Function at 0x405f8c
Capabilities:
Create directory
Create new key via cryptacquirecontext
Decode data using base64 via winapi
Get common file path
Get hostname
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1b54
call fcn.00571a00
mov eax, dword [0x601ff0]
xor eax, esp
mov dword [esp + 0x1b50], eax
push ebx
mov eax, edx
mov dword [esp + 0x30], 0x400
push esi
push edi
mov dword [esp + 0x14], eax
xor ebx, ebx
mov dword [eax], 0xfffffffe
mov edi, 0x60d3e0
lea eax, [esp + 0x38]
mov byte [0x60d3e0], bl
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov ecx, edi
mov edx, ebx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405fe1
sub ecx, esi
je 0x406014
mov al, byte [edx + 0x60d3e0]
cmp al, 0x7a
ja 0x405ffa
cmp al, 0x2c
jae 0x406001
mov byte [edx + 0x60d3e0], 0x20
mov ecx, edi
inc edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406007
sub ecx, esi
cmp edx, ecx
jb 0x405fec
lea eax, [esp + 0x50]
push eax
push ebx
push ebx
push 0x23
push ebx
mov ebx, dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
call ebx
lea edi, [esp + 0x50]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40602b
push 6
pop ecx
lea eax, [esp + 0x50]
mov esi, str.StardockRegistrations
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.0057ceee
lea edi, [esp + 0x54]
pop ecx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40604d
push 5
pop ecx
mov esi, str.ModernMixTrial2.bin
lea eax, [esp + 0x50]
rep movsd dword es:[edi], dword [esi]
push 0x5d93e8
push eax
movsb byte es:[edi], byte [esi]
call fcn.0057b0a1
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x40608e
xor eax, eax
mov ecx, dword [esp + 0x1b5c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00570fd6
mov esp, ebp
pop ebp
ret
push 2
push 0
push esi
call fcn.0057b6f8
add esp, 0xc
push esi
call fcn.0057bc6a
pop ecx
mov edi, eax
mov eax, 0xfe
push 0
cmp edi, eax
push 0
push esi
cmova edi, eax
call fcn.0057b6f8
add esp, 0xc
lea eax, [esp + 0x158]
push esi
push edi
push 1
push eax
call fcn.0057be41
add esp, 0x10
cmp edi, 0xff
jae 0x406493
push esi
mov byte [esp + edi + 0x15c], 0
call fcn.0057b3be
pop ecx
lea eax, [esp + 0x158]
push eax
call fcn.0057ad5d
cdq
pop ecx
mov dword [esp + 0x18], eax
lea eax, [esp + 0x50]
push eax
xor eax, eax
mov dword [esp + 0x20], edx
push eax
push eax
push 0x23
push eax
call ebx
lea edi, [esp + 0x50]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x406114
push 6
pop ecx
lea eax, [esp + 0x50]
mov esi, str.StardockRegistrations
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.0057ceee
lea edi, [esp + 0x54]
pop ecx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x406136
push 5
pop ecx
lea eax, [esp + 0x50]
mov esi, str.ModernMixTrial.bin
push 0x5d93e8
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.0057b0a1
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x406077
push 2
xor ebx, ebx
push ebx
push esi
call fcn.0057b6f8
add esp, 0xc
push esi
call fcn.0057bc6a
mov edi, eax
pop ecx
test edi, edi
jne 0x40618a
push esi
call fcn.0057b3be
pop ecx
jmp 0x406077
mov eax, 0x7ff
push ebx
cmp edi, eax
push ebx
push esi
cmova edi, eax
call fcn.0057b6f8
add esp, 0xc
lea eax, [esp + 0xb58]
push esi
push edi
push 1
push eax
call fcn.0057be41
add esp, 0x10
cmp edi, 0x800
jae 0x406493
push esi
mov byte [esp + edi + 0xb5c], bl
call fcn.0057b3be
pop ecx
lea ecx, [esp + 0x258]
call fcn.00405105
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
add eax, 0xb6109100
push ebx
push 0x989680
adc ecx, 2
push ecx
push eax
call fcn.00571bf0
mov dword [esp + 0x20], eax
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x28], edx
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
call fcn.004050e6
push 0xc9
push 0x2a69c000
mov edi, edx
mov esi, eax
push edi
push esi
call fcn.00593e40
mov ecx, dword [esp + 0x24]
mov ebx, edx
push 0xc9
push 0x2a69c000
push ecx
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x2c]
push ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], ecx
call fcn.00593e40
cmp edx, ebx
jb 0x406267
ja 0x40625b
cmp eax, dword [esp + 0x1c]
jbe 0x406267
mov eax, dword [esp + 0x14]
or dword [eax], 0xffffffff
jmp 0x406077
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x34]
add eax, 0xf8648000
mov dword [esp + 0x20], eax
adc ecx, 0x1792
mov dword [esp + 0x24], ecx
cmp ecx, edi
ja 0x4062b0
jb 0x40628c
cmp eax, esi
jae 0x4062b0
add eax, 0xd9f68000
adc ecx, 0x75de
cmp ecx, edi
ja 0x40625b
jb 0x4062a1
cmp eax, esi
jae 0x40625b
mov eax, dword [esp + 0x14]
mov dword [eax], 0xfffffffe
jmp 0x406077
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
movzx eax, word [esp + 0x46]
push eax
movzx eax, word [esp + 0x46]
push eax
movzx eax, word [esp + 0x48]
push eax
push 0x60d3e0
lea eax, [esp + 0x268]
push eax
push 0xa3c
lea eax, [esp + 0x1370]
push str._d_s_s_d__02d__02d
push eax
call fcn.00405081
lea ebx, [esp + 0x1378]
add esp, 0x20
lea ecx, [ebx + 1]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x4062fb
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
lea eax, [esp + 0xc]
push 0xf0000000
xor edi, edi
mov dword [esp + 0x34], 0x800
inc edi
sub ebx, ecx
push edi
push str.Microsoft_Strong_Cryptographic_Provider
push 0
push eax
call esi
test eax, eax
jne 0x406354
push 0xf0000008
push edi
push str.Microsoft_Strong_Cryptographic_Provider
push eax
lea eax, [esp + 0x1c]
push eax
call esi
test eax, eax
jne 0x406354
push 8
push edi
push str.Microsoft_Strong_Cryptographic_Provider
push eax
lea eax, [esp + 0x1c]
push eax
call esi
mov esi, dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
lea eax, [esp + 0x30]
xor ecx, ecx
push ecx
push ecx
push eax
lea eax, [esp + 0x364]
push eax
push edi
push ecx
lea eax, [esp + 0xb70]
push eax
call esi
push 0x800
call fcn.0057ae37
pop ecx
xor ecx, ecx
mov dword [esp + 0x2c], 0x800
push ecx
push ecx
mov edi, eax
lea eax, [esp + 0x34]
push eax
push edi
push 1
push ecx
push str.BgIAAACkAABSU0ExAAgAAAEAAQC7G6QgREGEFXvpwQ5pgRRbTfhRZ8Xl026FdST84rB1od1ye5hZp7SLoGXtUVc3qTimZrsi4ctbs2Ou2_zfF9BIGMOfmXdIpoIT_RM7dAplL03KHxBRRFT07a_cWyL8tGzpAAVULptN92F5aKBEOWcHk0u5IDoU3jnetVDkqYBxUX5rtxI_2HborDOIo205nN07ldFlnCm8agWzXY06yzsY6lm4_j3jIqzXcYATXIfd3dtMQX_R56NbzCVU96TSx8xYeiYgJSUqgS6ebw4p9YJI680zP4kHxUmEpCO_1AmXJizW24bzcJUIZ2AgRToTeSpGqg9frqsZrF
call esi
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push dword [esp + 0x38]
push edi
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x8004
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
push 0
push ebx
lea eax, [esp + 0x1360]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
mov edi, dword [esp + 0x30]
mov eax, edi
cdq
sub eax, edx
xor edx, edx
mov ebx, eax
sar ebx, 1
test ebx, ebx
jle 0x406417
lea esi, [esp + edi + 0x357]
mov al, byte [esi]
mov cl, byte [esp + edx + 0x358]
mov byte [esp + edx + 0x358], al
mov byte [esi], cl
dec esi
inc edx
cmp edx, ebx
jl 0x4063ff
xor ebx, ebx
lea eax, [esp + 0x358]
push ebx
push ebx
push dword [esp + 0x44]
push edi
push eax
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptVerifySignatureW]
test eax, eax
je 0x406469
mov eax, dword [esp + 0x14]
mov dword [eax], 2
cmp dword [esp + 0x10], ebx
je 0x406450
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp dword [esp + 0xc], ebx
je 0x406461
push ebx
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
inc eax
jmp 0x406079
cmp dword [esp + 0x10], ebx
je 0x406479
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp dword [esp + 0xc], ebx
je 0x406077
push ebx
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x406077
call fcn.0057112d
int3