Function at 0x10003d70
Capabilities:
Delete file
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Get file size
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt
Query or enumerate registry value
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x42c
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x428], eax
mov eax, dword [esp + 0x430]
push ebx
push ebp
push esi
push 0x400
mov ebx, ecx
xor ebp, ebp
lea ecx, [esp + 0x38]
push ebp
push ecx
mov dword [esp + 0x30], eax
call fcn.100d4cc0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
add esp, 0xc
lea edx, [esp + 0x20]
push edx
push str.SYSTEMControlSet001_
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x10003de0
lea eax, [esp + 0x20]
push eax
push str.SYSTEMCurrentControlSet_
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x10003de0
xor eax, eax
jmp 0x10004054
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x38]
push eax
push ebp
push str.AllcryID
push ecx
mov dword [esp + 0x44], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x20]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebp
jne 0x10003dd9
push edi
lea edi, [esp + 0x18]
mov ecx, 0x400
lea edx, [esp + 0x38]
call fcn.10004070
test eax, eax
jl 0x10003e49
mov eax, dword [esp + 0x18]
mov edx, 0x400
sub edx, eax
lea ecx, [esp + eax + 0x38]
mov eax, str.r7nKp9Nwl5g6cqNnyho19A5753sPS0Bn12__64_7TUqpodB__ivCwyetoSYDSAEW321908dsak7_67_____kds09___110001DSA11
call fcn.100040d0
push 0xf0000000
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push ebp
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x24], ebp
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x10003f17
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push ebp
push ebp
push 0x8003
push edx
mov dword [esp + 0x28], ebp
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
push ebp
test eax, eax
jne 0x10003e9f
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
jmp 0x10004053
lea ecx, [esp + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x40]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
mov ecx, dword [esp + 0x14]
test eax, eax
jne 0x10003edd
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov edx, dword [esp + 0x10]
push ebp
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
jmp 0x10004053
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x20]
push eax
push 0x800000
push ecx
push 0x6801
push edx
mov dword [esp + 0x34], ebp
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x10003f1e
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov ecx, dword [esp + 0x10]
push ebp
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
jmp 0x10004053
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push ebx
call esi
mov edi, eax
mov dword [esp + 0x18], edi
cmp edi, 0xffffffff
je 0x1000402e
mov edx, dword [esp + 0x28]
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push edx
call esi
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10004027
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
jbe 0x1000400c
push 0x3e8
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x10004011
mov dword [esp + 0x1c], ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov edi, edi
push 0
lea eax, [esp + 0x20]
push eax
push 0x3e8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x1c]
test eax, eax
jbe 0x10003ffe
xor ecx, ecx
cmp eax, 0x3e8
setne cl
lea edx, [esp + 0x1c]
push edx
push esi
push 0
mov edi, eax
mov eax, dword [esp + 0x2c]
push ecx
push 0
push eax
call ebp
mov edx, dword [esp + 0x1c]
push 0
lea ecx, [esp + 0x30]
push ecx
push edx
push esi
push ebx
mov dword [esp + 0x40], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test edi, edi
mov edi, dword [esp + 0x18]
ja 0x10003fa0
push esi
mov ebp, 1
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x10004011
mov ebp, 1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
jne 0x10004027
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [esp + 0x10]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, ebp
pop edi
mov ecx, dword [esp + 0x434]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100d0738
add esp, 0x42c
ret 4