Function at 0x401f70
Capabilities:
Delete file
Get file size
Move file

Disassembly:
sub esp, 0x22c
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov ecx, 0x86
xor eax, eax
lea edi, [esp + 0x22]
mov word [esp + 0x20], bx
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileW]
rep stosd dword es:[edi], eax
push ebx
push ebx
push 3
push ebx
stosw word es:[edi], ax
mov eax, dword [esp + 0x250]
push 1
push 0x80000000
push eax
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x34], ebx
call ebp
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x40200b
push 0x41e130
call fcn.00401cb0
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:
push esi
call fcn.004035c0
add esp, 8
mov ecx, eax
call fcn.00402dc0
mov esi, eax
push 0xa
mov ecx, esi
call fcn.00402fe0
mov ecx, esi
call fcn.00403150
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x22c
ret
push str.Check_file_...
push 0x41e130
call fcn.004035c0
add esp, 8
mov esi, eax
mov ecx, esi
push 0xa
call fcn.00402fe0
mov ecx, dword [esi]
mov bl, 6
xor edi, edi
mov edx, dword [ecx + 4]
mov cl, byte [edx + esi + 4]
test bl, cl
lea eax, [edx + esi]
jne 0x402050
mov eax, dword [eax + 0x28]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x402050
mov edi, 4
mov eax, dword [esi]
push 0
push edi
mov ecx, dword [eax + 4]
add ecx, esi
call fcn.004031b0
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
je 0x402339
test eax, 0xfff
jne 0x402339
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x402339
push esi
call fcn.00401cf0
add esp, 4
cmp eax, 1
mov dword [esp + 0x1c], eax
je 0x4020f9
cmp eax, 2
je 0x40214d
push str.No_wartermark_found_
push 0x41e130
call fcn.00401cb0
add esp, 4
push eax
call fcn.004035c0
add esp, 8
mov esi, eax
mov ecx, esi
push 0xa
call fcn.00402fe0
mov edx, dword [esi]
xor edi, edi
mov eax, dword [edx + 4]
add eax, esi
test byte [eax + 4], bl
jne 0x402385
mov eax, dword [eax + 0x28]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x402385
jmp 0x402380
push str.Encrypted_by_XOR
push 0x41e130
call fcn.004035c0
add esp, 8
mov esi, eax
mov ecx, esi
push 0xa
call fcn.00402fe0
mov ecx, dword [esi]
xor edi, edi
mov edx, dword [ecx + 4]
mov cl, byte [edx + esi + 4]
test bl, cl
lea eax, [edx + esi]
jne 0x40213c
mov eax, dword [eax + 0x28]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x40213c
mov edi, 4
mov eax, dword [esi]
push 0
push edi
mov ecx, dword [eax + 4]
add ecx, esi
call fcn.004031b0
jmp 0x4021a8
push str.Ecnrypted_by_AES
push 0x41e130
call fcn.004035c0
add esp, 8
mov esi, eax
mov ecx, esi
push 0xa
call fcn.00402fe0
mov ecx, dword [esi]
xor edi, edi
mov edx, dword [ecx + 4]
mov cl, byte [edx + esi + 4]
test bl, cl
lea eax, [edx + esi]
jne 0x402190
mov eax, dword [eax + 0x28]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x402190
mov edi, 4
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
test edi, edi
je 0x4021a8
mov edx, dword [ecx + 4]
push 0
or edx, edi
push edx
call fcn.00403290
mov eax, dword [esp + 0x240]
push 0x104
lea ecx, [esp + 0x24]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea edx, [esp + 0x20]
push str._dwm
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0
push 0
push 2
push 0
push 1
lea eax, [esp + 0x34]
push 0xc0000000
push eax
call ebp
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x402276
push 0x41e130
call fcn.00401cb0
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:
push esi
call fcn.004035c0
add esp, 8
mov ecx, eax
call fcn.00402dc0
mov esi, eax
push 0xa
mov ecx, esi
call fcn.00402fe0
mov ecx, dword [esi]
xor edi, edi
mov edx, dword [ecx + 4]
mov cl, byte [edx + esi + 4]
test bl, cl
lea eax, [edx + esi]
jne 0x40224c
mov eax, dword [eax + 0x28]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, ebp
jne 0x40224c
mov edi, 4
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
test edi, edi
je 0x402398
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x28]
or eax, edi
test edx, edx
jne 0x402269
or al, 4
push 0
push eax
call fcn.00407205
jmp 0x402398
push str.Decrypt_...
push 0x41e130
call fcn.004035c0
add esp, 8
mov esi, eax
mov ecx, esi
push 0xa
call fcn.00402fe0
mov ecx, dword [esi]
xor edi, edi
mov edx, dword [ecx + 4]
mov cl, byte [edx + esi + 4]
test bl, cl
lea eax, [edx + esi]
jne 0x4022b9
mov eax, dword [eax + 0x28]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x4022b9
mov edi, 4
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
test edi, edi
je 0x4022da
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x28]
or eax, edi
test edx, edx
jne 0x4022d2
or al, 4
push 0
push eax
call fcn.00407205
mov ecx, dword [esp + 0x1c]
mov esi, dword [esp + 0x10]
push ecx
push ebp
push esi
call fcn.00401de0
add esp, 0xc
test al, al
je 0x402398
push ebp
call fcn.00401ef0
add esp, 4
test al, al
je 0x402398
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebp
call esi
mov esi, dword [esp + 0x240]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [esp + 0x20]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x22c
ret
push str.File_size_error
push 0x41e130
call fcn.00401cb0
add esp, 4
push eax
call fcn.004035c0
add esp, 8
mov esi, eax
mov ecx, esi
push 0xa
call fcn.00402fe0
mov eax, dword [esi]
xor edi, edi
mov ecx, dword [eax + 4]
lea eax, [ecx + esi]
mov cl, byte [ecx + esi + 4]
test bl, cl
jne 0x402385
mov eax, dword [eax + 0x28]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x402385
mov edi, 4
mov eax, dword [esi]
push 0
push edi
mov ecx, dword [eax + 4]
add ecx, esi
call fcn.004031b0
mov ebp, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
cmp ebp, 0xffffffff
je 0x4023b8
push ebp
call esi
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x22c
ret