Function at 0x442310
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5abe78
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x62c2a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
xor edi, edi
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov byte [ebp - 4], 2
mov esi, dword [ebp + 0xc]
cmp dword [esi + 0x14], 0x10
mov ecx, dword [esi + 0x10]
jb 0x44237c
mov eax, dword [esi]
mov dword [ebp + 0xc], eax
jmp 0x44237f
mov dword [ebp + 0xc], esi
mov eax, 0x17
mov edx, 0x5fe0d4
cmp ecx, eax
cmovb eax, ecx
mov ecx, dword [ebp + 0xc]
push eax
call fcn.004188f0
mov ecx, dword [esi + 0x10]
add esp, 4
test eax, eax
jne 0x4423b0
cmp ecx, 0x17
jb 0x4423b0
cmp ecx, 0x17
setne al
test eax, eax
je 0x4423f9
cmp dword [esi + 0x14], 0x10
jb 0x4423bd
mov eax, dword [esi]
mov dword [ebp + 0xc], eax
jmp 0x4423c0
mov dword [ebp + 0xc], esi
mov eax, 0x17
mov edx, 0x5fed08
cmp ecx, eax
cmovb eax, ecx
mov ecx, dword [ebp + 0xc]
push eax
call fcn.004188f0
add esp, 4
test eax, eax
jne 0x44246f
mov ecx, dword [esi + 0x10]
cmp ecx, 0x17
jb 0x44246f
cmp ecx, 0x17
setne al
test eax, eax
jne 0x44246f
lea eax, [ebp - 0x3c]
mov dword [ebp + 0xc], 5
push eax
push esi
push 0x40
push 2
mov ecx, ebx
call fcn.00442670
cmp dword [esi + 0x14], 0x10
mov edi, dword [esi + 0x10]
jb 0x44241d
mov ecx, dword [esi]
jmp 0x44241f
mov ecx, esi
cmp edi, 0x17
mov eax, 0x17
mov edx, 0x5fe0d4
cmovb eax, edi
push eax
call fcn.004188f0
add esp, 4
test eax, eax
jne 0x4424d8
cmp edi, 0x17
jb 0x4424d8
cmp edi, 0x17
setne al
test eax, eax
jne 0x4424d8
lea eax, [ebp - 0x2c]
mov ecx, ebx
push eax
push esi
push 0x28
push 1
call fcn.00442670
mov edi, dword [ebp - 0x3c]
jmp 0x442553
mov edx, 0x5fe3b8
mov ecx, esi
call fcn.0041b0a0
test al, al
je 0x4424b1
lea eax, [ebp - 0x3c]
mov dword [ebp + 0xc], 3
push eax
push esi
push 0x40
push 2
mov ecx, ebx
call fcn.00442670
lea eax, [ebp - 0x2c]
mov ecx, ebx
push eax
push esi
push 0xc0
push 1
call fcn.00442670
mov edi, dword [ebp - 0x3c]
jmp 0x442553
mov edx, 0x5febf0
mov ecx, esi
call fcn.0041b0a0
test al, al
je 0x4424f0
lea eax, [ebp - 0x3c]
mov dword [ebp + 0xc], 2
push eax
push esi
push 0x40
push 2
mov ecx, ebx
call fcn.00442670
lea eax, [ebp - 0x2c]
mov ecx, ebx
push eax
push esi
push 0x80
push 1
call fcn.00442670
mov edi, dword [ebp - 0x3c]
jmp 0x442553
mov edx, 0x5fec08
mov ecx, esi
call fcn.0041b0a0
test al, al
jne 0x442525
mov edx, 0x5febd4
mov ecx, esi
call fcn.0041b0a0
test al, al
jne 0x442525
push 0x6256a0
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0xa
push eax
call fcn.00586852
mov edx, 0x5fec08
mov dword [ebp + 0xc], 4
mov ecx, esi
call fcn.0041b0a0
test al, al
mov ecx, ebx
lea eax, [ebp - 0x2c]
push eax
push esi
je 0x442547
push 0x28
jmp 0x44254c
push 0x80
push 1
call fcn.00442670
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp - 0x1c]
push 1
push edi
push dword [ebp - 0x28]
push esi
push dword [ebp + 0xc]
call fcn.004329c0
mov ebx, dword [ebp + 8]
push 0
mov eax, dword [ebx + 4]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 1
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x4425a1
push 0x6256a0
lea eax, [ebp + 8]
mov dword [ebp + 8], 8
push eax
call fcn.00586852
push dword [ebp - 0x10]
mov ecx, ebx
call fcn.00432ce0
mov ecx, dword [ebx]
test ecx, ecx
jne 0x4425bf
mov eax, dword [ebx + 4]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push ecx
push eax
push ecx
jmp 0x4425c7
push dword [ebp - 0x10]
lea eax, [ebx + 4]
push eax
push ecx
mov eax, dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
push 0
push 1
push 0
push dword [ebp - 0x18]
call eax
test eax, eax
jne 0x4425f0
push 0x6256a0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 8
push eax
call fcn.00586852
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4425fe
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x44260e
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test esi, esi
je 0x442639
mov ecx, dword [ebp - 0x20]
mov eax, esi
test ecx, ecx
je 0x442629
jmp 0x442620
mov byte [eax], 0
lea eax, [eax + 1]
dec ecx
jne 0x442620
push esi
call fcn.00582cf0
add esp, 4
mov dword [ebp - 0x2c], 0
test edi, edi
je 0x442658
mov ecx, dword [ebp - 0x30]
mov eax, edi
test ecx, ecx
je 0x44264f
mov byte [eax], 0
lea eax, [eax + 1]
dec ecx
jne 0x442646
push edi
call fcn.00582cf0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8