Function at 0x1001b720
Capabilities:
Delete file
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Get file size
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x20
push ebx
push ebp
xor ebp, ebp
push esi
push edi
mov byte [esp + 0x17], 0
cmp eax, ebp
je 0x1001b93f
mov ebx, dword [esp + 0x34]
cmp ebx, ebp
je 0x1001b93f
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push ebp
push 0x80
push 3
push ebp
push 1
push SysReAllocString
push eax
call esi
mov edi, eax
cmp edi, 0xffffffff
je 0x1001b92a
lea eax, [esp + 0x28]
push eax
push edi
mov dword [esp + 0x20], ebp
mov dword [esp + 0x30], 0x3e8
mov dword [esp + 0x34], ebp
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
add dword [esp + 0x28], 0xfffffc18
push ebp
push ebp
adc dword [esp + 0x34], 0xffffffff
push 0x3e8
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [esp + 0x2c], ebp
jl 0x1001b91c
jg 0x1001b7b3
cmp dword [esp + 0x28], ebp
jbe 0x1001b91c
push ebp
push 0x80
push 2
push ebp
push 1
push 0x40000000
push ebx
call esi
mov ebp, eax
cmp ebp, 0xffffffff
je 0x1001b91c
push 0xf0000000
push 1
push 0
push 0
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1001b915
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x1c]
push edx
push 0
push 0
push 0x8003
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1001b908
push 0
push 0x101dec01
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0x20]
push eax
push 0x101dec01
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1001b8fd
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x24]
push edx
push 0x800000
push eax
push 0x6801
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x1001b8fd
push 0x3f0
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x1001b8fd
cmp dword [esp + 0x2c], 0
mov eax, dword [esp + 0x28]
jl 0x1001b88d
jg 0x1001b888
cmp eax, 0x3e8
jb 0x1001b88d
mov eax, 0x3e8
push 0
lea edx, [esp + 0x1c]
push edx
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
xor bl, bl
sub eax, dword [esp + 0x18]
sbb ecx, 0
mov dword [esp + 0x28], eax
or eax, ecx
mov dword [esp + 0x2c], ecx
jne 0x1001b8bc
mov bl, 1
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x18]
push eax
push esi
push 0
movzx ecx, bl
push ecx
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov ecx, dword [esp + 0x18]
push 0
lea eax, [esp + 0x1c]
push eax
push ecx
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test bl, bl
je 0x1001b874
push esi
mov byte [esp + 0x1b], 1
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ebx, dword [esp + 0x34]
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [esp + 0x20]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esp + 0x17], 0
jne 0x1001b931
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, byte [esp + 0x17]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x20
ret 4