Function at 0x1800207e0
Capabilities:
Encrypt or decrypt via wincrypt
Get file size
Read file on windows

Disassembly:
push rbx
push r13
push r14
push r15
sub rsp, 0x58
xor r15d, r15d
test rdx, rdx
mov r13, r8
mov rax, rdx
mov r14, rcx
je 0x180020807
test r8, r8
je 0x180020807
mov ebx, r15d
jmp 0x18002080c
mov ebx, 0x80070057
test ebx, ebx
mov dword [rsp + 0x88], r15d
js 0x180020a69
cmp qword [rcx + 8], r15
jne 0x180020833
mov eax, 0x80070005
add rsp, 0x58
pop r15
pop r14
pop r13
pop rbx
ret
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, rax
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov r12, rax
jne 0x180020880
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x180020880
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x180020a47
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x50], rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov esi, eax
jne 0x180020966
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x1800208b8
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x180020a42
mov rdx, rsi
mov ecx, 2
mov qword [rsp + 0x48], rdi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
mov rdi, rax
jne 0x1800208f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x1800208f0
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x180020a25
mov rcx, rdi
mov qword [rsp + 0x80], rbp
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
mov rbp, rax
jne 0x180020926
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x180020926
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x1800209d6
lea r9, [rsp + 0x98]
mov r8d, esi
mov rdx, rbp
mov rcx, r12
mov dword [rsp + 0x98], r15d
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180020978
cmp dword [rsp + 0x98], esi
je 0x18002098d
mov ebx, 0x8000ffff
jmp 0x1800209d6
test eax, eax
jne 0x1800208b8
mov ebx, 0x800710d2
jmp 0x180020a42
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x18002098d
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x1800209d6
mov rcx, qword [r14 + 8]
xor r9d, r9d
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
lea r8d, [r9 + 1]
xor edx, edx
mov dword [rsp + 0x88], esi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x1800209d6
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x1800209d6
movzx ebx, ax
or ebx, 0x80070000
test rbp, rbp
mov rbp, qword [rsp + 0x80]
je 0x1800209ec
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
test ebx, ebx
js 0x180020a25
mov edx, dword [rsp + 0x88]
mov r8d, 2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalReAlloc]
test rax, rax
je 0x180020a10
mov rdi, rax
jmp 0x180020a25
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x180020a25
movzx ebx, ax
or ebx, 0x80070000
test rdi, rdi
je 0x180020a3d
test ebx, ebx
js 0x180020a34
mov qword [r13], rdi
jmp 0x180020a3d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
cmp r12, 0xffffffffffffffff
je 0x180020a56
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov r12, qword [rsp + 0x40]
add rsp, 0x58
pop r15
pop r14
pop r13
pop rbx
ret
mov eax, ebx
add rsp, 0x58
pop r15
pop r14
pop r13
pop rbx
ret