Function at 0x49cff0
Capabilities:
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Get file size
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt
Read file on windows

Disassembly:
push ecx
push ebx
mov eax, dword [esp + 0xc]
push ebp
push esi
push edi
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
mov ebp, ecx
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x49d02c
pop edi
mov dword [ebp + 0x44], 1
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0x10
push 0
push esi
call dword [sym.imp.kernel32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [ebp + 0x24], eax
jne 0x49d055
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
mov dword [ebp + 0x44], 0xb
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0x10
mov eax, dword [ebp + 4]
test eax, eax
je 0x49d06d
push eax
call dword [sym.imp.msvcr71.dll_free]
add esp, 4
mov dword [ebp + 4], 0
mov ecx, dword [ebp + 0x24]
push ecx
call dword [sym.imp.msvcr71.dll_malloc]
add esp, 4
mov dword [ebp + 4], eax
test eax, eax
jne 0x49d099
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
mov dword [ebp + 0x44], 2
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0x10
mov ecx, dword [ebp + 0x24]
lea edx, [esp + 0x10]
push 0
push edx
push ecx
push eax
push esi
call dword [sym.imp.kernel32.dll_ReadFile]
mov eax, dword [ebp + 0x24]
mov ecx, dword [esp + 0x10]
cmp ecx, eax
je 0x49d0cf
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
mov dword [ebp + 0x44], 3
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0x10
mov edx, dword [ebp + 4]
lea ecx, [ebp + 0x28]
mov edi, ecx
lea edx, [edx + eax - 0x10]
mov ebx, dword [edx]
mov dword [edi], ebx
mov ebx, dword [edx + 4]
mov dword [edi + 4], ebx
mov ebx, dword [edx + 8]
mov dword [edi + 8], ebx
mov edx, dword [edx + 0xc]
mov dword [edi + 0xc], edx
mov edx, dword [ecx]
cmp edx, 0x32812622
jne 0x49d123
cmp dword [ebp + 0x34], 0x32812621
jne 0x49d123
mov ecx, dword [ebp + 0x2c]
mov edx, dword [ebp + 0x30]
mov edi, eax
mov byte [ebp + 0x1c], 1
lea edx, [edx + ecx + 0x10]
mov dword [ebp + 0x38], ecx
sub edi, edx
mov dword [ebp + 0x20], edx
mov dword [ebp + 8], edi
xor edi, edi
jmp 0x49d141
xor eax, eax
xor edi, edi
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov byte [ebp + 0x1c], al
mov eax, dword [ebp + 0x24]
mov dword [ebp + 0x20], edi
mov dword [ebp + 8], eax
mov dword [ebp + 0x38], edi
cmp eax, dword [ebp + 0x20]
jae 0x49d156
mov byte [ebp + 0x1c], 0
mov dword [ebp + 0x20], edi
mov dword [ebp + 0x24], edi
mov dword [ebp + 8], edi
mov dword [ebp + 0x38], edi
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
cmp dword [ebp], edi
jne 0x49d18b
push 0xf0000000
push 1
push 0x4fcbd8
push edi
push ebp
call dword [sym.imp.advapi32.dll_CryptAcquireContextA]
test eax, eax
jne 0x49d18b
pop edi
mov dword [ebp + 0x44], 4
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0x10
mov eax, dword [ebp + 0x40]
lea ebx, [ebp + 0x40]
cmp eax, edi
je 0x49d19e
push eax
call dword [sym.imp.advapi32.dll_CryptDestroyHash]
mov dword [ebx], edi
mov ecx, dword [ebp]
push ebx
push edi
push edi
push 0x8003
push ecx
call dword [sym.imp.advapi32.dll_CryptCreateHash]
test eax, eax
jne 0x49d1c5
pop edi
mov dword [ebp + 0x44], 5
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0x10
mov edx, dword [esp + 0x24]
push edi
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov edx, dword [ebx]
push edx
call dword [sym.imp.advapi32.dll_CryptHashData]
test eax, eax
jne 0x49d1f6
pop edi
mov dword [ebp + 0x44], 6
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0x10
mov eax, dword [ebp + 0x3c]
lea esi, [ebp + 0x3c]
test eax, eax
je 0x49d20d
push eax
call dword [sym.imp.advapi32.dll_CryptDestroyKey]
mov dword [esi], 0
mov eax, dword [ebx]
mov ecx, dword [ebp]
push esi
push 0
push eax
push 0x6801
push ecx
call dword [sym.imp.advapi32.dll_CryptDeriveKey]
test eax, eax
jne 0x49d237
pop edi
mov dword [ebp + 0x44], 7
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0x10
mov ecx, dword [ebp + 4]
mov edx, dword [ebp + 8]
lea eax, [esp + 0x18]
mov dword [esp + 0x18], edx
mov edx, dword [esi]
push eax
push ecx
push 0
push 1
push 0
push edx
call dword [sym.imp.advapi32.dll_CryptDecrypt]
test eax, eax
jne 0x49d29b
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x80090010
je 0x49d278
pop edi
mov dword [ebp + 0x44], 8
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0x10
mov eax, dword [esp + 0x18]
mov ecx, dword [ebp + 4]
push eax
push ecx
mov ecx, ebp
call fcn.0049d5a0
test al, al
jne 0x49d29b
pop edi
mov dword [ebp + 0x44], 0x58
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [ebp + 8]
mov eax, dword [esp + 0x20]
cmp eax, ecx
jbe 0x49d2a8
mov eax, ecx
mov edx, dword [esp + 0x1c]
mov esi, dword [ebp + 4]
mov ecx, eax
mov edi, edx
mov ebx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [edx + eax], 0
mov eax, dword [ebp + 4]
test eax, eax
je 0x49d2dd
push eax
call dword [sym.imp.msvcr71.dll_free]
add esp, 4
mov dword [ebp + 4], 0
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
pop ecx
ret 0x10