Function at 0x4b3a80
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5a3fa8]
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
push ebx
push esi
push edi
test ecx, ecx
js 0x4b3f64
mov ebx, dword [0x5a3fa4]
mov edi, dword [ebp + 8]
test ebx, ebx
je 0x4b3caf
cmp eax, 0xffffffff
je 0x4b3caf
mov eax, dword [ebp + 0x10]
and ecx, 0xfffffff8
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0x14]
mov esi, dword [eax + 4]
cmp edx, esi
mov eax, edx
cmovbe eax, esi
cmp ecx, eax
ja 0x4b3ad7
cmp edx, esi
mov ecx, esi
cmova ecx, edx
push 0
lea eax, [ecx*8]
mov dword [ebp - 4], ecx
push eax
push edi
push ebx
call sub.bcrypt.dll_BCryptGenerateKeyPair
test eax, eax
js 0x4b3f64
mov eax, dword [ebp - 4]
lea ebx, [eax*2 + 0xc]
push ebx
call fcn.004bf44f
mov esi, eax
add esp, 4
test esi, esi
je 0x4b3f64
mov eax, dword [ebp + 0x14]
mov dword [esi], ebx
mov dword [esi + 4], 0x4d504844
mov ecx, dword [ebp - 4]
mov dword [esi + 8], ecx
push dword [eax + 4]
push dword [eax]
lea eax, [esi + 0xc]
push dword [ebp - 4]
push eax
call fcn.004b6a70
mov eax, dword [ebp + 0x10]
push dword [eax + 4]
push dword [eax]
mov eax, dword [ebp - 4]
push eax
add eax, 0xc
add eax, esi
push eax
call fcn.004b6a70
add esp, 0x20
push 0
push ebx
push esi
push str.DHParameters
push dword [edi]
call sub.bcrypt.dll_BCryptSetProperty
mov dword [edi + 4], esi
test eax, eax
js 0x4b3f64
push 0
push dword [edi]
call sub.bcrypt.dll_BCryptFinalizeKeyPair
test eax, eax
js 0x4b3f64
cmp dword [ebp - 0xc], 1
mov eax, str.DHPRIVATEBLOB
push 0
mov ebx, str.DHPUBLICBLOB
mov dword [ebp - 4], 0
cmovne ebx, eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push ebx
push 0
push dword [edi]
call sub.bcrypt.dll_BCryptExportKey
test eax, eax
js 0x4b3f64
push dword [ebp - 4]
call fcn.004bf44f
mov esi, eax
add esp, 4
test esi, esi
je 0x4b3f64
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push esi
push ebx
push 0
push dword [edi]
call sub.bcrypt.dll_BCryptExportKey
test eax, eax
js 0x4b3fee
push dword [esi + 4]
mov ebx, dword [ebp + 0xc]
push ebx
call fcn.004b4950
add esp, 8
test eax, eax
jne 0x4b3fbd
mov eax, dword [esi + 4]
push eax
add eax, 4
lea eax, [esi + eax*2]
push eax
push dword [ebx]
call fcn.0043d170
add esp, 0xc
cmp dword [esi], 0x56504844
jne 0x4b3f95
call fcn.004b4740
mov dword [edi + 8], eax
test eax, eax
je 0x4b3f6e
push dword [esi + 4]
push eax
call fcn.004b4950
add esp, 8
test eax, eax
jne 0x4b3f3f
mov ecx, dword [esi + 4]
push ecx
lea eax, [esi + ecx*2]
add ecx, 8
add eax, ecx
push eax
mov eax, dword [edi + 8]
push dword [eax]
call fcn.0043d170
mov eax, dword [edi + 8]
add esp, 0xc
mov ecx, dword [eax + 4]
mov eax, dword [eax]
test byte [ecx + eax - 1], 1
jne 0x4b3f95
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x4b3c7b
mov eax, esi
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4b3c70
push esi
call fcn.004bf434
push edi
call fcn.004b39c0
mov ecx, dword [ebp + 0x18]
add esp, 8
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov ebx, dword [0x5a3fa4]
test ebx, ebx
jne 0x4b3ab6
call fcn.004b4740
mov esi, eax
mov dword [edi + 8], esi
test esi, esi
je 0x4b3f64
mov eax, dword [ebp + 0x18]
sub esp, 8
lea eax, [eax*8 - 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x4fad68]
movsd qword [ebp - 0x10], xmm0
fld qword [ebp - 0x10]
fstp qword [esp]
call fcn.004ccf70
add esp, 8
fstp qword [ebp - 0x10]
movsd xmm0, qword [ebp - 0x10]
call fcn.004bf2a0
mov ecx, dword [esi + 4]
mov ebx, eax
cmp ebx, ecx
je 0x4b3d43
mov eax, dword [esi]
test eax, eax
je 0x4b3d2b
test ecx, ecx
je 0x4b3d2b
cmp ebx, ecx
jae 0x4b3d2b
lea eax, [eax + ebx]
sub ecx, ebx
je 0x4b3d2b
nop dword [eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4b3d20
push ebx
push dword [esi]
call fcn.004cb4e8
add esp, 8
test eax, eax
je 0x4b3f64
mov dword [esi], eax
mov dword [esi + 4], ebx
mov esi, dword [esi]
push ebx
push esi
call fcn.004b6230
add esp, 8
test eax, eax
jne 0x4b3f64
mov ecx, dword [ebp + 0x18]
lea eax, [ecx*8 - 1]
and eax, reloc.WS2_32.dll_getsockopt
jns 0x4b3d6f
dec eax
or eax, 0xfffffff8
add eax, 1
mov edx, 8
cmovne edx, eax
mov al, 1
mov ecx, edx
shl al, cl
dec al
movzx ecx, al
movzx eax, byte [esi]
and ecx, eax
lea eax, [edx - 1]
bts ecx, eax
mov byte [esi], cl
or byte [esi + ebx - 1], 1
cmp dword [ebp + 0xc], 0
mov esi, dword [edi + 8]
je 0x4b3f64
cmp dword [ebp + 0x10], 0
je 0x4b3f64
test esi, esi
je 0x4b3f64
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4b3f64
mov edi, dword [eax + 4]
add edi, 0x18
mov dword [ebp - 8], 0x18
add edi, dword [esi + 4]
push edi
call fcn.004bf44f
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4b3f64
mov eax, dword [ebp + 0x14]
mov dword [ebx], 0x31415352
mov ecx, dword [eax + 4]
shl ecx, 3
mov dword [ebx + 4], ecx
mov ecx, dword [esi + 4]
mov dword [ebx + 8], ecx
mov eax, dword [eax + 4]
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
push dword [esi + 4]
mov eax, dword [ebp - 8]
push dword [esi]
add eax, ebx
push eax
call fcn.0043d170
mov eax, dword [ebp + 0x14]
push dword [eax + 4]
push dword [eax]
mov eax, dword [esi + 4]
add eax, ebx
add eax, dword [ebp - 8]
push eax
call fcn.0043d170
add esp, 0x18
mov dword [ebp - 8], 0
lea eax, [ebp - 0x14]
push 0
push edi
push ebx
push eax
push str.RSAPUBLICBLOB
push 0
push dword [0x5a3f8c]
call sub.bcrypt.dll_BCryptImportKeyPair
mov esi, eax
test esi, esi
js 0x4b4030
push 1
lea eax, [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x10]
push 0
push 0
push 0
push 0
push 0
push dword [eax + 4]
push dword [eax]
push dword [ebp - 0x14]
call sub.bcrypt.dll_BCryptEncrypt
mov esi, eax
test esi, esi
js 0x4b4028
push dword [ebp + 0x18]
push dword [ebp + 0xc]
call fcn.004b4950
add esp, 8
test eax, eax
jne 0x4b4023
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x18]
cmp dword [eax + 4], ecx
cmova ecx, dword [eax + 4]
push ecx
mov dword [ebp + 0x18], ecx
call fcn.004bf44f
mov esi, eax
add esp, 4
mov dword [ebp - 0xc], esi
test esi, esi
je 0x4b4023
mov eax, dword [ebp + 0x10]
push dword [eax + 4]
push dword [eax]
push dword [ebp + 0x18]
push esi
call fcn.004b6a70
add esp, 0x10
lea eax, [ebp - 8]
push 1
push eax
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push dword [eax]
push 0
push 0
push 0
push dword [ebp + 0x18]
push esi
push dword [ebp - 0x14]
call sub.bcrypt.dll_BCryptEncrypt
mov ecx, dword [ebp + 0x18]
mov esi, eax
mov edx, dword [ebp - 0xc]
test ecx, ecx
je 0x4b3f1b
mov eax, edx
nop dword [eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4b3f10
push edx
call fcn.004bf434
add esp, 4
test esi, esi
js 0x4b4028
push dword [ebp - 8]
push dword [ebp + 0xc]
call fcn.004b4950
add esp, 8
jmp 0x4b4028
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x4b3f5b
mov eax, esi
nop dword [eax + eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4b3f50
push esi
call fcn.004bf434
add esp, 4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x4b3f5b
mov eax, esi
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4b3f77
push esi
call fcn.004bf434
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x4b3fab
mov eax, esi
nop
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4b3fa0
push esi
call fcn.004bf434
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0xc], 1
je 0x4b3f5b
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x4b3f5b
mov eax, esi
nop dword [eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4b3fd0
push esi
call fcn.004bf434
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0xc], 1
je 0x4b3f5b
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x4b3f5b
mov eax, esi
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4b4005
push esi
call fcn.004bf434
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, 0xc0000017
push dword [ebp - 0x14]
call sub.bcrypt.dll_BCryptDestroyKey
test edi, edi
je 0x4b4041
mov eax, ebx
mov byte [eax], 0
lea eax, [eax + 1]
sub edi, 1
jne 0x4b4036
push ebx
call fcn.004bf434
add esp, 4
sar esi, 0x1f
neg esi
sbb esi, esi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret