Function at 0x140044970
Capabilities:
Create new key via cryptacquirecontext
Get file size
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Read file via mapping

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x1400a3758]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor edi, edi
mov qword [rsp + 0x40], rdx
mov rsi, r8
mov qword [rsp + 0x30], rdi
mov r15, rdx
mov dword [rsp + 0x28], edi
xor r9d, r9d
mov qword [rsp + 0x58], rdi
lea r8d, [rdi + 7]
mov qword [rsp + 0x50], rdi
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov r14d, edi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x48], rax
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140044bd1
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileTime]
lea r9d, [rdi + 0x18]
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
lea rcx, [rsp + 0x58]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov r14d, eax
test eax, eax
jne 0x140044a3c
lea r9d, [rdi + 1]
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
lea rcx, [rsp + 0x58]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov r14d, eax
test eax, eax
je 0x140044bc8
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x8004
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140044bbb
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor edx, edx
mov qword [rsp + 0x90], r13
mov rcx, rbx
mov dword [rsp + 0x20], edi
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r13, rax
test rax, rax
je 0x140044bf6
xor edx, edx
mov qword [rsp + 0xe8], rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r14d, 1
mov rbx, rdi
mov ebp, eax
test eax, eax
je 0x140044b2b
mov qword [rsp + 0x98], r12
mov eax, 0x100000
mov esi, ebp
cmp ebp, eax
mov r8, rbx
mov r9d, ebx
mov edx, 4
cmova esi, eax
mov rcx, r13
mov r12d, esi
shr r8, 0x20
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r15, rax
test rax, rax
je 0x140044b09
mov rcx, qword [rsp + 0x50]
xor r9d, r9d
mov r8d, esi
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x140044b1b
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
add rbx, r12
sub ebp, esi
je 0x140044b1e
jmp 0x140044abd
mov r14d, edi
mov r15, qword [rsp + 0x40]
mov r12, qword [rsp + 0x98]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0xe8]
test r14d, r14d
je 0x140044ba3
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x40]
xorps xmm0, xmm0
mov dword [rsp + 0x40], 0x20
lea r8, [rsp + 0x60]
mov dword [rsp + 0x20], edi
mov edx, 2
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x140044ba3
cmp dword [rsp + 0x40], edi
jbe 0x140044ba3
nop
mov eax, edi
lea rdx, str._02X
movzx r8d, byte [rsp + rax + 0x60]
lea eax, [rdi + rdi]
lea rcx, [r15 + rax*2]
call fcn.140005340
inc edi
cmp edi, dword [rsp + 0x40]
jb 0x140044b80
mov rbx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov r13, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x58]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14d, r14d
setne al
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14004bd30
add rsp, 0xa0
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov r14d, edi
jmp 0x140044ba8