Function at 0x180061910
Capabilities:
Create new key via cryptacquirecontext
Encode data using xor
Hash data with crc32
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xd40
mov rax, qword [0x1800ff050]
xor rax, rsp
mov qword [rsp + 0xd20], rax
mov rbp, r8
mov rsi, rdx
mov rdi, rcx
test r8, r8
je 0x180061d71
cmp word [r8], 0
je 0x180061d71
cmp qword [rcx + 0x70], 0xffffffffffffffff
jne 0x18006195b
mov eax, 0x80004005
jmp 0x180061b96
lea rcx, [rsp + 0xb21]
xor edx, edx
mov r8d, 0x1ff
mov qword [rsp + 0xd38], rbx
mov byte [rsp + 0xb20], 0
mov qword [rsp + 0xd30], r12
call fcn.18006cf60
lea rcx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0xb20]
mov rcx, rdi
call fcn.1800617c0
lea rcx, [rdi + 0x40]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
js 0x180061d60
cmp ebx, 1
je 0x180061d60
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test rsi, rsi
je 0x180061d67
lea r9, [rsp + 0xb40]
lea rcx, [rsp + 0x560]
mov r8d, eax
mov rdx, rsi
call fcn.180065330
test eax, eax
je 0x180061d67
lea rdx, [rsp + 0xb80]
lea rcx, [rsp + 0x560]
or r9, 0xffffffffffffffff
mov r8d, 0x1a0
call fcn.180065700
cmp dword [rsp + 0xb80], 0x10211a41
jne 0x180061d67
lea rcx, [rsp + 0xb90]
mov edx, 0x40
call fcn.1800658c0
cmp dword [rsp + 0xb84], eax
jne 0x180061d67
or r9, 0xffffffffffffffff
lea rdx, [rsp + 0xb30]
lea rcx, [rsp + 0x560]
lea r8d, [r9 + 0x11]
call fcn.180065700
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x280
call fcn.18006cf60
xor ebx, ebx
lea rcx, [rsp + 0x550]
lea r9d, [rbx + 1]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x540], ebx
mov dword [rsp + 0x544], ebx
mov dword [rsp + 0x548], ebx
mov qword [rsp + 0x550], rbx
mov dword [rsp + 0x558], 1
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x180061aed
lea r9d, [rbx + 1]
lea rcx, [rsp + 0x550]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 8
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov ecx, dword [rsp + 0x558]
test eax, eax
cmove ecx, ebx
mov dword [rsp + 0x558], ecx
lea rcx, [rsp + 0x40]
call fcn.180065c30
lea rcx, [rsp + 0x40]
call fcn.180066380
lea rcx, [rsp + 0x40]
call fcn.180065c30
lea rdx, [rsp + 0xb40]
lea rcx, [rsp + 0x40]
mov r8d, 0x40
mov dword [rsp + 0x540], 1
call fcn.180065940
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r9, [rsp + 0xb40]
lea rcx, [rsp + 0x840]
mov r8d, eax
mov rdx, rbp
call fcn.180065330
test eax, eax
jne 0x180061bb1
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x280
call fcn.18006cf60
cmp dword [rsp + 0x558], ebx
je 0x180061b81
mov rcx, qword [rsp + 0x550]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 0x80004005
mov rbx, qword [rsp + 0xd38]
mov r12, qword [rsp + 0xd30]
mov rcx, qword [rsp + 0xd20]
xor rcx, rsp
call fcn.18006a4f0
add rsp, 0xd40
pop rdi
pop rsi
pop rbp
ret
or r9, 0xffffffffffffffff
lea rdx, [rsp + 0xb30]
lea rcx, [rsp + 0x840]
lea r8d, [r9 + 0x11]
call fcn.180065540
lea rdx, [rsp + 0xb80]
lea rcx, [rsp + 0x840]
or r9, 0xffffffffffffffff
mov r8d, 0x1a0
call fcn.180065540
mov dword [rsp + 0xb2c], ebx
mov r9d, 0x200
lea r10, [rsp + 0xb20]
or r8d, 0xffffffff
lea r11, [0x1801042e0]
nop dword [rax]
movzx ecx, byte [r10]
mov eax, r8d
inc r10
xor rcx, rax
shr eax, 8
movzx edx, cl
mov r8d, dword [r11 + rdx*4]
xor r8d, eax
sub r9d, 1
jne 0x180061c10
not r8d
lea rcx, [rdi + 0x40]
mov dword [rsp + 0xb2c], r8d
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rsi, qword [rdi + 0x70]
cmp rsi, 0xffffffffffffffff
je 0x180061d25
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x180061c75
call fcn.180003180
mov ebx, eax
jmp 0x180061d2a
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0xb20]
mov r8d, 0x200
mov rcx, rsi
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180061d2a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6f8
je 0x180061cc9
cmp eax, 0x3e6
je 0x180061cc9
test eax, eax
jg 0x180061cbe
mov ebx, eax
jmp 0x180061d2a
movzx ebx, ax
or ebx, 0x80070000
jmp 0x180061d2a
lea rcx, [rdi + 0x10]
mov edx, 0x200
call fcn.180003da0
test eax, eax
js 0x180061d21
cmp eax, 1
je 0x180061d21
mov rcx, qword [rdi + 0x10]
lea rdx, [rsp + 0xb20]
mov r8d, 0x200
call fcn.18006c2d0
mov rdx, qword [rdi + 0x10]
lea r9, [rsp + 0x30]
mov r8d, 0x200
mov rcx, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180061d2a
call fcn.180003180
mov ebx, eax
jmp 0x180061d2a
mov ebx, eax
jmp 0x180061d2a
mov ebx, 0x80070057
lea rcx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x280
call fcn.18006cf60
cmp dword [rsp + 0x558], 0
je 0x180061d60
mov rcx, qword [rsp + 0x550]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, ebx
jmp 0x180061b86
mov eax, 0xe0037002
jmp 0x180061b86
mov eax, 0x80070057
jmp 0x180061b96