Function at 0x140001340
Capabilities:
Create new key via cryptacquirecontext
Delete file
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Get file size
Hash data via wincrypt
Initialize hashing via wincrypt
Read file on windows
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r15
lea rbp, [rsp - 0xa8]
sub rsp, 0x1a8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x90], rax
xor ebx, ebx
mov qword [rsp + 0x50], rdx
mov rdi, rdx
mov qword [rsp + 0x68], rbx
mov r15, rcx
mov qword [rsp + 0x58], rbx
mov rcx, rdi
mov qword [rsp + 0x60], rbx
mov edx, 0x20
mov dword [rsp + 0x44], ebx
mov r13, r8
mov dword [rsp + 0x40], ebx
mov esi, ebx
mov dword [rsp + 0x48], ebx
call qword [sym.imp.KERNEL32.dll_VirtualLock]
test eax, eax
je 0x1400016e9
mov edx, 0x10
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualLock]
test eax, eax
je 0x1400016e9
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000168c
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea ecx, [rdi - 1]
cmp ecx, 0xfffffffd
ja 0x140001687
mov qword [rsp + 0x1f8], r12
mov ecx, edi
mov qword [rsp + 0x1a0], r14
mov r12d, edi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
test rax, rax
je 0x140001677
lea r9, [rsp + 0x44]
mov qword [rsp + 0x20], rsi
mov r8d, edi
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000164b
cmp dword [rsp + 0x44], edi
jne 0x14000164b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x18
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
lea rcx, [rsp + 0x68]
xor edx, edx
mov rbx, 0xffffffffffffffff
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x14000164b
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x14000164b
mov rdx, qword [rsp + 0x50]
xor r9d, r9d
mov rcx, qword [rsp + 0x60]
mov r8d, 0x20
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x14000164b
mov r8, qword [rsp + 0x60]
lea rax, [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x14000164b
mov rcx, qword [rsp + 0x58]
xor r9d, r9d
mov r8, r13
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x14000164b
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x30], edi
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
mov r8d, 1
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x40], edi
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x14000164b
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x14000164b
mov r8d, edi
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [rsp + 0x40]
lea rax, [rsp + 0x48]
mov dword [rsp + 0x30], ecx
xor r9d, r9d
mov rcx, qword [rsp + 0x58]
xor edx, edx
mov qword [rsp + 0x28], rax
mov r8d, 1
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x48], edi
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x14000164b
mov r9, r15
lea r8, str._s.raz
mov edx, 0x104
lea rcx, [rbp - 0x80]
call fcn.140001060
xor edi, edi
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000164b
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x70]
mov rdx, rsi
mov qword [rsp + 0x20], rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000164b
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x70], eax
jne 0x14000164b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
mov rbx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
mov rdi, r14
mov rcx, r12
rep stosb byte [rdi], al
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rsi, rsi
je 0x140001677
mov ecx, dword [rsp + 0x40]
xor eax, eax
mov rdi, rsi
rep stosb byte [rdi], al
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r12, qword [rsp + 0x1f8]
mov r14, qword [rsp + 0x1a0]
mov rdi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14000169c
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400016ac
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400016be
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
cmp rbx, 0xffffffffffffffff
je 0x1400016cd
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x20
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualUnlock]
mov edx, 0x10
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualUnlock]
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.140001ff0
add rsp, 0x1a8
pop r15
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret