Function at 0x1000b580
Capabilities:
Create new key via cryptacquirecontext
Delete file
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt
Get file size
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x40
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
mov ebx, edx
push esi
push edi
mov esi, ecx
mov dword [esp + 0x30], ebx
mov byte [esp + 0x13], 0
test ebx, ebx
je 0x1000b609
push 0xf0000000
push 0x18
push 0
push 0
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1000b609
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push 0x8003
push edx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1000b5fc
mov ecx, dword [esp + 0x1c]
push 1
push 3
push 0x101293c8
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
mov edx, dword [esp + 0x1c]
test eax, eax
jne 0x1000b61d
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [esp + 0x18]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.100d0738
add esp, 0x40
ret
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x2c]
push ecx
push 1
push edx
push 0x6601
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x1000b665
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov edx, dword [esp + 0x18]
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.100d0738
add esp, 0x40
ret
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push esi
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x1000b783
lea eax, [esp + 0x20]
push eax
push esi
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push ebx
call edi
mov edi, eax
cmp edi, 0xffffffff
je 0x1000b77c
push 0
lea ecx, [esp + 0x18]
push ecx
push 8
lea edx, [esp + 0x40]
push edx
push esi
mov dword [esp + 0x28], 0
xor bl, bl
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1000b76d
mov edi, edi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1000b76d
cmp eax, 8
jne 0x1000b7ca
mov eax, dword [esp + 0x20]
add eax, 0xfffffff8
adc dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x20], eax
test bl, bl
jne 0x1000b717
mov bl, 1
or eax, dword [esp + 0x24]
mov edx, dword [esp + 0x2c]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x38]
push ecx
push 0
jne 0x1000b731
push 1
jmp 0x1000b733
push 0
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov ecx, dword [esp + 0x14]
push 0
lea eax, [esp + 0x18]
push eax
push ecx
lea edx, [esp + 0x40]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [esp + 0x18]
push eax
push 8
lea ecx, [esp + 0x40]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1000b6f0
push edi
mov byte [esp + 0x17], bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [esp + 0x30]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [esp + 0x2c]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov ecx, dword [esp + 0x18]
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
cmp byte [esp + 0x13], 0
jne 0x1000b7b4
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x44]
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100d0738
add esp, 0x40
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push esi
call edi
mov ebx, dword [esp + 0x30]
jmp 0x1000b7ad