Add CngLargeDecryption signature for large payloads

[kevross33]

Sample bcff5812c1bdd518470f91a0b2e5c1e8ed28ba96c58e28953c1e5d9b6cfe9db0

[gemini-code-assist]

Code Review

This pull request introduces a new signature class, CngLargeDecryption, to detect when Windows Cryptography APIs (BCryptDecrypt or CryptDecrypt) are used to decrypt payloads larger than 50KB. Feedback on the changes points out a potential UnboundLocalError if size_raw is referenced without being initialized, suggesting it be explicitly initialized to None before the conditional blocks.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.