r14d, 0xffffffef
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x1400397a1
call fcn.140015ad0
nop
test r14b, 8
je 0x1400397b9
and r14d, 0xfffffff7
test rbx, rbx
je 0x1400397b9
mov rcx, rbx
call fcn.140015ad0
nop
test r14b, 4
je 0x1400397d2
and r14d, 0xfffffffb
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x1400397d2
call fcn.140015ad0
nop
test r14b, 2
je 0x1400397eb
and r14d, 0xfffffffd
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1400397eb
call fcn.140015ad0
nop
mov qword [rbp - 0x60], r12
lea r13, [r15 + 0x80]
mov eax, dword [r15 + 0x68]
mov dword [rsp + 0x48], eax
lea rax, [rbp + 0x1a8]
mov qword [rsp + 0x40], rax
mov eax, dword [rbp - 0x58]
mov dword [rsp + 0x38], eax
mov rax, qword [rbp - 0x50]
mov qword [rsp + 0x30], rax
xor eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, dword [r15 + 0x78]
mov rdx, qword [r13]
mov rcx, qword [r15 + 0x60]
call sub.bcrypt.dll_BCryptEncrypt
mov r15d, eax
test eax, eax
js 0x140039a8b
mov edx, 0x18
mov rcx, qword [str.BCrypt_AES_CTR_Cipher]
call fcn.14001add0
mov r15, rax
mov rdx, qword [reloc.WS2_32.dll_recv]
mov rcx, rax
call fcn.14000b740
mov qword [r15], r12
lea rdx, [rbp - 0x60]
mov rcx, qword [rbp - 0x48]
call fcn.140035400
mov rdx, rax
mov rcx, r15
call fcn.140037550
mov rax, qword [rbp - 0x78]
mov rcx, qword [rbp - 0x80]
mov qword [rax + rcx*8], r15
mov r15, qword [rbp + 0x190]
lea rdx, [r15 + 0x70]
mov r8d, 1
lea rcx, [rbp + 0x10]
call fcn.1400436f0
mov rcx, qword [rax + 8]
mov qword [r15 + 0x78], rcx
lea rcx, [rax + 0x10]
cmp r13, rcx
je 0x1400398d6
mov rax, qword [rcx]
mov qword [rcx], 0
mov rcx, qword [r13]
mov qword [r13], rax
test rcx, rcx
je 0x1400398d6
call fcn.140015ad0
nop
mov qword [rbp + 0x10], r12
lea rcx, [rbp + 0x10]
call fcn.140035800
nop
mov rcx, qword [rbp + 0x20]
test rcx, rcx
je 0x1400398f3
call fcn.140015ad0
nop
mov qword [rbp - 0x60], r12
lea rcx, [rbp - 0x60]
call fcn.140035800
nop
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x140039910
call fcn.140015ad0
nop
mov r13, qword [rbp - 0x78]
mov rax, qword [rbp - 0x80]
inc rax
mov qword [rbp - 0x80], rax
mov r8, qword [rbp - 0x48]
add r8, 0x18
mov qword [rbp - 0x48], r8
cmp rax, qword [rsp + 0x58]
mov rax, qword [rsp + 0x58]
lea rcx, vtable.Aws::Utils::Array_unsigned_char_.0
jb 0x140039680
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x28]
call fcn.140036e20
nop
mov r14, qword [rbp - 0x40]
mov rdi, r14
mov r15, qword [rbp - 0x38]
cmp r14, r15
je 0x14003998f
mov rsi, qword [rdi]
test rsi, rsi
je 0x140039986
mov rcx, rsi
call fcn.1400bbf90
mov rbx, rax
mov r8, qword [rsi]
xor edx, edx
mov rcx, rsi
call qword [r8]
mov rcx, rbx
call fcn.140015ad0
add rdi, 8
cmp rdi, r15
jne 0x140039960
mov rax, qword [rbp - 0x20]
mov r13, qword [rbp + 0x198]
mov qword [r13 + 8], rax
mov rax, qword [rbp - 0x18]
mov qword [r13 + 0x10], rax
xor eax, eax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [r13], r12
mov qword [rbp - 0x28], r12
lea rcx, [rbp - 0x28]
call fcn.140035800
nop
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1400399d1
call fcn.140015ad0
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140039a10
lea rsi, [rcx - 8]
mov rdi, qword [rsi]
test rdi, rdi
je 0x140039a07
lea rbx, [rdi - 1]
lea rbx, [rbx + rbx*2]
lea rbx, [rcx + rbx*8]
mov rax, qword [rbx]
xor edx, edx
mov rcx, rbx
call qword [rax]
sub rbx, 0x18
sub rdi, 1
jne 0x1400399f3
mov rcx, rsi
call fcn.140015ad0
nop
mov qword [rsp + 0x68], r12
lea rcx, [rsp + 0x68]
call fcn.140035800
nop
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140039a30
call fcn.140015ad0
nop
test r14, r14
je 0x140039a6d
mov rdx, qword [rbp - 0x30]
sub rdx, r14
and rdx, 0xfffffffffffffff8
mov rax, r14
cmp rdx, 0x1000
jb 0x140039a65
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140039c60
mov rcx, r14
call fcn.1400b91c0
mov rax, r13
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x250
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x50], 1
call fcn.1400170f0
mov rbx, rax
test rax, rax
je 0x140039aff
mov r8, qword [rax]
mov rcx, rax
call qword [rhtons + 8]
cmp eax, 2
jl 0x140039aff
mov edx, 1
lea rcx, [rbp + 0x60]
call fcn.140002860
nop
lea rdx, str.Failed_to_compute_encrypted_output_with_error_code
lea rcx, [rbp + 0x60]
call fcn.1400019a0
mov rcx, rax
mov edx, r15d
call fcn.1400107d0
mov rax, qword [rbx]
lea r9, [rbp + 0x60]
mov r8, qword [str.BCrypt_AES_CTR_Cipher]
mov edx, 2
mov rcx, rbx
call qword [rax + 0x18]
nop
lea rcx, [rbp + 0x60]
call fcn.140003bc0
mov r15, qword [rbp - 0x78]
mov rdi, r15
mov r13, qword [rbp - 0x70]
cmp r15, r13
je 0x140039b3f
nop
mov rsi, qword [rdi]
test rsi, rsi
je 0x140039b36
mov rcx, rsi
call fcn.1400bbf90
mov rbx, rax
mov r8, qword [rsi]
xor edx, edx
mov rcx, rsi
call qword [r8]
mov rcx, rbx
call fcn.140015ad0
add rdi, 8
cmp rdi, r13
jne 0x140039b10
mov r13, qword [rbp + 0x198]
lea rax, vtable.Aws::Utils::Array_unsigned_char_.0
mov qword [r13], rax
xor eax, eax
mov qword [r13 + 8], rax
mov qword [r13 + 0x10], rax
and r14d, 0xffff9fff
bt r14d, 0xc
jae 0x140039b80
btr r14d, 0xc
mov rcx, qword [rbp + 0x190]
test rcx, rcx
je 0x140039b80
call fcn.140015ad0
nop
bt r14d, 0xb
jae 0x140039b99
mov rcx, qword [rbp + 0x190]
test rcx, rcx
je 0x140039b99
call fcn.140015ad0
nop
mov qword [r13], r12
mov qword [rbp - 0x60], r12
lea rcx, [rbp - 0x60]
call fcn.140035800
nop
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x140039bba
call fcn.140015ad0
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140039bfd
lea rsi, [rcx - 8]
mov rdi, qword [rsi]
test rdi, rdi
je 0x140039bf4
lea rbx, [rdi - 1]
lea rbx, [rbx + rbx*2]
lea rbx, [rcx + rbx*8]
nop dword [rax]
mov rax, qword [rbx]
xor edx, edx
mov rcx, rbx
call qword [rax]
sub rbx, 0x18
sub rdi, 1
jne 0x140039be0
mov rcx, rsi
call fcn.140015ad0
nop
mov qword [rsp + 0x68], r12
lea rcx, [rsp + 0x68]
call fcn.140035800
nop
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140039c1d
call fcn.140015ad0
nop
test r15, r15
je 0x140039a6d
mov rdx, qword [rbp - 0x30]
sub rdx, r15
and rdx, 0xfffffffffffffff8
mov rax, r15
cmp rdx, 0x1000
jb 0x140039c52
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140039c5a
mov rcx, r15
jmp 0x140039a68
call fcn.1400bfe60
int3
call fcn.1400bfe60
int3