Function at 0x10008680
Capabilities:
Create new key via cryptacquirecontext
Delete file
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Get file size
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x2c
cmp dword [esp + 0x34], 0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x3c]
push edi
mov byte [esp + 0x17], 0
je 0x100087c2
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
call ebx
lea eax, [eax + eax + 2]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x100087c2
push esi
call ebx
lea ecx, [eax + eax + 2]
shr ecx, 1
je 0x100086d7
cmp ecx, 0x7fffffff
ja 0x100086d7
mov eax, esi
mov edx, edi
call fcn.10003cf0
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push edi
xor esi, esi
call ebx
test eax, eax
je 0x1000870e
mov ebp, dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
lea esp, [esp]
push str..eoeo
push edi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1000870e
push edi
call ebp
push edi
inc esi
call ebx
test eax, eax
jne 0x100086f0
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea eax, [esi*4]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
mov dword [esp + 0x2c], ebx
test ebx, ebx
je 0x100087c2
xor edi, edi
test esi, esi
jbe 0x1000875e
mov ebp, ebx
jmp 0x10008740
push 0xf0000000
push 0x18
push 0
push 0
push ebp
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x100087a2
inc edi
add ebp, 4
cmp edi, esi
jb 0x10008740
lea eax, [esi*4]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [esp + 0x18], eax
test eax, eax
jne 0x100087ce
xor edi, edi
test esi, esi
jbe 0x1000878f
mov ebp, dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov edx, dword [ebx + edi*4]
push 0
push edx
call ebp
inc edi
cmp edi, esi
jb 0x10008782
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 8
xor esi, esi
test edi, edi
jbe 0x100087bb
mov ebp, dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebx + esi*4]
push 0
push ecx
call ebp
inc esi
cmp esi, edi
jb 0x100087ae
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 8
xor ebp, ebp
test esi, esi
jbe 0x10008809
mov eax, dword [esp + 0x18]
sub eax, ebx
mov edi, ebx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov ecx, dword [edi]
add eax, edi
push eax
push 0
push 0
push 0x8003
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x10008895
inc ebp
add edi, 4
cmp ebp, esi
jb 0x100087e0
xor edi, edi
test esi, esi
jbe 0x1000884a
mov ebp, dword [sym.imp.ADVAPI32.dll_CryptHashData]
jmp 0x10008820
push 1
push str.54xC41nY
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx + edi*4]
push eax
push str.54xC41nY
push edx
call ebp
test eax, eax
je 0x100088d9
inc edi
cmp edi, esi
jb 0x10008820
lea eax, [esi*4]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [esp + 0x20], eax
test eax, eax
jne 0x1000891a
test esi, esi
jbe 0x100088fe
mov ebp, dword [esp + 0x18]
mov edi, ebx
sub ebp, ebx
mov eax, dword [edi + ebp]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov ecx, dword [edi]
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
add edi, 4
sub esi, 1
jne 0x10008876
jmp 0x100088fe
xor edi, edi
mov edx, dword [ebx + edi*4]
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
inc edi
cmp edi, esi
jb 0x10008897
mov edi, dword [esp + 0x18]
xor esi, esi
test ebp, ebp
jbe 0x100088c1
mov eax, dword [edi + esi*4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
inc esi
cmp esi, ebp
jb 0x100088b2
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
call esi
push edi
call esi
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 8
mov ebp, dword [esp + 0x18]
mov edi, ebx
sub ebp, ebx
mov eax, dword [edi + ebp]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov ecx, dword [edi]
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
add edi, 4
sub esi, 1
jne 0x100088e1
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
call esi
mov edx, dword [esp + 0x18]
push edx
call esi
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 8
xor ebp, ebp
test esi, esi
jbe 0x10008965
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
sub eax, edi
mov dword [esp + 0x28], eax
mov eax, ebx
sub eax, edi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x28]
mov ecx, dword [edi]
mov edx, dword [esp + 0x24]
add eax, edi
push eax
mov eax, dword [edx + edi]
push 1
push ecx
push 0x6610
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x10008a70
inc ebp
add edi, 4
cmp ebp, esi
jb 0x10008936
mov ecx, dword [esp + 0x40]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileW]
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push ecx
call ebp
mov edi, eax
mov dword [esp + 0x28], edi
cmp edi, 0xffffffff
je 0x10008b4f
lea edx, [esp + 0x30]
push edx
push edi
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [esp + 0x44]
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
push eax
call ebp
mov dword [esp + 0x24], eax
cmp eax, 0xffffffff
je 0x10008b48
push 0x100000
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push ebx
lea ecx, [esp + 0x20]
push ecx
push 0x100000
mov ebp, eax
push ebp
push edi
mov dword [esp + 0x30], ebx
mov byte [esp + 0x54], bl
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10008b28
mov ebx, dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x10008b28
test al, 0xf
jne 0x10008bc5
mov ecx, dword [esp + 0x30]
sub ecx, eax
mov edi, 0
sbb dword [esp + 0x34], edi
cmp byte [esp + 0x40], 0
mov dword [esp + 0x30], ecx
jne 0x10008a36
mov byte [esp + 0x40], 1
or ecx, dword [esp + 0x34]
jne 0x10008ad1
cmp esi, edi
jbe 0x10008af4
jmp 0x10008a50
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + edi*4]
lea edx, [esp + 0x1c]
push edx
push ebp
push 0
push 1
push 0
push ecx
call ebx
inc edi
cmp edi, esi
jb 0x10008a50
jmp 0x10008af0
xor edi, edi
test ebp, ebp
jbe 0x10008a89
mov ecx, dword [esp + 0x20]
mov edx, dword [ecx + edi*4]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
inc edi
cmp edi, ebp
jb 0x10008a76
mov ebp, dword [esp + 0x18]
mov edi, ebx
sub ebp, ebx
mov eax, dword [edi + ebp]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov ecx, dword [edi]
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
add edi, 4
sub esi, 1
jne 0x10008a91
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
call esi
mov edx, dword [esp + 0x18]
push edx
call esi
mov eax, dword [esp + 0x20]
push eax
call esi
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 8
cmp esi, edi
jbe 0x10008af4
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + edi*4]
lea edx, [esp + 0x1c]
push edx
push ebp
push 0
push 0
push 0
push ecx
call ebx
inc edi
cmp edi, esi
jb 0x10008ad5
mov eax, dword [esp + 0x1c]
push 0
lea edx, [esp + 0x20]
push edx
push eax
mov eax, dword [esp + 0x30]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [esp + 0x28]
push 0
lea ecx, [esp + 0x20]
push ecx
push 0x100000
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10008a03
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0x24]
mov dl, byte [esp + 0x40]
push eax
mov byte [esp + 0x1b], dl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x28]
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, ebx
jbe 0x10008b8a
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov ebx, dword [esp + 0x2c]
sub ebp, edi
sub ebx, edi
mov ecx, dword [edi + ebp]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov edx, dword [edi]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov eax, dword [ebx + edi]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
add edi, 4
sub esi, 1
jne 0x10008b63
mov ecx, dword [esp + 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
push ecx
call esi
mov edx, dword [esp + 0x18]
push edx
call esi
mov eax, dword [esp + 0x20]
push eax
call esi
cmp byte [esp + 0x17], 0
jne 0x10008bb7
mov ecx, dword [esp + 0x44]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, byte [esp + 0x17]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 8
mov eax, dword [esp + 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0x28]
push ecx
call esi
jmp 0x10008bac