Function at 0x1400010e0
Capabilities:
Allocate or change rwx memory
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Get file size
Hash data via wincrypt
Initialize hashing via wincrypt
Read file on windows

Disassembly:
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
mov rax, qword [0x140024008]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r15d, r8d
lea rcx, str.Data.bin
mov r14, rdx
xor r12d, r12d
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000135a
lea rdx, [rbp - 0x49]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140001351
mov rdx, qword [rbp - 0x49]
test rdx, rdx
je 0x140001351
mov qword [rsp + 0xf0], rbx
lea r9d, [r12 + 0x40]
xor ecx, ecx
mov qword [rsp + 0x108], rsi
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea r9, [rbp - 0x41]
mov qword [rsp + 0x20], r12
lea r8d, [r12 + 0x40]
mov rcx, rdi
lea rdx, [rbp - 0x19]
mov rsi, rax
mov ebx, r12d
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140001239
mov ecx, dword [rbp - 0x41]
test ecx, ecx
je 0x140001239
movsxd rdx, ebx
lea rax, [rbp - 0x19]
mov r9d, ecx
add rdx, rsi
shr r9, 3
mov r8d, ecx
test r9, r9
je 0x1400011f7
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [rax]
add rax, 8
mov qword [rdx], rcx
add rdx, 8
sub r9, 1
jne 0x1400011e0
mov ecx, dword [rbp - 0x41]
and r8d, 7
je 0x140001213
sub rdx, rax
movzx ecx, byte [rax]
mov byte [rdx + rax], cl
lea rax, [rax + 1]
sub r8, 1
jne 0x140001200
mov ecx, dword [rbp - 0x41]
add ebx, ecx
mov qword [rsp + 0x20], r12
mov rcx, rdi
lea r9, [rbp - 0x41]
mov r8d, 0x40
lea rdx, [rbp - 0x19]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400011b4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp - 0x49]
lea rcx, [rbp - 0x31]
mov r9d, 0x18
mov dword [rbp - 0x39], eax
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov rbx, qword [rsp + 0xf0]
test eax, eax
je 0x140001345
mov rcx, qword [rbp - 0x31]
lea rax, [rbp - 0x29]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140001345
mov rcx, qword [rbp - 0x29]
xor r9d, r9d
mov r8d, r15d
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x140001345
mov r8, qword [rbp - 0x29]
lea rax, [rbp - 0x21]
mov rcx, qword [rbp - 0x31]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x140001345
mov rcx, qword [rbp - 0x21]
lea rax, [rbp - 0x39]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], rsi
lea r8d, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x140001345
mov rcx, qword [rbp - 0x31]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rax, rsi
mov rsi, qword [rsp + 0x108]
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400014d0
add rsp, 0xc0
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov rcx, rsi
call fcn.14000a1a0
xor eax, eax
jmp 0x140001321
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140001329