Function at 0x10002090
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1028
call fcn.10009f30
mov eax, dword [0x10010038]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push edi
push 0xfff
lea eax, [ebp - 0x1003]
mov edi, edx
push ebx
push eax
mov esi, ecx
mov dword [ebp - 0x1028], edi
mov dword [ebp - 0x1008], ebx
mov dword [ebp - 0x1014], ebx
mov dword [ebp - 0x100c], ebx
mov dword [ebp - 0x1024], 4
mov dword [ebp - 0x1020], ebx
mov dword [ebp - 0x1010], ebx
mov byte [ebp - 0x1004], bl
call fcn.100092e0
add esp, 0xc
mov edx, esi
lea ecx, [ebp - 0x1004]
mov dword [edi], ebx
call fcn.10002040
mov eax, str.MIGJAoGBAK7mh7RSMtisKLnJfkq9AUlOHqUe4zjTLVC89ksPux5ZMr9ndtjzdx8bCcSfCQtemKrR2LY4lRr5cZs3jgwaBbHS2SdCezUuNUdrEEsfWX8BlK13G8djFmmYZqKeQFnUrKZnuA0A4nIGPRFKB2fKfBjh4Y5qN2IoyV9Y0e8HHAgMBAAE
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x10002110
sub eax, ecx
lea ecx, [ebp - 0x1010]
push ecx
mov ecx, eax
call fcn.10001120
mov esi, dword [sym.imp.CRYPT32.dll_CryptDecodeObjectEx]
add esp, 4
lea edx, [ebp - 0x1014]
push edx
push ebx
push ebx
push ebx
push eax
mov dword [ebp - 0x1008], eax
mov eax, dword [ebp - 0x1010]
push eax
push 0x13
push 0x10001
call esi
test eax, eax
je 0x100022c9
mov ecx, dword [ebp - 0x1014]
push ecx
push 1
call fcn.1000363c
mov ecx, dword [ebp - 0x1010]
add esp, 8
lea edx, [ebp - 0x1014]
push edx
mov edi, eax
mov eax, dword [ebp - 0x1008]
push edi
push ebx
push ebx
push eax
push ecx
push 0x13
push 0x10001
call esi
test eax, eax
je 0x100022c0
push 0xf0000000
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push ebx
lea edx, [ebp - 0x101c]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x100022c0
mov ecx, dword [ebp - 0x1014]
mov edx, dword [ebp - 0x101c]
lea eax, [ebp - 0x1018]
push eax
push ebx
push ebx
push ecx
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x100022b2
mov edx, dword [ebp - 0x1018]
push ebx
lea eax, [ebp - 0x1024]
push eax
lea ecx, [ebp - 0x100c]
push ecx
push 9
push edx
call dword [sym.imp.ADVAPI32.dll_CryptGetKeyParam]
test eax, eax
je 0x100022a5
shr dword [ebp - 0x100c], 3
lea eax, [ebp - 0x1004]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10002213
sub eax, edx
mov edx, dword [ebp - 0x1018]
push 0x1000
mov dword [ebp - 0x1008], eax
lea eax, [ebp - 0x1008]
push eax
lea ecx, [ebp - 0x1004]
push ecx
push ebx
push 1
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x100022a5
mov ecx, dword [ebp - 0x100c]
mov esi, ecx
xor eax, eax
shr esi, 1
je 0x1000227a
lea ecx, [ebp + ecx - 0x1005]
nop
mov bl, byte [ecx]
mov dl, byte [ebp + eax - 0x1004]
mov byte [ebp + eax - 0x1004], bl
mov byte [ecx], dl
inc eax
dec ecx
cmp eax, esi
jb 0x10002260
xor ebx, ebx
mov esi, dword [ebp - 0x1008]
push esi
mov dword [ebp - 0x1020], esi
call fcn.100032f3
mov ecx, dword [ebp - 0x1028]
push esi
lea edx, [ebp - 0x1004]
push edx
push eax
mov dword [ecx], eax
call fcn.100099a0
add esp, 0x10
mov eax, dword [ebp - 0x1018]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov ecx, dword [ebp - 0x101c]
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push edi
call fcn.10003432
add esp, 4
mov edx, dword [ebp - 0x1010]
push edx
call fcn.10003432
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1020]
add esp, 4
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100032e4
mov esp, ebp
pop ebp
ret