Function at 0x180008d10
Capabilities:
Delete file
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt
Read file on windows
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1090]
mov eax, 0x1190
call fcn.180029e20
sub rsp, rax
mov rax, qword [0x180074020]
xor rax, rsp
mov qword [rbp + 0x1080], rax
mov rbx, rcx
mov r15d, r9d
mov rcx, rdx
mov r14, r8
mov rsi, rdx
xor dil, dil
call qword [sym.imp.KERNEL32.DLL_DeleteFileW]
xor edx, edx
lea rcx, [rbp - 0x80]
mov r8d, 0x100
call fcn.18002b450
xor r12d, r12d
mov dword [rsp + 0x44], 0x100
lea r8, [0x18006272c]
mov qword [rsp + 0x50], r12
mov rdx, rbx
mov qword [rsp + 0x60], r12
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x30], r12
call fcn.180030b60
mov r9, qword [rsp + 0x30]
test r9, r9
je 0x180008fe7
lea edx, [r12 + 4]
mov dword [rsp + 0x58], r12d
lea r8d, [r12 + 1]
lea rcx, [rsp + 0x58]
call fcn.180031554
mov r9, qword [rsp + 0x30]
lea edx, [r12 + 1]
lea rcx, [rbp - 0x80]
lea r8d, [rdx + 0x7f]
call fcn.180031554
lea r9d, [r12 + 1]
mov dword [rsp + 0x20], 0xf0000040
lea r8, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
xor edx, edx
lea rcx, [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x180008e64
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov r8d, r15d
mov dword [rsp + 0x20], r12d
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x180008e57
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rbp - 0x80]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov rcx, qword [rsp + 0x60]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
lea rcx, [rsp + 0x50]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x180008fcd
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x8003
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x180008fc0
mov r8d, dword [rsp + 0x44]
lea rdx, [rbp - 0x80]
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x180008fb5
mov r8, qword [rsp + 0x48]
lea rax, [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
xor r9d, r9d
mov edx, 0x6801
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x180008fb5
lea r8, [0x1800627a4]
mov dword [rsp + 0x40], r12d
mov rdx, rsi
mov qword [rsp + 0x38], r12
lea rcx, [rsp + 0x38]
call fcn.180030b60
cmp qword [rsp + 0x38], r12
je 0x180008faa
mov r9, qword [rsp + 0x30]
lea rcx, [rbp + 0x80]
mov edx, 1
mov r8d, 0x1000
call fcn.180031554
mov rcx, qword [rsp + 0x30]
mov dword [rsp + 0x40], eax
call fcn.18003a8d8
mov rcx, qword [rsp + 0x68]
mov ebx, eax
xor r9d, r9d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
xor edx, edx
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x180008f9d
mov r8d, dword [rsp + 0x40]
lea rcx, [rbp + 0x80]
mov r9, qword [rsp + 0x38]
mov edx, 1
call fcn.180031954
test ebx, ebx
je 0x180008f24
mov rcx, qword [rsp + 0x38]
call fcn.1800316a0
mov dil, 1
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x180008fdd
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x30]
call fcn.1800316a0
movzx eax, dil
mov rcx, qword [rbp + 0x1080]
xor rcx, rsp
call fcn.1800292f0
add rsp, 0x1190
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret