Function at 0x622c2460
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0xa8
mov eax, dword [ecx]
mov esi, dword [ecx + 4]
mov ebx, dword [ecx + 0x10]
mov dword [ebp - 0x5c], eax
mov eax, dword [ecx + 8]
mov dword [ebp - 0x68], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x6c], eax
mov eax, dword [ecx + 0x14]
mov dword [ebp - 0x64], eax
mov eax, dword [ecx + 0x18]
mov dword [ebp - 0x60], eax
test byte [0x622d8018], 8
jne 0x622c26d0
mov eax, dword [ebp - 0x5c]
mov dword [esp + 8], 0x26384993
mov dword [esp], 0x622d8080
mov dword [esp + 4], eax
call sym._is_valid_handle
test eax, eax
je 0x622c26b0
test ebx, 0xffffffbf
je 0x622c24f0
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x80090009
xor eax, eax
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x1c
lea eax, [ebp - 0x4c]
mov dword [esp + 8], 0x73620457
mov dword [esp + 0xc], eax
mov dword [esp + 4], esi
mov dword [esp], 0x622d8080
call sym._lookup_handle
test eax, eax
je 0x622c2750
mov edx, dword [ebp - 0x4c]
mov eax, dword [edx + 0x30]
test eax, eax
jne 0x622c2728
mov dword [edx + 0x30], 1
mov eax, dword [ebp - 0x60]
mov ecx, dword [edx + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x80], eax
mov eax, ecx
and eax, 0x1e00
cmp eax, 0x600
je 0x622c2788
cmp eax, 0x800
je 0x622c2a77
cmp eax, 0x400
jne 0x622c2770
cmp ecx, 0x2400
je 0x622c2aa7
mov edi, dword [ebp - 0x64]
lea eax, [edx + 0x34]
mov dword [esp], ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], edi
mov dword [esp + 8], eax
mov dword [esp + 4], 0
call sym._encrypt_block_impl
mov eax, dword [ebp - 0x4c]
mov edx, edi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ebp - 0x60]
mov dword [esp + 8], ebx
mov dword [esp], edi
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x5c]
call sym._unpad_data
mov edx, eax
mov eax, dword [ebp - 0x4c]
test edx, edx
je 0x622c277d
mov ebx, dword [eax + 0x374]
mov ecx, dword [eax + 0x388]
lea edx, [eax + 0x334]
mov dword [eax + 0x30], 0
mov dword [eax + 0x38c], ebx
mov ebx, dword [eax + 0x378]
mov dword [eax + 0x3a0], ecx
mov dword [eax + 0x390], ebx
mov ebx, dword [eax + 0x37c]
mov dword [eax + 0x394], ebx
mov ebx, dword [eax + 0x380]
mov dword [eax + 0x398], ebx
mov ebx, dword [eax + 0x384]
mov dword [eax + 0x39c], ebx
mov dword [esp + 0x14], edx
mov edx, dword [eax + 0x28]
mov dword [esp + 0x10], edx
mov edx, dword [eax + 0x24]
mov dword [esp + 0xc], edx
mov edx, dword [eax + 0x20]
mov dword [esp + 8], edx
lea edx, [eax + 0x34]
mov dword [esp + 4], edx
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sym._setup_key_impl
mov edi, dword [ebp - 0x68]
mov dword [esp + 8], 0x85938417
mov dword [esp], 0x622d8080
mov dword [esp + 4], edi
call sym._is_valid_handle
mov edx, eax
mov eax, 1
test edx, edx
je 0x622c24e1
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x80]
ja 0x622c277d
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x64]
mov dword [esp + 0x10], 0
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x5c]
mov dword [esp + 4], edi
mov dword [esp], eax
call sym.rsaenh.dll_CPHashData
sub esp, 0x14
test eax, eax
setne al
movzx eax, al
jmp 0x622c24e1
mov edx, dword fs:[0x18]
mov dword [edx + 0x34], 0x80090001
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x1c
mov dword [esp + 0x28], eax
mov eax, dword [ebp - 0x64]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], eax
mov eax, dword [ebp - 0x6c]
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], eax
mov eax, dword [ebp - 0x68]
mov dword [esp + 0xc], str._hProv_08Ix__hKey_08Ix__hHash_08Ix__Final_d__dwFlags_08lx__pbData_p__pdwDataLen_p__n
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x5c]
mov dword [esp + 8], str.RSAENH_CPDecrypt
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x622d8018
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x622c24a7
cmp eax, 1
je 0x622c252c
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x80090005
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x1c
mov edx, dword fs:[0x18]
mov dword [edx + 0x34], 0x80090003
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x1c
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x8009000a
xor eax, eax
jmp 0x622c24e1
mov ebx, dword [ebp - 0x80]
test ebx, ebx
je 0x622c2abb
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x70], eax
mov eax, dword [edx + 0x14]
cmp eax, 2
je 0x622c27d0
cmp eax, 4
je 0x622c29a0
cmp eax, 1
je 0x622c2900
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x80090008
xor eax, eax
jmp 0x622c24e1
lea eax, [ebp - 0x48]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x70]
mov dword [esp + 4], 0
mov dword [esp + 0xc], eax
lea eax, [edx + 0x34]
mov dword [esp + 8], eax
mov eax, dword [edx + 0xc]
mov dword [esp], eax
call sym._encrypt_block_impl
mov edx, dword [ebp - 0x4c]
mov ebx, dword [edx + 0x2c]
mov edi, dword [ebp - 0x70]
lea eax, [ebp - 0x48]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], edi
mov dword [ebp - 0x74], edx
call sym._memcpy
mov edx, dword [ebp - 0x74]
mov esi, dword [edx + 0x2c]
add dword [ebp - 0x7c], esi
mov eax, dword [ebp - 0x7c]
add edi, esi
mov dword [ebp - 0x70], edi
mov edi, dword [ebp - 0x60]
mov esi, dword [edi]
cmp esi, eax
ja 0x622c27a0
mov ecx, dword [ebp - 0x6c]
test ecx, ecx
je 0x622c2640
mov ebx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x4c]
movzx edx, byte [ebx + esi - 1]
test dl, dl
je 0x622c286b
cmp dword [eax + 0x2c], esi
mov ecx, esi
cmovbe ecx, dword [eax + 0x2c]
movzx edi, dl
cmp ecx, edi
jae 0x622c2ac2
mov edx, dword fs:[0x18]
mov dword [edx + 0x34], 0x80090005
mov ebx, dword [eax + 0x374]
lea edx, [eax + 0x334]
mov ecx, dword [eax + 0x388]
mov dword [eax + 0x30], 0
mov dword [eax + 0x38c], ebx
mov ebx, dword [eax + 0x378]
mov dword [eax + 0x3a0], ecx
mov dword [eax + 0x390], ebx
mov ebx, dword [eax + 0x37c]
mov dword [eax + 0x394], ebx
mov ebx, dword [eax + 0x380]
mov dword [eax + 0x398], ebx
mov ebx, dword [eax + 0x384]
mov dword [eax + 0x39c], ebx
mov dword [esp + 0x14], edx
mov edx, dword [eax + 0x28]
mov dword [esp + 0x10], edx
mov edx, dword [eax + 0x24]
mov dword [esp + 0xc], edx
mov edx, dword [eax + 0x20]
mov dword [esp + 8], edx
lea edx, [eax + 0x34]
mov dword [esp + 4], edx
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sym._setup_key_impl
xor eax, eax
jmp 0x622c24e1
lea eax, [ebp - 0x48]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x70]
mov dword [esp + 4], 0
mov dword [esp + 0xc], eax
lea eax, [edx + 0x34]
mov dword [esp + 8], eax
mov eax, dword [edx + 0xc]
mov dword [esp], eax
call sym._encrypt_block_impl
mov edx, dword [ebp - 0x4c]
xor eax, eax
mov ebx, dword [edx + 0x2c]
test ebx, ebx
je 0x622c2957
lea esi, [esi]
movzx ecx, byte [ebp + eax - 0x48]
xor cl, byte [edx + eax + 0x38c]
mov byte [ebp + eax - 0x48], cl
inc eax
cmp eax, ebx
jne 0x622c2940
mov eax, ebx
lea edi, [edx + 0x38c]
mov dword [ebp - 0x74], edi
cmp eax, 4
jae 0x622c2a5c
test eax, eax
je 0x622c2806
mov esi, dword [ebp - 0x70]
movzx ecx, byte [esi]
mov byte [edx + 0x38c], cl
test al, 2
je 0x622c2806
mov edi, dword [ebp - 0x70]
movzx ecx, word [edi + eax - 2]
mov edi, dword [ebp - 0x74]
mov word [edi + eax - 2], cx
jmp 0x622c2806
mov ebx, dword [edx + 0x2c]
lea eax, [edx + 0x38c]
xor esi, esi
mov dword [ebp - 0x74], eax
test ebx, ebx
je 0x622c2806
mov edi, edx
mov edx, dword [ebp - 0x74]
jmp 0x622c29ff
lea edx, [edi + 0x38c]
lea eax, [edi + 0x38d]
mov dword [esp + 8], ecx
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x74], edx
call sym._memmove
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x78]
mov edx, dword [ebp - 0x74]
movzx eax, byte [eax + esi]
inc esi
cmp esi, ebx
mov byte [edi + ecx + 0x38c], al
jae 0x622c2aea
lea eax, [ebp - 0x30]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
lea eax, [edi + 0x34]
mov dword [esp + 0x14], 1
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [edi + 0xc]
mov dword [esp], eax
call sym._encrypt_block_impl
mov eax, dword [ebp - 0x70]
mov edi, dword [ebp - 0x4c]
movzx edx, byte [ebp - 0x30]
movzx eax, byte [eax + esi]
mov ebx, dword [edi + 0x2c]
xor edx, eax
lea ecx, [ebx - 1]
mov byte [ebp + esi - 0x48], dl
cmp ebx, 1
jne 0x622c29c0
mov byte [edi + 0x38c], al
mov edx, edi
jmp 0x622c2806
mov esi, dword [ebp - 0x70]
mov edi, dword [ebp - 0x74]
mov ecx, dword [esi + eax - 4]
mov dword [edi + eax - 4], ecx
lea ecx, [eax - 1]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
jmp 0x622c2806
mov eax, dword [ebp - 0x80]
mov dword [esp], ecx
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x64]
mov dword [esp + 8], eax
lea eax, [edx + 0x34]
mov dword [esp + 4], eax
call sym._encrypt_stream_impl
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x4c]
test edx, edx
jne 0x622c25c0
jmp 0x622c2640
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x80090003
xor eax, eax
jmp 0x622c24e1
xor esi, esi
jmp 0x622c283d
cmp edi, 1
jbe 0x622c2ade
lea ecx, [ebx + esi - 2]
lea ebx, [ebx + esi - 1]
sub ebx, edi
cmp dl, byte [ecx]
jne 0x622c286b
dec ecx
cmp ebx, ecx
jne 0x622c2ad1
sub esi, edi
mov edi, dword [ebp - 0x60]
mov dword [edi], esi
jmp 0x622c25c0
mov edx, edi
jmp 0x622c2806