Function at 0x4e2f90
Capabilities:
Contain obfuscated stackstrings
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0x814
mov eax, dword [0x526b24]
xor eax, esp
mov dword [esp + 0x810], eax
mov eax, dword [esp + 0x818]
push ebx
push ebp
push esi
push edi
push 0x800
mov dword [esp + 0x20], eax
lea eax, [esp + 0x24]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov edx, dword [esp + 0x83c]
add esp, 0xc
mov ebx, dword [sym.imp.ADVAPI32.dll_CryptHashData]
mov esi, dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov edi, dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov ebp, dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
test edx, edx
je 0x4e30f2
cmp edx, 0x5230d8
jne 0x4e30d3
mov eax, dword [0x5326c0]
cmp eax, dword [ebx]
jne 0x4e317a
mov eax, dword [0x5326c4]
cmp eax, dword [ebx + 4]
jne 0x4e317a
mov ecx, dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
mov eax, dword [0x5326c8]
cmp eax, dword [ecx]
jne 0x4e317a
mov eax, dword [0x5326cc]
cmp eax, dword [ecx + 4]
jne 0x4e317a
mov eax, dword [0x5326d0]
cmp eax, dword [esi]
jne 0x4e317a
mov eax, dword [0x5326d4]
cmp eax, dword [esi + 4]
jne 0x4e317a
mov ecx, dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov eax, dword [0x5326d8]
cmp eax, dword [ecx]
jne 0x4e317a
mov eax, dword [0x5326dc]
cmp eax, dword [ecx + 4]
jne 0x4e317a
mov eax, dword [0x5326e0]
cmp eax, dword [edi]
jne 0x4e317a
mov eax, dword [0x5326e4]
cmp eax, dword [edi + 4]
jne 0x4e317a
mov eax, dword [0x5326e8]
cmp eax, dword [ebp]
jne 0x4e317a
mov eax, dword [0x5326ec]
cmp eax, dword [ebp + 4]
jne 0x4e317a
mov dword [esp + 0x20], 0x750041
mov dword [esp + 0x24], 0x6f0074
mov dword [esp + 0x28], 0x6f0048
mov dword [esp + 0x2c], 0x6b0074
mov dword [esp + 0x30], 0x790065
jmp 0x4e30f2
mov eax, dword [edx]
xor ecx, ecx
test eax, eax
je 0x4e30f2
nop dword [eax + eax]
mov ax, word [eax]
lea ecx, [ecx + 1]
mov word [esp + ecx*2 + 0x1e], ax
mov eax, dword [edx + ecx*4]
test eax, eax
jne 0x4e30e0
push 0xf0000000
push 0x18
push 0
push 0
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x4e317a
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0x8004
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x4e316e
lea ecx, [esp + 0x20]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4e3130
sub ecx, edx
sar ecx, 1
push 0
lea eax, [ecx + ecx]
push eax
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x20]
call ebx
push 0x800
test eax, eax
lea eax, [esp + 0x24]
push 0
push eax
jne 0x4e3181
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push dword [esp + 0x14]
call esi
push 0
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
jmp 0x4e3237
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [esp + 0x844]
add esp, 0xc
mov edx, ecx
shl edx, 0x10
cmp ecx, 0x80
jne 0x4e31a4
mov eax, 0x660e
jmp 0x4e31b4
xor eax, eax
cmp ecx, 0xc0
setne al
add eax, 0x660f
lea ecx, [esp + 0x18]
push ecx
push edx
push dword [esp + 0x1c]
push eax
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x4e3168
cmp byte [esp + 0x834], 0
je 0x4e3200
mov eax, dword [esp + 0x82c]
add eax, 0x10
push eax
lea eax, [esp + 0x830]
push eax
push dword [esp + 0x24]
push 0
push 1
push 0
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
jmp 0x4e3218
lea eax, [esp + 0x82c]
push eax
push dword [esp + 0x20]
push 0
push 1
push 0
push dword [esp + 0x2c]
call edi
push dword [esp + 0x18]
call ebp
push dword [esp + 0x14]
call esi
push 0
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [esp + 0x82c]
mov ecx, dword [esp + 0x820]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004ebadf
add esp, 0x814
ret