Function at 0x1800023e0
Capabilities:
Allocate or change rwx memory
Create new key via cryptacquirecontext
Query environment variable
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0xb90
mov rax, qword [0x18001a2b0]
xor rax, rsp
mov qword [rsp + 0xb70], rax
mov r14, rcx
mov ecx, 0x1000
mov r15, rdx
call fcn.18000413c
xor edi, edi
mov rbx, rax
test rax, rax
jne 0x18000242c
lea rcx, str.Out_of_memory_n
call fcn.180003fd4
jmp 0x1800024e1
lea rcx, str.APPDATA
mov r8d, 0x1000
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
test eax, eax
jne 0x18000246d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
jne 0x1800024d9
lea rcx, str.Environment_variable_does_not_exist._n
call fcn.180003fd4
mov dword [0x18001bf40], edi
jmp 0x1800024d9
cmp esi, 0x1000
jbe 0x1800024cf
mov rdx, rsi
mov rcx, rbx
call fcn.1800053c8
mov rbx, rax
test rax, rax
jne 0x180002496
lea rcx, str.Out_of_memory_n
call fcn.180003fd4
jmp 0x1800024e1
lea rcx, str.APPDATA
mov r8d, esi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x1800024c3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.GetEnvironmentVariable_failed___d__n
mov edx, eax
call fcn.180003fd4
jmp 0x1800024d9
mov dword [0x18001bf40], 1
jmp 0x1800024d9
mov dword [0x18001bf40], 1
mov rcx, rbx
call fcn.1800040a8
lea rdx, [0x18001bcd0]
lea rcx, [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rcx, [rsp + 0x190]
mov edx, 0x2e
call fcn.180002bd0
mov rbx, rax
test rax, rax
je 0x1800028f6
mov byte [rax + 1], 0x64
mov byte [rax + 2], 0x62
lea rdx, [0x180014fa0]
lea rcx, [rsp + 0x70]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x70], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x180002574
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x180002574
lea rdx, [0x180014fa0]
lea rcx, [rsp + 0x70]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x20], 8
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x180002586
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov qword [rsp + 0xbd0], rbp
lea rdx, [0x180014f9c]
lea rcx, [rsp + 0x190]
mov qword [rsp + 0xb88], r12
mov byte [rbx + 3], dil
mov qword [rsp + 0xb80], r13
call fcn.1800053bc
mov rsi, rax
test rax, rax
je 0x1800028dc
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 2]
call fcn.1800051d4
mov rcx, rsi
call fcn.1800050b8
xor r8d, r8d
xor edx, edx
mov rcx, rsi
movsxd rbp, eax
call fcn.1800051d4
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
lea r11d, [rbp + 1]
lea r9d, [rcx + 0x40]
mov r8d, 0x3000
movsxd rdx, r11d
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r12, rax
test rax, rax
je 0x1800028dc
cmp ebp, 0x1000
jle 0x1800028dc
mov ecx, 0xf4240
call fcn.18000413c
mov rbx, rax
call fcn.1800040e8
mov rcx, rbx
call fcn.1800040a8
mov r9, rsi
mov r8d, 1
mov rdx, rbp
mov rcx, r12
mov r13, rbp
call fcn.180004ed4
mov rcx, rsi
call fcn.180004b40
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbx, r12
mov eax, edi
test ebp, ebp
jle 0x180002675
cmp byte [rbx], dil
jne 0x180002675
inc eax
inc rbx
cmp eax, ebp
jl 0x180002667
lea rax, [rsp + 0x78]
lea rcx, [rsp + 0x88]
xor r9d, r9d
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], edi
xor r8d, r8d
mov dl, 1
mov dword [rsp + 0x28], edi
mov byte [rsp + 0x88], dil
mov dword [rsp + 0x20], edi
mov byte [rsp + 0x89], dil
mov byte [rsp + 0x8a], dil
mov byte [rsp + 0x8b], dil
mov byte [rsp + 0x8c], dil
mov byte [rsp + 0x8d], 1
mov qword [rsp + 0x78], rdi
mov dword [rsp + 0x60], edi
mov qword [rsp + 0x68], rdi
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x18000277c
lea r8, [rsp + 0x68]
mov edx, 8
or rcx, 0xffffffffffffffff
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x18000277c
mov rcx, qword [rsp + 0x68]
xor r9d, r9d
lea rax, [rsp + 0x60]
lea edx, [r9 + 1]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov r11d, dword [rsp + 0x60]
cmp r11d, 0x400
ja 0x18000277c
mov rdx, r11
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x18000277c
mov r9d, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x84]
mov r8, rsi
mov edx, 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x18000278c
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x18000279c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbx
sub rax, r12
add rax, 0x1000
cmp rax, rbp
jl 0x1800027d5
mov r8, rbp
xor edx, edx
mov rcx, r12
mov qword [r14], rdi
call fcn.1800045f0
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x1800028de
lea rcx, [rsp + 0x90]
mov r8d, 0x10
mov rdx, rbx
call fcn.180002150
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
test rax, rax
je 0x180002838
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x18001bf38], rax
cmp rax, rsi
jne 0x180002818
xor ecx, ecx
call fcn.180004a24
int3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov qword [0x18001bf38], rax
cmp rax, rsi
je 0x180002838
mov ecx, 1
call fcn.180004a24
int3
mov eax, r12d
lea rsi, [rbx + 0x10]
lea rcx, [rsp + 0x90]
sub eax, ebx
mov r9, rsi
mov rdx, rsi
add ebp, eax
lea r8d, [rbp - 0x10]
call fcn.180001710
cmp byte [rsi], 0x53
jne 0x1800028bb
cmp byte [rbx + 0x11], 0x55
jne 0x1800028bb
lea rcx, [rsp + 0x2a0]
lea rdx, str.__xml_version_1.0__encoding_UTF_8____model_unit_millimeter__xml:lang_en_US__xmlns_http:__schemas.microsoft.com_208710___resources__object_id_0__type_model___mesh__vertices__vertex_x_0.000000__y_0.000000__z_10.000000_____vertex_x_0.000000__y_10.000000__z_10.000000_____vertex_x_0.000000__y_0.000000__z_0.000000_____vertex_x_0.000000__y_10.000000__z_0.000000_____vertex_x_10.000000__y_0.000000__z_10.000000_____vertex_x_10.000000__y_10.000000__z_10.000000_____vertex_x_10.000000__y_0.000000__z_0.000000_____vertex_x_10.000000__y_10.000000__z_0.000000______vertices__triangles__triangle_v1_0__v2_1__v3_2_____triangle_v1_2__v2_1__v3_3_____triangle_v1_0__v2_4__v3_5_____triangle_v1_1__v2_0__v3_5_____triangle_v1_2__v2_6__v3_4_____triangle_v1_0__v2_2__v3_4_____triangle_v1_3__v2_7__v3_2_____triangle_v1_2__v2_7__v3_6_____triangle_v1_1__v2_5__v3_3_____triangle_v1_3__v2_5__v3_7_____triangle_v1_6__v2_7__v3_5_____triangle_v1_4__v2_6__v3_5______triangles___mesh___object___resources__build__item_objectid_0__transform_10_0_0_0_10_0_0_0_10_0_0_0______build___model_
mov r8d, 0x8ca
call fcn.180003ca0
mov r11d, dword [0x18001bf30]
test r11b, 1
jne 0x1800028ab
or r11d, 1
lea rcx, [rsp + 0x2a0]
mov dword [0x18001bf30], r11d
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [0x18001bf2c], eax
lea eax, [rbp - 0x10]
mov qword [r14], rsi
mov edi, 1
mov dword [r15], eax
jmp 0x1800028dc
mov r8, r13
xor edx, edx
mov rcx, r12
mov qword [r14], rdi
call fcn.1800045f0
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
mov r12, qword [rsp + 0xb88]
mov rbp, qword [rsp + 0xbd0]
mov r13, qword [rsp + 0xb80]
mov rcx, qword [rsp + 0xb70]
xor rcx, rsp
call fcn.1800045c0
add rsp, 0xb90
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret