Function at 0x461e50
Capabilities:
Check os version
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x52c7b2
mov eax, dword fs:[0]
push eax
sub esp, 0x118
push ebx
push ebp
push esi
push edi
mov eax, dword [0x59c6b8]
xor eax, esp
push eax
lea eax, [esp + 0x12c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x118], esi
mov eax, dword [esp + 0x13c]
mov dword [esi + 4], eax
mov ebx, dword [esp + 0x140]
mov eax, 0xd
xor edi, edi
push edi
lea ecx, [esp + 0xec]
push ecx
mov dword [esi], vtable.StandardSecurityHandler.0
mov dword [esi + 0x58], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x30], edi
mov ecx, dword [ebx + 8]
push 0x5315d8
mov dword [esp + 0x140], edi
mov dword [esp + 0xf4], eax
mov dword [esp + 0xd4], eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x84], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xe4], eax
mov dword [esp + 0x128], eax
mov dword [esp + 0x104], eax
mov dword [esp + 0xc4], eax
mov dword [esp + 0x94], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x114], eax
call fcn.00412200
mov ecx, dword [ebx + 8]
push edi
lea edx, [esp + 0xcc]
push edx
push 0x531630
call fcn.00412200
mov ecx, dword [ebx + 8]
push edi
lea eax, [esp + 0xac]
push eax
push str.Length
call fcn.00412200
push edi
lea ecx, [esp + 0x4c]
push ecx
mov ecx, dword [ebx + 8]
push 0x532e58
call fcn.00412200
mov ecx, dword [ebx + 8]
push edi
lea edx, [esp + 0x7c]
push edx
push 0x53174c
call fcn.00412200
mov ecx, dword [ebx + 8]
push edi
lea eax, [esp + 0x5c]
push eax
push 0x532d50
call fcn.00412200
push edi
lea ecx, [esp + 0x3c]
push ecx
mov ecx, dword [ebx + 8]
push 0x54c60c
call fcn.00412200
mov ecx, dword [ebx + 8]
push edi
lea edx, [esp + 0x9c]
push edx
push 0x532e54
call fcn.00412200
mov eax, dword [esi + 4]
mov eax, dword [eax + 0x20]
push edi
lea ecx, [esp + 0xdc]
push ecx
mov ecx, dword [eax + 0x38]
push 0x534bfc
call fcn.00412200
mov eax, 1
cmp dword [esp + 0xe8], eax
jne 0x462537
cmp dword [esp + 0xc8], eax
jne 0x462537
cmp dword [esp + 0x98], eax
jne 0x462537
mov ecx, 3
cmp dword [esp + 0x48], ecx
jne 0x462537
cmp dword [esp + 0x78], ecx
jne 0x462537
mov edi, dword [esp + 0xd0]
mov ebp, dword [esp + 0xf0]
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x80]
mov dword [esi + 0x34], ebp
mov dword [esi + 0x38], edi
cmp edi, 4
jg 0x462058
cmp dword [ecx], 0x20
jne 0x462058
cmp dword [edx], 0x20
je 0x4620ab
cmp edi, 5
je 0x462066
cmp edi, 6
jne 0x46252a
cmp dword [ecx], 0x30
jl 0x46252a
cmp dword [edx], 0x30
jl 0x46252a
mov eax, 3
cmp dword [esp + 0x58], eax
jne 0x46252a
mov edx, dword [esp + 0x60]
cmp dword [edx], 0x20
jne 0x46252a
cmp dword [esp + 0x38], eax
jne 0x46252a
mov eax, dword [esp + 0x40]
cmp dword [eax], 0x20
jne 0x46252a
mov dword [esi + 0x3c], 0
cmp edi, 2
je 0x4620d6
cmp dword [esp + 0xa8], 1
jne 0x4620d6
mov eax, dword [esp + 0xb0]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [esi + 0x30], eax
jmp 0x4620dd
mov dword [esi + 0x30], 5
mov dword [esi + 0x40], 1
cmp ebp, 4
je 0x4620f2
cmp ebp, 5
jne 0x46237b
cmp edi, 4
je 0x462105
cmp edi, 5
je 0x462105
cmp edi, 6
jne 0x46237b
push 0
lea ecx, [esp + 0xfc]
push ecx
mov ecx, dword [ebx + 8]
push 0x54c608
call fcn.00412200
mov ecx, dword [ebx + 8]
push 0
lea edx, [esp + 0xbc]
push edx
push str.StmF
call fcn.00412200
mov ecx, dword [ebx + 8]
push 0
lea eax, [esp + 0x8c]
push eax
push str.StrF
call fcn.00412200
cmp dword [esp + 0xf8], 7
jne 0x462321
mov eax, 4
cmp dword [esp + 0xb8], eax
jne 0x462321
cmp dword [esp + 0x88], eax
jne 0x462321
mov ebp, dword [esp + 0xc0]
mov ecx, dword [esp + 0x90]
mov eax, ebp
mov edi, 2
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4621ae
test dl, dl
je 0x4621aa
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4621ae
add eax, edi
add ecx, edi
test dl, dl
jne 0x462190
xor eax, eax
jmp 0x4621b3
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x462321
mov ecx, str.Identity
mov eax, ebp
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4621e0
test dl, dl
je 0x4621dc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4621e0
add eax, edi
add ecx, edi
test dl, dl
jne 0x4621c2
xor eax, eax
jmp 0x4621e5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4621f7
or eax, 0xffffffff
mov dword [esi + 0x38], eax
mov dword [esi + 0x34], eax
jmp 0x462321
push 0
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x108]
push ebp
call fcn.00412200
cmp dword [eax], 7
jne 0x462318
mov ecx, dword [esp + 0x30]
push 0
lea edx, [esp + 0x6c]
push edx
push 0x54c5f4
call fcn.00412200
push 0x54c5f0
lea ecx, [esp + 0x6c]
call fcn.004010c0
test eax, eax
je 0x46226f
mov ecx, dword [esp + 0x30]
push 0
lea eax, [esp + 0x1c]
push eax
push str.Length
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], 3
call fcn.00412200
cmp dword [eax], 1
jne 0x462306
mov ecx, dword [esp + 0x20]
mov dword [esi + 0x30], ecx
jmp 0x462306
push str.AESV2
lea ecx, [esp + 0x6c]
call fcn.004010c0
test eax, eax
je 0x4622b5
mov ecx, dword [esp + 0x30]
push 0
lea edx, [esp + 0x1c]
push edx
push str.Length
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], 3
mov dword [esi + 0x3c], 1
call fcn.00412200
cmp dword [eax], 1
jne 0x462306
mov eax, dword [esp + 0x20]
mov dword [esi + 0x30], eax
jmp 0x462306
push str.AESV3
lea ecx, [esp + 0x6c]
call fcn.004010c0
test eax, eax
je 0x46230f
mov eax, dword [esi + 0x38]
mov dword [esi + 0x34], 5
cmp eax, 5
je 0x4622e2
cmp eax, 6
je 0x4622e2
mov dword [esi + 0x38], 6
push 0
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x38]
push str.Length
mov dword [esi + 0x3c], edi
call fcn.00412200
cmp dword [eax], 1
jne 0x462306
mov edx, dword [esp + 0x20]
mov dword [esi + 0x30], edx
lea ecx, [esp + 0x18]
call fcn.0044ea50
lea ecx, [esp + 0x68]
call fcn.0044ea50
lea ecx, [esp + 0x28]
call fcn.0044ea50
lea ecx, [esp + 0x88]
call fcn.0044ea50
lea ecx, [esp + 0xb8]
call fcn.0044ea50
lea ecx, [esp + 0xf8]
call fcn.0044ea50
mov ecx, dword [ebx + 8]
push 0
lea eax, [esp + 0x10c]
push eax
push str.EncryptMetadata
call fcn.00412200
cmp dword [eax], 0
jne 0x46236b
mov ecx, dword [esp + 0x110]
mov dword [esi + 0x40], ecx
lea ecx, [esp + 0x108]
call fcn.0044ea50
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0xa0]
mov dword [esi + 8], edx
call fcn.00401000
mov ecx, dword [esp + 0x80]
mov dword [esi + 0x44], eax
call fcn.00401000
mov dword [esi + 0x48], eax
mov eax, dword [esi + 0x34]
mov edi, 1
cmp eax, edi
jl 0x462495
cmp eax, 2
jg 0x462495
mov ecx, dword [esi + 0x38]
cmp ecx, 2
jl 0x462495
cmp ecx, 3
jg 0x462495
cmp dword [esp + 0xd8], 6
jne 0x46244a
mov ecx, dword [esp + 0xe0]
lea eax, [esp + 0x11c]
push eax
push 0
call fcn.00408350
cmp dword [eax], 3
jne 0x46240c
mov ecx, dword [esp + 0x124]
call fcn.00401000
lea ecx, [esp + 0x11c]
mov dword [esi + 0x54], eax
call fcn.0044ea50
jmp 0x46247a
push 8
call fcn.00511699
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x134], 1
test eax, eax
je 0x46242f
mov ecx, eax
call fcn.004a1c60
jmp 0x462431
xor eax, eax
lea ecx, [esp + 0x11c]
mov byte [esp + 0x134], 0
mov dword [esi + 0x54], eax
call fcn.0044ea50
jmp 0x46247a
push 8
call fcn.00511699
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x134], 2
test eax, eax
je 0x46246d
mov ecx, eax
call fcn.004a1c60
jmp 0x46246f
xor eax, eax
mov byte [esp + 0x134], 0
mov dword [esi + 0x54], eax
mov eax, dword [esi + 0x30]
cmp eax, 0x10
jg 0x462486
test eax, eax
jg 0x46248d
mov dword [esi + 0x30], 0x10
mov dword [esi + 0x58], edi
jmp 0x462549
cmp eax, 5
jne 0x462506
mov ecx, dword [esi + 0x38]
cmp ecx, eax
je 0x4624a6
cmp ecx, 6
jne 0x462506
push 8
call fcn.00511699
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x134], 3
test eax, eax
je 0x4624c9
mov ecx, eax
call fcn.004a1c60
jmp 0x4624cb
xor eax, eax
mov ecx, dword [esp + 0x60]
mov byte [esp + 0x134], 0
mov dword [esi + 0x54], eax
call fcn.00401000
mov ecx, dword [esp + 0x40]
mov dword [esi + 0x4c], eax
call fcn.00401000
mov dword [esi + 0x50], eax
mov eax, dword [esi + 0x30]
cmp eax, 0x20
jg 0x4624fa
test eax, eax
jg 0x462501
mov dword [esi + 0x30], 0x20
mov dword [esi + 0x58], edi
jmp 0x462549
cmp eax, 0xffffffff
jne 0x462510
cmp dword [esi + 0x38], eax
je 0x462549
mov ecx, dword [esi + 0x38]
push ecx
push eax
push str.Unsupported_version_revision__0:d_1:d__of_Standard_security_handler
push 0xffffffffffffffff
push 0xffffffffffffffff
push 6
call fcn.00412330
add esp, 0x18
jmp 0x462549
push str.Invalid_encryption_key_length
push 0xffffffffffffffff
push 0xffffffffffffffff
push 1
jmp 0x462541
push str.Weird_encryption_info
push 0xffffffffffffffff
push 0xffffffffffffffff
push eax
call fcn.00412330
add esp, 0x10
lea ecx, [esp + 0xd8]
call fcn.0044ea50
lea ecx, [esp + 0x98]
call fcn.0044ea50
lea ecx, [esp + 0x38]
call fcn.0044ea50
lea ecx, [esp + 0x58]
call fcn.0044ea50
lea ecx, [esp + 0x78]
call fcn.0044ea50
lea ecx, [esp + 0x48]
call fcn.0044ea50
lea ecx, [esp + 0xa8]
call fcn.0044ea50
lea ecx, [esp + 0xc8]
call fcn.0044ea50
lea ecx, [esp + 0xe8]
call fcn.0044ea50
mov eax, esi
mov ecx, dword [esp + 0x12c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x124
ret 8