Function at 0x180030f50
Capabilities:
Delete file
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Generate random numbers via winapi
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt
Read file on windows
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x10b0]
mov eax, 0x11b0
call fcn.180082320
sub rsp, rax
movaps xmmword [rsp + 0x11a0], xmm6
mov rax, qword [0x1800c8010]
xor rax, rsp
mov qword [rbp + 0x1090], rax
mov r14, rcx
mov esi, r9d
mov rcx, rdx
mov rdi, r8
mov r15, rdx
xor bl, bl
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r12d, r12d
mov dword [rsp + 0x5c], 0x75
xor edx, edx
mov qword [rsp + 0x68], r12
mov r8d, 0x100
mov qword [rsp + 0x78], r12
lea rcx, [rbp - 0x70]
mov qword [rsp + 0x70], r12
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x80], r12
call fcn.180059570
lea r9d, [r12 + 1]
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
lea rcx, [rsp + 0x68]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
movsd xmm6, qword [0x1800ba7c8]
test eax, eax
je 0x1800312fd
mov edx, dword [rsp + 0x5c]
lea r8, [rbp - 0x70]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1800312f0
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x8003
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1800312f0
mov r8d, dword [rsp + 0x5c]
lea rdx, [rbp - 0x70]
mov rcx, qword [rsp + 0x70]
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1800312e5
mov r8, qword [rsp + 0x70]
lea rax, [rbp - 0x78]
mov rcx, qword [rsp + 0x68]
xor r9d, r9d
mov edx, 0x6801
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x1800312e5
lea r9d, [r12 + 1]
mov dword [rsp + 0x20], 0xf0000040
lea r8, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
xor edx, edx
lea rcx, [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x180031110
mov rcx, qword [rsp + 0x78]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov r8d, esi
mov dword [rsp + 0x20], r12d
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x180031103
mov rcx, qword [rbp - 0x80]
lea rax, [rsp + 0x5c]
mov dword [rsp + 0x30], 0x100
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rbp - 0x70]
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov rcx, qword [rsp + 0x78]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
movaps xmm1, xmm6
lea rcx, [0x1800a7d98]
movq rdx, xmm6
call fcn.18000ba10
mov r8d, 0xaa0
mov dword [rsp + 0x58], r12d
mov ecx, 0xac2
mov word [rsp + 0x40], r8w
xor cx, r8w
mov dword [rsp + 0x60], r12d
mov eax, 0xad2
mov word [rsp + 0x44], cx
xor ax, r8w
mov qword [rsp + 0x50], r12
lea rcx, [rsp + 0x50]
mov word [rsp + 0x42], ax
lea r8, [rsp + 0x42]
mov word [rsp + 0x46], r12w
mov rdx, r14
call fcn.180067b80
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1800312cc
call fcn.1800680bc
mov ecx, eax
call fcn.1800679e8
mov r8d, 0x39aa
mov dword [rsp + 0x60], eax
mov ecx, 0x39c8
mov word [rsp + 0x40], r8w
xor cx, r8w
mov qword [rsp + 0x48], r12
mov eax, 0x39dd
mov word [rsp + 0x44], cx
xor ax, r8w
mov word [rsp + 0x46], r12w
lea rcx, [rsp + 0x48]
mov word [rsp + 0x42], ax
lea r8, [rsp + 0x42]
mov rdx, r15
call fcn.180067b80
movaps xmm1, xmm6
lea rcx, [0x1800a7d98]
movq rdx, xmm6
call fcn.18000ba10
mov r9, qword [rsp + 0x48]
test r9, r9
je 0x1800312c2
mov edx, 1
lea rcx, [rsp + 0x60]
lea r8d, [rdx + 3]
call fcn.1800683d0
mov r9, qword [rsp + 0x48]
lea rcx, [rbp - 0x70]
mov edx, 1
lea r8d, [rdx + 0x7f]
call fcn.1800683d0
mov r9, qword [rsp + 0x50]
lea rcx, [rbp + 0x90]
mov edx, 1
mov r8d, 0x1000
call fcn.180068e28
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x58], eax
call fcn.180068b34
mov rcx, qword [rbp - 0x78]
mov ebx, eax
mov eax, dword [rsp + 0x58]
xor r9d, r9d
mov dword [rsp + 0x30], eax
xor edx, edx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x90]
lea r8d, [r9 + 1]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x1800312a2
mov r8d, dword [rsp + 0x58]
lea rcx, [rbp + 0x90]
mov r9, qword [rsp + 0x48]
mov edx, 1
call fcn.1800683d0
test ebx, ebx
je 0x180031222
movaps xmm1, xmm6
lea rcx, [0x1800a7d98]
movq rdx, xmm6
call fcn.18000ba10
mov rcx, qword [rsp + 0x48]
call fcn.180067c5c
mov bl, 1
mov rcx, qword [rsp + 0x50]
call fcn.180067c5c
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1800312db
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x68]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
movaps xmm1, xmm6
lea rcx, [0x1800a7d98]
movq rdx, xmm6
call fcn.18000ba10
movzx eax, bl
mov rcx, qword [rbp + 0x1090]
xor rcx, rsp
call fcn.1800555d0
movaps xmm6, xmmword [rsp + 0x11a0]
add rsp, 0x11b0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret