Function at 0x140001170
Capabilities:
Create new key via cryptacquirecontext
Delete file
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Read file on windows
Write file on windows

Disassembly:
test rcx, rcx
je 0x1400013b8
push rbp
push rsi
push r14
mov eax, 0x201a0
call fcn.140002f90
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x20180], rax
mov r14, r8
mov rbp, rdx
mov rsi, rcx
test rdx, rdx
je 0x14000139d
test r8, r8
je 0x14000139d
lea rdx, [0x1400062bc]
mov qword [rsp + 0x20198], rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rbx, rax
test rax, rax
je 0x140001395
mov r9, rsi
mov qword [rsp + 0x20190], rdi
lea r8, str._s.enc
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.1400010c0
lea rdx, [0x1400062b0]
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rdi, rax
test rax, rax
jne 0x140001221
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x14000138d
mov r9d, 0x18
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
lea rcx, [rsp + 0x58]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
mov r8d, 0x20
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov r8, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
mov rcx, qword [rsp + 0x50]
xor r9d, r9d
mov r8, r14
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov r9, rbx
lea rcx, [rsp + 0x170]
mov edx, 1
mov r8d, 0x10000
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
test eax, eax
je 0x14000135a
nop dword [rax]
mov rcx, rbx
mov dword [rsp + 0x40], eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_feof]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x30], 0x10010
mov qword [rsp + 0x28], rcx
xor r9d, r9d
lea rcx, [rsp + 0x10170]
mov r8d, eax
mov qword [rsp + 0x20], rcx
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov r8d, dword [rsp + 0x40]
lea rcx, [rsp + 0x10170]
mov r9, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, rbx
lea rcx, [rsp + 0x170]
mov edx, 1
mov r8d, 0x10000
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
test eax, eax
jne 0x1400012e0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x58]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rdi, qword [rsp + 0x20190]
mov rbx, qword [rsp + 0x20198]
mov rcx, qword [rsp + 0x20180]
xor rcx, rsp
call fcn.140002190
add rsp, 0x201a0
pop r14
pop rsi
pop rbp
ret