Function at 0x1400abd57
Capabilities:
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov dword [rsp + 0x40], 0
xor esi, esi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x48], rsi
cmp edx, 0x42
jb 0x1400ac17b
mov edi, r9d
mov rbp, r8
mov rbx, rcx
mov rax, qword [rcx]
cmp rax, qword [str._t_]
jne 0x1400abda0
mov edx, dword [rbx + 0x14]
add rbx, 0x18
add edx, 0xffffffc0
mov dword [rsp + 0x44], edx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
xor esi, esi
mov rcx, rbp
mov edx, 0x8004
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.advapi32.dll_CryptCreateHash]
test eax, eax
je 0x1400ac17b
mov rcx, qword [rsp + 0x58]
xor esi, esi
mov rdx, rbx
mov r8d, Ordinal_36
xor r9d, r9d
call qword [sym.imp.advapi32.dll_CryptHashData]
mov rcx, qword [rsp + 0x58]
lea r14, [rsp + 0x40]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], 0
mov edx, edi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.advapi32.dll_CryptSignHashW]
test eax, eax
je 0x1400ac0fb
mov edx, dword [rsp + 0x40]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
je 0x1400ac170
mov r12, rax
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
xor esi, esi
mov edx, edi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.advapi32.dll_CryptSignHashW]
test eax, eax
je 0x1400ac111
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rcx, rbp
mov edx, 0x8004
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.advapi32.dll_CryptCreateHash]
test eax, eax
je 0x1400ac167
mov r8d, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
mov rdi, qword [sym.imp.advapi32.dll_CryptHashData]
xor esi, esi
mov rdx, r12
xor r9d, r9d
call rdi
lea rdx, [rbx + 0x20]
mov rcx, qword [rsp + 0x50]
mov r8d, Ordinal_36
xor r9d, r9d
call rdi
mov r8, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rbp
mov edx, 0x6801
xor r9d, r9d
call qword [sym.imp.advapi32.dll_CryptDeriveKey]
test eax, eax
je 0x1400ac127
lea rax, [rbx + 0x40]
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x44]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rax
xor edx, edx
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.advapi32.dll_CryptDecrypt]
mov esi, eax
test eax, eax
je 0x1400ac13d
mov edx, dword [rsp + 0x44]
add edx, 0xffffffe8
add rbx, 0x58
lea r9, [0x140022c74]
lea r8, [rsp + 0x38]
mov rcx, rbx
call fcn.14001e00e
test eax, eax
je 0x1400ac151
mov rax, qword [rsp + 0x38]
cmp dword [rax], 0
je 0x1400ac0e8
xor ebx, ebx
lea r15, str.iIiI
lea r13, [0x1401212d8]
lea r14, [0x1401212e8]
lea rbp, [0x14015e220]
mov rdi, rbx
shl rdi, 5
lea r8, [rax + rdi]
add r8, 8
mov rcx, r15
mov edx, ebx
call fcn.140016430
mov rax, qword [rsp + 0x38]
lea rdx, [rax + rdi]
add rdx, 8
mov rcx, r13
mov r8b, 1
call sub.ntdll.dll_RtlEqualUnicodeString
mov rcx, qword [rsp + 0x38]
test al, al
je 0x1400abff1
mov rdi, qword [rcx + rdi + 0x20]
mov edx, dword [rdi]
cmp edx, 4
je 0x1400ac07b
test edx, edx
jne 0x1400ac09e
mov eax, dword [rdi + 4]
test al, 1
je 0x1400abfd4
lea rcx, str.YSsSsSsSsS
call fcn.140016430
lea rcx, [rdi + 8]
mov edx, 0x10
xor r8d, r8d
call fcn.140023ac7
mov eax, dword [rdi + 4]
test al, 2
je 0x1400ac0cd
lea rcx, str._JjJjJ
call fcn.140016430
add rdi, 0x18
jmp 0x1400ac091
lea rdx, [rcx + rdi]
add rdx, 8
mov rcx, r14
mov r8b, 1
call sub.ntdll.dll_RtlEqualUnicodeString
test al, al
je 0x1400ac0ac
mov rax, qword [rsp + 0x38]
mov edx, dword [rax + rdi + 0x18]
mov rcx, qword [rax + rdi + 0x20]
lea r8, [rsp + 0x48]
lea r9, [0x140022968]
call fcn.14001e00e
test eax, eax
je 0x1400ac0cd
mov rcx, qword [rsp + 0x48]
cmp dword [rcx], 0
je 0x1400ac061
mov edi, 8
xor ebp, ebp
add rcx, rdi
xor edx, edx
call fcn.1400e6a08
inc rbp
mov rcx, qword [rsp + 0x48]
mov eax, dword [rcx]
add rdi, 0x18
cmp rbp, rax
jb 0x1400ac044
lea rcx, [rsp + 0x48]
lea rdx, [0x140022991]
call fcn.14001e109
lea rbp, [0x14015e220]
jmp 0x1400ac0cd
test byte [rdi + 4], 2
je 0x1400ac0cd
lea rcx, str._JjJjJ
call fcn.140016430
add rdi, 0xc
mov rcx, rdi
mov edx, 0x10
xor r8d, r8d
jmp 0x1400ac0c8
lea rcx, str.XR_aR_R9R_RR_R_RrR_R7R_R_R_RR_RhRrRwRRXRRR
call fcn.140016430
jmp 0x1400ac0cd
mov rcx, rbp
call fcn.140016430
mov rax, qword [rsp + 0x38]
mov edx, dword [rax + rdi + 0x18]
mov rcx, qword [rax + rdi + 0x20]
mov r8d, 0x100001
call fcn.140023ac7
mov rcx, rbp
call fcn.140016430
inc rbx
mov rax, qword [rsp + 0x38]
mov ecx, dword [rax]
cmp rbx, rcx
jb 0x1400abf5b
lea rdx, [0x140022c9d]
lea rcx, [rsp + 0x38]
call fcn.14001e109
jmp 0x1400ac151
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x14015f6c0]
mov edx, eax
call fcn.140016430
jmp 0x1400ac170
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x14015f670]
mov edx, eax
call fcn.140016430
jmp 0x1400ac167
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x14015f620]
mov edx, eax
call fcn.140016430
jmp 0x1400ac15c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.6s_s_s_s_sSsSsHsSs0s
mov edx, eax
call fcn.140016430
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.advapi32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.advapi32.dll_CryptDestroyHash]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.advapi32.dll_CryptDestroyHash]
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret