Function at 0x1400238c0
Capabilities:
Check if file exists
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt
Get file attributes
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x240]
sub rsp, 0x340
mov rax, qword [0x14015a038]
xor rax, rsp
mov qword [rbp + 0x230], rax
mov qword [rbp - 0x58], r8
mov qword [rbp - 0x60], rcx
xor bl, bl
mov byte [rsp + 0x31], bl
mov word [rbp + 0x20], dx
movups xmm0, xmmword [str.:lockxls.data]
movups xmmword [rbp + 0x22], xmm0
movsd xmm1, qword [0x1401361d0]
movsd qword [rbp + 0x32], xmm1
mov eax, dword [0x1401361d8]
mov dword [rbp + 0x3a], eax
movzx eax, word [0x1401361dc]
mov word [rbp + 0x3e], ax
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140024123
xor edi, edi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x20]
call fcn.140026660
test al, al
je 0x140024156
lea rcx, [rbp - 0x50]
call fcn.1400373d0
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x38], rdi
mov r13, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rbp - 0x50]
test rbx, rbx
jne 0x140023a2e
mov dword [rsp + 0x20], 0xf0000008
lea r9d, [rdi + 1]
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x140023a2a
mov dword [rsp + 0x20], edi
lea r9d, [rdi + 1]
xor r8d, r8d
lea rdx, str.Spreadsheet_Tools
lea rcx, [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x140023a2a
mov dword [rsp + 0x20], 8
lea r9d, [rdi + 1]
xor r8d, r8d
lea rdx, str.Spreadsheet_Tools
lea rcx, [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x140023a2a
mov dword [rsp + 0x20], 0x20
lea r9d, [rdi + 1]
xor r8d, r8d
lea rdx, str.Spreadsheet_Tools
lea rcx, [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140023ae7
mov rbx, qword [rbp - 0x50]
mov edi, dword [rbp - 0x38]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8003
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140023ae5
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 0x10
cmovae rdx, qword [rbp - 0x48]
xor r9d, r9d
mov r8d, edi
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x140023ada
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, qword [rsp + 0x38]
mov edx, 0x6603
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x140023ada
cmp rsi, r13
je 0x140023acf
mov rax, r13
sub rax, rsi
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
xor edi, edi
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x140023b22
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023b1d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024163
call fcn.14009b510
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x78], xmm0
mov rax, rdi
mov qword [rsp + 0x48], rax
mov qword [rbp - 0x68], rax
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rdi
mov r15, r13
sub r15, rsi
mov r14, qword [rsp + 0x68]
lea rax, [r14 + 4]
cmp rax, r15
ja 0x140023b60
mov edi, dword [r14 + rsi]
mov r14, rax
mov qword [rsp + 0x68], rax
mov ebx, edi
test edi, edi
je 0x140023bb6
lea r8, [rsp + 0x30]
mov edx, ebx
lea rcx, [rbp - 0x78]
call fcn.140019c40
mov rax, qword [rbp - 0x68]
mov qword [rsp + 0x48], rax
test edi, edi
je 0x140023bb6
lea rcx, [r14 + rsi]
mov rdx, qword [rbp - 0x78]
mov r8d, 1
sub r8, rsi
lea rax, [r8 + rcx]
cmp rax, r15
ja 0x140023ba8
movzx eax, byte [rcx]
mov byte [rdx], al
inc r14
inc rcx
inc rdx
sub rbx, 1
jne 0x140023b94
mov qword [rsp + 0x68], r14
lea rcx, [rbp - 8]
call fcn.1400373d0
nop
mov r12, qword [rbp - 0x70]
sub r12, qword [rbp - 0x78]
lea edi, [r12 + 4]
mov ebx, r15d
sub ebx, edi
mov qword [rsp + 0x38], 0
cmp rsi, r13
je 0x140023d21
lea rcx, [rbp - 8]
call fcn.1400374d0
test eax, eax
je 0x140023ca3
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8003
mov rcx, qword [rbp - 8]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140023ca3
test ebx, ebx
cmove ebx, r15d
mov edx, edi
add rdx, rsi
xor r9d, r9d
mov r8d, ebx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x140023c91
mov dword [rsp + 0x40], reloc.WS2_32.dll_recv
lea r8, [rsp + 0x30]
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x70]
call fcn.140019c40
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r13, qword [rsp + 0x70]
mov r8, r13
mov edx, 2
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x140023c96
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x140023d26
mov r13, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x140023ca8
mov r13, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
mov rcx, rdi
sub rcx, r13
cmp rcx, 1
jbe 0x140023cc9
lea rdi, [r13 + 1]
mov qword [rsp + 0x78], rdi
mov byte [r13], reloc.OLEAUT32.dll_SafeArrayUnaccessData
jmp 0x140023d2b
jae 0x140023d1a
mov rax, qword [rbp - 0x80]
sub rax, r13
cmp rax, 1
jae 0x140023cfd
lea r8, [rsp + 0x30]
mov edx, 1
lea rcx, [rsp + 0x70]
call fcn.140019c40
mov rdi, qword [rsp + 0x78]
mov r13, qword [rsp + 0x70]
mov byte [r13], reloc.OLEAUT32.dll_SafeArrayUnaccessData
jmp 0x140023d2b
mov ebx, 1
sub rbx, rcx
mov r8, rbx
xor edx, edx
mov rcx, rdi
call fcn.14009e4c0
add rdi, rbx
mov qword [rsp + 0x78], rdi
mov byte [r13], reloc.OLEAUT32.dll_SafeArrayUnaccessData
jmp 0x140023d2b
mov r13, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
sub rdi, r13
mov rbx, qword [rbp - 0x78]
cmp rdi, r12
jne 0x140024025
mov r8, r12
mov rdx, rbx
mov rcx, r13
call fcn.14009ee60
test eax, eax
jne 0x140024025
xor r12d, r12d
mov eax, r12d
lea rcx, [r14 + 4]
cmp rcx, r15
ja 0x140023d69
mov eax, dword [r14 + rsi]
mov qword [rsp + 0x68], rcx
cmp eax, 1
sete r14b
mov byte [rsp + 0x30], r14b
dec eax
cmp eax, 1
ja 0x140024025
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], r12w
movzx r8d, r14b
lea rdx, [rbp - 0x28]
lea rcx, [rsp + 0x50]
call fcn.140033940
mov rax, qword [rbp - 0x58]
mov rcx, rax
cmp qword [rax + 0x18], 8
jb 0x140023db8
mov rcx, qword [rax]
lea r8, [rbp - 0x28]
mov rbx, qword [rbp - 0x28]
mov r15, qword [rbp - 0x10]
cmp r15, 8
cmovae r8, rbx
mov rdx, qword [rbp - 0x18]
cmp rdx, qword [rax + 0x10]
jne 0x140023fe1
test rdx, rdx
je 0x140023dfa
sub r8, rcx
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x140023fe1
add rcx, 2
sub rdx, 1
jne 0x140023de2
mov edi, r12d
mov dword [rsp + 0x40], r12d
mov rax, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
sub rax, rsi
mov rcx, qword [rsp + 0x68]
lea rdx, [rcx + 4]
cmp rdx, rax
ja 0x140023e29
mov edi, dword [rcx + rsi]
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x68], rdx
mov ebx, r12d
mov dword [rsp + 0x38], ebx
test edi, edi
jle 0x140023fa7
nop dword [rax + rax]
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 7
mov word [rbp - 0x50], r12w
movzx r8d, r14b
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x50]
call fcn.140033940
cmp qword [rbp - 0x40], 0
je 0x140023f5e
lea rdx, [rbp - 0x50]
mov rcx, qword [rbp - 0x60]
call fcn.140024c70
mov r12, rax
xor eax, eax
mov r14d, eax
mov r15, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
sub r15, rsi
mov rbx, qword [rsp + 0x68]
lea rcx, [rbx + 4]
cmp rcx, r15
ja 0x140023eae
mov r14d, dword [rbx + rsi]
mov rbx, rcx
mov qword [rsp + 0x68], rcx
mov edi, r14d
mov edx, r14d
mov rcx, r12
call fcn.140019e80
test r14d, r14d
je 0x140023efa
lea rcx, [rbx + rsi]
xor eax, eax
mov edx, eax
mov r9d, 1
sub r9, rsi
mov r8, qword [r12]
lea rax, [rcx + r9]
cmp rax, r15
ja 0x140023eec
movzx eax, byte [rcx]
mov byte [r8 + rdx], al
inc rbx
inc rcx
inc rdx
sub rdi, 1
jne 0x140023ed2
mov qword [rsp + 0x68], rbx
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x140023f3a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023f35
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024169
call fcn.14009b510
mov ebx, dword [rsp + 0x38]
inc ebx
mov dword [rsp + 0x38], ebx
mov edi, dword [rsp + 0x40]
cmp ebx, edi
movzx r14d, byte [rsp + 0x30]
mov r12d, 0
jl 0x140023e40
jmp 0x140023fa3
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x140023f9e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023f99
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024169
call fcn.14009b510
mov rsi, qword [rsp + 0x50]
mov r15, qword [rbp - 0x10]
cmp ebx, edi
jne 0x140023fb6
mov byte [rsp + 0x31], 1
mov rbx, qword [rbp - 0x28]
jmp 0x140023fe6
mov rdi, qword [rbp - 0x60]
mov rbx, qword [rdi]
mov r8, qword [rbx + 8]
mov rdx, rdi
mov rcx, rdi
call fcn.140025340
mov qword [rbx + 8], rbx
mov qword [rbx], rbx
mov qword [rbx + 0x10], rbx
mov qword [rdi + 8], r12
mov rbx, qword [rbp - 0x28]
jmp 0x140023fe6
mov rsi, qword [rsp + 0x50]
cmp r15, 8
jb 0x140024021
lea rdx, [r15*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140024019
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002416f
mov rcx, rbx
call fcn.14009b510
mov rbx, qword [rbp - 0x78]
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x140024060
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002405b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024175
call fcn.14009b510
movdqa xmm0, xmmword [0x14013a430]
movdqu xmmword [rbp + 0x10], xmm0
mov byte [rbp], 0
test r13, r13
je 0x1400240ab
mov rdx, qword [rbp - 0x80]
sub rdx, r13
mov rax, r13
cmp rdx, 0x1000
jb 0x1400240a2
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002417b
mov rcx, r13
call fcn.14009b510
nop
test rbx, rbx
je 0x1400240e8
mov rcx, qword [rsp + 0x48]
sub rcx, rbx
mov rax, rbx
cmp rcx, 0x1000
jb 0x1400240dd
add rcx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024181
mov rdx, rcx
mov rcx, rbx
call fcn.14009b510
movzx ebx, byte [rsp + 0x31]
test rsi, rsi
je 0x140024123
mov rdx, qword [rsp + 0x60]
sub rdx, rsi
mov rax, rsi
cmp rdx, 0x1000
jb 0x14002411b
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002415d
mov rcx, rsi
call fcn.14009b510
movzx eax, bl
mov rcx, qword [rbp + 0x230]
xor rcx, rsp
call fcn.14009b5b0
lea r11, [rsp + 0x340]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rsi, qword [rsp + 0x50]
jmp 0x1400240ed
call fcn.1400ac408
nop
call fcn.1400ac408
nop
call fcn.1400ac408
nop
call fcn.1400ac408
nop
call fcn.1400ac408
nop
call fcn.1400ac408
nop
call fcn.1400ac408
int3