Function at 0x41a1f5
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc94
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, str.o6806642kbM7c5
lea edi, [ebp - 0x14]
push 9
mov ebx, ecx
mov eax, edx
pop ecx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc94], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, str.72905C47_F4FD_4CF7_A489_4E8121A155BD
lea edi, [ebp - 0x3c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov edi, 0x3e8
mov byte [eax], 0
push edi
push ecx
lea eax, [ebp - 0xc58]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00643470
pop ecx
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00643470
pop ecx
mov edx, eax
lea ecx, [ebp - 0x3c]
call fcn.004192b9
add esp, 0x14
test eax, eax
je 0x41a434
push str.u00
push ebx
call fcn.00639500
pop ecx
pop ecx
test eax, eax
je 0x41a28f
mov ecx, ebx
call fcn.00404718
push ebx
call fcn.00643470
pop ecx
push ecx
lea edx, [ebp - 0x488]
mov ecx, ebx
call fcn.004020b3
mov esi, eax
pop ecx
test esi, esi
je 0x41a434
push ebx
call fcn.00643470
cmp dword [ebp - 0x488], 0x10
pop ecx
jne 0x41a434
push 0x10
lea eax, [ebp - 0x484]
push eax
lea eax, [ebp - 0xa0]
push eax
call fcn.00638b30
add esi, 0xffffffec
lea eax, [ebp - 0x474]
push esi
push eax
lea eax, [ebp - 0x870]
push eax
call fcn.00638b30
push 0x20
pop eax
push eax
mov dword [ebp - 0xc7c], eax
lea eax, [ebp - 0xc58]
push eax
lea eax, [ebp - 0xc78]
mov dword [ebp - 0xc84], 0x208
push eax
mov dword [ebp - 0xc80], 0x6610
call fcn.00638b30
add esp, 0x24
lea eax, [ebp - 0xc8c]
xor ebx, ebx
push 0xf0000000
push 0x18
push ebx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x41a42e
lea eax, [ebp - 0xc88]
push eax
push ebx
push ebx
push 0x2c
lea eax, [ebp - 0xc84]
push eax
push dword [ebp - 0xc8c]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x41a42e
push ebx
lea eax, [ebp - 0xa0]
push eax
push 1
push dword [ebp - 0xc88]
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x41a42e
lea eax, [ebp - 0xc90]
mov dword [ebp - 0xc90], esi
push eax
lea eax, [ebp - 0x870]
push eax
push ebx
push 1
push ebx
push dword [ebp - 0xc88]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x41a3d9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0xc88], ebx
je 0x41a3c2
push dword [ebp - 0xc88]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
cmp dword [ebp - 0xc8c], ebx
je 0x41a434
push ebx
push dword [ebp - 0xc8c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x41a434
mov eax, dword [ebp - 0xc90]
cmp eax, edi
jae 0x41a445
mov byte [ebp + eax - 0x870], bl
lea eax, [ebp - 0x870]
push eax
push edi
push dword [ebp - 0xc94]
call fcn.006494f3
add esp, 0xc
cmp dword [ebp - 0xc88], ebx
je 0x41a414
push dword [ebp - 0xc88]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
cmp dword [ebp - 0xc8c], ebx
je 0x41a429
push ebx
push dword [ebp - 0xc8c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
inc eax
jmp 0x41a436
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret
call fcn.00612782
int3