Function at 0x414d40
Capabilities:
Encrypt or decrypt via wincrypt
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x44a308
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x45e520]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x45e520]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x128], 0x10
jb 0x414d85
mov eax, dword [edi + 0x114]
jmp 0x414d8b
lea eax, [edi + 0x114]
xor ebx, ebx
push ebx
push 0x2000000
push 3
push ebx
push ebx
push 0x20000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x415050
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebp
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xffffffff
mov dword [esp + 0x2c], esi
je 0x415050
push esi
call fcn.00416bfc
mov ebp, eax
add esp, 4
cmp ebp, ebx
je 0x415050
push esi
push ebx
push ebp
call fcn.00436440
add esp, 0xc
cmp dword [edi + 0x128], 0x10
jb 0x414dfb
mov eax, dword [edi + 0x114]
jmp 0x414e01
lea eax, [edi + 0x114]
push 0x4537b0
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00433b40
add esp, 0xc
test eax, eax
jne 0x415047
mov ecx, dword [esp + 0x20]
push ecx
push esi
push 1
push ebp
call fcn.00434b4f
mov edx, dword [esp + 0x30]
push edx
mov dword [esp + 0x28], eax
call fcn.00432ebb
mov eax, dword [edi + 0x10c]
add esp, 0x14
cmp dword [edi + 4], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], eax
je 0x414f0e
mov dword [esp + 0x50], 0xf
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
mov dword [esp + 0x60], ebx
mov ecx, dword [esp + 0x14]
push ecx
push ebp
lea ecx, [esp + 0x40]
call fcn.004024f0
mov eax, dword [esp + 0x14]
push eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x28], eax
call fcn.00416bfc
mov ecx, dword [esp + 0x40]
add esp, 4
cmp dword [esp + 0x50], 0x10
mov ebx, eax
mov dword [esp + 0x30], ebx
jae 0x414e9f
lea ecx, [esp + 0x3c]
mov eax, dword [esp + 0x34]
lea edx, [esp + 0x24]
push edx
push ebx
call fcn.00414760
add esp, 8
test eax, eax
je 0x41500a
push esi
push 0
push ebp
call fcn.00436440
mov ebx, dword [esp + 0x30]
add esp, 0xc
cmp esi, ebx
ja 0x414ee5
push ebp
call fcn.00416c01
lea esi, [ebx + 1]
push esi
call fcn.00416bfc
mov ebp, eax
add esp, 8
mov eax, esi
jmp 0x414ee9
mov eax, dword [esp + 0x2c]
mov esi, dword [esp + 0x30]
push ebx
push esi
push eax
push ebp
call fcn.00432a79
push esi
call fcn.00416c01
add esp, 0x14
lea ecx, [esp + 0x38]
mov dword [esp + 0x14], ebx
call fcn.00402120
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x60], 1
mov eax, dword [esp + 0x28]
push eax
lea ecx, [edi + 8]
push ecx
lea esi, [esp + 0x20]
call fcn.00416b00
test eax, eax
je 0x415026
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x14]
push edx
push ebp
push ebx
push 1
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x415026
mov ecx, dword [esp + 0x14]
add edi, 0x12c
push 0x45388c
mov byte [ecx + ebp], 0
call fcn.00416a00
cmp eax, ebx
je 0x414f9f
push 0x45389c
call fcn.00416a00
cmp eax, ebx
je 0x414f9f
push 0x4538ac
call fcn.00416a00
cmp eax, ebx
je 0x414f9f
push 0x4538bc
call fcn.00416a00
cmp eax, ebx
jl 0x415026
mov esi, edi
call fcn.004169e0
mov esi, eax
mov edx, dword [esi]
mov eax, dword [edx + 0xfc]
push ebx
push esi
call eax
cmp eax, ebx
jge 0x414fc4
push 0x45384c
push esi
push eax
call fcn.00448770
push ecx
mov ebx, esp
mov dword [esp + 0x2c], esp
push ebp
call fcn.004132f0
mov esi, edi
mov byte [esp + 0x64], 2
call fcn.004169e0
mov ecx, eax
mov byte [esp + 0x64], 1
call fcn.00414bc0
movzx eax, ax
test ax, ax
je 0x415024
push ebp
call fcn.00416c01
add esp, 4
lea esi, [esp + 0x18]
call fcn.00416ad0
mov eax, 1
jmp 0x415052
push ebx
call fcn.00416c01
push ebp
call fcn.00416c01
add esp, 8
lea ecx, [esp + 0x38]
call fcn.00402120
jmp 0x415050
xor ebx, ebx
cmp dword [esp + 0x18], ebx
je 0x415047
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov edx, dword [esp + 0x18]
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esp + 0x18], ebx
push ebp
call fcn.00416c01
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.004322f2
add esp, 0x50
ret