Function at 0x10055880
Capabilities:
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xe0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, esp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x10063700
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov edx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x24]
push eax
mov ebx, esp
push eax
mov esi, esp
mov dword [ebp - 0xa8], esi
push eax
mov eax, esp
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x30], ecx
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x34], ecx
push eax
mov ecx, esp
mov dword [ebp - 0xa4], ecx
push eax
mov ecx, esp
mov dword [ebp - 0xa0], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x9c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x98], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x94], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x90], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x8c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x88], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x84], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x80], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x7c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x78], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x74], ecx
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x70], ecx
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x6c], ecx
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x68], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x64], ecx
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x60], ecx
sub esp, 0x14
mov ecx, esp
mov dword [ebp - 0x5c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x58], ecx
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x54], ecx
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x50], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x4c], ecx
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x48], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x44], ecx
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x40], ecx
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x3c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x2c]
mov dword [ebx], ecx
mov ecx, dword [ebp - 0x30]
mov dword [esi], edi
mov dword [eax], edx
mov eax, dword [eax]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10051d20
mov ecx, dword [ebp - 0x34]
add esp, 8
call fcn.10053b90
mov ecx, dword [ebp - 0x30]
call fcn.10053d40
cmp eax, 0x10
jbe 0x10055d2f
mov esi, dword [0x1028413c]
mov edx, dword [0x10284140]
mov eax, esi
xor eax, 0xffffffff
and eax, 0xd2819d5f
and esi, 0x2d7e62a0
mov ecx, edx
xor ecx, 0xffffffff
and ecx, 0xd2819d5f
and edx, 0x2d7e62a0
or eax, esi
or ecx, edx
xor eax, ecx
xor eax, 0xffffffff
or eax, 0x579b4038
xor eax, 0xffffffff
mov edx, eax
and edx, 0x99485771
mov ecx, eax
or ecx, 0x99485771
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x66b7a88e
or eax, 0x66b7a88e
imul eax, edx
add eax, ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0xe532998c
mov ecx, eax
and ecx, 0x1acd6673
imul ecx, edx
mov edx, eax
and edx, 0xe532998c
or eax, 0xe532998c
imul eax, edx
add eax, ecx
cmp eax, 0x56d756a2
jb 0x10056a08
mov ecx, dword [ebp - 0x30]
mov eax, dword [0x10284144]
add eax, dword [0x10284148]
and eax, 0xa8ed1b50
mov edx, eax
and edx, 0x96e22a2d
xor eax, 0x96e22a2d
or edx, eax
mov eax, edx
xor eax, 0xffffffff
and eax, 0x6962ecaa
xor edx, 0xffffffff
and edx, 0x6962ecaa
xor eax, 0xffffffff
xor edx, 0xffffffff
and eax, edx
mov dword [ebp - 0xb0], eax
call fcn.10052340
mov ecx, eax
sub esp, 0xc
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 8], 8
mov dword [eax + 4], str.Salted__
call fcn.101f307d
add esp, 0xc
mov ecx, eax
mov eax, dword [ebp - 0xb0]
cmp ecx, 0
sete cl
mov byte [ebp - 0xa9], cl
cmp eax, 0xfbe6d756
jae 0x10056a08
mov al, byte [ebp - 0xa9]
test al, 1
jne 0x10055b2e
jmp 0x10055d2f
mov dword [ebp - 0x10], 1
mov edi, dword [ebp - 0x9c]
mov esi, dword [ebp - 0x94]
mov ebx, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0xa0]
sub esp, 4
mov eax, esp
mov dword [eax], edx
call fcn.10055490
mov ecx, dword [ebp - 0xa0]
mov edx, dword [ebp - 0xa4]
sub esp, 8
mov eax, esp
mov dword [eax], edx
mov dword [eax + 4], 0x10
call fcn.100556d0
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x98]
sub esp, 4
mov eax, esp
mov dword [eax], edx
call fcn.10055490
mov ecx, dword [ebp - 0x98]
sub esp, 8
mov eax, esp
mov dword [eax], edi
mov dword [eax + 4], 8
call fcn.100556d0
mov ecx, dword [ebp - 0x34]
sub esp, 4
mov eax, esp
mov dword [eax], ebx
call fcn.10054870
mov eax, dword [ebp - 0xa4]
mov edx, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x34]
mov ebx, dword [ebx]
mov dword [esi], ebx
mov esi, dword [esi]
mov edi, dword [edi]
mov ebx, dword [eax]
sub esp, 0x10
mov eax, esp
mov dword [eax + 0xc], ebx
mov dword [eax + 8], edi
mov dword [eax + 4], esi
mov dword [eax], edx
call fcn.10055040
jmp 0x10055beb
mov esi, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x30]
mov edi, dword [ebp - 0x78]
mov ebx, dword [0x10284164]
mov eax, dword [0x10284168]
mov edx, ebx
xor edx, 0xffffffff
and edx, eax
xor eax, 0xffffffff
and ebx, eax
mov eax, dword [ebp - 0x80]
sub ebx, edx
mov edx, ebx
and edx, 0x93d0b4da
xor edx, 0xffffffff
add ebx, 0x93d0b4da
add ebx, 1
add ebx, edx
mov edx, ebx
and edx, 0x57485164
or ebx, 0x57485164
add edx, ebx
imul edx, edx, 0x4b08f467
mov dword [ebp - 0xb4], edx
sub esp, 4
mov dword [esp], eax
call fcn.10055490
mov ecx, dword [ebp - 0x80]
mov eax, dword [ebp - 0x84]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.100556d0
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x30]
mov edx, dword [edx]
mov dword [eax], edx
sub esp, 4
mov dword [esp], edi
call fcn.10055490
mov edx, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x30]
mov edi, dword [edi]
mov dword [edx], edi
mov edx, dword [edx]
mov eax, dword [eax]
sub esp, 0xc
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], eax
call fcn.10056ce0
mov eax, dword [ebp - 0xb4]
cmp eax, 0xc272ef52
ja 0x10055beb
mov eax, dword [0x1028417c]
xor eax, dword [0x10284180]
mov edx, eax
and edx, 0xc42ce95c
mov ecx, eax
or ecx, 0xc42ce95c
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x3bd316a3
or eax, 0x3bd316a3
imul eax, edx
add eax, ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0x55d08c8c
mov ecx, eax
and ecx, 0xaa2f7373
imul ecx, edx
mov edx, eax
and edx, 0x55d08c8c
or eax, 0x55d08c8c
imul eax, edx
add eax, ecx
sub eax, 0x31117b2d
cmp eax, 0x9aea04bc
jbe 0x10055dfd
jmp 0x10056a39
mov ecx, dword [ebp - 0x70]
lea eax, str.Invalid_encrypted_data_header.
sub esp, 4
mov dword [esp], eax
call fcn.10052110
mov eax, dword [0x1028416c]
sub eax, dword [0x10284170]
sub eax, 0xb970547b
add eax, 0xa0fccec6
mov ecx, eax
and ecx, 0x29c17fc6
shl ecx, 1
add eax, 0x29c17fc6
sub eax, ecx
cmp eax, 0xd8f9db86
jae 0x10056a34
mov ecx, dword [0x10284174]
add ecx, dword [0x10284178]
and ecx, 0xc32d7714
mov edx, ecx
xor edx, 0xffffffff
and edx, 0x7ce244ab
mov eax, ecx
and eax, 0x831dbb54
imul eax, edx
mov edx, ecx
and edx, 0x7ce244ab
or ecx, 0x7ce244ab
imul ecx, edx
add ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, ecx
xor edx, 0xffffffff
or eax, edx
and eax, 0xa839f152
xor ecx, 0xffffffff
or ecx, 0xa839f152
xor ecx, 0xffffffff
or eax, ecx
cmp eax, 0x2d11f057
jb 0x10056a34
mov ecx, dword [ebp - 0x70]
mov dword [ebp - 0x10], 1
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x1026f93c
call fcn.101f26d1
add esp, 8
jmp 0x10056a08
mov ecx, dword [ebp - 0x6c]
mov eax, dword [0x10284184]
xor edx, edx
div dword [0x10284188]
mov edx, eax
and edx, 0x2b321b1d
shl edx, 1
add eax, 0x2b321b1d
sub eax, edx
sub eax, 0x14fc6f1a
imul eax, eax, 0x7279dd87
mov dword [ebp - 0xbc], eax
call fcn.10053b90
mov ecx, dword [ebp - 0x68]
call fcn.10053b90
mov ecx, dword [ebp - 0xa8]
mov eax, dword [ebp - 0xbc]
mov ecx, dword [ecx]
mov dword [ebp - 0xb8], ecx
cmp eax, 0xa72449d4
jae 0x10055dfd
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0xb8]
mov esi, dword [ebp - 0x6c]
mov edi, dword [ebp - 0x68]
mov dword [ebp - 0x10], 3
sub esp, 0x18
mov eax, esp
mov dword [eax + 0xc], edi
mov dword [eax + 8], esi
mov dword [eax + 4], edx
mov dword [eax], ecx
mov dword [eax + 0x14], 8
mov dword [eax + 0x10], 8
call fcn.10052640
add esp, 0x18
jmp 0x10055e9c
jmp 0x10055ea1
mov eax, dword [0x10284194]
xor edx, edx
div dword [0x10284198]
mov ecx, eax
mov eax, dword [ebp - 0x64]
mov edx, ecx
xor edx, 0xffffffff
and edx, 0xf4acf76f
and ecx, 0xb530890
sub ecx, edx
add ecx, 0x64f2f299
add ecx, 0xc2bc389c
mov dword [ebp - 0xc4], ecx
mov dword [eax], 0
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 0xf0000000
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov ecx, eax
mov eax, dword [ebp - 0xc4]
cmp ecx, 0
setne cl
mov byte [ebp - 0xbd], cl
cmp eax, 0x5e46db96
jae 0x10055ea1
mov al, byte [ebp - 0xbd]
test al, 1
jne 0x10055ffb
jmp 0x10055f3e
mov eax, dword [0x102841a4]
mov ecx, dword [0x102841a8]
add eax, 0x122927eb
add eax, ecx
sub eax, 0x122927eb
imul eax, eax, 0x6e4ccd7
mov ecx, eax
xor ecx, 0xffffffff
xor eax, 0xffffffff
or ecx, eax
xor ecx, 0xffffffff
or ecx, 0x64bdba04
mov eax, ecx
and eax, 0xe1f0091c
xor ecx, 0xffffffff
and ecx, 0x1e0ff6e3
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
cmp eax, 0xbf2ac586
jae 0x10056a4e
mov ecx, dword [ebp - 0x60]
lea eax, str.Failed_to_acquire_cryptographic_context.
sub esp, 4
mov dword [esp], eax
call fcn.10052110
mov ecx, dword [0x102841ac]
and ecx, dword [0x102841b0]
and ecx, 0xe6ad553e
mov eax, ecx
and eax, 0x6406bc9c
or ecx, 0x6406bc9c
add eax, ecx
add eax, 0x28841c8e
cmp eax, 0x10be4cf6
jb 0x10056a53
mov ecx, dword [ebp - 0x60]
mov dword [ebp - 0x10], 3
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x1026f93c
call fcn.101f26d1
add esp, 8
jmp 0x10056a08
mov eax, dword [0x102841bc]
xor edx, edx
div dword [0x102841c0]
imul eax, eax, 0xe25e524e
mov ecx, 0x3cfbd809
xor edx, edx
div ecx
or eax, 0x953967a7
cmp eax, 0xef128787
jae 0x10056a5f
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x6c]
mov byte [eax], 8
mov byte [eax + 1], 2
mov word [eax + 2], 0
mov dword [eax + 4], 0x6601
mov dword [eax + 8], 8
call fcn.10052340
mov edx, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x5c]
mov esi, eax
mov eax, dword [ebp - 0x58]
mov edi, dword [esi]
mov dword [ecx + 0xc], edi
mov esi, dword [esi + 4]
mov dword [ecx + 0x10], esi
mov dword [eax], 0
mov edx, dword [edx]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x14
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], eax
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
cmp eax, 0
jne 0x10056178
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 0x54]
lea eax, str.Failed_to_import_key.
sub esp, 4
mov dword [esp], eax
call fcn.10052110
mov eax, dword [0x102841cc]
add eax, dword [0x102841d0]
mov ecx, eax
and ecx, 0xfd889fcb
xor ecx, 0xffffffff
add eax, 0xfd889fcb
add eax, 1
add eax, ecx
mov ecx, eax
xor ecx, 0x2257718d
xor ecx, 0xffffffff
or eax, 0x2257718d
and eax, ecx
sub eax, 0x245b8a22
cmp eax, 0x636d394a
jb 0x10056ad6
mov eax, dword [0x102841d4]
mov edx, dword [0x102841d8]
mov ecx, eax
or ecx, edx
xor ecx, 0xffffffff
or eax, edx
xor eax, 0xffffffff
or ecx, eax
mov eax, ecx
xor eax, 0xffffffff
and ecx, 0x50bc32f5
and eax, 0xaf43cd0a
sub eax, ecx
xor eax, 0x9d4da0b7
sub eax, 0xcd1b0480
cmp eax, 0x26185e08
jb 0x10056ad6
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x10], 3
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x1026f93c
call fcn.101f26d1
add esp, 8
jmp 0x10056a08
mov eax, dword [0x102841dc]
mov edx, dword [0x102841e0]
mov ecx, eax
xor ecx, 0xffffffff
mov esi, eax
xor esi, 0xffffffff
or ecx, esi
and ecx, edx
xor edx, 0xffffffff
and eax, edx
or ecx, eax
mov edx, ecx
xor edx, 0xffffffff
and edx, 0x70f93ae3
mov eax, ecx
and eax, 0x8f06c51c
imul eax, edx
mov edx, ecx
and edx, 0x70f93ae3
or ecx, 0x70f93ae3
imul ecx, edx
add ecx, eax
mov eax, ecx
xor eax, 0xffffffff
and eax, 0xcceb4fb3
and ecx, 0x3314b04c
or eax, ecx
sub eax, 0x2864ac1
cmp eax, 0x9a89920
jbe 0x10056adb
mov ecx, dword [ebp - 0x68]
mov eax, dword [0x102841e4]
and eax, dword [0x102841e8]
mov esi, 0xf6d5eb40
xor edx, edx
div esi
xor eax, 0x8482ad06
xor eax, 0xd2e04187
mov dword [ebp - 0xcc], eax
call fcn.10052340
mov ecx, dword [ebp - 0x58]
mov ecx, dword [ecx]
xor edx, edx
sub esp, 0x10
mov dword [esp], ecx
mov dword [esp + 4], 1
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
mov ecx, eax
mov eax, dword [ebp - 0xcc]
cmp ecx, 0
setne cl
mov byte [ebp - 0xc5], cl
cmp eax, 0xc72e574d
ja 0x10056adb
mov al, byte [ebp - 0xc5]
test al, 1
jne 0x10056337
jmp 0x10056267
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 0x50]
lea eax, str.Failed_to_set_IV.
sub esp, 4
mov dword [esp], eax
call fcn.10052110
mov eax, dword [0x102841f4]
and eax, dword [0x102841f8]
or eax, 0xa609bde6
mov edx, eax
and edx, 0x7586169e
mov ecx, eax
or ecx, 0x7586169e
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x8a79e961
or eax, 0x8a79e961
imul eax, edx
add eax, ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0x967c8dec
mov ecx, eax
and ecx, 0x69837213
imul ecx, edx
mov edx, eax
and edx, 0x967c8dec
or eax, 0x967c8dec
imul eax, edx
add eax, ecx
cmp eax, 0xc3d453d1
jae 0x10056b0f
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x10], 3
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x1026f93c
call fcn.101f26d1
add esp, 8
jmp 0x10056a08
mov eax, dword [0x102841fc]
mov edx, dword [str._vN7]
mov ecx, eax
and ecx, edx
shl ecx, 1
xor eax, edx
add eax, ecx
and eax, 0x87e7a33e
add eax, 0xcd35be36
sub eax, 0x4f5c7521
sub eax, 0xcd35be36
imul eax, eax, 0x3d6369ad
cmp eax, 0x9fa8c66f
jb 0x10056b14
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x58]
mov dword [eax], 1
mov ecx, dword [ecx]
xor edx, edx
sub esp, 0x10
mov dword [esp], ecx
mov dword [esp + 4], 4
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
cmp eax, 0
jne 0x1005650f
mov eax, dword [0x1028420c]
mov esi, dword [0x10284210]
mov ecx, eax
xor ecx, 0xffffffff
mov edx, eax
xor edx, 0xffffffff
or ecx, edx
and ecx, esi
mov edx, esi
xor edx, 0xffffffff
xor esi, 0xffffffff
or edx, esi
and eax, edx
or ecx, eax
xor ecx, 0x589fab8c
mov eax, ecx
and eax, 0x39bee780
or ecx, 0x39bee780
add eax, ecx
imul eax, eax, 0x18f70413
cmp eax, 0xaec8eb68
je 0x10056b49
mov ecx, dword [0x10284214]
mov edx, dword [0x10284218]
mov esi, ecx
xor esi, 0xffffffff
mov eax, edx
and eax, esi
xor edx, 0xffffffff
and ecx, edx
or eax, ecx
add eax, 0x7b0836a8
mov ecx, 0xbfa95ec7
xor edx, edx
div ecx
mov ecx, eax
mov eax, dword [ebp - 0x58]
mov edx, ecx
xor edx, 0x5612ee7a
and ecx, 0xa9ed1185
shl ecx, 1
sub ecx, edx
mov dword [ebp - 0xd0], ecx
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 0xd0]
cmp eax, 0xa9b1a28d
jb 0x10056b49
mov ecx, dword [ebp - 0x48]
lea eax, str.Failed_to_set_cipher_mode.
sub esp, 4
mov dword [esp], eax
call fcn.10052110
mov esi, dword [0x1028421c]
mov edx, dword [0x10284220]
mov eax, esi
xor eax, 0xffffffff
and eax, 0xa8fe3292
and esi, 0x5701cd6d
mov ecx, edx
xor ecx, 0xffffffff
and ecx, 0xa8fe3292
and edx, 0x5701cd6d
or eax, esi
or ecx, edx
xor eax, ecx
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 0x535097c7
and eax, 0xacaf6838
sub eax, ecx
mov ecx, 0xadc02f0d
xor edx, edx
div ecx
sub eax, 0xadf8b69b
cmp eax, 0xffdb663e
jae 0x10056b7a
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x10], 3
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x1026f93c
call fcn.101f26d1
add esp, 8
jmp 0x10056a08
mov ecx, dword [ebp - 0x30]
call fcn.10053d40
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x40]
mov esi, eax
mov eax, dword [ebp - 0x44]
mov dword [eax], esi
mov dword [ebp - 0x10], 3
sub esp, 4
mov eax, esp
mov dword [eax], edx
call fcn.10057310
jmp 0x1005653c
mov ecx, dword [ebp - 0x40]
call fcn.10052340
mov edx, dword [ebp - 0x58]
mov ecx, eax
mov eax, dword [ebp - 0x44]
mov edx, dword [edx]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
cmp eax, 0
jne 0x1005674f
mov ecx, dword [0x1028423c]
sub ecx, dword [0x10284240]
mov eax, ecx
and eax, 0x920151d
xor ecx, 0x920151d
or eax, ecx
xor eax, 0x5bc889ff
or eax, 0xb4a127cd
cmp eax, 0xf4a85f1c
jb 0x10056b86
mov eax, dword [ebp - 0x58]
mov edx, dword [0x10284244]
add edx, dword [0x10284248]
mov ecx, edx
and ecx, 0xc5b0c70a
shl ecx, 1
xor edx, 0xc5b0c70a
add edx, ecx
mov ecx, edx
xor ecx, 0xffffffff
and ecx, 0x169124ef
and edx, 0xe96edb10
or ecx, edx
xor ecx, 0xc25b6c13
add ecx, 0x6fbc259a
mov dword [ebp - 0xd4], ecx
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 0xd4]
cmp eax, 0x9c158c80
je 0x100565b5
mov ecx, dword [ebp - 0x3c]
lea eax, str.Failed_to_decrypt_data.
sub esp, 4
mov dword [esp], eax
call fcn.10052110
mov eax, dword [0x1028424c]
mov ecx, dword [0x10284250]
xor ecx, 0xffffffff
add eax, ecx
add eax, 1
mov ecx, eax
add ecx, 1
xor eax, 0xffffffff
or eax, 0x200811ce
add eax, ecx
mov ecx, eax
and ecx, 0x44ae3cb8
xor ecx, 0xffffffff
add eax, 0x44ae3cb8
add eax, 1
add eax, ecx
mov ecx, eax
xor ecx, 0x9ceefc9d
xor ecx, 0xffffffff
and ecx, 0x9ceefc9d
shl ecx, 1
sub ecx, 0x9ceefc9d
sub eax, ecx
cmp eax, 0x50a9c953
jbe 0x10056bb7
mov edx, dword [0x10284254]
mov esi, dword [0x10284258]
mov eax, edx
xor eax, 0xffffffff
mov ecx, esi
and ecx, eax
mov edi, esi
xor edi, 0xffffffff
mov eax, edx
and eax, edi
imul eax, ecx
mov ecx, edx
and ecx, esi
or edx, esi
imul edx, ecx
add edx, eax
mov eax, edx
xor eax, 0xffffffff
mov ecx, eax
and ecx, 0x27d91b54
and edx, 0xd826e4ab
or ecx, edx
xor ecx, 0xfe15e41d
or eax, 0x263300b6
xor eax, 0xffffffff
or ecx, eax
mov eax, ecx
xor eax, 0xffffffff
and eax, 0x1dc70333
and ecx, 0xe238fccc
or eax, ecx
xor eax, 0xf90d2b5
mov ecx, eax
and ecx, 0x5a006e30
shl ecx, 1
add eax, 0x5a006e30
sub eax, ecx
cmp eax, 0x1509eccb
jb 0x100566a6
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x10], 4
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x1026f93c
call fcn.101f26d1
add esp, 8
jmp 0x10056a08
mov ecx, dword [0x1028425c]
and ecx, dword [0x10284260]
sub ecx, 0xb1ed655f
mov eax, ecx
xor eax, 0x4ba41242
and eax, ecx
mov ecx, eax
xor ecx, 0xe328008a
xor ecx, 0xffffffff
and ecx, 0xe328008a
shl ecx, 1
sub ecx, 0xe328008a
sub eax, ecx
cmp eax, 0xf893bda0
ja 0x10056bbc
mov eax, dword [0x10284264]
sub eax, dword [0x10284268]
add eax, 0xa13a7ff0
add eax, 0xa5fca78d
sub eax, 0xa13a7ff0
mov ecx, 0x1de788ed
xor edx, edx
div ecx
mov esi, eax
mov eax, dword [ebp - 0x58]
mov edx, esi
xor edx, 0xffffffff
mov ecx, edx
and ecx, 0x3ae32821
and esi, 0xc51cd7de
or ecx, esi
xor ecx, 0xcdfcf957
or edx, 0x8e02e89
xor edx, 0xffffffff
or ecx, edx
mov dword [ebp - 0xdc], ecx
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0xdc]
mov ecx, dword [ecx]
mov dword [ebp - 0xd8], ecx
cmp eax, 0x7a50bd40
jbe 0x10056bbc
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0xd8]
mov dword [ebp - 0x10], 4
sub esp, 4
mov eax, esp
mov dword [eax], edx
call fcn.10055000
jmp 0x1005684a
mov edx, dword [0x1028426c]
sub edx, dword [0x10284270]
mov ecx, edx
xor ecx, 0xffffffff
mov eax, ecx
and eax, 0x6e8dc9b9
and edx, 0x91723646
or eax, edx
xor eax, 0x8dc5d064
or ecx, 0x1cb7e622
xor ecx, 0xffffffff
or eax, ecx
sub eax, 0x5bb965ed
mov edx, eax
xor edx, 0xffffffff
and edx, 0x521afb5b
mov ecx, eax
and ecx, 0xade504a4
imul ecx, edx
mov edx, eax
and edx, 0x521afb5b
or eax, 0x521afb5b
imul eax, edx
add eax, ecx
cmp eax, 0xdf4950fe
ja 0x10056bed
mov ecx, dword [ebp - 0x40]
mov eax, dword [0x10284274]
add eax, dword [0x10284278]
mov esi, 0x8f27eb19
xor edx, edx
div esi
mov edx, eax
mov eax, dword [ebp - 0x38]
or edx, 0x639ed063
or edx, 0xea52541
mov dword [ebp - 0xe4], edx
mov byte [eax], 0
call fcn.10053d40
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0xe8], eax
call fcn.10052340
mov ecx, eax
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0xe0], ecx
cmp eax, 0xed6b0399
jae 0x100568b2
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0xe0]
mov esi, dword [ebp - 0xe8]
mov dword [ebp - 0x10], 4
sub esp, 8
mov eax, esp
mov dword [eax + 4], esi
mov dword [eax], edx
call fcn.1003a4a0
jmp 0x10056939
mov eax, dword [ebp - 0x38]
mov byte [eax], 1
test byte [eax], 1
jne 0x10056950
mov ecx, dword [ebp - 0x2c]
call fcn.10006100
mov eax, dword [0x1028428c]
or eax, dword [0x10284290]
imul eax, eax, 0x9e28ecb7
mov ecx, eax
and ecx, 0x9a5f9fe7
shl ecx, 1
add eax, 0x9a5f9fe7
sub eax, ecx
xor eax, 0xffffffff
and eax, 0xc8d26500
xor eax, 0xffffffff
cmp eax, 0x2ca11a67
jb 0x10056c08
mov ecx, dword [ebp - 0x40]
mov eax, dword [0x10284294]
mov esi, dword [0x10284298]
xor eax, 0xffffffff
mov edx, esi
xor edx, 0xffffffff
xor esi, 0xffffffff
or edx, esi
and eax, edx
xor eax, 0xffffffff
xor eax, 0x3e55693b
sub eax, 0xc4502f37
add eax, 0x864e7bd
mov dword [ebp - 0xec], eax
call fcn.10052500
mov ecx, dword [ebp - 0x68]
call fcn.10052500
mov ecx, dword [ebp - 0x6c]
call fcn.10052500
mov ecx, dword [ebp - 0x34]
call fcn.10052500
mov ecx, dword [ebp - 0x30]
call fcn.10052500
mov eax, dword [ebp - 0xec]
cmp eax, 0x6a862b01
je 0x10056988
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [ebp - 0x30]
call fcn.10052340
mov ecx, eax
sub esp, 0xc
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 8], 8
mov dword [eax + 4], str.Salted__
call fcn.101f307d
add esp, 0xc
jmp 0x10055a95
jmp 0x10055d74
mov ecx, dword [ebp - 0x6c]
call fcn.10053b90
mov ecx, dword [ebp - 0x68]
call fcn.10053b90
jmp 0x10055dfd
jmp 0x10055f3e
mov dword [ebp - 0x10], 3
jmp 0x10055fd6
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x6c]
mov byte [eax], 8
mov byte [eax + 1], 2
mov word [eax + 2], 0
mov dword [eax + 4], 0x6601
mov dword [eax + 8], 8
call fcn.10052340
mov edx, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x5c]
mov esi, eax
mov eax, dword [ebp - 0x58]
mov edi, dword [esi]
mov dword [ecx + 0xc], edi
mov esi, dword [esi + 4]
mov dword [ecx + 0x10], esi
mov dword [eax], 0
mov edx, dword [edx]
xor esi, esi
sub esp, 0x18
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x14
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], eax
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
jmp 0x10056027
jmp 0x10056113
mov ecx, dword [ebp - 0x68]
call fcn.10052340
mov ecx, dword [ebp - 0x58]
mov ecx, dword [ecx]
xor edx, edx
sub esp, 0x10
mov dword [esp], ecx
mov dword [esp + 4], 1
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
jmp 0x100561e2
jmp 0x100562a7
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x58]
mov dword [eax], 1
mov ecx, dword [ecx]
xor edx, edx
sub esp, 0x10
mov dword [esp], ecx
mov dword [esp + 4], 4
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
jmp 0x10056371
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x100563f7
mov dword [ebp - 0x10], 3
jmp 0x100564ea
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x100565b5
jmp 0x100566a6
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x10056790
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x38]
mov byte [eax], 0
call fcn.10053d40
mov ecx, dword [ebp - 0x40]
call fcn.10052340
jmp 0x100568b2
mov ecx, dword [ebp - 0x40]
call fcn.10052500
mov ecx, dword [ebp - 0x68]
call fcn.10052500
mov ecx, dword [ebp - 0x6c]
call fcn.10052500
mov ecx, dword [ebp - 0x34]
call fcn.10052500
mov ecx, dword [ebp - 0x30]
call fcn.10052500
jmp 0x10056988