Function at 0x180007760
Capabilities:
Decode data using base64 via winapi
Encrypt or decrypt via wincrypt

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rbp
mov qword [rax + 0x18], r8
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x60
xor ebp, ebp
mov r12d, edx
mov rdi, 0xffffffffffffffff
mov dword [rax + 0x28], ebp
mov rdx, rdi
mov rbx, r9
mov r15, rcx
inc rdx
cmp word [r9 + rdx*2], bp
jne 0x180007793
xor r9d, r9d
mov qword [rsp + 0x30], rbp
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x28], rbp
mov rcx, rbx
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 1]
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
mov ecx, dword [rsp + 0xb0]
call fcn.180011270
mov rsi, rax
inc rdi
cmp word [rbx + rdi*2], bp
jne 0x1800077d3
mov qword [rsp + 0x30], rbp
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x28], rbp
mov rdx, rdi
mov r9, rsi
mov qword [rsp + 0x20], rax
mov r8d, 1
mov rcx, rbx
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
mov edi, dword [rsp + 0xb0]
mov ecx, edi
call fcn.180011270
mov r8d, edi
xor edx, edx
mov rcx, rax
mov r13, rax
call fcn.180022f00
mov byte [r13], bpl
mov rdx, rsi
mov r8d, dword [rsp + 0xb0]
mov rcx, r13
call fcn.180022840
mov edx, 1
mov rcx, rsi
call fcn.180010c10
mov eax, dword [rsp + 0xb0]
lea r8, [rsp + 0x40]
mov r9, r13
mov dword [rsp + 0x20], eax
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x48], rbp
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x40], rbp
call fcn.1800074e0
test al, al
je 0x1800079c5
mov rbx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x40], r12d
mov rcx, rbx
mov qword [rsp + 0x20], rbp
lea r8d, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x18000796f
mov ecx, dword [rsp + 0x40]
call fcn.18002c3dc
mov rsi, rax
test rax, rax
je 0x18000796f
mov rdi, rax
mov qword [rsp + 0x90], r14
mov r14d, dword [rsp + 0x40]
xor eax, eax
mov ecx, r14d
rep stosb byte [rdi], al
test r12d, r12d
je 0x180007935
test r15, r15
je 0x180007901
cmp r14, r12
jb 0x180007901
mov r8, r12
mov rdx, r15
mov rcx, rsi
call fcn.180022840
jmp 0x180007935
mov r8, r14
xor edx, edx
mov rcx, rsi
call fcn.180022f00
test r15, r15
jne 0x180007920
call fcn.18002cb90
mov dword [rax], reloc.WS2_32.dll_shutdown
jmp 0x180007930
cmp r14, r12
jae 0x180007935
call fcn.18002cb90
mov dword [rax], 0x22
call fcn.18002c344
xor r9d, r9d
mov dword [rsp + 0x40], r12d
lea rax, [rsp + 0x40]
xor edx, edx
mov qword [rsp + 0x28], rax
mov rcx, rbx
mov qword [rsp + 0x20], rsi
lea r8d, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov r14, qword [rsp + 0x90]
test eax, eax
jne 0x180007992
mov rcx, rsi
call fcn.18002ba04
test rbx, rbx
je 0x18000797d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [0x18006abc8]
lea rdx, str.log:CymMimi::WinAES256EncryptFile::Deccrypt___Failed_n
call fcn.1800022f0
jmp 0x1800079a1
mov rax, qword [rsp + 0xa0]
mov ebp, dword [rsp + 0x40]
mov qword [rax], rsi
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1800079b1
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1800079d8
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x1800079d8
mov rcx, qword [0x18006abc8]
lea rdx, str.log:CymMimi::WinAES256EncryptFile::EncryptFiles__::CryptoInit_failed__n
call fcn.1800022f0
xor edx, edx
mov rcx, r13
call fcn.180010c10
lea r11, [rsp + 0x60]
mov eax, ebp
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret