Function at 0x4db9b0
Capabilities:
Encrypt data using rc4 via winapi
Get file size
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x48], 0
je 0x4dbaa7
push dword [esi + 0x4c]
call fcn.005294af
add esp, 4
mov dword [esi + 4], eax
test eax, eax
jne 0x4db9e2
pop edi
mov dword [esi + 0x44], 0xc
xor al, al
pop esi
pop ebp
ret 0x10
push dword [esi + 0x4c]
push dword [esi + 0x48]
push eax
call fcn.00526b40
mov eax, dword [esi + 0x4c]
add esp, 0xc
mov dword [esi + 0x24], eax
mov edx, dword [esi + 4]
mov edi, dword [esi + 0x24]
add edx, edi
movups xmm0, xmmword [edx - 0x10]
movups xmmword [esi + 0x28], xmm0
cmp dword [esi + 0x28], 0x32812622
jne 0x4dbb71
cmp dword [esi + 0x34], 0x32812621
jne 0x4dbb71
mov byte [esi + 0x1c], 1
xorps xmm1, xmm1
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x30]
add eax, 0x10
add ecx, eax
sub edi, ecx
mov dword [esi + 0x20], ecx
mov dword [esi + 8], edi
mov eax, dword [esi + 0x2c]
mov dword [esi + 0x38], eax
cmp edi, 0x10
jbe 0x4dba4c
sub edx, ecx
movups xmm1, xmmword [edx - 0x10]
movd eax, xmm1
cmp eax, 0x32812624
jne 0x4dbb90
movaps xmm0, xmm1
psrldq xmm0, 0xc
movd eax, xmm0
cmp eax, 0x32812623
jne 0x4dbb90
movaps xmm0, xmm1
mov dword [esi + 0x24], edi
psrldq xmm0, 8
movups xmmword [esi + 0x28], xmm1
mov byte [esi + 0x1c], 1
movd eax, xmm0
psrldq xmm1, 4
movd ecx, xmm1
add eax, 0x10
add eax, ecx
mov dword [esi + 0x38], ecx
sub edi, eax
mov dword [esi + 0x20], eax
mov dword [esi + 8], edi
jmp 0x4dbb90
push 0
push 0x80
push 3
push 0
push 3
push accept
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4dbad8
pop edi
mov dword [esi + 0x44], 1
xor al, al
pop esi
pop ebp
ret 0x10
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x24], eax
cmp eax, 0xffffffff
jne 0x4dbaff
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov dword [esi + 0x44], 0xb
xor al, al
pop esi
pop ebp
ret 0x10
mov eax, dword [esi + 4]
test eax, eax
je 0x4dbb16
push eax
call fcn.005294aa
add esp, 4
mov dword [esi + 4], 0
push dword [esi + 0x24]
call fcn.005294af
add esp, 4
mov dword [esi + 4], eax
test eax, eax
jne 0x4dbb3e
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov dword [esi + 0x44], 2
xor al, al
pop esi
pop ebp
ret 0x10
push 0
lea ecx, [ebp + 8]
push ecx
push dword [esi + 0x24]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
cmp eax, dword [esi + 0x24]
je 0x4db9f7
pop edi
mov dword [esi + 0x44], 3
xor al, al
pop esi
pop ebp
ret 0x10
xorps xmm0, xmm0
movups xmmword [esi + 0x28], xmm0
mov eax, dword [esi + 0x24]
mov byte [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 8], eax
mov dword [esi + 0x38], 0
mov eax, dword [esi + 0x24]
cmp eax, dword [esi + 0x20]
jae 0x4dbbb8
mov byte [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 8], 0
mov dword [esi + 0x38], 0
cmp byte [esi + 0x1c], 0
jne 0x4dbbcd
pop edi
mov dword [esi + 0x44], 6
xor al, al
pop esi
pop ebp
ret 0x10
cmp dword [esi], 0
jne 0x4dbbfa
push 0xf0000000
push 1
push 0x55e610
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x4dbbfa
pop edi
mov dword [esi + 0x44], 4
xor al, al
pop esi
pop ebp
ret 0x10
mov eax, dword [esi + 0x40]
lea edi, [esi + 0x40]
test eax, eax
je 0x4dbc11
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov dword [edi], 0
push edi
push 0
push 0
push 0x8003
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x4dbc36
pop edi
mov dword [esi + 0x44], 5
xor al, al
pop esi
pop ebp
ret 0x10
mov edx, dword [ebp + 0x14]
mov ecx, edx
push ebx
lea ebx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4dbc40
push 0
sub ecx, ebx
push ecx
push edx
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x4dbc69
pop ebx
pop edi
mov dword [esi + 0x44], 6
xor al, al
pop esi
pop ebp
ret 0x10
mov eax, dword [esi + 0x3c]
lea ebx, [esi + 0x3c]
test eax, eax
je 0x4dbc80
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov dword [ebx], 0
push ebx
push 0
push dword [edi]
push 0x6801
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x4dbca6
pop ebx
pop edi
mov dword [esi + 0x44], 7
xor al, al
pop esi
pop ebp
ret 0x10
push dword [esi + 8]
mov ecx, esi
push dword [esi + 4]
call fcn.004dbd10
test al, al
jne 0x4dbcc5
pop ebx
pop edi
mov dword [esi + 0x44], 0x58
pop esi
pop ebp
ret 0x10
mov ebx, dword [ebp + 0x10]
cmp ebx, dword [esi + 8]
mov edi, dword [ebp + 0xc]
cmova ebx, dword [esi + 8]
push ebx
push dword [esi + 4]
push edi
call fcn.00526b40
mov byte [edi + ebx], 0
add esp, 0xc
mov eax, dword [esi + 4]
test eax, eax
je 0x4dbcfa
push eax
call fcn.005294aa
add esp, 4
mov dword [esi + 4], 0
pop ebx
pop edi
mov al, 1
pop esi
pop ebp
ret 0x10