Function at 0x180014390
Capabilities:
Create new key via cryptacquirecontext
Encode data using xor
Hash data with crc32
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xd40
mov rax, qword [0x18010f050]
xor rax, rsp
mov qword [rsp + 0xd20], rax
mov rbp, r8
mov rsi, rdx
mov rdi, rcx
test r8, r8
je 0x1800147f1
cmp word [r8], 0
je 0x1800147f1
cmp qword [rcx + 0x70], 0xffffffffffffffff
jne 0x1800143db
mov eax, 0x80004005
jmp 0x180014616
lea rcx, [rsp + 0xb21]
xor edx, edx
mov r8d, 0x1ff
mov qword [rsp + 0xd38], rbx
mov byte [rsp + 0xb20], 0
mov qword [rsp + 0xd30], r12
call fcn.1800795c0
lea rcx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0xb20]
mov rcx, rdi
call fcn.180014240
lea rcx, [rdi + 0x40]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
js 0x1800147e0
cmp ebx, 1
je 0x1800147e0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test rsi, rsi
je 0x1800147e7
lea r9, [rsp + 0xb40]
lea rcx, [rsp + 0x560]
mov r8d, eax
mov rdx, rsi
call fcn.180017be0
test eax, eax
je 0x1800147e7
lea rdx, [rsp + 0xb80]
lea rcx, [rsp + 0x560]
or r9, 0xffffffffffffffff
mov r8d, 0x1a0
call fcn.180017fb0
cmp dword [rsp + 0xb80], 0x10211a41
jne 0x1800147e7
lea rcx, [rsp + 0xb90]
mov edx, 0x40
call fcn.180018170
cmp dword [rsp + 0xb84], eax
jne 0x1800147e7
or r9, 0xffffffffffffffff
lea rdx, [rsp + 0xb30]
lea rcx, [rsp + 0x560]
lea r8d, [r9 + 0x11]
call fcn.180017fb0
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x280
call fcn.1800795c0
xor ebx, ebx
lea rcx, [rsp + 0x550]
lea r9d, [rbx + 1]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x540], ebx
mov dword [rsp + 0x544], ebx
mov dword [rsp + 0x548], ebx
mov qword [rsp + 0x550], rbx
mov dword [rsp + 0x558], 1
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x18001456d
lea r9d, [rbx + 1]
lea rcx, [rsp + 0x550]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 8
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov ecx, dword [rsp + 0x558]
test eax, eax
cmove ecx, ebx
mov dword [rsp + 0x558], ecx
lea rcx, [rsp + 0x40]
call fcn.1800184e0
lea rcx, [rsp + 0x40]
call fcn.180018b70
lea rcx, [rsp + 0x40]
call fcn.1800184e0
lea rdx, [rsp + 0xb40]
lea rcx, [rsp + 0x40]
mov r8d, 0x40
mov dword [rsp + 0x540], 1
call fcn.1800181f0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r9, [rsp + 0xb40]
lea rcx, [rsp + 0x840]
mov r8d, eax
mov rdx, rbp
call fcn.180017be0
test eax, eax
jne 0x180014631
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x280
call fcn.1800795c0
cmp dword [rsp + 0x558], ebx
je 0x180014601
mov rcx, qword [rsp + 0x550]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 0x80004005
mov rbx, qword [rsp + 0xd38]
mov r12, qword [rsp + 0xd30]
mov rcx, qword [rsp + 0xd20]
xor rcx, rsp
call fcn.180076a70
add rsp, 0xd40
pop rdi
pop rsi
pop rbp
ret
or r9, 0xffffffffffffffff
lea rdx, [rsp + 0xb30]
lea rcx, [rsp + 0x840]
lea r8d, [r9 + 0x11]
call fcn.180017df0
lea rdx, [rsp + 0xb80]
lea rcx, [rsp + 0x840]
or r9, 0xffffffffffffffff
mov r8d, 0x1a0
call fcn.180017df0
mov dword [rsp + 0xb2c], ebx
mov r9d, 0x200
lea r10, [rsp + 0xb20]
or r8d, 0xffffffff
lea r11, [0x180115370]
nop dword [rax]
movzx ecx, byte [r10]
mov eax, r8d
inc r10
xor rcx, rax
shr eax, 8
movzx edx, cl
mov r8d, dword [r11 + rdx*4]
xor r8d, eax
sub r9d, 1
jne 0x180014690
not r8d
lea rcx, [rdi + 0x40]
mov dword [rsp + 0xb2c], r8d
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rsi, qword [rdi + 0x70]
cmp rsi, 0xffffffffffffffff
je 0x1800147a5
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x1800146f5
call fcn.180003220
mov ebx, eax
jmp 0x1800147aa
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0xb20]
mov r8d, 0x200
mov rcx, rsi
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1800147aa
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6f8
je 0x180014749
cmp eax, 0x3e6
je 0x180014749
test eax, eax
jg 0x18001473e
mov ebx, eax
jmp 0x1800147aa
movzx ebx, ax
or ebx, 0x80070000
jmp 0x1800147aa
lea rcx, [rdi + 0x10]
mov edx, 0x200
call fcn.180003e00
test eax, eax
js 0x1800147a1
cmp eax, 1
je 0x1800147a1
mov rcx, qword [rdi + 0x10]
lea rdx, [rsp + 0xb20]
mov r8d, 0x200
call fcn.1800785c0
mov rdx, qword [rdi + 0x10]
lea r9, [rsp + 0x30]
mov r8d, 0x200
mov rcx, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1800147aa
call fcn.180003220
mov ebx, eax
jmp 0x1800147aa
mov ebx, eax
jmp 0x1800147aa
mov ebx, 0x80070057
lea rcx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x280
call fcn.1800795c0
cmp dword [rsp + 0x558], 0
je 0x1800147e0
mov rcx, qword [rsp + 0x550]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, ebx
jmp 0x180014606
mov eax, 0xe0037002
jmp 0x180014606
mov eax, 0x80070057
jmp 0x180014616