Function at 0x180031340
Capabilities:
Delete file
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt
Read file on windows
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x10a0]
mov eax, 0x11a0
call fcn.180082320
sub rsp, rax
movaps xmmword [rsp + 0x1190], xmm6
mov rax, qword [0x1800c8010]
xor rax, rsp
mov qword [rbp + 0x1080], rax
mov rdi, rcx
mov r14d, r9d
mov rcx, rdx
mov rsi, r8
mov r15, rdx
xor bl, bl
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edx, edx
lea rcx, [rbp - 0x80]
mov r8d, 0x100
call fcn.180059570
xor r12d, r12d
mov dword [rsp + 0x54], 0x100
mov qword [rsp + 0x60], r12
mov ecx, r12d
mov qword [rsp + 0x68], r12
mov edx, 0xac16
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x48], 0xac64ac16
mov dword [rsp + 0x4c], 0xac75
nop dword [rax]
nop word [rax + rax]
lea eax, [rdx + rcx]
xor word [rsp + rcx*2 + 0x4a], ax
inc rcx
cmp rcx, 2
jae 0x180031408
movzx edx, word [rsp + 0x48]
jmp 0x1800313f0
lea r8, [rsp + 0x4a]
mov word [rsp + 0x4e], r12w
mov rdx, rdi
lea rcx, [rsp + 0x38]
call fcn.180067b80
mov r9, qword [rsp + 0x38]
movsd xmm6, qword [0x1800ba7c8]
test r9, r9
je 0x1800316d6
mov edx, 4
mov dword [rsp + 0x48], r12d
lea rcx, [rsp + 0x48]
lea r8d, [rdx - 3]
call fcn.180068e28
mov r9, qword [rsp + 0x38]
lea rcx, [rbp - 0x80]
mov edx, 1
lea r8d, [rdx + 0x7f]
call fcn.180068e28
movaps xmm1, xmm6
lea rcx, [0x1800a7d98]
movq rdx, xmm6
call fcn.18000ba10
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000040
lea r8, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
xor edx, edx
lea rcx, [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1800314f9
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov r8d, r14d
mov dword [rsp + 0x20], r12d
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x1800314ec
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rbp - 0x80]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov rcx, qword [rsp + 0x68]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
movaps xmm1, xmm6
lea rcx, [0x1800a7d98]
movq rdx, xmm6
call fcn.18000ba10
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
lea rcx, [rsp + 0x60]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1800316bc
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x8003
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1800316af
mov r8d, dword [rsp + 0x54]
lea rdx, [rbp - 0x80]
mov rcx, qword [rsp + 0x58]
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1800316a4
mov r8, qword [rsp + 0x58]
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
xor r9d, r9d
mov edx, 0x6801
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x1800316a4
mov r8d, 0xd868
mov dword [rsp + 0x50], r12d
mov ecx, 0xd80a
mov word [rsp + 0x30], r8w
xor cx, r8w
mov qword [rsp + 0x40], r12
mov eax, 0xd81f
mov word [rsp + 0x34], cx
xor ax, r8w
mov word [rsp + 0x36], r12w
lea rcx, [rsp + 0x40]
mov word [rsp + 0x32], ax
lea r8, [rsp + 0x32]
mov rdx, r15
call fcn.180067b80
cmp qword [rsp + 0x40], r12
je 0x180031699
nop dword [rax]
mov r9, qword [rsp + 0x38]
lea rcx, [rbp + 0x80]
mov edx, 1
mov r8d, 0x1000
call fcn.180068e28
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x50], eax
call fcn.180068b34
mov rcx, qword [rsp + 0x70]
mov ebx, eax
xor r9d, r9d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
xor edx, edx
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x180031679
mov r8d, dword [rsp + 0x50]
lea rcx, [rbp + 0x80]
mov r9, qword [rsp + 0x40]
mov edx, 1
call fcn.1800683d0
test ebx, ebx
je 0x180031600
movaps xmm1, xmm6
lea rcx, [0x1800a7d98]
movq rdx, xmm6
call fcn.18000ba10
mov rcx, qword [rsp + 0x40]
call fcn.180067c5c
mov bl, 1
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x60]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1800316cc
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x38]
call fcn.180067c5c
movaps xmm1, xmm6
lea rcx, [0x1800a7d98]
movq rdx, xmm6
call fcn.18000ba10
movzx eax, bl
mov rcx, qword [rbp + 0x1080]
xor rcx, rsp
call fcn.1800555d0
movaps xmm6, xmmword [rsp + 0x1190]
add rsp, 0x11a0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret