Function at 0x1400014d0
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x158], rbx
mov rax, qword [0x14000d010]
xor rax, rsp
mov qword [rbp], rax
mov r13, r8
mov rsi, rcx
mov qword [rsp + 0x50], rcx
xor r12d, r12d
mov dword [rsp + 0x40], r12d
xor eax, eax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov rcx, r9
mov rdx, qword [r9 + 0x18]
cmp rdx, 0x10
jb 0x140001538
mov rcx, qword [r9]
lea rdi, [r9 + 0x10]
mov r8, qword [rdi]
add r8, rcx
cmp rdx, 0x10
jb 0x14000154b
mov r9, qword [r9]
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], r12
mov rdx, r9
lea rcx, [rbp - 0x30]
call fcn.140003550
nop
mov rbx, qword [rbp - 0x28]
mov r15, qword [rbp - 0x30]
sub rbx, r15
mov edx, ebx
and edx, 0xfffffff0
add edx, 0x10
xor ecx, ecx
mov qword [rbp - 0x18], rcx
mov qword [rbp - 0x10], rcx
mov qword [rbp - 8], rcx
lea rcx, [rbp - 0x18]
call fcn.140001d60
nop
mov qword [rsi], r12
mov qword [rsi + 8], r12
mov qword [rsi + 0x10], r12
mov dword [rsp + 0x40], 1
mov r8, rbx
mov rdx, r15
mov r14, qword [rbp - 0x18]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi]
shr rax, 4
add eax, 1
mov rdi, r12
mov r12d, eax
je 0x140001691
mov rbx, r14
nop dword [rax]
xor eax, eax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rax
lea r8, [rbx + 0x10]
mov rdx, rbx
lea rcx, [rbp - 0x50]
call fcn.140003550
nop
lea rcx, [rbp - 0x50]
call fcn.1400030a0
mov dword [rbp - 0x38], 0x10
mov rax, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x50]
sub rax, rcx
mov dword [rsp + 0x30], eax
lea rax, [rbp - 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 1]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x14000173b
mov rdx, qword [rsi + 8]
mov r9, qword [rbp - 0x48]
mov r8, qword [rbp - 0x50]
mov rcx, rsi
call fcn.140003620
nop
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x140001681
mov rdx, qword [rbp - 0x40]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000167c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400016c5
call fcn.140006000
inc rdi
add rbx, 0x10
cmp rdi, r12
jb 0x1400015d0
test r14, r14
je 0x1400016d5
mov rdx, qword [rbp - 8]
sub rdx, r14
mov rax, r14
cmp rdx, 0x1000
jb 0x1400016cc
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400016cc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, r14
call fcn.140006000
nop
test r15, r15
je 0x140001711
mov rdx, qword [rbp - 0x20]
sub rdx, r15
mov rax, r15
cmp rdx, 0x1000
jb 0x140001709
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001709
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.140006000
mov rax, rsi
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.140005fa0
mov rbx, qword [rsp + 0x158]
add rsp, 0x110
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x70]
call fcn.140001430
nop
mov r8, rax
lea rcx, [rbp - 0x70]
call fcn.140002f80
nop
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140001270
lea rdx, [0x14000a9b8]
lea rcx, [rsp + 0x58]
call sub.VCRUNTIME140.dll__CxxThrowException
int3