Function at 0x140001310
Capabilities:
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push r12
push r15
mov rbp, rsp
sub rsp, 0x60
xor r15d, r15d
lea rcx, [0x140004020]
mov r12d, 1
mov qword [rsp + 0x30], r15
mov rbx, r8
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov dword [rsp + 0x20], 3
mov r8d, r12d
mov qword [rbp - 0x18], r15
mov edx, r12d
mov qword [rbp - 0x20], r15
mov qword [rbp + 0x48], r15
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140001383
mov eax, r12d
add rsp, 0x60
pop r15
pop r12
pop rsi
pop rbx
pop rbp
ret
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
lea rcx, [0x140004240]
mov r8d, r12d
mov qword [rsp + 0x50], r14
mov dword [rsp + 0x20], 4
lea edx, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x1400013d2
lea eax, [r14 + 3]
mov r14, qword [rsp + 0x50]
add rsp, 0x60
pop r15
pop r12
pop rsi
pop rbx
pop rbp
ret
mov r9d, r12d
mov dword [rsp + 0x20], r15d
lea r8, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
xor edx, edx
lea rcx, [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x140001407
mov r14, qword [rsp + 0x50]
mov eax, 3
add rsp, 0x60
pop r15
pop r12
pop rsi
pop rbx
pop rbp
ret
test rbx, rbx
je 0x1400014c7
cmp byte [rbx], r15b
je 0x1400014c7
mov rcx, qword [rbp + 0x48]
lea rax, [rbp - 0x20]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x8003
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x140001451
mov r14, qword [rsp + 0x50]
mov eax, 8
add rsp, 0x60
pop r15
pop r12
pop rsi
pop rbx
pop rbp
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [rbp - 0x20]
xor r9d, r9d
mov r8d, eax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x140001487
mov r14, qword [rsp + 0x50]
mov eax, 9
add rsp, 0x60
pop r15
pop r12
pop rsi
pop rbx
pop rbp
ret
mov r8, qword [rbp - 0x20]
lea rax, [rbp - 0x18]
mov rcx, qword [rbp + 0x48]
mov r9d, 0x800000
mov edx, 0x6801
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x1400015ae
mov r14, qword [rsp + 0x50]
mov eax, 0xa
add rsp, 0x60
pop r15
pop r12
pop rsi
pop rbx
pop rbp
ret
lea r9, [rbp + 0x38]
mov qword [rsp + 0x20], r15
mov r8d, 4
lea rdx, [rbp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400014fd
mov r14, qword [rsp + 0x50]
mov eax, 0x14
add rsp, 0x60
pop r15
pop r12
pop rsi
pop rbx
pop rbp
ret
mov edx, dword [rbp + 0x30]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x14000152e
mov r14, qword [rsp + 0x50]
lea eax, [rbx + 0x15]
add rsp, 0x60
pop r15
pop r12
pop rsi
pop rbx
pop rbp
ret
mov r8d, dword [rbp + 0x30]
lea r9, [rbp + 0x38]
mov rdx, rbx
mov qword [rsp + 0x20], r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140001561
mov r14, qword [rsp + 0x50]
mov eax, 0x16
add rsp, 0x60
pop r15
pop r12
pop rsi
pop rbx
pop rbp
ret
mov r8d, dword [rbp + 0x30]
lea rax, [rbp - 0x18]
mov rcx, qword [rbp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov rdx, rbx
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x14000159d
mov r14, qword [rsp + 0x50]
mov eax, 7
add rsp, 0x60
pop r15
pop r12
pop rsi
pop rbx
pop rbp
ret
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor ecx, ecx
mov qword [rsp + 0x58], rdi
mov edx, 0x3e8
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
jne 0x1400015da
lea eax, [rdi + 0xb]
jmp 0x1400016c0
xor bl, bl
nop dword [rax]
lea r9, [rbp + 0x38]
mov qword [rsp + 0x20], r15
mov r8d, 0x3e8
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400016bb
cmp dword [rbp + 0x38], 0x3e8
lea rax, [rbp + 0x38]
mov rcx, qword [rbp - 0x18]
mov qword [rsp + 0x28], rax
movzx ebx, bl
cmovbe ebx, r12d
mov qword [rsp + 0x20], rdi
movzx r8d, bl
xor r9d, r9d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x1400016b4
mov r8d, dword [rbp + 0x38]
lea r9, [rbp + 0x38]
mov rdx, rdi
mov qword [rsp + 0x20], r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400016ad
test bl, bl
je 0x1400015e0
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140001689
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x140001698
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x1400016a9
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
jmp 0x1400016c0
mov eax, 0xe
jmp 0x1400016c0
mov eax, 0xd
jmp 0x1400016c0
mov eax, 0xc
mov rdi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x50]
add rsp, 0x60
pop r15
pop r12
pop rsi
pop rbx
pop rbp
ret