Function at 0x140063d40
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xa0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r14, rdx
mov r12, qword [rbp + 0x7f]
xor r13d, r13d
mov r15, qword [r9]
mov eax, dword [r8]
mov edi, 0x80004005
test rdx, rdx
je 0x140063e0a
mov dword [rbp - 0x51], eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, ebx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
mov edi, 0x8007000e
test rax, rax
cmovne edi, r13d
je 0x140063e0a
lfence
test rbx, rbx
je 0x140063dc8
mov r8d, ebx
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x51]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 1]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x140063df1
mov edi, r13d
jmp 0x140063e0e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test eax, eax
jle 0x140063e06
movzx edi, ax
or edi, 0x80070000
test edi, edi
jns 0x140063e0e
mov rsi, qword [rbp - 0x51]
mov ebx, dword [rbp - 0x51]
test edi, edi
js 0x140064068
lfence
xorps xmm0, xmm0
movups xmmword [rbp - 0x49], xmm0
mov qword [rbp - 0x39], r13
mov qword [rbp - 0x31], r13
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rsi + r8], r13b
jne 0x140063e32
mov rdx, rsi
lea rcx, [rbp - 0x49]
call fcn.140008e00
nop
mov r9d, ebx
xor r8d, r8d
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x49]
call fcn.14001ac30
mov rbx, rax
lea rax, [rbp - 0x49]
cmp rax, rbx
je 0x140063ecc
mov rdx, qword [rbp - 0x31]
cmp rdx, 0xf
jbe 0x140063e9e
inc rdx
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140063e99
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140063efe
call fcn.1400688dc
mov qword [rbp - 0x39], r13
mov qword [rbp - 0x31], 0xf
mov byte [rbp - 0x49], 0
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x49], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x39], xmm1
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [rbp - 0x11]
cmp rdx, 0xf
jbe 0x140063f0a
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140063f05
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140063f05
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400688dc
movdqa xmm0, xmmword [0x1400b2990]
movdqu xmmword [rbp - 0x19], xmm0
mov byte [rbp - 0x29], 0
cmp qword [rbp - 0x39], 0
jne 0x140063f40
xorps xmm0, xmm0
movups xmmword [rbp - 9], xmm0
movdqa xmm1, xmmword [0x1400b2980]
movdqu xmmword [rbp + 7], xmm1
mov word [rbp - 9], r13w
jmp 0x140063fbe
lea r8, [rbp - 0x49]
cmp qword [rbp - 0x31], 0xf
cmova r8, qword [rbp - 0x49]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
mov r9d, dword [rbp - 0x39]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov rdx, rbx
lea rcx, [rbp - 0x29]
call fcn.14001ac00
lea rcx, [rbp - 0x29]
cmp qword [rbp - 0x11], 7
cmova rcx, qword [rbp - 0x29]
lea r8, [rbp - 0x49]
cmp qword [rbp - 0x31], 0xf
cmova r8, qword [rbp - 0x49]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rcx
mov r9d, dword [rbp - 0x39]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movups xmm0, xmmword [rbp - 0x29]
movups xmmword [rbp - 9], xmm0
movups xmm1, xmmword [rbp - 0x19]
movups xmmword [rbp + 7], xmm1
lea rdx, [rbp - 9]
mov rcx, r12
call fcn.140009f80
mov rdx, qword [rbp + 0xf]
cmp rdx, 7
jbe 0x14006400d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140064008
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140064008
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400688dc
test rsi, rsi
je 0x14006402a
lfence
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov rdx, qword [rbp - 0x31]
cmp rdx, 0xf
jbe 0x140064068
inc rdx
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140064063
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140064063
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400688dc
mov eax, edi
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140068890
mov rbx, qword [rsp + 0xe0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret