Function at 0x406b90
Capabilities:
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Get file size
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt
Read file on windows

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x1c]
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 3
push closesocket
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov dword [esp + 0x28], edi
cmp edi, 0xffffffff
jne 0x406bd2
pop edi
mov dword [esi + 0x44], 1
pop esi
xor al, al
pop ebx
add esp, 0x18
ret 0x10
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x24], eax
cmp eax, 0xffffffff
jne 0x406bfb
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov dword [esi + 0x44], 0xb
pop esi
xor al, al
pop ebx
add esp, 0x18
ret 0x10
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x406c0e
push eax
call fcn.004b8a69
add esp, 4
mov dword [esi + 4], ebx
mov ecx, dword [esi + 0x24]
push ecx
call fcn.004b958c
add esp, 4
mov dword [esi + 4], eax
cmp eax, ebx
jne 0x406c3a
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov dword [esi + 0x44], 2
pop esi
xor al, al
pop ebx
add esp, 0x18
ret 0x10
mov ecx, dword [esi + 0x24]
push ebx
lea edx, [esp + 0x14]
push edx
push ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esi + 0x24]
cmp dword [esp + 0x10], ecx
je 0x406c6e
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov dword [esi + 0x44], 3
pop esi
xor al, al
pop ebx
add esp, 0x18
ret 0x10
push ebp
mov ebp, dword [esi + 4]
mov edx, dword [ecx + ebp - 0x10]
mov dword [esi + 0x28], edx
mov eax, dword [ecx + ebp - 0xc]
mov dword [esi + 0x2c], eax
mov edx, dword [ecx + ebp - 8]
mov dword [esi + 0x30], edx
mov eax, dword [ecx + ebp - 4]
mov dword [esi + 0x34], eax
cmp dword [esi + 0x28], 0x32812622
jne 0x406d6d
cmp eax, 0x32812621
jne 0x406d6d
mov edx, dword [esi + 0x2c]
mov eax, dword [esi + 0x30]
lea edi, [eax + edx + 0x10]
mov eax, ecx
sub eax, edi
mov dword [esi + 0x38], edx
xor edx, edx
mov dword [esi + 0x20], edi
mov byte [esi + 0x1c], 1
mov dword [esi + 8], eax
mov edi, edx
mov dword [esp + 0x20], edx
cmp eax, 0x10
jbe 0x406ce2
mov ebx, dword [eax + ebp - 8]
mov edx, dword [eax + ebp - 0x10]
mov edi, dword [eax + ebp - 0xc]
mov dword [esp + 0x20], ebx
mov ebx, dword [eax + ebp - 4]
cmp edx, 0x32812624
jne 0x406d1d
cmp ebx, 0x32812623
jne 0x406d1d
sub ecx, dword [esi + 0x20]
mov eax, dword [esp + 0x20]
mov dword [esi + 0x28], edx
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], eax
lea eax, [eax + edi + 0x10]
mov edx, ecx
sub edx, eax
mov dword [esi + 0x34], ebx
mov dword [esi + 0x24], ecx
mov byte [esi + 0x1c], 1
mov dword [esi + 0x20], eax
mov dword [esi + 8], edx
mov dword [esi + 0x38], edi
mov edi, dword [esp + 0x2c]
xor ebx, ebx
cmp ecx, dword [esi + 0x20]
jae 0x406d37
mov byte [esi + 0x1c], bl
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0x38], ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], ebx
jne 0x406d8c
push 0xf0000000
push 1
push 0x50163c
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x406d8c
pop ebp
pop edi
mov dword [esi + 0x44], 4
pop esi
xor al, al
pop ebx
add esp, 0x18
ret 0x10
xor eax, eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov ecx, dword [esi + 0x24]
mov byte [esi + 0x1c], bl
mov dword [esi + 0x20], ebx
mov dword [esi + 8], ecx
mov dword [esi + 0x38], ebx
jmp 0x406d23
mov eax, dword [esi + 0x40]
lea ebp, [esi + 0x40]
cmp eax, ebx
je 0x406da0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov dword [ebp], ebx
mov eax, dword [esi]
push ebp
push ebx
push ebx
push 0x8003
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x406dc8
pop ebp
pop edi
mov dword [esi + 0x44], 5
pop esi
xor al, al
pop ebx
add esp, 0x18
ret 0x10
mov edx, dword [esp + 0x38]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x406dd1
mov ecx, dword [ebp]
push ebx
sub eax, edi
push eax
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x406dfe
pop ebp
pop edi
mov dword [esi + 0x44], 6
pop esi
xor al, al
pop ebx
add esp, 0x18
ret 0x10
mov eax, dword [esi + 0x3c]
lea edi, [esi + 0x3c]
cmp eax, ebx
je 0x406e11
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov dword [edi], ebx
mov edx, dword [ebp]
mov eax, dword [esi]
push edi
push ebx
push edx
push 0x6801
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x406e3c
pop ebp
pop edi
mov dword [esi + 0x44], 7
pop esi
xor al, al
pop ebx
add esp, 0x18
ret 0x10
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
lea edx, [esp + 0x10]
push edx
push eax
push ebx
push 1
mov dword [esp + 0x20], ecx
mov ecx, dword [edi]
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x406ea2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090010
je 0x406e7d
pop ebp
pop edi
mov dword [esi + 0x44], 8
pop esi
xor al, al
pop ebx
add esp, 0x18
ret 0x10
mov edx, dword [esp + 0x10]
mov eax, dword [esi + 4]
push edx
push eax
mov ecx, esi
call fcn.00406ac0
test al, al
jne 0x406ea2
pop ebp
pop edi
mov dword [esi + 0x44], 0x58
pop esi
pop ebx
add esp, 0x18
ret 0x10
mov eax, dword [esi + 8]
mov edi, dword [esp + 0x34]
cmp edi, eax
jbe 0x406eaf
mov edi, eax
mov ecx, dword [esi + 4]
mov ebp, dword [esp + 0x30]
push edi
push ecx
push ebp
call fcn.004b6e40
mov byte [edi + ebp], bl
mov eax, dword [esi + 4]
add esp, 0xc
cmp eax, ebx
je 0x406ed7
push eax
call fcn.004b8a69
add esp, 4
mov dword [esi + 4], ebx
pop ebp
pop edi
pop esi
mov al, 1
pop ebx
add esp, 0x18
ret 0x10