Function at 0x1400d7b70
Capabilities:
Create new key via cryptacquirecontext
Get file size
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Read file via mapping

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0xa0
mov rax, qword [0x1401737a8]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor edi, edi
mov qword [rsp + 0x40], rdx
mov rbp, r8
mov qword [rsp + 0x30], rdi
mov rsi, rdx
mov dword [rsp + 0x28], edi
xor r9d, r9d
mov qword [rsp + 0x58], rdi
lea r8d, [rdi + 7]
mov qword [rsp + 0x50], rdi
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov r14d, edi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x48], rax
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400d7d76
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileTime]
lea r9d, [rdi + 0x18]
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
lea rcx, [rsp + 0x58]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov r14d, eax
test eax, eax
jne 0x1400d7c3b
lea r9d, [rdi + 1]
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
lea rcx, [rsp + 0x58]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov r14d, eax
test eax, eax
je 0x1400d7d6d
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x8004
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1400d7d60
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor edx, edx
mov qword [rsp + 0xe8], r12
mov rcx, rbx
mov dword [rsp + 0x20], edi
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r12, rax
test rax, rax
je 0x1400d7e18
mov qword [rsp + 0x98], r13
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x90], r15
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r14d, 1
mov rbx, rdi
mov ebp, eax
test eax, eax
je 0x1400d7d9a
mov eax, 0x100000
mov esi, ebp
cmp ebp, eax
mov r8, rbx
mov r9d, ebx
mov edx, 4
cmova esi, eax
mov rcx, r12
mov r13d, esi
shr r8, 0x20
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r15, rax
test rax, rax
je 0x1400d7d0c
mov rcx, qword [rsp + 0x50]
xor r9d, r9d
mov r8d, esi
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1400d7d2c
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
add rbx, r13
sub ebp, esi
jne 0x1400d7cc0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x40]
jmp 0x1400d7da3
mov rcx, r12
mov r14d, edi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x48]
mov r13, qword [rsp + 0x98]
mov r15, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov r12, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0x58]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14d, r14d
setne al
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400e17a0
add rsp, 0xa0
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x40]
xorps xmm0, xmm0
mov dword [rsp + 0x40], 0x20
lea r8, [rsp + 0x60]
mov dword [rsp + 0x20], edi
mov edx, 2
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x1400d7d38
cmp dword [rsp + 0x40], edi
jbe 0x1400d7d38
nop dword [rax + rax]
mov eax, edi
lea rdx, str._02X
movzx r8d, byte [rsp + rax + 0x60]
lea eax, [rdi + rdi]
lea rcx, [rsi + rax*2]
call fcn.140017950
inc edi
cmp edi, dword [rsp + 0x40]
jb 0x1400d7df0
jmp 0x1400d7d38
mov r14d, edi
jmp 0x1400d7d4d