Function at 0x18000c1f0
Capabilities:
Encrypt or decrypt via wincrypt
Get file size
Read file on windows

Disassembly:
push rbx
push r13
push r14
push r15
sub rsp, 0x58
xor r15d, r15d
test rdx, rdx
mov r13, r8
mov rax, rdx
mov r14, rcx
je 0x18000c217
test r8, r8
je 0x18000c217
mov ebx, r15d
jmp 0x18000c21c
mov ebx, 0x80070057
test ebx, ebx
mov dword [rsp + 0x88], r15d
js 0x18000c479
cmp qword [rcx + 8], r15
jne 0x18000c243
mov eax, 0x80070005
add rsp, 0x58
pop r15
pop r14
pop r13
pop rbx
ret
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, rax
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov r12, rax
jne 0x18000c290
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x18000c290
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x18000c457
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x50], rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov esi, eax
jne 0x18000c376
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x18000c2c8
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x18000c452
mov rdx, rsi
mov ecx, 2
mov qword [rsp + 0x48], rdi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
mov rdi, rax
jne 0x18000c300
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x18000c300
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x18000c435
mov rcx, rdi
mov qword [rsp + 0x80], rbp
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
mov rbp, rax
jne 0x18000c336
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x18000c336
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x18000c3e6
lea r9, [rsp + 0x98]
mov r8d, esi
mov rdx, rbp
mov rcx, r12
mov dword [rsp + 0x98], r15d
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18000c388
cmp dword [rsp + 0x98], esi
je 0x18000c39d
mov ebx, 0x8000ffff
jmp 0x18000c3e6
test eax, eax
jne 0x18000c2c8
mov ebx, 0x800710d2
jmp 0x18000c452
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x18000c39d
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x18000c3e6
mov rcx, qword [r14 + 8]
xor r9d, r9d
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
lea r8d, [r9 + 1]
xor edx, edx
mov dword [rsp + 0x88], esi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x18000c3e6
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x18000c3e6
movzx ebx, ax
or ebx, 0x80070000
test rbp, rbp
mov rbp, qword [rsp + 0x80]
je 0x18000c3fc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
test ebx, ebx
js 0x18000c435
mov edx, dword [rsp + 0x88]
mov r8d, 2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalReAlloc]
test rax, rax
je 0x18000c420
mov rdi, rax
jmp 0x18000c435
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x18000c435
movzx ebx, ax
or ebx, 0x80070000
test rdi, rdi
je 0x18000c44d
test ebx, ebx
js 0x18000c444
mov qword [r13], rdi
jmp 0x18000c44d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
cmp r12, 0xffffffffffffffff
je 0x18000c466
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov r12, qword [rsp + 0x40]
add rsp, 0x58
pop r15
pop r14
pop r13
pop rbx
ret
mov eax, ebx
add rsp, 0x58
pop r15
pop r14
pop r13
pop rbx
ret