Function at 0x409a00
Capabilities:
Authenticate hmac
Check for time delay via gettickcount
Contain obfuscated stackstrings
Copy file
Delete file
Encode data using xor
Encrypt or decrypt via wincrypt
Move file
Write file on windows

Disassembly:
sub esp, 0x3a0
mov eax, dword [0x52e144]
xor eax, esp
mov dword [esp + 0x39c], eax
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov al, 0x39
mov cl, 0x8d
mov byte [esp + 0x39], al
mov byte [esp + 0x47], cl
mov byte [esp + 0x4b], cl
mov byte [esp + 0x59], al
mov al, 0xa8
mov dl, 0xf4
mov cl, 0xdc
mov byte [esp + 0x20], 6
mov byte [esp + 0x21], 2
mov byte [esp + 0x22], bl
mov byte [esp + 0x23], bl
mov byte [esp + 0x24], bl
mov byte [esp + 0x25], 0xa4
mov byte [esp + 0x26], bl
mov byte [esp + 0x27], bl
mov byte [esp + 0x28], 0x52
mov byte [esp + 0x29], 0x53
mov byte [esp + 0x2a], 0x41
mov byte [esp + 0x2b], 0x31
mov byte [esp + 0x2c], bl
mov byte [esp + 0x2d], 2
mov byte [esp + 0x2e], bl
mov byte [esp + 0x2f], bl
mov byte [esp + 0x30], 1
mov byte [esp + 0x31], bl
mov byte [esp + 0x32], 1
mov byte [esp + 0x33], bl
mov byte [esp + 0x34], 0x91
mov byte [esp + 0x35], 0xc8
mov byte [esp + 0x36], 0xb0
mov byte [esp + 0x37], 0x9a
mov byte [esp + 0x38], 0x2c
mov byte [esp + 0x3a], 0xd2
mov byte [esp + 0x3b], 0x73
mov byte [esp + 0x3c], 0x5e
mov byte [esp + 0x3d], 0x8f
mov byte [esp + 0x3e], 0x6f
mov byte [esp + 0x3f], 0x15
mov byte [esp + 0x40], 0x2a
mov byte [esp + 0x41], 0xe7
mov byte [esp + 0x42], 0x4f
mov byte [esp + 0x43], 0xbd
mov byte [esp + 0x44], 0x66
mov byte [esp + 0x45], 0xff
mov byte [esp + 0x46], 0x4e
mov byte [esp + 0x48], 0x8c
mov byte [esp + 0x49], 0xb3
mov byte [esp + 0x4a], 0xc0
mov byte [esp + 0x4c], 0x98
mov byte [esp + 0x4d], dl
mov byte [esp + 0x4e], 0xb2
mov byte [esp + 0x4f], cl
mov byte [esp + 0x50], 0x81
mov byte [esp + 0x51], 0x43
mov byte [esp + 0x52], 0x51
mov byte [esp + 0x53], 0xbc
mov byte [esp + 0x54], 0xf3
mov byte [esp + 0x55], 0xd6
mov byte [esp + 0x56], 0x74
mov byte [esp + 0x57], 0x50
mov byte [esp + 0x58], 0x7f
mov byte [esp + 0x5a], 0x87
mov byte [esp + 0x5b], al
mov byte [esp + 0x5c], 0x1b
mov byte [esp + 0x5d], 0x5c
mov byte [esp + 0x5e], 6
mov byte [esp + 0x5f], 0x36
mov byte [esp + 0x60], 0x47
mov byte [esp + 0x61], 8
mov byte [esp + 0x62], al
mov byte [esp + 0x63], 0xd8
mov byte [esp + 0x64], 0x63
mov byte [esp + 0x65], 0xad
mov byte [esp + 0x66], 0xfd
mov byte [esp + 0x67], 0x6d
cmp dword [esi], 0xffffffff
mov byte [esp + 0x68], 0xb5
mov byte [esp + 0x69], 0xa4
mov byte [esp + 0x6a], 0x94
mov byte [esp + 0x6b], 0xf0
mov byte [esp + 0x6c], 0xe0
mov byte [esp + 0x6d], 0xdf
mov byte [esp + 0x6e], 0xea
mov byte [esp + 0x6f], 0xc5
mov byte [esp + 0x70], dl
mov byte [esp + 0x71], 0x73
mov byte [esp + 0x72], cl
mov byte [esp + 0x73], 0xd2
je 0x409bc0
xor al, al
jmp 0x40a1c9
mov eax, dword [esp + 0x3b4]
mov ecx, dword [esp + 0x3b8]
push edi
mov edi, dword [esp + 0x3b0]
mov dword [esi + 0x143c], eax
mov eax, edi
mov dword [esi + 0x1440], ecx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x409be7
sub eax, edx
cmp eax, 3
jbe 0x409c53
cmp byte [edi + 1], 0x3a
je 0x409c53
push 0x104
lea edx, [esp + 0x1a0]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x19c]
push 0x5c
push eax
call fcn.004b6d8c
add esp, 8
cmp eax, ebx
je 0x409c3c
lea edx, [eax + 1]
mov ecx, edi
sub edx, edi
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
cmp al, bl
jne 0x409c30
jmp 0x409c6a
lea edx, [esp + 0x19c]
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x409c47
jmp 0x409c6a
lea edx, [esp + 0x19c]
mov eax, edi
sub edx, edi
mov edi, edi
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
cmp cl, bl
jne 0x409c60
push ebp
lea ecx, [esp + 0x1a0]
push 0x2e
push ecx
call fcn.004b6d8c
push 0x103
lea edx, [esp + 0xa9]
push ebx
mov byte [eax], bl
push edx
mov byte [esp + 0xb0], bl
call fcn.004b6dc0
push 0x103
lea eax, [esp + 0x2c1]
push ebx
push eax
mov byte [esp + 0x2c8], bl
call fcn.004b6dc0
add esp, 0x20
mov ecx, esi
call fcn.00409950
mov ebp, eax
or edi, 0xffffffff
nop
cmp edi, 0xffffffff
jne 0x409ce4
lea ecx, [esp + 0x1a0]
push ecx
lea edx, [esp + 0xa0]
push str._s.erl
push edx
call fcn.004b79a8
add esp, 0xc
jmp 0x409d02
push edi
lea eax, [esp + 0x1a4]
push eax
lea ecx, [esp + 0xa4]
push str._s_d.erl
push ecx
call fcn.004b79a8
add esp, 0x10
lea edx, [esp + 0x9c]
push ebx
push edx
call fcn.004ba516
add esp, 8
cmp eax, 0xffffffff
jne 0x409d1d
cmp edi, 1
jge 0x409d35
cmp ebp, ebx
jne 0x409d2f
lea eax, [esp + 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
inc edi
cmp edi, 0x63
jle 0x409cc0
cmp edi, 0xffffffff
jle 0x409ded
lea ebp, [edi - 1]
cmp ebp, 0xffffffff
jne 0x409d65
lea ecx, [esp + 0x1a0]
push ecx
lea edx, [esp + 0xa0]
push str._s.erl
push edx
call fcn.004b79a8
add esp, 0xc
jmp 0x409d83
push ebp
lea eax, [esp + 0x1a4]
push eax
lea ecx, [esp + 0xa4]
push str._s_d.erl
push ecx
call fcn.004b79a8
add esp, 0x10
push edi
lea edx, [esp + 0x1a4]
push edx
lea eax, [esp + 0x2b0]
push str._s_d.erl
push eax
call fcn.004b79a8
add esp, 0x10
push 1
lea ecx, [esp + 0x2ac]
push ecx
lea edx, [esp + 0xa4]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x409de2
push ebx
lea eax, [esp + 0x2ac]
push eax
lea ecx, [esp + 0xa4]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea edx, [esp + 0x9c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
dec edi
dec ebp
cmp edi, 0xffffffff
jg 0x409d41
lea eax, [esp + 0x1a0]
push eax
lea ecx, [esp + 0xa0]
push str._s.erl
push ecx
call fcn.004b79a8
add esp, 0xc
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
xor edx, edx
cmp byte [esp + 0x3b8], bl
push ebx
setne dl
push 0x80000080
lea eax, [esp + 0xa4]
lea edx, [edx + edx + 2]
mov edi, edx
push edi
push ebx
push 5
push 0xc0000000
push eax
call ebp
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x409e69
push ebx
push 0x80000080
push edi
push ebx
push 1
push 0xc0000000
lea ecx, [esp + 0xb4]
push ecx
call ebp
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x409e69
xor al, al
jmp 0x40a1c7
cmp byte [esp + 0x3b8], bl
je 0x409e7f
mov edx, dword [esi]
push 2
push ebx
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ebp, [esi + 0x1020]
push ebp
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esi + 0x102e]
movzx ecx, word [esi + 0x102c]
movzx edx, word [esi + 0x102a]
push eax
movzx eax, word [esi + 0x1028]
push ecx
movzx ecx, word [esi + 0x1026]
push edx
movzx edx, word [esi + 0x1022]
push eax
movzx eax, word [ebp]
push ecx
push edx
push eax
push 0x50d748
lea edi, [esi + 0x20]
call fcn.004045b0
add esp, 4
push eax
push edi
call fcn.004b79a8
mov eax, edi
add esp, 0x24
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x409ee0
sub eax, edx
cmp dword [esi + 0x1440], 0x3e7
mov ecx, eax
mov dword [esp + 0x14], ecx
jne 0x409f01
mov dword [esp + 0x14], ebx
mov ecx, ebx
cmp dword [esi + 0x143c], ebx
je 0x409f3d
cmp ecx, ebx
jle 0x40a1b1
lea eax, [esi + 0x20]
mov edi, ecx
jmp 0x409f20
add dword [esi + 0x143c], 2
mov dl, byte [esi + 0x143c]
add dl, 0x43
xor byte [eax], dl
inc eax
sub edi, 1
jne 0x409f20
jmp 0x40a1b1
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
movzx edx, word [esi + 0x1022]
movzx ecx, word [esi + 0x102e]
mov dword [esp + 0x10], eax
movzx eax, word [esi + 0x1026]
imul eax, edx
movzx edx, word [ebp]
movzx ebp, word [esi + 0x102a]
imul eax, edx
movzx edx, word [esi + 0x102c]
imul eax, ecx
add edx, ecx
add ebp, edx
add ebp, dword [esp + 0x10]
inc eax
imul eax, ebp
mov dword [esi + 0x1030], eax
xor eax, eax
mov word [esi + 0x1032], ax
mov ecx, dword [esi + 0x1030]
or ecx, 0xfc000000
xor edx, edx
mov eax, ecx
mov ebp, 0xa
div ebp
xor edx, 0x55
shl edx, 0x10
or edx, ecx
mov dword [esi + 0x1030], edx
call edi
push eax
call fcn.004b71f6
add esp, 4
xor edi, edi
call fcn.004b7208
and eax, 0x800000ff
jns 0x409fd9
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + edi + 0x7c], al
inc edi
cmp edi, 0x10
jl 0x409fc6
lea ecx, [esp + 0x7c]
push ecx
lea eax, [esi + 0x1034]
push 0x10
push eax
call fcn.004aa670
add esp, 0xc
push 0xf0000000
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push ebx
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x40a194
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x18]
push eax
push ebx
push ebx
push 0x54
lea ecx, [esp + 0x38]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x40a188
mov ecx, dword [esp + 0x18]
push ebx
lea eax, [esp + 0x14]
push eax
push ebx
push ebx
push 1
push ebx
push ecx
mov dword [esp + 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x40a0fe
push eax
mov ebp, eax
call fcn.004b97b1
mov edx, dword [esp + 0x80]
mov edi, eax
mov dword [esp + 0x14], 0x10
mov dword [edi], edx
mov eax, dword [esp + 0x84]
add esp, 4
mov dword [edi + 4], eax
mov ecx, dword [esp + 0x84]
push ebp
lea eax, [esp + 0x14]
push eax
push edi
mov dword [edi + 8], ecx
mov edx, dword [esp + 0x94]
push ebx
mov dword [edi + 0xc], edx
xor byte [edi], 0x23
mov ecx, dword [esp + 0x28]
push 1
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x40a0f0
mov ecx, dword [esi]
push ebx
lea edx, [esp + 0x14]
push edx
push 4
lea eax, [esp + 0x2c]
push eax
push ecx
mov dword [esp + 0x34], 0xccfc00
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi]
push ebx
lea edx, [esp + 0x14]
push edx
push ebp
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call fcn.004b97a6
add esp, 4
jmp 0x40a17d
mov eax, dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
lea ecx, [esp + 0x14]
push ecx
push 4
lea edx, [esp + 0x2c]
push edx
push eax
mov dword [esp + 0x34], 0xccfd00
call edi
xor eax, eax
movzx ecx, byte [esp + eax + 0x7c]
movzx edx, byte [esp + eax + 0x7d]
xor cl, byte [esp + eax + 0x3d]
xor dl, byte [esp + eax + 0x3e]
mov byte [esp + eax + 0x8c], cl
movzx ecx, byte [esp + eax + 0x7e]
xor cl, byte [esp + eax + 0x3f]
mov byte [esp + eax + 0x8d], dl
movzx edx, byte [esp + eax + 0x7f]
xor dl, byte [esp + eax + 0x40]
mov byte [esp + eax + 0x8e], cl
mov byte [esp + eax + 0x8f], dl
add eax, 4
cmp eax, 0x10
jl 0x40a120
mov edx, dword [esi]
push ebx
lea eax, [esp + 0x14]
push eax
push 0x10
lea ecx, [esp + 0x98]
push ecx
push edx
call edi
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov ecx, dword [esp + 0x1c]
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov edx, dword [esp + 0x14]
lea eax, [esi + 0x20]
push eax
push eax
push edx
lea eax, [esi + 0x1034]
push eax
call fcn.004aa750
mov ecx, dword [esp + 0x24]
add esp, 0x10
push ebx
lea eax, [esp + 0x28]
push eax
push ecx
mov ecx, dword [esi]
lea eax, [esi + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov al, 1
pop ebp
pop edi
mov ecx, dword [esp + 0x3a4]
pop esi
pop ebx
xor ecx, esp
call fcn.004b6da3
add esp, 0x3a0
ret 0x10