Function at 0x14000c9cc
Capabilities:
Encrypt data using aes via winapi
Reference public rsa key

Disassembly:
mov rdx, qword [rcx + 0x50]
lea r9, [0x140049260]
mov r8d, dword [0x140049374]
add rcx, reloc.Mso20Win32Client.dll_Ordinal_255
jmp reloc.Mso20Win32Client.dll_Ordinal_255
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
and qword [rbp - 0x18], 0
xor esi, esi
and qword [rbp - 0x10], 0
mov r14, r9
and qword [rbp - 0x20], 0
mov ebx, r8d
mov r15, rdx
mov rdi, rcx
test r9, r9
je reloc.Mso20Win32Client.dll_Ordinal_255
test ebx, ebx
je reloc.Mso20Win32Client.dll_Ordinal_255
lea r9d, [rsi + 0x18]
mov dword [rax - 0x48], 0xf0000000
xor r8d, r8d
lea rcx, [rbp - 0x18]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne reloc.Mso20Win32Client.dll_Ordinal_255
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne reloc.Mso20Win32Client.dll_Ordinal_255
mov ebx, reloc.Mso20Win32Client.dll_Ordinal_255
jmp reloc.Mso20Win32Client.dll_Ordinal_255
movzx ebx, ax
or ebx, reloc.Mso20Win32Client.dll_Ordinal_255
test eax, eax
cmovle ebx, eax
jmp reloc.Mso20Win32Client.dll_Ordinal_255
mov rcx, qword [rbp - 0x18]
lea r9, [rbp - 0x20]
mov edx, reloc.Mso20Win32Client.dll_Ordinal_255
mov r8d, 1
call qword [sym.imp.ADVAPI32.dll_CryptGenKey]
test eax, eax
je reloc.Mso20Win32Client.dll_Ordinal_255
mov rcx, qword [rbp - 0x18]
lea rax, [rbp - 0x10]
mov qword [rsp + 0x28], rax
xor r9d, r9d
and dword [rsp + 0x20], esi
mov r8d, ebx
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je reloc.Mso20Win32Client.dll_Ordinal_255
mov rdx, qword [rbp - 0x10]
lea rax, [rbp + 0x38]
mov rcx, qword [rbp - 0x20]
xor r9d, r9d
and dword [rbp + 0x38], esi
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], rsi
lea r8d, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_CryptExportKey]
test eax, eax
je reloc.Mso20Win32Client.dll_Ordinal_255
mov eax, dword [rbp + 0x38]
lea ebx, [rax + 0x14]
cmp ebx, eax
ja reloc.Mso20Win32Client.dll_Ordinal_255
mov ebx, reloc.Mso20Win32Client.dll_Ordinal_255
jmp reloc.Mso20Win32Client.dll_Ordinal_255
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
jne reloc.Mso20Win32Client.dll_Ordinal_255
mov ebx, reloc.Mso20Win32Client.dll_Ordinal_255
jmp reloc.Mso20Win32Client.dll_Ordinal_255
mov dword [rax], ebx
lea rcx, [rbp + 0x38]
mov dword [rax + 4], 1
xor r9d, r9d
mov dword [rax + 8], 0x10000
mov eax, dword [rbp + 0x38]
mov dword [rsi + 0xc], eax
lea rax, [rsi + 0x10]
mov rdx, qword [rbp - 0x10]
lea r8d, [r9 + 1]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp - 0x20]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptExportKey]
test eax, eax
je reloc.Mso20Win32Client.dll_Ordinal_255
mov rax, qword [0x140049b80]
test rax, rax
jne reloc.Mso20Win32Client.dll_Ordinal_255
mov ebx, reloc.Mso20Win32Client.dll_Ordinal_255
jmp reloc.Mso20Win32Client.dll_Ordinal_255
mov r8, rsi
mov edx, ebx
mov rcx, r15
call rax
mov ebx, eax
test eax, eax
js reloc.Mso20Win32Client.dll_Ordinal_255
mov rcx, qword [rdi + 8]
test rcx, rcx
je reloc.Mso20Win32Client.dll_Ordinal_255
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
and qword [rdi + 8], 0
mov rcx, qword [rbp - 0x20]
and qword [rbp - 0x20], 0
mov qword [rdi + 8], rcx
mov rcx, qword [rdi]
test rcx, rcx
je reloc.Mso20Win32Client.dll_Ordinal_255
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
and qword [rdi], 0
mov rax, qword [rbp - 0x18]
and qword [rbp - 0x18], 0
mov qword [rdi], rax
jmp reloc.Mso20Win32Client.dll_Ordinal_255
mov ebx, reloc.Mso20Win32Client.dll_Ordinal_255
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je reloc.Mso20Win32Client.dll_Ordinal_255
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je reloc.Mso20Win32Client.dll_Ordinal_255
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je reloc.Mso20Win32Client.dll_Ordinal_255
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test rsi, rsi
je reloc.Mso20Win32Client.dll_Ordinal_255
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret