Function at 0x18000ab20
Capabilities:
Create new key via cryptacquirecontext
Encode data using xor
Hash data with crc32
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xd40
mov rax, qword [0x1800f7050]
xor rax, rsp
mov qword [rsp + 0xd20], rax
mov rbp, r8
mov rsi, rdx
mov rdi, rcx
test r8, r8
je 0x18000af81
cmp word [r8], 0
je 0x18000af81
cmp qword [rcx + 0x70], 0xffffffffffffffff
jne 0x18000ab6b
mov eax, 0x80004005
jmp 0x18000ada6
lea rcx, [rsp + 0xb21]
xor edx, edx
mov r8d, 0x1ff
mov qword [rsp + 0xd38], rbx
mov byte [rsp + 0xb20], 0
mov qword [rsp + 0xd30], r12
call fcn.1800644c0
lea rcx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0xb20]
mov rcx, rdi
call fcn.18000a9d0
lea rcx, [rdi + 0x40]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
js 0x18000af70
cmp ebx, 1
je 0x18000af70
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test rsi, rsi
je 0x18000af77
lea r9, [rsp + 0xb40]
lea rcx, [rsp + 0x560]
mov r8d, eax
mov rdx, rsi
call fcn.18000e330
test eax, eax
je 0x18000af77
lea rdx, [rsp + 0xb80]
lea rcx, [rsp + 0x560]
or r9, 0xffffffffffffffff
mov r8d, 0x1a0
call fcn.18000e700
cmp dword [rsp + 0xb80], 0x10211a41
jne 0x18000af77
lea rcx, [rsp + 0xb90]
mov edx, 0x40
call fcn.18000e8c0
cmp dword [rsp + 0xb84], eax
jne 0x18000af77
or r9, 0xffffffffffffffff
lea rdx, [rsp + 0xb30]
lea rcx, [rsp + 0x560]
lea r8d, [r9 + 0x11]
call fcn.18000e700
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x280
call fcn.1800644c0
xor ebx, ebx
lea rcx, [rsp + 0x550]
lea r9d, [rbx + 1]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x540], ebx
mov dword [rsp + 0x544], ebx
mov dword [rsp + 0x548], ebx
mov qword [rsp + 0x550], rbx
mov dword [rsp + 0x558], 1
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x18000acfd
lea r9d, [rbx + 1]
lea rcx, [rsp + 0x550]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 8
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov ecx, dword [rsp + 0x558]
test eax, eax
cmove ecx, ebx
mov dword [rsp + 0x558], ecx
lea rcx, [rsp + 0x40]
call fcn.18000ec30
lea rcx, [rsp + 0x40]
call fcn.18000f380
lea rcx, [rsp + 0x40]
call fcn.18000ec30
lea rdx, [rsp + 0xb40]
lea rcx, [rsp + 0x40]
mov r8d, 0x40
mov dword [rsp + 0x540], 1
call fcn.18000e940
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r9, [rsp + 0xb40]
lea rcx, [rsp + 0x840]
mov r8d, eax
mov rdx, rbp
call fcn.18000e330
test eax, eax
jne 0x18000adc1
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x280
call fcn.1800644c0
cmp dword [rsp + 0x558], ebx
je 0x18000ad91
mov rcx, qword [rsp + 0x550]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 0x80004005
mov rbx, qword [rsp + 0xd38]
mov r12, qword [rsp + 0xd30]
mov rcx, qword [rsp + 0xd20]
xor rcx, rsp
call fcn.180062100
add rsp, 0xd40
pop rdi
pop rsi
pop rbp
ret
or r9, 0xffffffffffffffff
lea rdx, [rsp + 0xb30]
lea rcx, [rsp + 0x840]
lea r8d, [r9 + 0x11]
call fcn.18000e540
lea rdx, [rsp + 0xb80]
lea rcx, [rsp + 0x840]
or r9, 0xffffffffffffffff
mov r8d, 0x1a0
call fcn.18000e540
mov dword [rsp + 0xb2c], ebx
mov r9d, 0x200
lea r10, [rsp + 0xb20]
or r8d, 0xffffffff
lea r11, [0x1800fd2d0]
nop dword [rax]
movzx ecx, byte [r10]
mov eax, r8d
inc r10
xor rcx, rax
shr eax, 8
movzx edx, cl
mov r8d, dword [r11 + rdx*4]
xor r8d, eax
sub r9d, 1
jne 0x18000ae20
not r8d
lea rcx, [rdi + 0x40]
mov dword [rsp + 0xb2c], r8d
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rsi, qword [rdi + 0x70]
cmp rsi, 0xffffffffffffffff
je 0x18000af35
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x18000ae85
call fcn.1800030e0
mov ebx, eax
jmp 0x18000af3a
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0xb20]
mov r8d, 0x200
mov rcx, rsi
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x18000af3a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6f8
je 0x18000aed9
cmp eax, 0x3e6
je 0x18000aed9
test eax, eax
jg 0x18000aece
mov ebx, eax
jmp 0x18000af3a
movzx ebx, ax
or ebx, 0x80070000
jmp 0x18000af3a
lea rcx, [rdi + 0x10]
mov edx, 0x200
call fcn.180003cc0
test eax, eax
js 0x18000af31
cmp eax, 1
je 0x18000af31
mov rcx, qword [rdi + 0x10]
lea rdx, [rsp + 0xb20]
mov r8d, 0x200
call fcn.180063290
mov rdx, qword [rdi + 0x10]
lea r9, [rsp + 0x30]
mov r8d, 0x200
mov rcx, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x18000af3a
call fcn.1800030e0
mov ebx, eax
jmp 0x18000af3a
mov ebx, eax
jmp 0x18000af3a
mov ebx, 0x80070057
lea rcx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x280
call fcn.1800644c0
cmp dword [rsp + 0x558], 0
je 0x18000af70
mov rcx, qword [rsp + 0x550]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, ebx
jmp 0x18000ad96
mov eax, 0xe0037002
jmp 0x18000ad96
mov eax, 0x80070057
jmp 0x18000ada6