Function at 0x1064fae
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x10d0620]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x1c], ecx
xor ecx, ecx
inc dword [eax + 4]
mov dword [ebp - 0x2c], ecx
mov esi, ebx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], ecx
movsd dword es:[edi], dword [esi]
call fcn.0108dd55
mov esi, eax
xor edi, edi
cmp esi, edi
je 0x106501d
push esi
push 0x20840139
call fcn.0108c55a
jmp 0x1065444
mov eax, dword [ebp + 0x14]
add eax, 0xfffffff0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
add ebx, 0x10
push 1
mov dword [ebp - 0x18], ebx
call fcn.0105dab8
mov esi, eax
cmp esi, edi
je 0x106504d
push esi
push 0x208c0139
jmp 0x1065013
mov eax, dword [ebp - 0x20]
shr eax, 1
lea eax, [eax + eax + 2]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
mov dword [ebp - 0x38], esi
cmp esi, edi
jne 0x1065077
mov esi, 0x8007000e
push esi
push 0x20940139
jmp 0x10654aa
push dword [ebp - 0x20]
push dword [ebp - 0x18]
push esi
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x20]
shr eax, 1
xor ecx, ecx
add esp, 0xc
mov word [esi + eax*2], cx
cmp dword [0x10d2284], edi
je 0x10650c6
push 0x1012ca8
call fcn.0109c1a8
mov dword [esp], 0x8d4
call fcn.0108bc14
push eax
call fcn.0109c1a8
push dword [ebp - 0x2c]
push esi
push 0x1012c8c
call fcn.0109c1a8
add esp, 0x10
mov eax, dword [ebp - 0x20]
add dword [ebp - 0x18], eax
sub dword [ebp - 0x1c], eax
je 0x1065434
mov ebx, 0x1004310
cmp dword [0x10d2284], edi
je 0x10650e9
push ebx
call fcn.0109c1a8
pop ecx
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
call fcn.0105dab8
mov esi, eax
cmp esi, edi
jne 0x1065484
cmp dword [0x10d2284], 1
jle 0x1065127
push ebx
call fcn.0109c1a8
pop ecx
push dword [ebp - 0x3c]
mov eax, 0x100e098
push eax
push eax
push 1
push edi
call fcn.010583fb
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 1
call fcn.0105dab8
mov esi, eax
cmp esi, edi
jne 0x106548c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
cmp dword [0x10d22a0], edi
je 0x1065176
push ebx
call fcn.0109c1a8
pop ecx
push 0xffffffffffffffff
push dword [ebp - 0x30]
push dword [ebp - 0x18]
call fcn.0105e783
mov esi, eax
cmp esi, edi
jne 0x1065494
mov eax, dword [ebp - 0x20]
add dword [ebp - 0x18], eax
sub dword [ebp - 0x1c], eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
call fcn.0105dab8
mov esi, eax
cmp esi, edi
jne 0x106549c
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
call fcn.0105dab8
mov esi, eax
cmp esi, edi
jne 0x10654a4
cmp dword [0x10d2284], edi
je 0x10651de
lea eax, [ebp - 0x5c]
push eax
push edi
push 0x20f
push edi
call fcn.0103d802
cmp eax, edi
je 0x10651de
push eax
push 0x20e20139
call fcn.0108c55a
test dword [ebp - 0x3c], 8
jne 0x1065216
mov eax, dword [ebp - 0x34]
inc dword [eax + 8]
cmp dword [0x10d2284], edi
je 0x106542b
push 0x8a9
call fcn.0108bc14
push eax
call fcn.0109c1a8
push ebx
call fcn.0109c1a8
pop ecx
pop ecx
jmp 0x106542b
mov edi, dword [ebp - 0x34]
inc dword [edi + 0xc]
inc dword [edi + 0x20]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 1
call fcn.0105dab8
mov esi, eax
test esi, esi
jne 0x10654b1
cmp dword [0x10d2284], 1
jle 0x106525f
push 0x1012c80
call fcn.0109c1a8
pop ecx
push 8
push dword [ebp - 0x18]
push 0xe04
call fcn.0108fdf5
cmp dword [ebp + 0x18], 0
je 0x1065289
push 0
push dword [ebp - 0x18]
push 1
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
jne 0x1065289
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x10654b9
add dword [ebp - 0x18], 8
sub dword [ebp - 0x1c], 8
lea eax, [ebp - 0x20]
push eax
push 8
push dword [ebp - 0x20]
call fcn.0105e2ce
mov esi, eax
test esi, esi
jne 0x10654c1
cmp dword [0x10d2284], 1
jle 0x10652de
push ebx
call fcn.0109c1a8
mov dword [esp], 0x8d5
call fcn.0108bc14
push eax
call fcn.0109c1a8
push ebx
call fcn.0109c1a8
pop ecx
pop ecx
push dword [ebp - 0x20]
push dword [ebp - 0x18]
push esi
call fcn.0108fdf5
cmp dword [ebp + 0x18], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x48], eax
je 0x1065420
push eax
push 0
mov dword [ebp - 0x28], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
mov dword [ebp - 0x24], esi
test esi, esi
je 0x10654c9
push dword [ebp - 0x28]
push dword [ebp - 0x18]
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
push esi
push 0
push 1
push 0
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x1065344
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x21340139
call fcn.0108c55a
jmp 0x1065405
cmp dword [0x10d2284], 1
jle 0x106537b
push ebx
call fcn.0109c1a8
mov dword [esp], 0x8d6
call fcn.0108bc14
push eax
call fcn.0109c1a8
push ebx
call fcn.0109c1a8
pop ecx
pop ecx
push dword [ebp - 0x20]
push esi
push 0x1000
call fcn.0103cbc3
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x50]
push eax
push 0xa400
push 0
push dword [ebp - 0x28]
push esi
call fcn.0105dc6c
mov esi, eax
test esi, esi
jne 0x10654d6
mov esi, dword [ebp - 0x4c]
mov ebx, dword [ebp - 0x50]
push eax
push 1
push esi
push ebx
push dword [ebp - 0x30]
push dword [ebp - 0x40]
call fcn.01064c17
test eax, eax
je 0x10653c2
push eax
push 0x21530139
call fcn.0108c55a
push edi
push 0
push esi
push ebx
push dword [ebp - 0x30]
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push dword [ebp - 0x54]
call fcn.0105e974
test eax, eax
je 0x10653ec
push 0x80090006
push eax
push 0x215e0139
call fcn.0108c577
mov ecx, esi
mov eax, ebx
test esi, esi
je 0x10653fb
mov byte [eax], 0
inc eax
dec ecx
jne 0x10653f4
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov eax, esi
test ecx, ecx
je 0x1065415
mov byte [eax], 0
inc eax
dec ecx
jne 0x106540e
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x48]
add dword [ebp - 0x18], eax
sub dword [ebp - 0x1c], eax
xor edi, edi
cmp dword [ebp - 0x1c], edi
ja 0x10650d5
xor esi, esi
cmp dword [ebp - 0x38], edi
je 0x1065444
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x2c], edi
je 0x1065452
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x24], edi
je 0x1065471
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
cmp ecx, edi
je 0x1065468
mov byte [eax], 0
inc eax
dec ecx
jne 0x1065461
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01077dc7
leave
ret 0x18
push esi
push 0x20b10139
jmp 0x10654aa
push esi
push 0x20bf0139
jmp 0x10654aa
push esi
push 0x20c90139
jmp 0x10654aa
push esi
push 0x20d60139
jmp 0x10654aa
push esi
push 0x20dd0139
call fcn.0108c55a
jmp 0x1065436
push esi
push 0x20f70139
jmp 0x10654dc
push esi
push 0x210f0139
jmp 0x10654dc
push esi
push 0x21170139
jmp 0x10654dc
mov esi, 0x8007000e
push esi
push 0x212e0139
jmp 0x10654dc
push esi
push 0x214a0139
call fcn.0108c55a
xor edi, edi
jmp 0x1065436