Function at 0x1800089d0
Capabilities:
Delete file
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Generate random numbers via winapi
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt
Read file on windows
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x10a0]
mov eax, 0x11a0
call fcn.180029e20
sub rsp, rax
mov rax, qword [0x180074020]
xor rax, rsp
mov qword [rbp + 0x1090], rax
mov rdi, rcx
mov r15d, r9d
mov rcx, rdx
mov r14, r8
mov rsi, rdx
xor bl, bl
call qword [sym.imp.KERNEL32.DLL_DeleteFileW]
xor r12d, r12d
mov dword [rsp + 0x54], 0x75
xor edx, edx
mov qword [rsp + 0x60], r12
mov r8d, 0x100
mov qword [rsp + 0x70], r12
lea rcx, [rbp - 0x70]
mov qword [rsp + 0x68], r12
mov qword [rbp - 0x80], r12
mov qword [rsp + 0x78], r12
call fcn.18002b450
lea r9d, [r12 + 1]
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
lea rcx, [rsp + 0x60]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x180008ce8
mov edx, dword [rsp + 0x54]
lea r8, [rbp - 0x70]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x180008cdb
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x8003
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x180008cdb
mov r8d, dword [rsp + 0x54]
lea rdx, [rbp - 0x70]
mov rcx, qword [rsp + 0x68]
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x180008cd0
mov r8, qword [rsp + 0x68]
lea rax, [rbp - 0x80]
mov rcx, qword [rsp + 0x60]
xor r9d, r9d
mov edx, 0x6801
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x180008cd0
lea r9d, [r12 + 1]
mov dword [rsp + 0x20], 0xf0000040
lea r8, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
xor edx, edx
lea rcx, [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x180008b83
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov r8d, r15d
mov dword [rsp + 0x20], r12d
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x180008b76
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x54]
mov dword [rsp + 0x30], 0x100
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rbp - 0x70]
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov rcx, qword [rsp + 0x70]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea r8, [0x18006272c]
mov dword [rsp + 0x50], r12d
mov rdx, rdi
mov dword [rsp + 0x58], r12d
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x48], r12
call fcn.180030b60
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x180008cb6
call fcn.18003a8b0
mov ecx, eax
call fcn.18003a8a8
lea r8, [0x1800627a4]
mov dword [rsp + 0x58], eax
mov rdx, rsi
mov qword [rsp + 0x40], r12
lea rcx, [rsp + 0x40]
call fcn.180030b60
mov r9, qword [rsp + 0x40]
test r9, r9
je 0x180008cac
mov edx, 1
lea rcx, [rsp + 0x58]
lea r8d, [rdx + 3]
call fcn.180031954
mov r9, qword [rsp + 0x40]
lea rcx, [rbp - 0x70]
mov edx, 1
lea r8d, [rdx + 0x7f]
call fcn.180031954
nop word [rax + rax]
mov r9, qword [rsp + 0x48]
lea rcx, [rbp + 0x90]
mov edx, 1
mov r8d, 0x1000
call fcn.180031554
mov rcx, qword [rsp + 0x48]
mov dword [rsp + 0x50], eax
call fcn.18003a8d8
mov ecx, dword [rsp + 0x50]
mov ebx, eax
mov dword [rsp + 0x30], ecx
lea rax, [rsp + 0x50]
mov rcx, qword [rbp - 0x80]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
lea rax, [rbp + 0x90]
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x180008ca0
mov r8d, dword [rsp + 0x50]
lea rcx, [rbp + 0x90]
mov r9, qword [rsp + 0x40]
mov edx, 1
call fcn.180031954
test ebx, ebx
je 0x180008c20
mov rcx, qword [rsp + 0x40]
call fcn.1800316a0
mov bl, 1
mov rcx, qword [rsp + 0x48]
call fcn.1800316a0
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x180008cc6
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x60]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
movzx eax, bl
mov rcx, qword [rbp + 0x1090]
xor rcx, rsp
call fcn.1800292f0
add rsp, 0x11a0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret