Function at 0x407ebf
Capabilities:
Encrypt or decrypt via wincrypt
Generate random numbers via winapi

Disassembly:
mov eax, 0x411f59
call fcn.00410b94
sub esp, 0x218
and dword [ebp - 0x30], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push edi
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0x15]
push eax
xor edi, edi
inc edi
push edi
push dword [0x41c060]
call esi
test eax, eax
jne 0x407f1d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0xa0], vtable.xwnmqigmmwptq.0
push 0x417274
lea eax, [ebp - 0xa0]
push eax
call fcn.0040c1f5
lea eax, [ebp - 0x14c]
push eax
push 0x20
push dword [0x41c060]
call esi
test eax, eax
jne 0x407f55
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa8], vtable.xwnmqigmmwptq.0
push 0x417274
lea eax, [ebp - 0xa8]
jmp 0x407f17
mov cl, byte [ebp - 0x15]
mov byte [ebp - 0x12c], cl
test cl, cl
je 0x407f83
mov eax, dword [ebx + 0x10]
movzx ecx, cl
add ecx, eax
mov esi, ebx
cmp ecx, eax
ja 0x407f79
push 0xffffffffffffffff
call fcn.004063f1
jmp 0x407f83
push 0
sub ecx, eax
push ecx
call fcn.00405e30
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00408cac
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 4], edi
call fcn.00408cac
mov byte [ebp - 4], 2
cmp dword [ebx + 0x14], 0x10
mov eax, dword [ebx + 0x10]
jb 0x407fb7
mov ecx, dword [ebx]
jmp 0x407fb9
mov ecx, ebx
push 0x14
lea edx, [ebp - 0x12b]
push edx
push eax
push ecx
lea esi, [ebp - 0x2c]
call fcn.00408c20
push eax
call fcn.00408c67
lea eax, [ebp - 0x14c]
push eax
mov esi, 0x41c060
lea eax, [ebp - 0x20]
push esi
push eax
call fcn.004015a2
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x24]
push esi
push eax
mov byte [ebp - 4], 3
call fcn.004015a2
add esp, 0x18
mov byte [ebp - 4], 4
cmp dword [ebx + 0x14], 0x10
mov eax, dword [ebx + 0x10]
jb 0x408011
mov edx, dword [ebx]
jmp 0x408013
mov edx, ebx
mov ecx, dword [ebp - 0x20]
mov esi, dword [ecx]
push eax
push edx
call dword [esi + 0xc]
mov esi, 0x80
push esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x14c]
push eax
xor edi, edi
push edi
push edi
push edi
push dword [0x41c064]
mov dword [ebp - 0x14], 0x35
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x408067
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x78], vtable.xwnmqigmmwptq.0
push 0x417274
lea eax, [ebp - 0x78]
jmp 0x407f17
cmp dword [ebp - 0x14], esi
je 0x408090
mov dword [ebp - 0x90], vtable.livsx.0
mov dword [ebp - 0x8c], 0x80092001
push 0x4172e0
lea eax, [ebp - 0x90]
jmp 0x407f17
cmp dword [ebx + 0x14], 0x10
jb 0x40809a
mov eax, dword [ebx]
jmp 0x40809c
mov eax, ebx
mov esi, dword [ebx + 0x10]
push dword [ebp - 0x20]
add esi, eax
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0xcc]
push eax
lea ecx, [ebp - 0x14c]
mov dword [ebp - 0xb8], 0xf
mov dword [ebp - 0xbc], edi
mov byte [ebp - 0xcc], 0
call fcn.00405e8b
mov byte [ebp - 4], 5
cmp dword [ebx + 0x14], 0x10
jb 0x4080e2
mov eax, dword [ebx]
jmp 0x4080e4
mov eax, ebx
cmp esi, edi
jne 0x4080ec
xor esi, esi
jmp 0x4080ee
sub esi, eax
lea eax, [ebp - 0xcc]
push eax
push edi
mov edi, esi
mov esi, ebx
call fcn.00408a4b
push 1
xor edi, edi
lea esi, [ebp - 0xcc]
call fcn.00406714
mov ecx, 0x80
lea eax, [ebp - 0x14c]
mov byte [eax], 0
inc eax
dec ecx
jne 0x408119
xor esi, esi
mov dword [ebp - 0x5c], 0xf
mov dword [ebp - 0x60], esi
mov byte [ebp - 0x70], 0
mov ebx, 0x41c078
push ebx
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0xffffffffffffffff
push esi
push 0x41ad8c
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 7
call fcn.004065f0
push ebx
mov byte [ebp - 4], 6
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], 0xa
jne 0x408185
call fcn.0040891d
xor edx, edx
mov ecx, 0x2711
div ecx
add edx, 0x2710
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 8
cmp dword [ebp - 0x60], esi
jne 0x40828e
push ebx
mov dword [ebp - 0xb0], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 9
mov eax, dword [0x41c06c]
mov ecx, dword [0x41c068]
sub eax, ecx
cdq
push 0x1c
pop esi
idiv esi
xor edx, edx
mov esi, eax
mov eax, dword [0x41c044]
lea edi, [esi + 0xc]
div edi
inc dword [0x41c044]
cmp edx, esi
jae 0x4081e2
imul edx, edx, 0x1c
push 0xffffffffffffffff
add edx, ecx
push 0
push edx
lea eax, [ebp - 0x70]
call fcn.004065f0
jmp 0x40821d
call fcn.0040891d
push 0xc
pop ecx
xor edx, edx
div ecx
lea eax, [ebp - 0x184]
push edx
push eax
call fcn.00407d36
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 0xa
call fcn.00406680
push 1
xor edi, edi
lea esi, [ebp - 0x184]
mov byte [ebp - 4], 9
call fcn.00406714
push 3
push 0x415f24
lea eax, [ebp - 0x70]
push eax
xor eax, eax
call fcn.00407357
cmp eax, 0xffffffff
jne 0x408283
lea eax, [ebp - 0x1a0]
push str.http:__
push eax
lea edi, [ebp - 0x70]
call fcn.004057ee
pop ecx
pop ecx
lea ecx, [ebp - 0x168]
push ecx
mov byte [ebp - 4], 0xb
call fcn.0040895c
pop ecx
push eax
mov eax, edi
mov byte [ebp - 4], 0xc
call fcn.00406680
push 1
xor edi, edi
lea esi, [ebp - 0x168]
call fcn.00406714
push 1
lea esi, [ebp - 0x1a0]
call fcn.00406714
push ebx
mov byte [ebp - 4], 8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebp + 0xc]
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.00407799
add esp, 0xc
mov byte [ebp - 4], 0xd
cmp dword [ebp - 0x44], 0x15
jae 0x4082c6
mov dword [ebp - 0x7c], 0x2f78
mov dword [ebp - 0x80], vtable.cuovxnupr.0
push 0x417318
lea eax, [ebp - 0x80]
jmp 0x407f17
cmp dword [ebp - 0x40], 0x10
mov eax, dword [ebp - 0x54]
jae 0x4082d2
lea eax, [ebp - 0x54]
push dword [ebp - 0x44]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx]
push eax
call dword [edx + 0x10]
mov edi, dword [ebp - 0x44]
mov eax, dword [ebp - 0x54]
add edi, 0xffffffec
cmp dword [ebp - 0x40], 0x10
jae 0x4082f0
lea eax, [ebp - 0x54]
cmp dword [ebp - 0x40], 0x10
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x54]
jae 0x4082ff
lea eax, [ebp - 0x54]
push edi
push eax
lea esi, [ebp - 0x38]
call fcn.00408c20
push 0x80
lea ecx, [ebp - 0x220]
push ecx
push eax
call fcn.00408c67
cmp eax, 0x14
jne 0x408332
add edi, dword [ebp - 0x1c]
push 5
pop ecx
lea esi, [ebp - 0x220]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
je 0x408356
mov dword [ebp - 0x84], 0x2f78
mov dword [ebp - 0x88], vtable.cuovxnupr.0
push 0x417318
lea eax, [ebp - 0x88]
jmp 0x407f17
cmp dword [ebp - 0x40], 0x10
mov ecx, dword [ebp - 0x54]
jae 0x408362
lea ecx, [ebp - 0x54]
mov eax, dword [ebp - 0x44]
movzx ecx, byte [eax + ecx - 0x15]
sub eax, ecx
sub eax, 0x15
jns 0x408395
mov dword [ebp - 0x94], 0x2f78
mov dword [ebp - 0x98], vtable.cuovxnupr.0
push 0x417318
lea eax, [ebp - 0x98]
jmp 0x407f17
push 0xffffffffffffffff
mov ecx, eax
lea esi, [ebp - 0x54]
call fcn.004063f1
push ebx
mov dword [ebp - 0xac], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x70]
push eax
mov eax, 0x41ad8c
mov byte [ebp - 4], 0xe
call fcn.004065f0
push ebx
mov byte [ebp - 4], 0xd
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
mov esi, dword [ebp + 8]
push eax
call fcn.004066d9
xor ebx, ebx
inc ebx
or dword [ebp - 0x30], ebx
push ebx
xor edi, edi
lea esi, [ebp - 0x54]
call fcn.00406714
push ebx
lea esi, [ebp - 0x70]
call fcn.00406714
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx]
push ebx
call dword [eax]
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x20]
xor esi, esi
cmp ecx, esi
je 0x408412
mov eax, dword [ecx]
push ebx
call dword [eax]
cmp dword [ebp - 0x34], esi
je 0x408420
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp dword [ebp - 0x38], esi
je 0x40842e
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
cmp dword [ebp - 0x28], esi
je 0x40843c
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp dword [ebp - 0x2c], esi
je 0x40844a
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret