Function at 0x180021090
Capabilities:
Encrypt or decrypt via wincrypt
Get file size
Read file on windows

Disassembly:
push rbx
push r13
push r14
push r15
sub rsp, 0x58
xor r15d, r15d
test rdx, rdx
mov r13, r8
mov rax, rdx
mov r14, rcx
je 0x1800210b7
test r8, r8
je 0x1800210b7
mov ebx, r15d
jmp 0x1800210bc
mov ebx, 0x80070057
test ebx, ebx
mov dword [rsp + 0x88], r15d
js 0x180021319
cmp qword [rcx + 8], r15
jne 0x1800210e3
mov eax, 0x80070005
add rsp, 0x58
pop r15
pop r14
pop r13
pop rbx
ret
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, rax
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov r12, rax
jne 0x180021130
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x180021130
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x1800212f7
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x50], rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov esi, eax
jne 0x180021216
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x180021168
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x1800212f2
mov rdx, rsi
mov ecx, 2
mov qword [rsp + 0x48], rdi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
mov rdi, rax
jne 0x1800211a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x1800211a0
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x1800212d5
mov rcx, rdi
mov qword [rsp + 0x80], rbp
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
mov rbp, rax
jne 0x1800211d6
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x1800211d6
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x180021286
lea r9, [rsp + 0x98]
mov r8d, esi
mov rdx, rbp
mov rcx, r12
mov dword [rsp + 0x98], r15d
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180021228
cmp dword [rsp + 0x98], esi
je 0x18002123d
mov ebx, 0x8000ffff
jmp 0x180021286
test eax, eax
jne 0x180021168
mov ebx, 0x800710d2
jmp 0x1800212f2
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x18002123d
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x180021286
mov rcx, qword [r14 + 8]
xor r9d, r9d
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
lea r8d, [r9 + 1]
xor edx, edx
mov dword [rsp + 0x88], esi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x180021286
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x180021286
movzx ebx, ax
or ebx, 0x80070000
test rbp, rbp
mov rbp, qword [rsp + 0x80]
je 0x18002129c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
test ebx, ebx
js 0x1800212d5
mov edx, dword [rsp + 0x88]
mov r8d, 2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalReAlloc]
test rax, rax
je 0x1800212c0
mov rdi, rax
jmp 0x1800212d5
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x1800212d5
movzx ebx, ax
or ebx, 0x80070000
test rdi, rdi
je 0x1800212ed
test ebx, ebx
js 0x1800212e4
mov qword [r13], rdi
jmp 0x1800212ed
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
cmp r12, 0xffffffffffffffff
je 0x180021306
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov r12, qword [rsp + 0x40]
add rsp, 0x58
pop r15
pop r14
pop r13
pop rbx
ret
mov eax, ebx
add rsp, 0x58
pop r15
pop r14
pop r13
pop rbx
ret