Function at 0x40be60
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x43800c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x4c], eax
test edx, edx
jne 0x40be91
cmp dword [eax], edx
jbe 0x40be91
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004165a1
mov esp, ebp
pop ebp
ret
push ebx
push esi
push edi
xor esi, esi
xor edi, edi
push esi
push 0x80
push 3
push esi
push 1
push 1
push ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40bee6
lea eax, [ebp - 0x48]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x40bee2
mov edi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x4c]
and edi, 0xfffffff8
add edi, 8
cmp dword [eax], edi
jae 0x40bf40
mov dword [eax], edi
xor edi, edi
test ebx, ebx
je 0x40beed
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x40befa
push esi
call fcn.00419c84
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x40bf0f
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x40bf1d
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x40bf2d
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004165a1
mov esp, ebp
pop ebp
ret
push 0
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push 0
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x40bf83
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x40bf83
push 8
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push 0
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x40bee0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x8003
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x40bee0
push 0
push str.F82B3070_8C29_42FF_9A74_28699A1F2BCD
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push str.F82B3070_8C29_42FF_9A74_28699A1F2BCD
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x40bee0
lea eax, [ebp - 0x14]
push eax
push 0x800000
push dword [ebp - 8]
push 0x6801
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x40bee0
push edi
call fcn.00419db8
mov esi, eax
add esp, 4
test esi, esi
je 0x40bee0
push edi
push 0
push esi
call fcn.00417e70
add esp, 0xc
lea eax, [ebp - 0x10]
push 0
push eax
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40bee0
lea eax, [ebp - 0x10]
push eax
push esi
push 0
push 1
push 0
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x40bee0
push dword [ebp - 0x10]
push dword [ebp - 0x50]
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, 1
jmp 0x40bee2