Function at 0x140002c50
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Get file size
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt
Read file on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
mov qword [rax + 8], rbx
mov qword [rax - 0x18], rsi
xor edi, edi
mov qword [rax - 0x48], rdi
mov qword [rax - 0x20], r12
mov qword [rax - 0x28], r13
mov r13d, 1
mov rsi, rcx
mov rbx, rdx
mov dword [rax - 0x50], 0x80
lea rcx, str.brbconfig.tmp
xor r9d, r9d
mov r8d, r13d
mov edx, r13d
mov qword [rax - 0x30], rdi
mov qword [rax - 0x38], rdi
mov qword [rax + 0x20], rdi
mov dword [rax - 0x58], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x140002cd1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test eax, eax
jle 0x140002ef1
movzx edi, ax
or edi, 0x80070000
jmp 0x140002ef1
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x68], rbp
call qword [sym.imp.KERNEL32.dll_GetFileSize]
inc eax
mov dword [rbx], eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea r8, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
lea rcx, [rsp + 0x98]
mov r9d, r13d
xor edx, edx
mov dword [rsp + 0x20], edi
mov rbp, rax
mov qword [rsi], rax
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x140002d2c
call qword [sym.imp.KERNEL32.dll_GetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x140002d7d
lea r8, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
lea rcx, [rsp + 0x98]
mov r9d, r13d
xor edx, edx
mov dword [rsp + 0x20], 8
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x140002d7d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test eax, eax
jle 0x140002ee7
movzx edi, ax
or edi, 0x80070000
jmp 0x140002ee7
mov rcx, qword [rsp + 0x98]
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8003
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140002d5f
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
lea rdx, str.YnJiYm90
lea r8d, [r9 + 8]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x140002d5f
mov r8, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x98]
lea rax, [rsp + 0x48]
mov r9d, 0x800000
mov edx, 0x6801
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x140002d5f
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x3e8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
jne 0x140002e1d
mov edi, 0x8007000e
jmp 0x140002ee7
xor bl, bl
nop
lea r9, [rsp + 0x90]
mov r8d, 0x3e8
mov rdx, rsi
mov rcx, r12
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140002ebc
mov eax, dword [rsp + 0x90]
movzx ebx, bl
cmp eax, 0x3e8
cmovb ebx, r13d
test eax, eax
je 0x140002ed3
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x90]
movzx r8d, bl
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x140002ebc
mov r8d, dword [rsp + 0x90]
mov rdx, rsi
mov rcx, rbp
call fcn.140008d00
xor edx, edx
mov r8d, 0x3e8
mov rcx, rsi
call fcn.1400044b0
mov r11d, dword [rsp + 0x90]
add rbp, r11
test bl, bl
je 0x140002e20
jmp 0x140002ed3
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x140002eca
mov edi, eax
jmp 0x140002ed3
movzx edi, ax
or edi, 0x80070000
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbp, qword [rsp + 0x68]
test r12, r12
je 0x140002efa
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x40]
mov r13, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x80]
test rcx, rcx
je 0x140002f21
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140002f31
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x140002f46
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, edi
add rsp, 0x70
pop rdi
ret