Function at 0x106480c
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x10cd598]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x1c], ecx
xor ecx, ecx
inc dword [eax + 4]
mov dword [ebp - 0x2c], ecx
mov esi, ebx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], ecx
movsd dword es:[edi], dword [esi]
call fcn.0108abe1
mov esi, eax
xor edi, edi
cmp esi, edi
je 0x106487b
push esi
push 0x20840139
call fcn.010893e6
jmp 0x1064ca2
mov eax, dword [ebp + 0x14]
add eax, 0xfffffff0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
add ebx, 0x10
push 1
mov dword [ebp - 0x18], ebx
call fcn.0105d316
mov esi, eax
cmp esi, edi
je 0x10648ab
push esi
push 0x208c0139
jmp 0x1064871
mov eax, dword [ebp - 0x20]
shr eax, 1
lea eax, [eax + eax + 2]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
mov dword [ebp - 0x38], esi
cmp esi, edi
jne 0x10648d5
mov esi, 0x8007000e
push esi
push 0x20940139
jmp 0x1064d08
push dword [ebp - 0x20]
push dword [ebp - 0x18]
push esi
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x20]
shr eax, 1
xor ecx, ecx
add esp, 0xc
mov word [esi + eax*2], cx
cmp dword [0x10cf1f4], edi
je 0x1064924
push 0x1012ba8
call fcn.01099014
mov dword [esp], 0x8d4
call fcn.01088aa0
push eax
call fcn.01099014
push dword [ebp - 0x2c]
push esi
push 0x1012b8c
call fcn.01099014
add esp, 0x10
mov eax, dword [ebp - 0x20]
add dword [ebp - 0x18], eax
sub dword [ebp - 0x1c], eax
je 0x1064c92
mov ebx, 0x1004208
cmp dword [0x10cf1f4], edi
je 0x1064947
push ebx
call fcn.01099014
pop ecx
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
call fcn.0105d316
mov esi, eax
cmp esi, edi
jne 0x1064ce2
cmp dword [0x10cf1f4], 1
jle 0x1064985
push ebx
call fcn.01099014
pop ecx
push dword [ebp - 0x3c]
mov eax, 0x100df98
push eax
push eax
push 1
push edi
call fcn.01057c48
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 1
call fcn.0105d316
mov esi, eax
cmp esi, edi
jne 0x1064cea
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
cmp dword [0x10cf210], edi
je 0x10649d4
push ebx
call fcn.01099014
pop ecx
push 0xffffffffffffffff
push dword [ebp - 0x30]
push dword [ebp - 0x18]
call fcn.0105dfe1
mov esi, eax
cmp esi, edi
jne 0x1064cf2
mov eax, dword [ebp - 0x20]
add dword [ebp - 0x18], eax
sub dword [ebp - 0x1c], eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
call fcn.0105d316
mov esi, eax
cmp esi, edi
jne 0x1064cfa
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
call fcn.0105d316
mov esi, eax
cmp esi, edi
jne 0x1064d02
cmp dword [0x10cf1f4], edi
je 0x1064a3c
lea eax, [ebp - 0x5c]
push eax
push edi
push 0x20f
push edi
call fcn.0103d073
cmp eax, edi
je 0x1064a3c
push eax
push 0x20e20139
call fcn.010893e6
test dword [ebp - 0x3c], 8
jne 0x1064a74
mov eax, dword [ebp - 0x34]
inc dword [eax + 8]
cmp dword [0x10cf1f4], edi
je 0x1064c89
push 0x8a9
call fcn.01088aa0
push eax
call fcn.01099014
push ebx
call fcn.01099014
pop ecx
pop ecx
jmp 0x1064c89
mov edi, dword [ebp - 0x34]
inc dword [edi + 0xc]
inc dword [edi + 0x20]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 1
call fcn.0105d316
mov esi, eax
test esi, esi
jne 0x1064d0f
cmp dword [0x10cf1f4], 1
jle 0x1064abd
push 0x1012b80
call fcn.01099014
pop ecx
push 8
push dword [ebp - 0x18]
push 0xe04
call fcn.0108cc81
cmp dword [ebp + 0x18], 0
je 0x1064ae7
push 0
push dword [ebp - 0x18]
push 1
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
jne 0x1064ae7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x1064d17
add dword [ebp - 0x18], 8
sub dword [ebp - 0x1c], 8
lea eax, [ebp - 0x20]
push eax
push 8
push dword [ebp - 0x20]
call fcn.0105db2c
mov esi, eax
test esi, esi
jne 0x1064d1f
cmp dword [0x10cf1f4], 1
jle 0x1064b3c
push ebx
call fcn.01099014
mov dword [esp], 0x8d5
call fcn.01088aa0
push eax
call fcn.01099014
push ebx
call fcn.01099014
pop ecx
pop ecx
push dword [ebp - 0x20]
push dword [ebp - 0x18]
push esi
call fcn.0108cc81
cmp dword [ebp + 0x18], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x48], eax
je 0x1064c7e
push eax
push 0
mov dword [ebp - 0x28], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
mov dword [ebp - 0x24], esi
test esi, esi
je 0x1064d27
push dword [ebp - 0x28]
push dword [ebp - 0x18]
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
push esi
push 0
push 1
push 0
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x1064ba2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x21340139
call fcn.010893e6
jmp 0x1064c63
cmp dword [0x10cf1f4], 1
jle 0x1064bd9
push ebx
call fcn.01099014
mov dword [esp], 0x8d6
call fcn.01088aa0
push eax
call fcn.01099014
push ebx
call fcn.01099014
pop ecx
pop ecx
push dword [ebp - 0x20]
push esi
push 0x1000
call fcn.0103c434
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x50]
push eax
push 0xa400
push 0
push dword [ebp - 0x28]
push esi
call fcn.0105d4ca
mov esi, eax
test esi, esi
jne 0x1064d34
mov esi, dword [ebp - 0x4c]
mov ebx, dword [ebp - 0x50]
push eax
push 1
push esi
push ebx
push dword [ebp - 0x30]
push dword [ebp - 0x40]
call fcn.01064475
test eax, eax
je 0x1064c20
push eax
push 0x21530139
call fcn.010893e6
push edi
push 0
push esi
push ebx
push dword [ebp - 0x30]
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push dword [ebp - 0x54]
call fcn.0105e1d2
test eax, eax
je 0x1064c4a
push 0x80090006
push eax
push 0x215e0139
call fcn.01089403
mov ecx, esi
mov eax, ebx
test esi, esi
je 0x1064c59
mov byte [eax], 0
inc eax
dec ecx
jne 0x1064c52
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov eax, esi
test ecx, ecx
je 0x1064c73
mov byte [eax], 0
inc eax
dec ecx
jne 0x1064c6c
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x48]
add dword [ebp - 0x18], eax
sub dword [ebp - 0x1c], eax
xor edi, edi
cmp dword [ebp - 0x1c], edi
ja 0x1064933
xor esi, esi
cmp dword [ebp - 0x38], edi
je 0x1064ca2
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x2c], edi
je 0x1064cb0
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x24], edi
je 0x1064ccf
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
cmp ecx, edi
je 0x1064cc6
mov byte [eax], 0
inc eax
dec ecx
jne 0x1064cbf
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01074bd5
leave
ret 0x18
push esi
push 0x20b10139
jmp 0x1064d08
push esi
push 0x20bf0139
jmp 0x1064d08
push esi
push 0x20c90139
jmp 0x1064d08
push esi
push 0x20d60139
jmp 0x1064d08
push esi
push 0x20dd0139
call fcn.010893e6
jmp 0x1064c94
push esi
push 0x20f70139
jmp 0x1064d3a
push esi
push 0x210f0139
jmp 0x1064d3a
push esi
push 0x21170139
jmp 0x1064d3a
mov esi, 0x8007000e
push esi
push 0x212e0139
jmp 0x1064d3a
push esi
push 0x214a0139
call fcn.010893e6
xor edi, edi
jmp 0x1064c94