Function at 0x1401f36c0
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rbx, r9
mov r14, r8
mov rsi, rdx
mov rdi, rcx
test rcx, rcx
je 0x1401f38fd
test rdx, rdx
je 0x1401f38fd
test r8, r8
je 0x1401f38fd
test rbx, rbx
je 0x1401f38fd
mov ecx, dword [r9 + 8]
mov ebp, dword [r8 + 8]
add ecx, 0x18
add ebp, ecx
mov dword [rsp + 0x50], 0x18
mov ecx, ebp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r15, rax
test rax, rax
je 0x1401f38fd
mov dword [rax], 0x31415352
mov ecx, dword [rbx + 8]
shl ecx, 3
mov dword [rax + 4], ecx
mov ecx, dword [r14 + 8]
mov dword [rax + 8], ecx
mov ecx, dword [rbx + 8]
mov dword [rax + 0xc], ecx
mov qword [rsp + 0x98], r12
xor r12d, r12d
mov qword [rax + 0x10], r12
mov ecx, dword [rsp + 0x50]
mov r8d, dword [r14 + 8]
add rcx, rax
mov rdx, qword [r14]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [r14 + 8]
add ecx, dword [rsp + 0x50]
mov r8d, dword [rbx + 8]
add rcx, r15
mov rdx, qword [rbx]
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [0x140336a18]
lea r9, [rsp + 0x58]
mov dword [rsp + 0x30], r12d
lea r8, str.RSAPUBLICBLOB
mov dword [rsp + 0x28], ebp
xor edx, edx
mov qword [rsp + 0x20], r15
mov dword [rsp + 0x50], r12d
call sub.bcrypt.dll_BCryptImportKeyPair
mov ebx, eax
test eax, eax
js 0x1401f38e5
mov r8d, dword [rsi + 8]
lea rax, [rsp + 0x90]
mov rdx, qword [rsi]
xor r9d, r9d
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x48], 1
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call sub.bcrypt.dll_BCryptEncrypt
mov ebx, eax
test eax, eax
js 0x1401f38db
mov ebx, dword [rsp + 0x90]
cmp ebx, dword [rdi + 8]
je 0x1401f3829
mov rcx, qword [rdi]
mov edx, ebx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
test rax, rax
je 0x1401f38d6
mov dword [rdi + 8], ebx
mov ebx, dword [rsp + 0x90]
mov qword [rdi], rax
mov eax, dword [rsi + 8]
cmp eax, ebx
jbe 0x1401f3839
mov ebx, eax
mov dword [rsp + 0x90], eax
mov ecx, ebx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
je 0x1401f38d6
mov r9d, dword [rsi + 8]
mov rcx, rax
mov r8, qword [rsi]
mov edx, dword [rsp + 0x90]
call fcn.1401f5bd0
mov ecx, dword [rdi + 8]
lea rax, [rsp + 0x50]
mov r8d, dword [rsp + 0x90]
xor r9d, r9d
mov dword [rsp + 0x48], 1
mov rdx, rbp
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], ecx
mov rcx, qword [rdi]
mov qword [rsp + 0x30], rcx
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call sub.bcrypt.dll_BCryptEncrypt
mov rcx, rbp
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test ebx, ebx
js 0x1401f38db
mov esi, dword [rsp + 0x50]
cmp esi, dword [rdi + 8]
je 0x1401f38db
mov rcx, qword [rdi]
mov edx, esi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
test rax, rax
je 0x1401f38db
mov qword [rdi], rax
mov dword [rdi + 8], esi
jmp 0x1401f38db
mov ebx, 0xc0000017
mov rcx, qword [rsp + 0x58]
call sub.bcrypt.dll_BCryptDestroyKey
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r12, qword [rsp + 0x98]
sar ebx, 0x1f
mov eax, ebx
jmp 0x1401f3902
mov eax, 0xffffffff
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret