Function at 0x180017ec0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x90
xor eax, eax
mov byte [rsp + 0x68], 0
mov esi, r9d
mov r13d, ecx
mov r14, r8
mov rbx, rdx
mov byte [rsp + 0x58], al
mov qword [r11 - 0x4f], rax
lea r9d, [rax + 0x18]
lea rcx, [r11 - 0x58]
xor r8d, r8d
xor edx, edx
mov qword [r11 - 0x3f], rax
mov qword [r11 - 0x37], rax
mov qword [r11 - 0x2f], rax
mov word [r11 - 0x27], ax
mov byte [r11 - 0x25], al
mov dword [rsp + 0x61], eax
mov word [rsp + 0x65], ax
mov byte [rsp + 0x67], al
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1800180ce
mov edi, 0x10
lea rcx, [rsp + 0x74]
mov rdx, rbx
mov r8, rdi
call sub.ntdll.dll_memcpy
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
lea ebx, [rdi - 8]
lea r8d, [rdi + 0xc]
lea rdx, [rsp + 0x68]
xor r9d, r9d
mov dword [rsp + 0x70], edi
mov byte [rsp + 0x69], 2
mov dword [rsp + 0x6c], 0x660e
mov byte [rsp + 0x68], bl
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x1800180b7
mov rcx, qword [rsp + 0x48]
lea r8, [rsp + 0x58]
lea edx, [rdi - 0xf]
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x1800180a2
lea ecx, [rsi + 0xf]
and ecx, 0xfffffff0
test r13d, r13d
je 0x180017fca
cmp ecx, esi
jne 0x180017fca
add ecx, edi
call fcn.1800163cc
mov rdi, rax
test rax, rax
je 0x1800180aa
xor ebp, ebp
mov r12, rax
xor ebx, ebx
mov eax, 0x10
mov ecx, esi
mov rdx, r14
cmp esi, eax
cmova ecx, eax
mov dword [rsp + 0x40], ecx
mov r8d, ecx
mov rcx, r12
call sub.ntdll.dll_memcpy
mov eax, dword [rsp + 0x40]
sub esi, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
add r14, rax
xor r8d, r8d
lea rax, [rsp + 0x40]
test r13d, r13d
je 0x180018042
test esi, esi
mov dword [rsp + 0x30], 0x20
mov qword [rsp + 0x28], rax
sete r8b
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
jmp 0x18001805d
test esi, esi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
sete r8b
xor r9d, r9d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x180018075
mov eax, dword [rsp + 0x40]
add ebp, dword [rsp + 0x40]
add r12, rax
test esi, esi
je 0x180018081
jmp 0x180017fe2
call qword [sym.imp.kERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jne 0x180018098
mov rax, qword [rsp + 0xd0]
mov qword [rax], rdi
mov rax, qword [rsp + 0xd8]
mov dword [rax], ebp
jmp 0x1800180aa
mov rcx, rdi
call fcn.1800258e4
jmp 0x1800180aa
call qword [sym.imp.kERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
jmp 0x1800180bf
call qword [sym.imp.kERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x1800180d6
call qword [sym.imp.kERNEL32.dll_GetLastError]
mov ebx, eax
lea r11, [rsp + 0x90]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret