Function at 0x40747e
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esp + 0x1c], edx
xor ebp, ebp
mov ecx, 0x8004
push edi
mov eax, dword [esi + 0x18]
cmp eax, 0x8009
cmove eax, ecx
mov ecx, eax
mov dword [esp + 0x10], eax
call fcn.00403ed9
mov ecx, dword [esi + 0x1c]
mov ebx, eax
call fcn.00403fb0
mov ecx, dword [esi + 0x1c]
mov dword [esp + 0x14], eax
call fcn.00403f3e
mov ecx, eax
lea edi, [esi + 0x24]
mov eax, ebx
mov dword [esp + 0x18], ecx
xor edx, edx
div ecx
mov eax, dword [esp + 0x34]
add eax, 0x10
add ebx, edx
add eax, ebx
mov dword [edi], eax
add eax, ecx
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [esi + 0x20], eax
test eax, eax
je 0x407669
push 0x10
push eax
call dword [sym.imp.cryptdll.dll_CDGenerateRandomBits]
mov ecx, dword [esi + 0x20]
mov edx, dword [esp + 0x20]
push ebx
lea eax, [ecx + 0x10]
push eax
push 0x10
push ecx
mov ecx, dword [esp + 0x20]
push 0x14
call fcn.0040364a
add esp, 0x14
test eax, eax
je 0x40765a
mov edx, dword [esi + 0x20]
mov ecx, dword [esp + 0x10]
add edx, 0x10
push ebx
push edx
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push ebx
call fcn.0040364a
add esp, 0x14
test eax, eax
je 0x40765a
push dword [esp + 0x34]
mov eax, dword [esi + 0x20]
push dword [esp + 0x34]
add eax, 0x10
add eax, ebx
push eax
call fcn.0049fa90
mov eax, dword [esp + 0x24]
add esp, 0xc
add eax, dword [esp + 0x14]
mov dword [esp + 0x34], eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
je 0x40765a
mov edx, dword [esp + 0x20]
lea eax, [esi + 4]
mov ecx, dword [esp + 0x10]
push 1
push dword [esp + 0x38]
push ebx
push dword [esi + 0x14]
push 0x10
push eax
push 0x14
call fcn.00403785
add esp, 0x1c
test eax, eax
je 0x40764f
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x20]
mov edx, ebx
push eax
push ebp
push dword [esp + 0x20]
call fcn.00403cc7
add esp, 0x10
test eax, eax
je 0x40763c
mov eax, dword [esp + 0x14]
push ebp
add eax, ebx
push eax
push 1
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x407617
mov eax, dword [edi]
add eax, dword [esp + 0x18]
push eax
push edi
push dword [esi + 0x20]
push ebp
push 1
push ebp
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov ebp, eax
test ebp, ebp
je 0x407604
mov eax, dword [esp + 0x18]
sub dword [edi], eax
jmp 0x407617
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kull_m_dpapi_protect_masterkey_with_shaDerivedkey___CryptEncrypt__0x_08x__n
call fcn.00409cda
pop ecx
pop ecx
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov ecx, dword [esp + 0x24]
call fcn.004035a7
test eax, eax
jne 0x40764f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kull_m_dpapi_protect_masterkey_with_shaDerivedkey___kull_m_crypto_close_hprov_delete_container__0x_08x__n
jmp 0x407648
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kull_m_dpapi_protect_masterkey_with_shaDerivedkey___kull_m_crypto_hkey_session__0x_08x__n
call fcn.00409cda
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
test ebp, ebp
jne 0x407669
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_LocalFree]
and dword [edi], 0
mov dword [esi + 0x20], eax
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x18
ret