Function at 0x18001e0f0
Capabilities:
Encrypt or decrypt via wincrypt
Get file size
Read file on windows

Disassembly:
push rbx
push r13
push r14
push r15
sub rsp, 0x58
xor r15d, r15d
test rdx, rdx
mov r13, r8
mov rax, rdx
mov r14, rcx
je 0x18001e117
test r8, r8
je 0x18001e117
mov ebx, r15d
jmp 0x18001e11c
mov ebx, 0x80070057
test ebx, ebx
mov dword [rsp + 0x88], r15d
js 0x18001e379
cmp qword [rcx + 8], r15
jne 0x18001e143
mov eax, 0x80070005
add rsp, 0x58
pop r15
pop r14
pop r13
pop rbx
ret
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, rax
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov r12, rax
jne 0x18001e190
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x18001e190
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x18001e357
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x50], rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov esi, eax
jne 0x18001e276
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x18001e1c8
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x18001e352
mov rdx, rsi
mov ecx, 2
mov qword [rsp + 0x48], rdi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
mov rdi, rax
jne 0x18001e200
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x18001e200
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x18001e335
mov rcx, rdi
mov qword [rsp + 0x80], rbp
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
mov rbp, rax
jne 0x18001e236
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x18001e236
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x18001e2e6
lea r9, [rsp + 0x98]
mov r8d, esi
mov rdx, rbp
mov rcx, r12
mov dword [rsp + 0x98], r15d
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18001e288
cmp dword [rsp + 0x98], esi
je 0x18001e29d
mov ebx, 0x8000ffff
jmp 0x18001e2e6
test eax, eax
jne 0x18001e1c8
mov ebx, 0x800710d2
jmp 0x18001e352
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x18001e29d
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x18001e2e6
mov rcx, qword [r14 + 8]
xor r9d, r9d
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
lea r8d, [r9 + 1]
xor edx, edx
mov dword [rsp + 0x88], esi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x18001e2e6
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x18001e2e6
movzx ebx, ax
or ebx, 0x80070000
test rbp, rbp
mov rbp, qword [rsp + 0x80]
je 0x18001e2fc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
test ebx, ebx
js 0x18001e335
mov edx, dword [rsp + 0x88]
mov r8d, 2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalReAlloc]
test rax, rax
je 0x18001e320
mov rdi, rax
jmp 0x18001e335
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x18001e335
movzx ebx, ax
or ebx, 0x80070000
test rdi, rdi
je 0x18001e34d
test ebx, ebx
js 0x18001e344
mov qword [r13], rdi
jmp 0x18001e34d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
cmp r12, 0xffffffffffffffff
je 0x18001e366
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov r12, qword [rsp + 0x40]
add rsp, 0x58
pop r15
pop r14
pop r13
pop rbx
ret
mov eax, ebx
add rsp, 0x58
pop r15
pop r14
pop r13
pop rbx
ret