Function at 0x180001000
Capabilities:
Create new key via cryptacquirecontext
Encrypt or decrypt via wincrypt
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x70
mov rax, qword [0x180005008]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor r14d, r14d
lea rcx, str.C:ProgramDataScriptZIPE_C.dll.txt
mov qword [rsp + 0x30], r14
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x58], r14
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x180001064
xor eax, eax
jmp 0x180001295
xor edx, edx
mov qword [rsp + 0x80], rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
mov dword [rsp + 0x40], eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x50]
mov rdx, rax
mov qword [rsp + 0x20], r14
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rdi
test eax, eax
jne 0x1800010be
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
jmp 0x18000128d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x18
mov dword [rsp + 0x20], r14d
xor r8d, r8d
lea rcx, [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x180001112
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x1800010ae
mov r9d, 0x18
mov dword [rsp + 0x20], 8
xor r8d, r8d
lea rcx, [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1800010ae
mov qword [rsp + 0x30], r14
lea rcx, str.C:ProgramDataScriptZIPkey.blob
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
mov qword [rsp + 0x90], rsi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x18000116d
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
jmp 0x180001285
xor edx, edx
mov qword [rsp + 0x88], rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
mov ebp, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], r14
mov rdx, rax
mov r8d, ebp
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180001253
cmp dword [rsp + 0x50], ebp
jne 0x180001253
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov r8d, ebp
mov dword [rsp + 0x20], r14d
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x18000125c
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], rbx
lea r8d, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov rcx, qword [rsp + 0x58]
test eax, eax
jne 0x18000123b
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x18000127b
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rax, rbx
jmp 0x18000127d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov rbp, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1800015f0
mov rdi, qword [rsp + 0x98]
add rsp, 0x70
pop r14
ret