Function at 0x409dad
Capabilities:
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov byte [ebp - 0x19], 0
push dword [ebp + 8]
call fcn.00409f3d
pop ecx
mov byte [ebp - 0x19], al
movsx eax, byte [ebp - 0x19]
test eax, eax
je 0x409d48
mov al, byte [ebp - 0x19]
jmp 0x409f3b
mov eax, dword [0x4468a0]
mov eax, dword [eax + 4]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x409d75
cmp dword [ebp - 4], 0x2c
je 0x409d75
cmp dword [ebp - 4], 0xffffffc8
je 0x409d75
cmp dword [ebp - 4], 0xffffffc9
je 0x409d75
cmp dword [ebp - 4], 0xffffffca
jne 0x409f39
call fcn.00419289
lea eax, [ebp - 0x18]
push eax
call fcn.00409d22
pop ecx
mov byte [ebp - 0x19], al
movsx eax, byte [ebp - 0x19]
test eax, eax
je 0x409d97
mov al, byte [ebp - 0x19]
jmp 0x409f3b
push 0
push 0
push dword [ebp + 8]
call fcn.0041e457
add esp, 0xc
mov eax, dword [ebp + 8]
movzx eax, word [eax]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x409e18
cmp dword [ebp - 0x20], 8
je 0x409dc3
cmp dword [ebp - 0x20], 9
je 0x409dfb
jmp 0x409e27
and dword [ebp - 8], 0
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0
je 0x409ddf
mov eax, dword [ebp + 8]
push dword [eax + 8]
call fcn.0041ea20
pop ecx
mov dword [ebp - 8], eax
push dword [ebp + 8]
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp + 8]
mov word [eax], 3
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov dword [eax + 8], ecx
jmp 0x409e27
push dword [ebp + 8]
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp + 8]
mov word [eax], 3
mov eax, dword [ebp + 8]
mov dword [eax + 8], 1
jmp 0x409e27
mov eax, dword [ebp + 8]
mov word [eax], 3
mov eax, dword [ebp + 8]
and dword [eax + 8], 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0041e457
add esp, 0xc
movzx eax, word [ebp - 0x18]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x409e79
cmp dword [ebp - 0x24], 3
je 0x409e7f
cmp dword [ebp - 0x24], 8
je 0x409e58
cmp dword [ebp - 0x24], 9
je 0x409e70
jmp 0x409e85
and dword [ebp - 8], 0
cmp dword [ebp - 0x10], 0
je 0x409e6e
push dword [ebp - 0x10]
call fcn.0041ea20
pop ecx
mov dword [ebp - 8], eax
jmp 0x409e85
mov dword [ebp - 8], 1
jmp 0x409e85
and dword [ebp - 8], 0
jmp 0x409e85
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffc8
je 0x409ef9
cmp dword [ebp - 0x28], 0xffffffc9
je 0x409f0a
cmp dword [ebp - 0x28], 0xffffffca
je 0x409f1b
cmp dword [ebp - 0x28], 0
je 0x409eab
cmp dword [ebp - 0x28], 0x2c
je 0x409ed2
jmp 0x409f2a
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0
je 0x409ec3
cmp dword [ebp - 8], 0
je 0x409ec3
mov dword [ebp - 0x2c], 1
jmp 0x409ec7
and dword [ebp - 0x2c], 0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x2c]
mov dword [eax + 8], ecx
jmp 0x409f2a
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0
jne 0x409ee7
cmp dword [ebp - 8], 0
jne 0x409ee7
and dword [ebp - 0x30], 0
jmp 0x409eee
mov dword [ebp - 0x30], 1
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x30]
mov dword [eax + 8], ecx
jmp 0x409f2a
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
and eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
jmp 0x409f2a
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
or eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
jmp 0x409f2a
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
xor eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x409d48
xor al, al
leave
ret