Function at 0x48083f
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x64
mov eax, dword [0x5184d0]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [ebp + 8]
and dword [esp + 0x18], 0
push ebx
push esi
mov dword [esp + 0x44], ecx
mov esi, eax
mov ecx, dword [ebp + 0x14]
xor ebx, ebx
and dword [esp + 0x14], ebx
push edi
lea edi, [esp + 0x5c]
mov dword [esp + 0x44], edx
inc dword [ecx + 4]
lea edx, [esp + 0x24]
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x5c]
mov dword [esp + 0x1c], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.004c95e2
mov esi, eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x38], eax
test esi, esi
je 0x4808b2
push esi
push 0x213f0139
call dword [sym.imp.certcli.dll_Ordinal_357]
jmp 0x480d65
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x14]
add eax, 0x10
xor ecx, ecx
mov dword [esp + 0x14], eax
inc ecx
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0xc], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
call fcn.0047edf3
mov esi, eax
test esi, esi
je 0x4808eb
push esi
push 0x21470139
jmp 0x4808a7
mov eax, dword [esp + 0x10]
shr eax, 1
lea eax, [eax*2 + 2]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
mov dword [esp + 0x50], edi
test edi, edi
jne 0x48091a
mov eax, 0x8007000e
push eax
mov esi, eax
push 0x214f0139
jmp 0x4808a7
push dword [esp + 0x10]
mov esi, dword [esp + 0x18]
push esi
push edi
call sub.msvcrt.dll_memcpy
mov eax, dword [esp + 0x1c]
xor ecx, ecx
shr eax, 1
add esp, 0xc
mov word [edi + eax*2], cx
cmp dword [0x51996c], ecx
je 0x48096e
push 0x41d780
call fcn.004c5942
pop ecx
mov ecx, 0x8d4
call fcn.004cf8b9
push eax
call fcn.004c5942
pop ecx
push dword [esp + 0x38]
push edi
push 0x41d7b4
call fcn.004c5942
add esp, 0xc
mov eax, dword [esp + 0x10]
add esi, eax
sub dword [esp + 0xc], eax
mov dword [esp + 0x14], esi
je 0x480d57
mov edi, 0x406520
cmp dword [0x51996c], 0
je 0x480997
push edi
call fcn.004c5942
pop ecx
lea eax, [esp + 0x28]
xor ecx, ecx
push eax
lea eax, [esp + 0x10]
push eax
lea edx, [esp + 0x1c]
call fcn.0047edf3
mov esi, eax
test esi, esi
jne 0x480e18
cmp dword [0x51996c], 1
jle 0x4809dd
push edi
call fcn.004c5942
pop ecx
push dword [esp + 0x28]
mov dl, 1
xor cl, cl
push 0x41c3ec
push 0x41c3ec
call fcn.00473b6e
lea eax, [esp + 0x10]
xor ecx, ecx
push eax
lea eax, [esp + 0x10]
inc ecx
push eax
lea edx, [esp + 0x1c]
call fcn.0047edf3
mov esi, eax
test esi, esi
jne 0x480e10
mov ecx, dword [esp + 0x10]
mov esi, ecx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], esi
cmp dword [0x519984], eax
je 0x480a3e
push edi
call fcn.004c5942
pop ecx
push 0xffffffffffffffff
push 0
push 0
push esi
xor ecx, ecx
xor edx, edx
push ebx
inc ecx
call fcn.0045bba5
mov esi, eax
test esi, esi
jne 0x480da8
mov ecx, dword [esp + 0x10]
sub dword [esp + 0xc], ecx
lea eax, [ebx + ecx]
mov dword [esp + 0x14], eax
lea edx, [esp + 0x14]
lea eax, [esp + 0x54]
xor ecx, ecx
push eax
lea eax, [esp + 0x10]
push eax
call fcn.0047edf3
mov esi, eax
test esi, esi
jne 0x480e08
lea eax, [esp + 0x58]
xor ecx, ecx
push eax
lea eax, [esp + 0x10]
push eax
lea edx, [esp + 0x1c]
call fcn.0047edf3
mov esi, eax
test esi, esi
jne 0x480e00
cmp dword [0x51996c], eax
je 0x480ab1
lea eax, [esp + 0x54]
mov edx, 0x20f
push eax
push esi
xor cl, cl
call fcn.0045fcfa
test eax, eax
je 0x480ab1
push eax
push 0x21a10139
call dword [sym.imp.certcli.dll_Ordinal_357]
test dword [esp + 0x28], 8
jne 0x480aec
mov eax, dword [esp + 0x20]
inc dword [eax + 8]
cmp dword [0x51996c], 0
je 0x480ae3
mov ecx, 0x8a9
call fcn.004cf8b9
push eax
call fcn.004c5942
pop ecx
push edi
call fcn.004c5942
pop ecx
mov esi, dword [esp + 0xc]
jmp 0x480d4f
mov ebx, dword [esp + 0x20]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
xor ecx, ecx
push eax
inc dword [ebx + 0xc]
lea edx, [esp + 0x1c]
inc dword [ebx + 0x20]
inc ecx
call fcn.0047edf3
mov esi, eax
test esi, esi
jne 0x480df8
cmp dword [0x51996c], 1
mov edi, dword [esp + 0x14]
jle 0x480b3c
push 0x41d7d0
call fcn.004c5942
pop ecx
push 8
mov edx, edi
mov ecx, 0xe04
call fcn.004ca44f
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x480b63
push 0
push edi
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
jne 0x480b63
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x480db6
mov esi, dword [esp + 0xc]
add edi, 8
mov eax, dword [esp + 0x10]
sub esi, 8
mov dword [esp + 0x14], edi
mov dword [esp + 0x4c], esi
mov dword [esp + 0xc], esi
cmp eax, 8
jb 0x480de6
add eax, 0xfffffff8
cmp dword [0x51996c], 1
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], eax
jle 0x480bd7
push 0x406520
call fcn.004c5942
pop ecx
mov ecx, 0x8d5
call fcn.004cf8b9
push eax
call fcn.004c5942
mov dword [esp], 0x406520
call fcn.004c5942
pop ecx
push dword [esp + 0x10]
mov edx, edi
xor ecx, ecx
call fcn.004ca44f
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
test ebx, ebx
je 0x480d3a
push eax
push 0
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
je 0x480dc6
push dword [esp + 0x18]
push edi
push ebx
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push ebx
push 0
push 1
push 0
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x480c34
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x21f30139
call dword [sym.imp.certcli.dll_Ordinal_357]
jmp 0x480d20
cmp dword [0x51996c], 1
jle 0x480c78
mov esi, 0x406520
push esi
call fcn.004c5942
pop ecx
mov ecx, 0x8d6
call fcn.004cf8b9
push eax
call fcn.004c5942
pop ecx
push esi
call fcn.004c5942
pop ecx
mov ecx, dword [0x5199c0]
mov edx, ebx
push dword [esp + 0x10]
or ecx, 0x1000
call fcn.004ca44f
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x44]
mov ecx, ebx
push eax
push 0xa400
push 0
call fcn.0047f08d
mov esi, eax
test esi, esi
jne 0x480dbe
mov esi, dword [esp + 0x3c]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
push eax
push 1
push eax
mov eax, dword [esp + 0x4c]
push esi
push eax
mov dword [esp + 0x48], eax
call fcn.0047fb60
test eax, eax
je 0x480ccd
push eax
push 0x22130139
call dword [sym.imp.certcli.dll_Ordinal_357]
push dword [esp + 0x20]
mov edx, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
push 0
push esi
push dword [esp + 0x40]
push dword [esp + 0x3c]
push dword [esp + 0x44]
call fcn.00480524
test eax, eax
je 0x480d02
push 0x80090006
push eax
push 0x221e0139
call dword [sym.imp.certcli.dll_Ordinal_358]
mov ecx, dword [esp + 0x34]
mov eax, ecx
test esi, esi
je 0x480d15
mov byte [eax], 0
inc eax
sub esi, 1
jne 0x480d0c
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, dword [esp + 0x4c]
mov eax, dword [esp + 0x18]
mov ecx, ebx
test eax, eax
je 0x480d33
mov byte [ecx], 0
inc ecx
sub eax, 1
jne 0x480d2a
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
add edi, dword [esp + 0x1c]
sub esi, dword [esp + 0x1c]
mov dword [esp + 0x14], edi
mov edi, 0x406520
mov dword [esp + 0xc], esi
test esi, esi
jne 0x480987
xor esi, esi
xor ebx, ebx
push dword [esp + 0x50]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 0x38]
test eax, eax
je 0x480d74
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
test ebx, ebx
je 0x480d92
mov ecx, dword [esp + 0x18]
mov eax, ebx
test ecx, ecx
je 0x480d8b
mov byte [eax], 0
inc eax
sub ecx, 1
jne 0x480d82
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [esp + 0x6c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005036b0
mov esp, ebp
pop ebp
ret 0x10
push esi
push 0x21880139
call dword [sym.imp.certcli.dll_Ordinal_357]
jmp 0x480d59
push esi
push 0x21ce0139
jmp 0x480dae
push esi
push 0x22090139
jmp 0x480dd3
mov eax, 0x8007000e
push eax
mov esi, eax
push 0x21ed0139
call dword [sym.imp.certcli.dll_Ordinal_357]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x18], eax
jmp 0x480d5b
or dword [esp + 0x10], 0xffffffff
mov esi, 0x80070216
push esi
push 0x21d60139
jmp 0x480dae
push esi
push 0x21b60139
jmp 0x480dae
push esi
push 0x219c0139
jmp 0x480dae
push esi
push 0x21950139
jmp 0x480dae
push esi
push 0x217a0139
jmp 0x480dae
push esi
push 0x216c0139
jmp 0x480dae