Function at 0x1001adc0
Capabilities:
Clear file content
Copy file
Delete file
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Get file size
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x2c
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x44]
mov byte [esp + 0x16], 0
mov byte [esp + 0x17], 0
test edi, edi
jne 0x1001ade5
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 8
mov esi, dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push edi
call esi
test eax, eax
je 0x1001ae1d
push edi
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ebx, eax
xor esi, esi
nop
mov eax, dword [esi + 0x101b05c0]
push ebx
push eax
call ebp
test eax, eax
je 0x1001ae18
add esi, 4
cmp esi, 0x6c
jb 0x1001ae00
jmp 0x1001ae1d
mov byte [esp + 0x16], 1
mov ecx, dword [esp + 0x40]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1001b1b7
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push 2
lea edx, [esp + 0x34]
push edx
or ecx, 0xffffffff
mov eax, 0xffffff6f
push ecx
push eax
push esi
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ecx
call ebp
push 1
lea edx, [esp + 0x34]
push edx
xor ecx, ecx
mov eax, 0xe
push ecx
push eax
push esi
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ecx
call ebp
push 0x800
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
mov dword [esp + 0x2c], ebx
test ebx, ebx
je 0x1001b1a9
push 0
lea eax, [esp + 0x1c]
push eax
push 0x40
push ebx
push esi
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea edi, [esp + 0x1c]
mov ecx, 0x800
mov edx, ebx
call fcn.10004070
test eax, eax
jl 0x1001aee2
mov eax, dword [esp + 0x1c]
mov edx, 0x800
sub edx, eax
lea ecx, [eax + ebx]
mov eax, str.dfsa_FGDS_dsaKJiewiu____22121kD_______DSKL909____AA_AdJJMLDMLSXAIO98390dth2nfd__u2j312dsjdAa__FS_DSKkop___29002920_______gf4SAddAA
call fcn.100040d0
push str.dfsa_FGDS_dsaKJiewiu____22121kD_______DSKL909____AA_AdJJMLDMLSXAIO98390dth2nfd__u2j312dsjdAa__FS_DSKkop___29002920_______gf4SAddAA
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push 1
lea edx, [esp + 0x34]
push edx
xor ecx, ecx
lea edi, [eax + ebx + 0x40]
mov eax, 0xe
push ecx
push eax
push esi
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ecx
call ebp
push 0
lea eax, [esp + 0x1c]
push eax
push 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor ecx, ecx
push ecx
lea edx, [esp + 0x34]
push edx
xor eax, eax
push ecx
push eax
push esi
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ecx
call ebp
lea eax, [esp + 0x30]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
add ecx, 0xffffff6f
adc eax, 0xffffffff
cmp byte [esp + 0x16], 0
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
jne 0x1001afdd
test eax, eax
jg 0x1001af92
jl 0x1001af6e
cmp ecx, 0x5f5e100
ja 0x1001af92
push 0
push 0x7d0
push eax
push ecx
call fcn.100e67b0
push 0
push 0x3e8
push edx
push eax
call fcn.100d53f0
mov ecx, eax
or ecx, edx
je 0x1001afb6
jmp 0x1001afae
push 0
push 0x1388
push eax
push ecx
call fcn.100e67b0
push 0
push 0x3e8
push edx
push eax
call fcn.100d53f0
mov dword [esp + 0x34], edx
mov dword [esp + 0x30], eax
mov edi, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
push 0
push edi
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0
push 0x80
push 3
push 0
push 1
push 0x40000000
push edi
jmp 0x1001aff4
mov eax, dword [esp + 0x44]
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1001b19e
cmp byte [esp + 0x16], 0
jne 0x1001b046
push 2
lea edx, [esp + 0x24]
push edx
or ecx, 0xffffffff
mov eax, 0xffffff6f
push ecx
push eax
push edi
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
call ebp
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor ecx, ecx
push ecx
lea edx, [esp + 0x24]
push edx
xor eax, eax
push ecx
push eax
push edi
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
call ebp
cmp dword [esp + 0x34], 0
jl 0x1001b197
jg 0x1001b05e
cmp dword [esp + 0x30], 0
jbe 0x1001b197
push 0xf0000000
push 1
push 0
push 0
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1001b197
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x40]
push ecx
push 0
push 0
push 0x8003
push edx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1001b18a
mov eax, dword [esp + 0x40]
push 0
push 0xfb
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1001b17f
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x20]
push ecx
push 0x800000
push edx
push 0x6801
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x1001b17f
push 0x3f0
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
je 0x1001b17f
cmp dword [esp + 0x34], 0
mov eax, dword [esp + 0x30]
jl 0x1001b10f
jg 0x1001b10a
cmp eax, 0x3e8
jb 0x1001b10f
mov eax, 0x3e8
push 0
lea ecx, [esp + 0x1c]
push ecx
push eax
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
xor bl, bl
sub eax, dword [esp + 0x18]
sbb ecx, 0
mov dword [esp + 0x30], eax
or eax, ecx
mov dword [esp + 0x34], ecx
jne 0x1001b13e
mov bl, 1
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x18]
push edx
push ebp
push 0
movzx eax, bl
push eax
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov eax, dword [esp + 0x18]
push 0
lea edx, [esp + 0x1c]
push edx
push eax
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test bl, bl
je 0x1001b0f6
push ebp
mov byte [esp + 0x1b], 1
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ebx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x40]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov edx, dword [esp + 0x1c]
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov edi, dword [esp + 0x44]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esp + 0x17], 0
jne 0x1001b1be
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, byte [esp + 0x17]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 8