Function at 0x40cd4e
Capabilities:
Encrypt or decrypt via wincrypt
Get disk information

Disassembly:
push 0x419fdd
call fcn.0040b51a
dec dword [ebp - 4]
jne 0x411bd4
push esp
push 0xd
push dword [esp + 8]
push 0x404ef4
call fcn.0040432b
add byte [eax], al
mov eax, 0x419d52
push esi
push 0
mov esi, ecx
call fcn.00407ca0
mov dword [esi], 0x100063e0
push 0xc7f
push 0x419d68
call fcn.00408bf5
push 0x4005a5
push dword [esp + 0xc]
push ebp
push 0x3f6ade
call fcn.00403ef1
sub esp, 8
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
push 0x7a
push 0xab0
push 0x12
call fcn.0040e027
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
push 0x2b
push 0xffffffffffffff88
push 0x12ff
push edx
push 0x419d8e
push sym.imp.WININET.dll_InternetReadFile
call fcn.0040b0cc
push 7
push 0x400e34
push eax
push 0x3fb103
call fcn.00404199
push edx
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov eax, dword [esi + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
call fcn.00404c7b
push 0x5d
push 0x144e
push 0x532
push 0xffffffffffffffd2
push 0x4198fb
push ecx
call fcn.0040f448
push 0x419b83
push 0xffffffffffffffa3
push 0xd81
push ecx
push sym.imp.ADVAPI32.dll_CryptCreateHash
call fcn.0040d019
push 0x1e38
push eax
push sym.imp.KERNEL32.dll_GetCommandLineA
push sym.imp.KERNEL32.dll_DeleteFileW
call fcn.00405852
push 0x12
call fcn.0040dd04
call fcn.0040f62f
mov eax, dword [esi + 0x14]
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x50], ebx
jne 0x411cf1
push 0xf38
push 0xffffffffffffffa0
call fcn.0040bf9e
push 0x4005ff
push 0x400fcc
push 0x400215
push 0x3ff1ec
call fcn.004037fe
push ecx
mov ecx, dword [esp + 8]
call fcn.00409cf0
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
sub esp, 8
mov ecx, dword [esp + 0x10]
call fcn.00408f2f
push 0x2a
push 0x20
call fcn.0040da17
call dword [sym.imp.COMCTL32.dll_PropertySheetW]
mov eax, dword [ebp - 0xc]
xor eax, dword [ebp - 0x10]
xor esi, eax
mov dword [str._AUEFFECT_TYPE_], esi
jne 0x411d1a
mov dword [0x4197f0], 0xbb40e64e
push str.ERRORABO
push 0x1b
push sym.imp.GDI32.dll_GetStockObject
push sym.imp.KERNEL32.dll_QueryPerformanceCounter
push ecx
call fcn.0040c04d
push 0xfffffffffffffff6
push 0x4005f7
push 0x64
push 0x3f8296
call fcn.004037fe
xor eax, eax
mov edx, dword [ecx + 0x14]
xor eax, eax
sub esp, 8
cmp edx, eax
jne 0x411d8e
xor edx, edx
mov dword [esp], eax
mov dword [esp + 4], eax
push esp
push 0x18
call fcn.00409f27
mov ecx, dword [0x419381]
mov edx, dword [ecx]
push 0x419428
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
add esp, 8
pop edi
push 0x4194dd
push ebp
call fcn.0040b9c5
push sym.imp.KERNEL32.dll_CreateDirectoryExA
push 0x10cc
push 0x419546
call fcn.0040f0e3
push 0xffffffffffffffcd
push 0xffffffffffffff82
push 0xffffffffffffff93
push 0xffffffffffffffd0
call fcn.004047bf
push dword [esp + 4]
push eax
push dword [esp + 0xc]
push 0x3fba1d
call fcn.00403c49
push eax
push 0x419077
push ecx
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
push 0x8e2
push 0xffffffffffffffef
push 0xfffffffffffffffc
push 0x1fe7
push 0xffffffffffffff85
call fcn.0040ceb4
push 0xffffffffffffffe8
push dword [esp + 8]
push 0x400a01
push 0x3fa823
call fcn.00404062
cmp dword [ecx + 0x24], 0x10
jb 0x411e93
mov eax, dword [ecx + 0x10]
lea eax, [ecx + 0x10]
push eax
push 0xffffffffffffffa6
push 0x1b
call fcn.00404eca
add esp, 0xc
test eax, eax
je 0x411e72
mov eax, dword [0x419f82]
mov ecx, dword [esp]
lea edx, [esp + 4]
push 1
push edx
call fcn.0040b422
call fcn.0040ac85
push 0x41a11b
push 0xffffffffffffffe7
call fcn.0040c827
push 0xffffffffffffff94
push 0x3d
push 0x985
call fcn.00405e62
push 0x316
push 0x16af
push ebp
call fcn.004081bb
push esp
push 0x400800
push 0x39
push 0x3fc69d
call fcn.00403675
call fcn.00409bbf
sub esp, 8
and al, 0xff
adc eax, 0x10022340
sub esp, 0x10
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 4], eax
push esp
push sym.imp.USER32.dll_GetTopWindow
push esp
call fcn.0040c55c
push 0x419025
push 0x1fb8
push 0x7e
push 0x4194f9
push 0xffffffffffffffdf
call fcn.0040a5cc
push 0x40048a
push edx
push ebx
push 0x3f6172
call fcn.00403c49
push edi
call fcn.0040e50d
push eax
push 0xfffffffffffffffb
call fcn.0040621e
push 0x10
call fcn.00404b3b
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
add esp, 4
mov esi, eax
call fcn.0040e3a7
push 0xffffffffffffffd7
push 0x400cc4
push dword [esp + 8]
push 0x3f3446
call fcn.00403675
jne 0x411ef7
mov eax, dword [esi + 0x2018]
lea ecx, [eax + eax]
mov edi, eax
mov dword [esi + 0x2018], ecx
mov ecx, dword [esi + 0x2014]
shr edi, 0x1f
dec ecx
push ecx
push 0xf
call fcn.0040cb8b
pop ebx
mov dword fs:[0], ecx
add esp, 0x4c
ret