Function at 0x10029fc0
Capabilities:
Encrypt or decrypt via wincrypt
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x100b9040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov ecx, dword [0x100bcc98]
call fcn.1001ece0
movzx eax, al
test eax, eax
jne 0x1002a263
push 0x100bcc9c
mov ecx, dword [0x100bcc98]
push ecx
call fcn.10028b70
add esp, 8
movzx edx, al
test edx, edx
jne 0x1002a263
movzx eax, byte [ebp - 0x21]
push eax
push 0x100a58b4
lea ecx, [ebp - 0x50]
call fcn.1002a680
mov ecx, eax
call fcn.10009280
mov dword [ebp - 0x34], eax
push 0
mov ecx, dword [ebp - 0x34]
push ecx
mov ecx, dword [0x100bcc98]
call fcn.1002a630
cmp eax, 0xffffffff
je 0x1002a263
mov edx, dword [0x100bb5c8]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
push eax
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x48], esp
movzx ecx, byte [ebp - 0x22]
push ecx
push 0x100a58bc
lea ecx, [ebp - 0x84]
call fcn.1001e9b0
mov ecx, eax
call fcn.1001d680
push eax
mov ecx, esi
call fcn.10013290
lea edx, [ebp - 0x68]
push edx
call fcn.100122c0
add esp, 0x20
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
push ecx
mov ecx, 0x100bcc9c
call fcn.10022360
lea ecx, [ebp - 0x68]
call fcn.100128f0
nop
mov dword [ebp - 0x18], 0
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
mov ecx, dword [0x100bcc98]
call fcn.10011d10
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x1c], eax
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
mov ecx, 0x100bcc9c
call fcn.10011d10
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0xffffffff
je 0x1002a22c
cmp dword [ebp - 0x20], 0xffffffff
je 0x1002a22c
mov byte [ebp - 0x11], 0
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [ebp - 0xc]
cdq
mov cl, 0x20
call fcn.1009f280
or eax, dword [ebp - 0x10]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
and ecx, 0x80000001
jns 0x1002a13f
dec ecx
or ecx, 0xfffffffe
inc ecx
test ecx, ecx
jne 0x1002a14c
mov dword [ebp - 0x2c], 0x20
jmp 0x1002a153
mov dword [ebp - 0x2c], 0x1f
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x1002a22c
push 0
lea edx, [ebp - 8]
push edx
push 4
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1002a1ac
push 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov eax, dword [ebp - 0x30]
push eax
push 0
mov ecx, dword [ebp - 0x18]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 8], 0
push 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1002a224
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x28]
jae 0x1002a1ed
mov byte [ebp - 0x11], 1
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0x18]
push edx
push 0
push 1
push 0
mov eax, dword [0x100bb5cc]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x1002a224
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
nop
movzx edx, byte [ebp - 0x11]
test edx, edx
je 0x1002a1c5
cmp dword [ebp - 0x18], 0
je 0x1002a23f
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
cmp dword [ebp - 0x1c], 0
je 0x1002a250
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp dword [ebp - 0x20], 0
je 0x1002a261
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x1002a274
mov eax, dword [0x100bcc98]
push eax
mov ecx, 0x100bcc9c
call fcn.1001c6f0
nop
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1009dd14
mov esp, ebp
pop ebp
ret