Function at 0x180001540
Capabilities:
Create new key via cryptacquirecontext
Encrypt or decrypt via wincrypt

Disassembly:
push rbp
push rbx
push r12
lea rbp, [rsp - 0x47]
sub rsp, 0xe0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x3f], rax
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
lea rdx, str.svchost.exe
call qword [sym.imp.KERNEL32.dll_SetThreadDescription]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rax, str.LocalSvcAimControlData
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
mov rcx, 0xffffffffffffffff
mov dword [rsp + 0x20], 0x200
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [0x180006720], rax
test rax, rax
jne 0x1800015dd
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Failed_to_create_shared_memory._Error:
jmp 0x180001613
xor r9d, r9d
mov qword [rsp + 0x20], 0x200
xor r8d, r8d
mov edx, 0xf001f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [0x180006718], rax
test rax, rax
jne 0x180001643
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Failed_to_map_shared_memory._Error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov ebx, eax
call fcn.180001c80
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x180001e60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rax, qword [0x180006718]
mov qword [rsp + 0x100], rsi
xor r12d, r12d
mov qword [rsp + 0x108], rdi
mov qword [rsp + 0x110], r14
mov qword [rsp + 0x118], r15
test rax, rax
je 0x1800019f7
xorps xmm0, xmm0
mov qword [rbp + 0x1f], r12
movups xmmword [rbp + 0xf], xmm0
mov qword [rbp + 0x27], r12
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r12b
jne 0x180001685
mov rdx, rax
lea rcx, [rbp + 0xf]
call fcn.180002010
mov rax, qword [rbp + 0x1f]
mov ecx, eax
mov dword [rbp - 9], eax
call fcn.180002194
cmp qword [rbp + 0x27], 0xf
lea rdx, [rbp + 0xf]
mov r8d, dword [rbp - 9]
mov rcx, rax
cmova rdx, qword [rbp + 0xf]
mov rbx, rax
call sub.VCRUNTIME140.dll_memcpy
mov r9d, 0x18
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
lea rcx, [rbp + 0x37]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov rcx, qword [rbp + 0x37]
lea rax, [rbp + 0x2f]
mov qword [rsp + 0x28], rax
lea rdx, [0x1800044d8]
xor r9d, r9d
mov dword [rsp + 0x20], r12d
mov r8d, 0x20
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov rcx, qword [rbp + 0x2f]
lea rax, [rbp - 9]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rbx
mov r8d, 1
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov r8d, dword [rbp - 9]
lea rcx, [rbp + 0xf]
mov rdx, rbx
call fcn.180001a90
mov rcx, qword [rbp + 0x2f]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbp + 0x37]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, rbx
call fcn.180002150
mov r8d, 4
mov qword [rbp - 0x19], r12
cmp qword [rbp + 0x1f], r8
lea rdx, [rbp + 0xf]
xorps xmm0, xmm0
mov qword [rbp - 0x11], r12
cmovb r8, qword [rbp + 0x1f]
lea rcx, [rbp - 0x29]
cmp qword [rbp + 0x27], 0xf
movups xmmword [rbp - 0x29], xmm0
cmova rdx, qword [rbp + 0xf]
call fcn.180002010
mov rdx, qword [rbp - 0x11]
lea rax, [rbp - 0x29]
mov rcx, qword [rbp - 0x29]
cmp rdx, 0xf
cmova rax, rcx
cmp qword [rbp - 0x19], 4
je 0x1800017af
xor bl, bl
jmp 0x1800017b8
cmp dword [rax], 0x65766f6d
sete bl
cmp rdx, 0xf
jbe 0x1800017eb
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800017e6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001a66
call fcn.180002150
test bl, bl
je 0x1800019c0
mov r15, qword [rbp + 0x27]
lea rbx, [rbp + 0xf]
mov r14, qword [rbp + 0xf]
cmp r15, 0xf
mov rsi, qword [rbp + 0x1f]
cmova rbx, r14
test rsi, rsi
je 0x18000182d
mov r8, rsi
mov edx, 0x2c
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rdi, rax
test rax, rax
je 0x18000182d
sub rdi, rbx
jmp 0x180001834
mov rdi, 0xffffffffffffffff
mov qword [rbp - 0x59], r12
xorps xmm0, xmm0
mov qword [rbp - 0x51], r12
movups xmmword [rbp - 0x69], xmm0
cmp rsi, 5
jb 0x180001a60
lea rax, [rsi - 5]
lea r8, [rdi - 5]
cmp rax, r8
lea rdx, [rbp + 0xf]
lea rcx, [rbp - 0x69]
cmovb r8, rax
cmp r15, 0xf
cmova rdx, r14
add rdx, 5
call fcn.180002010
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp qword [rbp - 0x51], 0xf
lea rbx, [rbp - 0x69]
mov r8d, 0xa
lea rdx, [rbp - 1]
cmova rbx, qword [rbp - 0x69]
mov rsi, rax
mov rcx, rbx
mov dword [rax], r12d
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
mov r14d, eax
cmp rbx, qword [rbp - 1]
je 0x180001a52
cmp dword [rsi], 0x22
je 0x180001a44
mov rdx, qword [rbp - 0x51]
cmp rdx, 0xf
jbe 0x1800018f3
mov rcx, qword [rbp - 0x69]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800018ee
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001a14
call fcn.180002150
mov rax, qword [rbp + 0x1f]
inc rdi
mov qword [rbp - 0x39], r12
xorps xmm0, xmm0
mov qword [rbp - 0x31], r12
movups xmmword [rbp - 0x49], xmm0
cmp rax, rdi
jb 0x180001a3e
sub rax, rdi
lea rdx, [rbp + 0xf]
mov r8, 0xffffffffffffffff
lea rcx, [rbp - 0x49]
cmp rax, r8
cmovb r8, rax
cmp qword [rbp + 0x27], 0xf
cmova rdx, qword [rbp + 0xf]
add rdx, rdi
call fcn.180002010
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp qword [rbp - 0x31], 0xf
lea rbx, [rbp - 0x49]
mov r8d, 0xa
lea rdx, [rbp + 7]
cmova rbx, qword [rbp - 0x49]
mov rdi, rax
mov rcx, rbx
mov dword [rax], r12d
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
mov esi, eax
cmp rbx, qword [rbp + 7]
je 0x180001a30
cmp dword [rdi], 0x22
je 0x180001a22
mov rdx, qword [rbp - 0x31]
cmp rdx, 0xf
jbe 0x1800019b6
mov rcx, qword [rbp - 0x49]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800019b1
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001a1b
call fcn.180002150
mov edx, esi
mov ecx, r14d
call fcn.1800012a0
mov rdx, qword [rbp + 0x27]
cmp rdx, 0xf
jbe 0x1800019f7
mov rcx, qword [rbp + 0xf]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800019f2
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001a66
call fcn.180002150
lea rcx, [rbp - 9]
mov qword [rbp - 9], 0x64
call fcn.180001ea0
mov rax, qword [0x180006718]
jmp 0x180001666
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rcx, str.stoi_argument_out_of_range
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_]
int3
lea rcx, str.invalid_stoi_argument
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xinvalid_argument_char_const____ptr64_]
int3
call fcn.180001c60
int3
lea rcx, str.stoi_argument_out_of_range
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_]
int3
lea rcx, str.invalid_stoi_argument
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xinvalid_argument_char_const____ptr64_]
int3
call fcn.180001c60
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3