Function at 0x140003020
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x160
mov rax, qword [0x1401a5100]
xor rax, rsp
mov qword [rsp + 0x158], rax
mov r12, r8
mov r13, rdx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x70], rdx
mov qword [r11 - 0x100], r8
xor esi, esi
mov qword [r11 - 0x110], rsi
mov qword [r11 - 0x108], rsi
lea rax, [r8 + 8]
mov qword [rsp + 0x80], rax
mov rbx, qword [rax]
sub rbx, qword [r8]
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x100], esi
xorps xmm1, xmm1
movdqu xmmword [r11 - 0x78], xmm1
mov r14d, esi
mov qword [r11 - 0x68], rsi
je 0x140003119
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
ja 0x140003ae6
cmp rbx, 0x1000
jb 0x1400030e3
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140003aec
call fcn.1401391f8
test rax, rax
je 0x140003afe
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400030ee
mov rcx, rbx
call fcn.1401391f8
mov rdi, rax
mov qword [rsp + 0x120], rdi
lea r14, [rdi + rbx]
mov qword [rsp + 0x130], r14
mov r8, rbx
xor edx, edx
mov rcx, rdi
call fcn.140165b60
mov qword [rsp + 0x128], r14
jmp 0x140003121
mov rdi, qword [rsp + 0x120]
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x108], xmm1
mov rax, rsi
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x118], rax
movdqu xmmword [rsp + 0x138], xmm1
mov qword [rsp + 0x148], rsi
mov ecx, 0xc
call fcn.1401391f8
mov rbx, rax
mov qword [rsp + 0x138], rax
lea r15, [rax + 0xc]
mov qword [rsp + 0x148], r15
xor eax, eax
mov qword [rbx], rax
mov dword [rbx + 8], eax
mov qword [rsp + 0x140], r15
mov rdx, qword [r12]
add rdx, 3
mov r8d, 0xc
mov rcx, rbx
call fcn.1401653e0
mov rax, qword [r12]
mov r8, qword [rsp + 0x68]
add r8, rax
lea rdx, [rax + 0xf]
sub r8, rdx
mov rcx, rdi
call fcn.1401653e0
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1401783c8]
lea rcx, [rsp + 0x88]
call qword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
mov dword [rsp + 0x50], eax
test eax, eax
jns 0x1400032e4
lea rdx, str.BCryptOpenAlgorithmProvider_failed_with_status:
lea rcx, [0x1401ab090]
call fcn.140008250
mov edx, dword [rsp + 0x50]
mov rcx, rax
call fcn.140004ff0
mov rcx, rax
call fcn.140008500
xorps xmm0, xmm0
movups xmmword [r13], xmm0
mov qword [r13 + 0x10], rsi
mov qword [r13 + 0x18], rsi
xor r8d, r8d
lea rdx, [0x14017827d]
mov rcx, r13
call fcn.140008cb0
nop
test rbx, rbx
je 0x14000325a
sub r15, rbx
cmp r15, 0x1000
jb 0x14000324e
add r15, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x140003af8
mov rbx, rcx
mov rdx, r15
mov rcx, rbx
call fcn.1401391f0
nop
test rdi, rdi
je 0x140003293
sub r14, rdi
mov rax, rdi
cmp r14, 0x1000
jb 0x140003287
add r14, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003afe
mov rdx, r14
mov rcx, rdi
call fcn.1401391f0
nop
mov rcx, qword [r12]
test rcx, rcx
je 0x1400032dc
mov rdx, qword [r12 + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x1400032c9
add rdx, 0x27
mov rax, qword [rcx - 8]
sub rcx, rax
add rcx, 0xfffffffffffffff8
cmp rcx, 0x1f
ja 0x140003b04
mov rcx, rax
call fcn.1401391f0
mov qword [r12], rsi
mov qword [r12 + 8], rsi
mov qword [r12 + 0x10], rsi
mov rax, r13
jmp 0x140003abd
mov dword [rsp + 0x20], esi
mov r9d, 0x20
lea r8, str.ChainingModeGCM
lea rdx, str.ChainingMode
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.bcrypt.dll_BCryptSetProperty]
mov dword [rsp + 0x50], eax
test eax, eax
jns 0x140003433
lea rdx, str.BCryptSetProperty_failed_with_status:
lea rcx, [0x1401ab090]
call fcn.140008250
mov edx, dword [rsp + 0x50]
mov rcx, rax
call fcn.140004ff0
mov rcx, rax
call fcn.140008500
xor edx, edx
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.bcrypt.dll_BCryptCloseAlgorithmProvider]
xorps xmm0, xmm0
movups xmmword [r13], xmm0
mov qword [r13 + 0x10], rsi
mov qword [r13 + 0x18], rsi
xor r8d, r8d
lea rdx, [0x14017827d]
mov rcx, r13
call fcn.140008cb0
nop
test rbx, rbx
je 0x1400033a9
sub r15, rbx
cmp r15, 0x1000
jb 0x14000339d
add r15, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x140003af8
mov rbx, rcx
mov rdx, r15
mov rcx, rbx
call fcn.1401391f0
nop
test rdi, rdi
je 0x1400033e2
sub r14, rdi
mov rax, rdi
cmp r14, 0x1000
jb 0x1400033d6
add r14, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003afe
mov rdx, r14
mov rcx, rdi
call fcn.1401391f0
nop
mov rcx, qword [r12]
test rcx, rcx
je 0x14000342b
mov rdx, qword [r12 + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x140003418
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003b04
mov rcx, r8
call fcn.1401391f0
mov qword [r12], rsi
mov qword [r12 + 8], rsi
mov qword [r12 + 0x10], rsi
mov rax, r13
jmp 0x140003abd
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx]
mov dword [rsp + 0x30], esi
mov eax, dword [rcx]
mov dword [rsp + 0x28], eax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x90]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.bcrypt.dll_BCryptGenerateSymmetricKey]
mov dword [rsp + 0x50], eax
test eax, eax
jns 0x140003593
lea rdx, str.BcryptGenertaeSymmetricKey_failed_with_status:
lea rcx, [0x1401ab090]
call fcn.140008250
mov edx, dword [rsp + 0x50]
mov rcx, rax
call fcn.140004ff0
mov rcx, rax
call fcn.140008500
xor edx, edx
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.bcrypt.dll_BCryptCloseAlgorithmProvider]
xorps xmm0, xmm0
movups xmmword [r13], xmm0
mov qword [r13 + 0x10], rsi
mov qword [r13 + 0x18], rsi
xor r8d, r8d
lea rdx, [0x14017827d]
mov rcx, r13
call fcn.140008cb0
nop
test rbx, rbx
je 0x140003509
sub r15, rbx
cmp r15, 0x1000
jb 0x1400034fd
add r15, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x140003af8
mov rbx, rcx
mov rdx, r15
mov rcx, rbx
call fcn.1401391f0
nop
test rdi, rdi
je 0x140003542
sub r14, rdi
mov rax, rdi
cmp r14, 0x1000
jb 0x140003536
add r14, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003afe
mov rdx, r14
mov rcx, rdi
call fcn.1401391f0
nop
mov rcx, qword [r12]
test rcx, rcx
je 0x14000358b
mov rdx, qword [r12 + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x140003578
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003b04
mov rcx, r8
call fcn.1401391f0
mov qword [r12], rsi
mov qword [r12 + 8], rsi
mov qword [r12 + 0x10], rsi
mov rax, r13
jmp 0x140003abd
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
movups xmmword [rsp + 0xc0], xmm0
movups xmmword [rsp + 0xd0], xmm0
movups xmmword [rsp + 0xe0], xmm0
mov qword [rsp + 0xf0], rax
mov dword [rsp + 0xa0], 0x58
mov dword [rsp + 0xa4], 1
mov rcx, qword [rsp + 0x68]
add rcx, 0xffffffffffffffe1
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0xa8], rbx
mov dword [rsp + 0xb0], 0xc
lea rax, [rdi + rcx]
mov qword [rsp + 0xc8], rax
mov dword [rsp + 0xd0], 0x10
mov dword [rsp + 0x48], esi
lea rax, [rsp + 0x100]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0xa0]
mov r8d, ecx
mov rdx, rdi
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.bcrypt.dll_BCryptDecrypt]
mov dword [rsp + 0x50], eax
test eax, eax
jns 0x14000376e
lea rdx, str.BCryptDecrypt__1__failed_with_status:
lea rcx, [0x1401ab090]
call fcn.140008250
mov edx, dword [rsp + 0x50]
mov rcx, rax
call fcn.140004ff0
mov rcx, rax
call fcn.140008500
xorps xmm0, xmm0
movups xmmword [r13], xmm0
mov qword [r13 + 0x10], rsi
mov qword [r13 + 0x18], rsi
xor r8d, r8d
lea rdx, [0x14017827d]
mov rcx, r13
call fcn.140008cb0
nop
test rbx, rbx
je 0x1400036e4
sub r15, rbx
cmp r15, 0x1000
jb 0x1400036d8
add r15, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x140003af8
mov rbx, rcx
mov rdx, r15
mov rcx, rbx
call fcn.1401391f0
nop
test rdi, rdi
je 0x14000371d
sub r14, rdi
mov rax, rdi
cmp r14, 0x1000
jb 0x140003711
add r14, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003afe
mov rdx, r14
mov rcx, rdi
call fcn.1401391f0
nop
mov rcx, qword [r12]
test rcx, rcx
je 0x140003766
mov rdx, qword [r12 + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x140003753
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003b04
mov rcx, r8
call fcn.1401391f0
mov qword [r12], rsi
mov qword [r12 + 8], rsi
mov qword [r12 + 0x10], rsi
mov rax, r13
jmp 0x140003abd
mov ecx, dword [rsp + 0x100]
mov edx, ecx
test ecx, ecx
je 0x14000379c
lea rcx, [rsp + 0x108]
call fcn.14000b550
mov ecx, dword [rsp + 0x100]
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x48], esi
lea rax, [rsp + 0x100]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], ecx
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0xa0]
mov r8d, dword [rsp + 0x60]
mov rdx, rdi
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.bcrypt.dll_BCryptDecrypt]
mov dword [rsp + 0x50], eax
test eax, eax
jns 0x14000393e
lea rdx, str.BCrypt_Decrypt__2__failed_with_status:
lea rcx, [0x1401ab090]
call fcn.140008250
mov edx, dword [rsp + 0x50]
mov rcx, rax
call fcn.140004ff0
mov rcx, rax
call fcn.140008500
xorps xmm0, xmm0
movups xmmword [r13], xmm0
mov qword [r13 + 0x10], rsi
mov qword [r13 + 0x18], rsi
xor r8d, r8d
lea rdx, [0x14017827d]
mov rcx, r13
call fcn.140008cb0
nop
test rbx, rbx
je 0x140003874
sub r15, rbx
cmp r15, 0x1000
jb 0x140003868
add r15, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x140003af8
mov rbx, rcx
mov rdx, r15
mov rcx, rbx
call fcn.1401391f0
nop
mov rcx, qword [rsp + 0x108]
test rcx, rcx
je 0x1400038b4
mov rdx, qword [rsp + 0x58]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400038ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003af2
call fcn.1401391f0
nop
test rdi, rdi
je 0x1400038ed
sub r14, rdi
mov rax, rdi
cmp r14, 0x1000
jb 0x1400038e1
add r14, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003afe
mov rdx, r14
mov rcx, rdi
call fcn.1401391f0
nop
mov rcx, qword [r12]
test rcx, rcx
je 0x140003936
mov rdx, qword [r12 + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x140003923
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003b04
mov rcx, r8
call fcn.1401391f0
mov qword [r12], rsi
mov qword [r12 + 8], rsi
mov qword [r12 + 0x10], rsi
mov rax, r13
jmp 0x140003abd
xor edx, edx
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.bcrypt.dll_BCryptCloseAlgorithmProvider]
mov r8, qword [rsp + 0x110]
mov rdx, qword [rsp + 0x108]
mov rcx, r13
call fcn.140008590
nop
test rbx, rbx
je 0x1400039a0
sub r15, rbx
cmp r15, 0x1000
jb 0x140003994
add r15, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x140003af8
mov rbx, rcx
mov rdx, r15
mov rcx, rbx
call fcn.1401391f0
nop
mov rcx, qword [rsp + 0x108]
test rcx, rcx
je 0x1400039e0
mov rdx, qword [rsp + 0x58]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400039da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003af2
call fcn.1401391f0
nop
test rdi, rdi
je 0x140003a19
sub r14, rdi
mov rax, rdi
cmp r14, 0x1000
jb 0x140003a0d
add r14, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003afe
mov rdx, r14
mov rcx, rdi
call fcn.1401391f0
nop
mov rcx, qword [r12]
test rcx, rcx
je 0x140003a62
mov rdx, qword [r12 + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x140003a4f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003b04
mov rcx, r8
call fcn.1401391f0
mov qword [r12], rsi
mov qword [r12 + 8], rsi
mov qword [r12 + 0x10], rsi
mov rax, r13
jmp 0x140003abd
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.1401391d0
add rsp, 0x160
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.14000aa10
nop
call fcn.140001c60
nop
call fcn.140143b1c
nop
call fcn.140143b1c
nop
call fcn.140143b1c
nop
call fcn.140143b1c
int3