Function at 0x1064efd
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x10d0640]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x1c], ecx
xor ecx, ecx
inc dword [eax + 4]
mov dword [ebp - 0x2c], ecx
mov esi, ebx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], ecx
movsd dword es:[edi], dword [esi]
call fcn.0108dd30
mov esi, eax
xor edi, edi
cmp esi, edi
je 0x1064f6c
push esi
push 0x20840139
call fcn.0108c503
jmp 0x1065393
mov eax, dword [ebp + 0x14]
add eax, 0xfffffff0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
add ebx, 0x10
push 1
mov dword [ebp - 0x18], ebx
call fcn.0105da07
mov esi, eax
cmp esi, edi
je 0x1064f9c
push esi
push 0x208c0139
jmp 0x1064f62
mov eax, dword [ebp - 0x20]
shr eax, 1
lea eax, [eax + eax + 2]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
mov dword [ebp - 0x38], esi
cmp esi, edi
jne 0x1064fc6
mov esi, 0x8007000e
push esi
push 0x20940139
jmp 0x10653f9
push dword [ebp - 0x20]
push dword [ebp - 0x18]
push esi
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x20]
shr eax, 1
xor ecx, ecx
add esp, 0xc
mov word [esi + eax*2], cx
cmp dword [0x10d22a4], edi
je 0x1065015
push 0x1012cb8
call fcn.0109c1c3
mov dword [esp], 0x8d4
call fcn.0108bbbd
push eax
call fcn.0109c1c3
push dword [ebp - 0x2c]
push esi
push 0x1012c9c
call fcn.0109c1c3
add esp, 0x10
mov eax, dword [ebp - 0x20]
add dword [ebp - 0x18], eax
sub dword [ebp - 0x1c], eax
je 0x1065383
mov ebx, 0x10042f8
cmp dword [0x10d22a4], edi
je 0x1065038
push ebx
call fcn.0109c1c3
pop ecx
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
call fcn.0105da07
mov esi, eax
cmp esi, edi
jne 0x10653d3
cmp dword [0x10d22a4], 1
jle 0x1065076
push ebx
call fcn.0109c1c3
pop ecx
push dword [ebp - 0x3c]
mov eax, 0x100e0a8
push eax
push eax
push 1
push edi
call fcn.01058339
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 1
call fcn.0105da07
mov esi, eax
cmp esi, edi
jne 0x10653db
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
cmp dword [0x10d22c0], edi
je 0x10650c5
push ebx
call fcn.0109c1c3
pop ecx
push 0xffffffffffffffff
push dword [ebp - 0x30]
push dword [ebp - 0x18]
call fcn.0105e6d2
mov esi, eax
cmp esi, edi
jne 0x10653e3
mov eax, dword [ebp - 0x20]
add dword [ebp - 0x18], eax
sub dword [ebp - 0x1c], eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
call fcn.0105da07
mov esi, eax
cmp esi, edi
jne 0x10653eb
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
call fcn.0105da07
mov esi, eax
cmp esi, edi
jne 0x10653f3
cmp dword [0x10d22a4], edi
je 0x106512d
lea eax, [ebp - 0x5c]
push eax
push edi
push 0x20f
push edi
call fcn.0103d737
cmp eax, edi
je 0x106512d
push eax
push 0x20e20139
call fcn.0108c503
test dword [ebp - 0x3c], 8
jne 0x1065165
mov eax, dword [ebp - 0x34]
inc dword [eax + 8]
cmp dword [0x10d22a4], edi
je 0x106537a
push 0x8a9
call fcn.0108bbbd
push eax
call fcn.0109c1c3
push ebx
call fcn.0109c1c3
pop ecx
pop ecx
jmp 0x106537a
mov edi, dword [ebp - 0x34]
inc dword [edi + 0xc]
inc dword [edi + 0x20]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 1
call fcn.0105da07
mov esi, eax
test esi, esi
jne 0x1065400
cmp dword [0x10d22a4], 1
jle 0x10651ae
push 0x1012c90
call fcn.0109c1c3
pop ecx
push 8
push dword [ebp - 0x18]
push 0xe04
call fcn.0108fdd0
cmp dword [ebp + 0x18], 0
je 0x10651d8
push 0
push dword [ebp - 0x18]
push 1
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
jne 0x10651d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x1065408
add dword [ebp - 0x18], 8
sub dword [ebp - 0x1c], 8
lea eax, [ebp - 0x20]
push eax
push 8
push dword [ebp - 0x20]
call fcn.0105e21d
mov esi, eax
test esi, esi
jne 0x1065410
cmp dword [0x10d22a4], 1
jle 0x106522d
push ebx
call fcn.0109c1c3
mov dword [esp], 0x8d5
call fcn.0108bbbd
push eax
call fcn.0109c1c3
push ebx
call fcn.0109c1c3
pop ecx
pop ecx
push dword [ebp - 0x20]
push dword [ebp - 0x18]
push esi
call fcn.0108fdd0
cmp dword [ebp + 0x18], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x48], eax
je 0x106536f
push eax
push 0
mov dword [ebp - 0x28], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
mov dword [ebp - 0x24], esi
test esi, esi
je 0x1065418
push dword [ebp - 0x28]
push dword [ebp - 0x18]
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
push esi
push 0
push 1
push 0
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x1065293
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x21340139
call fcn.0108c503
jmp 0x1065354
cmp dword [0x10d22a4], 1
jle 0x10652ca
push ebx
call fcn.0109c1c3
mov dword [esp], 0x8d6
call fcn.0108bbbd
push eax
call fcn.0109c1c3
push ebx
call fcn.0109c1c3
pop ecx
pop ecx
push dword [ebp - 0x20]
push esi
push 0x1000
call fcn.0103cac1
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x50]
push eax
push 0xa400
push 0
push dword [ebp - 0x28]
push esi
call fcn.0105dbbb
mov esi, eax
test esi, esi
jne 0x1065425
mov esi, dword [ebp - 0x4c]
mov ebx, dword [ebp - 0x50]
push eax
push 1
push esi
push ebx
push dword [ebp - 0x30]
push dword [ebp - 0x40]
call fcn.01064b66
test eax, eax
je 0x1065311
push eax
push 0x21530139
call fcn.0108c503
push edi
push 0
push esi
push ebx
push dword [ebp - 0x30]
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push dword [ebp - 0x54]
call fcn.0105e8c3
test eax, eax
je 0x106533b
push 0x80090006
push eax
push 0x215e0139
call fcn.0108c520
mov ecx, esi
mov eax, ebx
test esi, esi
je 0x106534a
mov byte [eax], 0
inc eax
dec ecx
jne 0x1065343
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov eax, esi
test ecx, ecx
je 0x1065364
mov byte [eax], 0
inc eax
dec ecx
jne 0x106535d
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x48]
add dword [ebp - 0x18], eax
sub dword [ebp - 0x1c], eax
xor edi, edi
cmp dword [ebp - 0x1c], edi
ja 0x1065024
xor esi, esi
cmp dword [ebp - 0x38], edi
je 0x1065393
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x2c], edi
je 0x10653a1
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x24], edi
je 0x10653c0
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
cmp ecx, edi
je 0x10653b7
mov byte [eax], 0
inc eax
dec ecx
jne 0x10653b0
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01077d0b
leave
ret 0x18
push esi
push 0x20b10139
jmp 0x10653f9
push esi
push 0x20bf0139
jmp 0x10653f9
push esi
push 0x20c90139
jmp 0x10653f9
push esi
push 0x20d60139
jmp 0x10653f9
push esi
push 0x20dd0139
call fcn.0108c503
jmp 0x1065385
push esi
push 0x20f70139
jmp 0x106542b
push esi
push 0x210f0139
jmp 0x106542b
push esi
push 0x21170139
jmp 0x106542b
mov esi, 0x8007000e
push esi
push 0x212e0139
jmp 0x106542b
push esi
push 0x214a0139
call fcn.0108c503
xor edi, edi
jmp 0x1065385