Function at 0x180039b80
Capabilities:
Encrypt or decrypt via wincrypt
Get file size
Read file on windows

Disassembly:
push rbx
push r13
push r14
push r15
sub rsp, 0x58
xor r15d, r15d
test rdx, rdx
mov r13, r8
mov rax, rdx
mov r14, rcx
je 0x180039ba7
test r8, r8
je 0x180039ba7
mov ebx, r15d
jmp 0x180039bac
mov ebx, 0x80070057
test ebx, ebx
mov dword [rsp + 0x88], r15d
js 0x180039e09
cmp qword [rcx + 8], r15
jne 0x180039bd3
mov eax, 0x80070005
add rsp, 0x58
pop r15
pop r14
pop r13
pop rbx
ret
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, rax
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov r12, rax
jne 0x180039c20
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x180039c20
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x180039de7
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x50], rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov esi, eax
jne 0x180039d06
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x180039c58
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x180039de2
mov rdx, rsi
mov ecx, 2
mov qword [rsp + 0x48], rdi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
mov rdi, rax
jne 0x180039c90
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x180039c90
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x180039dc5
mov rcx, rdi
mov qword [rsp + 0x80], rbp
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
mov rbp, rax
jne 0x180039cc6
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x180039cc6
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x180039d76
lea r9, [rsp + 0x98]
mov r8d, esi
mov rdx, rbp
mov rcx, r12
mov dword [rsp + 0x98], r15d
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180039d18
cmp dword [rsp + 0x98], esi
je 0x180039d2d
mov ebx, 0x8000ffff
jmp 0x180039d76
test eax, eax
jne 0x180039c58
mov ebx, 0x800710d2
jmp 0x180039de2
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x180039d2d
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x180039d76
mov rcx, qword [r14 + 8]
xor r9d, r9d
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
lea r8d, [r9 + 1]
xor edx, edx
mov dword [rsp + 0x88], esi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x180039d76
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x180039d76
movzx ebx, ax
or ebx, 0x80070000
test rbp, rbp
mov rbp, qword [rsp + 0x80]
je 0x180039d8c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
test ebx, ebx
js 0x180039dc5
mov edx, dword [rsp + 0x88]
mov r8d, 2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalReAlloc]
test rax, rax
je 0x180039db0
mov rdi, rax
jmp 0x180039dc5
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x180039dc5
movzx ebx, ax
or ebx, 0x80070000
test rdi, rdi
je 0x180039ddd
test ebx, ebx
js 0x180039dd4
mov qword [r13], rdi
jmp 0x180039ddd
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
cmp r12, 0xffffffffffffffff
je 0x180039df6
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov r12, qword [rsp + 0x40]
add rsp, 0x58
pop r15
pop r14
pop r13
pop rbx
ret
mov eax, ebx
add rsp, 0x58
pop r15
pop r14
pop r13
pop rbx
ret