Function at 0x1400a4000
Capabilities:
Create new key via cryptacquirecontext
Get file size
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Read file via mapping

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x1401222f0]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor edi, edi
mov rsi, r8
mov r14, rdx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x30], rdi
lea r8d, [rdi + 7]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov r15d, edi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x58], rax
cmp rax, 0xffffffffffffffff
je 0x1400a4283
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileTime]
lea r9d, [rdi + 0x18]
lea rcx, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov r15d, eax
test eax, eax
jne 0x1400a40cc
lea r9d, [rdi + 1]
lea rcx, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov r15d, eax
test eax, eax
je 0x1400a427a
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8004
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1400a426d
xor r9d, r9d
xor edx, edx
mov rcx, rbx
lea r8d, [r9 + 2]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x90], r13
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r13, rax
test rax, rax
je 0x1400a42a8
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0xe8], rbp
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r15d, 1
mov rbx, rdi
mov ebp, eax
test eax, eax
je 0x1400a41bb
mov qword [rsp + 0x98], r12
mov eax, 0x100000
mov esi, ebp
mov r8, rbx
cmp ebp, eax
mov r9d, ebx
mov edx, 4
cmova esi, eax
shr r8, 0x20
mov rcx, r13
mov r12d, esi
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r14, rax
test rax, rax
je 0x1400a4199
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
mov r8d, esi
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1400a41ab
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
add rbx, r12
sub ebp, esi
je 0x1400a41ae
jmp 0x1400a414d
mov r15d, edi
mov r14, qword [rsp + 0x40]
mov r12, qword [rsp + 0x98]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0xe8]
test r15d, r15d
je 0x1400a4255
mov rcx, qword [rsp + 0x48]
xor eax, eax
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x60]
lea edx, [rax + 2]
mov byte [rsp + 0x60], dil
mov qword [rsp + 0x61], rax
mov qword [rsp + 0x69], rax
mov qword [rsp + 0x71], rax
mov dword [rsp + 0x79], eax
mov word [rsp + 0x7d], ax
mov byte [rsp + 0x7f], al
mov dword [rsp + 0x40], 0x20
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x1400a4255
mov ebx, edi
cmp dword [rsp + 0x40], ebx
jbe 0x1400a4255
mov esi, edi
nop word [rax + rax]
mov eax, ebx
lea rdx, str._02X
movzx r8d, byte [rsp + rax + 0x60]
mov eax, esi
lea rcx, [r14 + rax*2]
call fcn.1400aa864
inc ebx
add esi, 2
cmp ebx, dword [rsp + 0x40]
jb 0x1400a4230
mov rbx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov r13, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15d, r15d
setne al
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400ab140
add rsp, 0xa0
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov r15d, edi
jmp 0x1400a425a