Function at 0x4e53f0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x14], 0
push 0
push 0x80
push 3
push 0
push 1
push 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xffffffff
jne 0x4e5455
jmp 0x4e5669
push 0
push 0x80
push 4
push 0
push 1
push 2
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
jne 0x4e547c
jmp 0x4e5669
push 0
push 1
push 0x5402d0
push 0
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x4e54ce
push 8
push 1
push 0x5402fc
push 0
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x4e54ce
push 0xf0000000
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push 0
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x4e5669
lea edx, [ebp - 0xc]
push edx
push 0
push 0
push 0x8004
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x4e5650
push 0
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x4e5639
lea ecx, [ebp - 8]
push ecx
push 0
mov edx, dword [ebp - 0xc]
push edx
push 0x6801
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x4e5639
mov dword [ebp - 0x1c], 0x400
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.00415d52
add esp, 4
mov dword [ebp - 0x20], eax
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4e5606
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x1c]
jae 0x4e557c
mov dword [ebp - 0x14], 1
cmp dword [ebp + 0x14], 0
je 0x4e55c7
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
push 0
push 1
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x4e55c5
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4e55c5
mov dword [ebp - 0x24], 1
jmp 0x4e5606
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 0x20]
push edx
push 0
push 1
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x4e5606
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4e5606
mov dword [ebp - 0x24], 1
cmp dword [ebp - 0x14], 0
je 0x4e554d
cmp dword [ebp - 0x20], 0
je 0x4e5622
mov edx, dword [ebp - 0x20]
push edx
call fcn.00415c75
add esp, 4
cmp dword [ebp - 8], 0
je 0x4e5639
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov dword [ebp - 8], 0
cmp dword [ebp - 0xc], 0
je 0x4e5650
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0x10], 0
je 0x4e5669
push 0
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x2c], 0
je 0x4e5679
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x28], 0
je 0x4e5689
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
mov esp, ebp
pop ebp
ret