Function at 0x140001260
Capabilities:
Encrypt or decrypt via wincrypt
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Reference public rsa key
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14007e018]
xor rax, rsp
mov qword [rbp - 0x18], rax
cmp qword [0x1400819e0], 0
jne 0x1400012ac
lea r8, [0x140073e40]
lea rdx, [0x1400869f0]
lea rcx, [0x1400819e0]
call fcn.14003b524
cmp qword [0x1400819e0], 0
je 0x1400015d4
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0xa8], r12
xor r12d, r12d
mov qword [rsp + 0x78], r14
mov edi, r12d
mov qword [rsp + 0x70], r15
lea ecx, [r12 + 0x20]
call fcn.14003b9a4
mov ebx, dword [0x1400819e8]
lea r9d, [r12 + 1]
xor r8d, r8d
mov dword [rbp - 0x40], r12d
xor edx, edx
mov dword [rsp + 0x20], r12d
lea rcx, [rbp - 0x38]
mov rsi, rax
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1400013d2
mov rcx, qword [rbp - 0x38]
lea rax, [rbp - 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x8004
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1400013c6
mov rcx, qword [rbp - 0x30]
lea rdx, [0x1400819f0]
xor r9d, r9d
mov r8d, ebx
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rbp - 0x30]
test eax, eax
je 0x1400013c0
lea r9, [rbp - 0x40]
mov dword [rsp + 0x20], r12d
xor r8d, r8d
lea edx, [r12 + 2]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x1400013bc
mov ecx, dword [rbp - 0x40]
call fcn.14003b9a4
mov rbx, rax
test rax, rax
je 0x1400013d2
mov rcx, qword [rbp - 0x30]
lea r9, [rbp - 0x40]
mov r8, rax
mov dword [rsp + 0x20], r12d
lea edx, [r12 + 2]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x1400013b4
mov edi, dword [rbp - 0x40]
mov rdx, rbx
mov r8d, edi
mov rcx, rsi
call fcn.140036b80
mov rcx, rbx
call fcn.14003b990
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp - 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, 0x400
call fcn.14003b9a4
mov r9d, 1
mov dword [rbp - 0x40], edi
xor r8d, r8d
mov dword [rsp + 0x20], r12d
xor edx, edx
lea rcx, [rbp - 0x38]
mov r14, rax
mov r15d, r12d
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov rdi, qword [rsp + 0xa0]
test eax, eax
je 0x1400014c5
mov rcx, qword [rbp - 0x38]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [0x14007ec30]
xor r9d, r9d
mov dword [rsp + 0x20], r12d
mov r8d, 0x400
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x1400015f3
mov ecx, 0x400
call fcn.14003b9a4
mov rbx, rax
test rax, rax
je 0x1400015e9
mov r8d, dword [rbp - 0x40]
mov rdx, rsi
mov rcx, rax
call fcn.140036b80
mov rcx, qword [rbp - 0x30]
lea rax, [rbp - 0x40]
xor r9d, r9d
mov dword [rsp + 0x30], 0x400
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], rbx
lea r8d, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x1400015e9
mov r15d, dword [rbp - 0x40]
mov rdx, rbx
mov r8d, r15d
mov rcx, r14
call fcn.140036b80
mov rcx, rbx
call fcn.14003b990
mov rcx, qword [rbp - 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov ecx, 0x5000
call fcn.14003b9a4
mov edx, dword [0x1400819e8]
lea r9, [rbp - 0x38]
mov qword [rbp - 0x38], rax
lea rcx, [0x1400819f0]
lea rax, [rbp - 0x40]
mov dword [rbp - 0x40], r12d
mov qword [rsp + 0x20], rax
call fcn.140001070
mov r9, qword [0x1400819e0]
lea rcx, [rbp - 0x28]
mov edx, 1
mov dword [rbp - 0x28], 0xbe01be01
lea r8d, [rdx + 3]
call fcn.14003b90c
mov r9, qword [0x1400819e0]
mov edx, 1
mov r8d, r15d
mov rcx, r14
call fcn.14003b90c
mov r9, qword [0x1400819e0]
lea rcx, [rbp - 0x24]
mov edx, 1
mov dword [rbp - 0x24], 0xbe02be02
lea r8d, [rdx + 3]
call fcn.14003b90c
mov r8d, dword [rbp - 0x40]
mov edx, 1
mov r9, qword [0x1400819e0]
mov rcx, qword [rbp - 0x38]
call fcn.14003b90c
mov r9, qword [0x1400819e0]
lea rcx, [rbp - 0x20]
mov edx, 1
mov dword [rbp - 0x20], 0xf1eef1ee
lea r8d, [rdx + 3]
call fcn.14003b90c
mov rcx, qword [0x1400819e0]
call fcn.14003b334
mov rcx, rsi
mov dword [0x1400819e8], r12d
call fcn.14003b990
mov rcx, r14
call fcn.14003b990
mov rcx, qword [rbp - 0x38]
call fcn.14003b990
mov r14, qword [rsp + 0x78]
mov r12, qword [rsp + 0xa8]
mov rsi, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
mov r15, qword [rsp + 0x70]
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.140034c70
add rsp, 0x80
pop rbp
ret
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbp - 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov r9, qword [0x1400819e0]
lea rcx, [rbp - 0x40]
mov edx, 1
mov dword [rbp - 0x40], 0xee01ee01
lea r8d, [rdx + 3]
call fcn.14003b90c
mov rcx, rsi
call fcn.14003b990
mov rcx, r14
call fcn.14003b990
mov rcx, qword [0x1400819e0]
call fcn.14003b658
jmp 0x1400015b2