Function at 0x140017ad0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x40070
call fcn.140024c20
sub rsp, rax
mov rax, qword [0x140073080]
xor rax, rsp
mov qword [rsp + 0x40060], rax
mov rdi, r9
mov rbx, r8
mov r12, rdx
mov r8, r9
lea rdx, str.DecryptFileToBuffer_input___S
lea rcx, [0x140077e88]
call fcn.1400042c0
xor r13d, r13d
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x48], r13
mov r14d, r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x44], r13d
mov r15d, r13d
lea rdx, [0x140064588]
mov rcx, rdi
call fcn.1400308d4
mov rsi, rax
mov qword [rsp + 0x38], rax
lea rcx, [0x140077e88]
test rax, rax
jne 0x140017b75
lea rdx, str.DecryptFileToBuffer_failed_0___fopen_lpszSource__rb____NULL
call fcn.1400042c0
jmp 0x140017db1
lea rdx, str.DecryptFileToBuffer_success_0
call fcn.1400042c0
mov dword [rsp + 0x20], r13d
mov r9d, 1
xor r8d, r8d
mov rdx, r12
lea rcx, [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x140017c09
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x140077e88]
cmp eax, 0x80090016
jne 0x140017bfd
lea rdx, str.DecryptFileToBuffer_success_1
call fcn.1400042c0
mov dword [rsp + 0x20], 8
mov r9d, 1
xor r8d, r8d
mov rdx, r12
lea rcx, [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
lea rcx, [0x140077e88]
test eax, eax
jne 0x140017bf4
lea rdx, str.DecryptFileToBuffer_failed_2_____CryptAcquireContextA_hProv__lpszContainerName__NULL__PROV_RSA_FULL__CRYPT_NEWKEYSET__
jmp 0x140017c04
lea rdx, str.DecryptFileToBuffer_success_2
jmp 0x140017c04
lea rdx, str.DecryptFileToBuffer_failed_1___dwErr___0x80090016L
call fcn.1400042c0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8003
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140017db1
mov r13, 0xffffffffffffffff
mov r8, r13
nop dword [rax + rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x140017c40
xor r9d, r9d
mov rdx, rbx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x140017db8
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x800000
mov r8, qword [rsp + 0x48]
mov edx, 0x6801
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x140017db8
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov qword [rsp + 0x48], 0
mov ecx, 0x3e8
call fcn.140024144
mov r14, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140017db8
xor edx, edx
mov r8d, 0x40000
lea rcx, [rsp + 0x60]
call fcn.140026cc0
mov r12d, 2
nop word [rax + rax]
mov r9, rsi
mov edx, 1
mov r8d, 0x3e8
mov rcx, r14
call fcn.140030f2c
mov dword [rsp + 0x44], eax
mov rcx, rsi
call fcn.1400307ec
test eax, eax
jne 0x140017dbe
mov rcx, rsi
call fcn.1400307c0
lea rcx, [rsp + 0x44]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8d, eax
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x140017dbe
xor edi, edi
test r15d, r15d
cmove edi, r12d
mov ebx, dword [rsp + 0x44]
mov r8d, ebx
sub r8d, edi
mov edx, edi
add rdx, r14
mov eax, r15d
lea rcx, [rsp + 0x60]
add rcx, rax
call fcn.140026770
mov eax, ebx
sub eax, edi
add r15d, eax
mov dword [rsp + 0x40], r15d
mov r9d, r15d
mov r8d, ebx
lea rdx, str.DecryptFileToBuffer__while___feof_hSource____dwCount___d__dwOutBufferSize___d
lea rcx, [0x140077e88]
call fcn.1400042c0
mov rcx, rsi
call fcn.1400307c0
test eax, eax
je 0x140017ce0
mov r8d, r15d
lea rdx, str.DecryptFileToBuffer__out_while__blRet__TRUE__dwOutBufferSize___d
lea rcx, [0x140077e88]
call fcn.1400042c0
jmp 0x140017dbe
mov r13, 0xffffffffffffffff
mov r12d, 2
test r14, r14
je 0x140017dcb
mov rcx, r14
call fcn.140023e64
lea rdx, str.DecryptFileToBuffer__after_delete_pbBuffer
lea rcx, [0x140077e88]
call fcn.1400042c0
test rsi, rsi
je 0x140017deb
mov rcx, rsi
call fcn.140030964
lea rdx, str.DecryptFileToBuffer__after_fclose_hSource_
lea rcx, [0x140077e88]
call fcn.1400042c0
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140017e0e
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
lea rdx, str.DecryptFileToBuffer__after_CryptDestroyKey_hKey_
lea rcx, [0x140077e88]
call fcn.1400042c0
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140017e31
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
lea rdx, str.DecryptFileToBuffer__after_CryptDestroyHash_hHash_
lea rcx, [0x140077e88]
call fcn.1400042c0
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140017e56
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea rdx, str.DecryptFileToBuffer__after_CryptReleaseContext_hProv__0_
lea rcx, [0x140077e88]
call fcn.1400042c0
mov ebx, r15d
shr ebx, 1
inc ebx
mov rdi, qword [0x140077f50]
test rdi, rdi
je 0x140017e9e
mov rcx, rdi
call fcn.140023e64
mov rcx, qword [0x140077f50]
mov eax, 0x8123
test rdi, rdi
cmovne rcx, rax
mov qword [0x140077f50], rcx
mov rax, r12
mul rbx
cmovo rax, r13
mov rcx, rax
call fcn.140024144
mov qword [0x140077f50], rax
lea rdx, str.DecryptFileToBuffer__before_ZeroMemory_p__sizeof_wchar_t___length_
lea rcx, [0x140077e88]
call fcn.1400042c0
lea r8, [rbx + rbx]
xor edx, edx
mov rcx, qword [0x140077f50]
call fcn.140026cc0
mov r8d, r15d
lea rdx, str.DecryptFileToBuffer__after_ZeroMemory_p__sizeof_wchar_t___length___dwOutBufferSize___d
lea rcx, [0x140077e88]
call fcn.1400042c0
mov r8d, r15d
lea rdx, [rsp + 0x60]
mov rcx, qword [0x140077f50]
call fcn.140026770
mov rax, qword [0x140077f50]
mov rcx, qword [rsp + 0x40060]
xor rcx, rsp
call fcn.140023e40
add rsp, 0x40070
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret