Function at 0x4e9197
Capabilities:
Encode data using xor
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
lea ebp, [esp - 0xa8]
sub esp, 0x128
mov eax, dword [0x665ebc]
xor eax, ebp
mov dword [ebp + 0xa4], eax
mov eax, dword [ebp + 0xb8]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0xc0]
push esi
mov esi, dword [ebp + 0xb0]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0xc8]
push edi
xor edi, edi
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0xd8]
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x6c], edi
cmp dword [ebp + 0xd0], edi
jne 0x4e91fb
xor eax, eax
jmp 0x4e93b3
push ebx
mov ebx, 0x80
push ebx
lea eax, [ebp - 0x5c]
push edi
push eax
call fcn.0059cb30
push ebx
lea eax, [ebp + 0x24]
push edi
push eax
call fcn.0059cb30
and dword [ebp + 0xb4], 0x7f
push dword [ebp + 0xb4]
lea eax, [ebp - 0x5c]
push esi
push eax
call fcn.0059d730
push dword [ebp + 0xb4]
lea eax, [ebp + 0x24]
push esi
push eax
call fcn.0059d730
add esp, 0x30
xor eax, eax
xor dword [ebp + eax - 0x5c], 0x36363636
xor dword [ebp + eax + 0x24], 0x5c5c5c5c
add eax, 4
cmp eax, ebx
jb 0x4e9243
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x68]
push eax
push edi
push edi
push dword [ebp + 0xd4]
push dword [ebp + 0xd0]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x4e9302
mov esi, dword [sym.imp.ADVAPI32.dll_CryptHashData]
push edi
push ebx
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x68]
call esi
test eax, eax
je 0x4e9302
push edi
push dword [ebp + 0xbc]
push dword [ebp - 0x80]
push dword [ebp - 0x68]
call esi
test eax, eax
je 0x4e9302
cmp dword [ebp - 0x64], edi
je 0x4e92c5
cmp dword [ebp + 0xc4], edi
je 0x4e92c5
push edi
push dword [ebp + 0xc4]
push dword [ebp - 0x64]
push dword [ebp - 0x68]
call esi
test eax, eax
je 0x4e9302
cmp dword [ebp - 0x7c], edi
je 0x4e92e5
cmp dword [ebp + 0xcc], edi
je 0x4e92e5
push edi
push dword [ebp + 0xcc]
push dword [ebp - 0x7c]
push dword [ebp - 0x68]
call esi
test eax, eax
je 0x4e9302
push 4
pop eax
push edi
lea ecx, [ebp - 0x70]
push ecx
lea ecx, [ebp - 0x6c]
push ecx
push eax
push dword [ebp - 0x68]
mov dword [ebp - 0x70], eax
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x4e9311
mov eax, dword [ebp - 0x60]
mov dword [eax + 4], 0xb
jmp 0x4e93a1
push dword [ebp - 0x6c]
call fcn.00564e4a
pop ecx
mov dword [ebp - 0x64], eax
cmp eax, edi
jne 0x4e932d
mov eax, dword [ebp - 0x60]
mov dword [eax + 4], 5
jmp 0x4e93a1
push edi
lea ecx, [ebp - 0x6c]
push ecx
push eax
push 2
push dword [ebp - 0x68]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x4e9356
push dword [ebp - 0x64]
mov eax, dword [ebp - 0x60]
mov dword [eax + 4], 0xb
call fcn.00564e3f
jmp 0x4e93a0
push dword [ebp - 0x78]
push edi
push edi
push dword [ebp + 0xd4]
push dword [ebp + 0xd0]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x4e9342
push edi
push ebx
mov ebx, dword [ebp - 0x78]
lea eax, [ebp + 0x24]
push eax
push dword [ebx]
call esi
test eax, eax
je 0x4e9342
push edi
push dword [ebp - 0x6c]
push dword [ebp - 0x64]
push dword [ebx]
call esi
push dword [ebp - 0x64]
test eax, eax
je 0x4e9345
call fcn.00564e3f
mov dword [ebp - 0x74], 1
pop ecx
pop ebx
cmp dword [ebp - 0x68], edi
je 0x4e93b0
push dword [ebp - 0x68]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp + 0xa4]
pop edi
xor ecx, ebp
pop esi
call fcn.0059ca15
add ebp, 0xa8
leave
ret 0x2c