Function at 0x4af4e0
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5a1be8]
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
push ebx
push esi
push edi
test ecx, ecx
js 0x4af9c4
mov ebx, dword [0x5a1be4]
mov edi, dword [ebp + 8]
test ebx, ebx
je 0x4af70f
cmp eax, 0xffffffff
je 0x4af70f
mov eax, dword [ebp + 0x10]
and ecx, 0xfffffff8
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0x14]
mov esi, dword [eax + 4]
cmp edx, esi
mov eax, edx
cmovbe eax, esi
cmp ecx, eax
ja 0x4af537
cmp edx, esi
mov ecx, esi
cmova ecx, edx
push 0
lea eax, [ecx*8]
mov dword [ebp - 4], ecx
push eax
push edi
push ebx
call sub.bcrypt.dll_BCryptGenerateKeyPair
test eax, eax
js 0x4af9c4
mov eax, dword [ebp - 4]
lea ebx, [eax*2 + 0xc]
push ebx
call fcn.004bae7f
mov esi, eax
add esp, 4
test esi, esi
je 0x4af9c4
mov eax, dword [ebp + 0x14]
mov dword [esi], ebx
mov dword [esi + 4], 0x4d504844
mov ecx, dword [ebp - 4]
mov dword [esi + 8], ecx
push dword [eax + 4]
push dword [eax]
lea eax, [esi + 0xc]
push dword [ebp - 4]
push eax
call fcn.004b24d0
mov eax, dword [ebp + 0x10]
push dword [eax + 4]
push dword [eax]
mov eax, dword [ebp - 4]
push eax
add eax, 0xc
add eax, esi
push eax
call fcn.004b24d0
add esp, 0x20
push 0
push ebx
push esi
push str.DHParameters
push dword [edi]
call sub.bcrypt.dll_BCryptSetProperty
mov dword [edi + 4], esi
test eax, eax
js 0x4af9c4
push 0
push dword [edi]
call sub.bcrypt.dll_BCryptFinalizeKeyPair
test eax, eax
js 0x4af9c4
cmp dword [ebp - 0xc], 1
mov eax, str.DHPRIVATEBLOB
push 0
mov ebx, str.DHPUBLICBLOB
mov dword [ebp - 4], 0
cmovne ebx, eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push ebx
push 0
push dword [edi]
call sub.bcrypt.dll_BCryptExportKey
test eax, eax
js 0x4af9c4
push dword [ebp - 4]
call fcn.004bae7f
mov esi, eax
add esp, 4
test esi, esi
je 0x4af9c4
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push esi
push ebx
push 0
push dword [edi]
call sub.bcrypt.dll_BCryptExportKey
test eax, eax
js 0x4afa4e
push dword [esi + 4]
mov ebx, dword [ebp + 0xc]
push ebx
call fcn.004b03b0
add esp, 8
test eax, eax
jne 0x4afa1d
mov eax, dword [esi + 4]
push eax
add eax, 4
lea eax, [esi + eax*2]
push eax
push dword [ebx]
call fcn.00439170
add esp, 0xc
cmp dword [esi], 0x56504844
jne 0x4af9f5
call fcn.004b01a0
mov dword [edi + 8], eax
test eax, eax
je 0x4af9ce
push dword [esi + 4]
push eax
call fcn.004b03b0
add esp, 8
test eax, eax
jne 0x4af99f
mov ecx, dword [esi + 4]
push ecx
lea eax, [esi + ecx*2]
add ecx, 8
add eax, ecx
push eax
mov eax, dword [edi + 8]
push dword [eax]
call fcn.00439170
mov eax, dword [edi + 8]
add esp, 0xc
mov ecx, dword [eax + 4]
mov eax, dword [eax]
test byte [ecx + eax - 1], 1
jne 0x4af9f5
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x4af6db
mov eax, esi
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4af6d0
push esi
call fcn.004bae64
push edi
call fcn.004af420
mov ecx, dword [ebp + 0x18]
add esp, 8
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov ebx, dword [0x5a1be4]
test ebx, ebx
jne 0x4af516
call fcn.004b01a0
mov esi, eax
mov dword [edi + 8], esi
test esi, esi
je 0x4af9c4
mov eax, dword [ebp + 0x18]
sub esp, 8
lea eax, [eax*8 - 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x4f6d68]
movsd qword [ebp - 0x10], xmm0
fld qword [ebp - 0x10]
fstp qword [esp]
call fcn.004c89a0
add esp, 8
fstp qword [ebp - 0x10]
movsd xmm0, qword [ebp - 0x10]
call fcn.004bacd0
mov ecx, dword [esi + 4]
mov ebx, eax
cmp ebx, ecx
je 0x4af7a3
mov eax, dword [esi]
test eax, eax
je 0x4af78b
test ecx, ecx
je 0x4af78b
cmp ebx, ecx
jae 0x4af78b
lea eax, [eax + ebx]
sub ecx, ebx
je 0x4af78b
nop dword [eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4af780
push ebx
push dword [esi]
call fcn.004c6f18
add esp, 8
test eax, eax
je 0x4af9c4
mov dword [esi], eax
mov dword [esi + 4], ebx
mov esi, dword [esi]
push ebx
push esi
call fcn.004b1c90
add esp, 8
test eax, eax
jne 0x4af9c4
mov ecx, dword [ebp + 0x18]
lea eax, [ecx*8 - 1]
and eax, reloc.WS2_32.dll_getsockopt
jns 0x4af7cf
dec eax
or eax, 0xfffffff8
add eax, 1
mov edx, 8
cmovne edx, eax
mov al, 1
mov ecx, edx
shl al, cl
dec al
movzx ecx, al
movzx eax, byte [esi]
and ecx, eax
lea eax, [edx - 1]
bts ecx, eax
mov byte [esi], cl
or byte [esi + ebx - 1], 1
cmp dword [ebp + 0xc], 0
mov esi, dword [edi + 8]
je 0x4af9c4
cmp dword [ebp + 0x10], 0
je 0x4af9c4
test esi, esi
je 0x4af9c4
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4af9c4
mov edi, dword [eax + 4]
add edi, 0x18
mov dword [ebp - 8], 0x18
add edi, dword [esi + 4]
push edi
call fcn.004bae7f
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4af9c4
mov eax, dword [ebp + 0x14]
mov dword [ebx], 0x31415352
mov ecx, dword [eax + 4]
shl ecx, 3
mov dword [ebx + 4], ecx
mov ecx, dword [esi + 4]
mov dword [ebx + 8], ecx
mov eax, dword [eax + 4]
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
push dword [esi + 4]
mov eax, dword [ebp - 8]
push dword [esi]
add eax, ebx
push eax
call fcn.00439170
mov eax, dword [ebp + 0x14]
push dword [eax + 4]
push dword [eax]
mov eax, dword [esi + 4]
add eax, ebx
add eax, dword [ebp - 8]
push eax
call fcn.00439170
add esp, 0x18
mov dword [ebp - 8], 0
lea eax, [ebp - 0x14]
push 0
push edi
push ebx
push eax
push str.RSAPUBLICBLOB
push 0
push dword [0x5a1bcc]
call sub.bcrypt.dll_BCryptImportKeyPair
mov esi, eax
test esi, esi
js 0x4afa90
push 1
lea eax, [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x10]
push 0
push 0
push 0
push 0
push 0
push dword [eax + 4]
push dword [eax]
push dword [ebp - 0x14]
call sub.bcrypt.dll_BCryptEncrypt
mov esi, eax
test esi, esi
js 0x4afa88
push dword [ebp + 0x18]
push dword [ebp + 0xc]
call fcn.004b03b0
add esp, 8
test eax, eax
jne 0x4afa83
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x18]
cmp dword [eax + 4], ecx
cmova ecx, dword [eax + 4]
push ecx
mov dword [ebp + 0x18], ecx
call fcn.004bae7f
mov esi, eax
add esp, 4
mov dword [ebp - 0xc], esi
test esi, esi
je 0x4afa83
mov eax, dword [ebp + 0x10]
push dword [eax + 4]
push dword [eax]
push dword [ebp + 0x18]
push esi
call fcn.004b24d0
add esp, 0x10
lea eax, [ebp - 8]
push 1
push eax
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push dword [eax]
push 0
push 0
push 0
push dword [ebp + 0x18]
push esi
push dword [ebp - 0x14]
call sub.bcrypt.dll_BCryptEncrypt
mov ecx, dword [ebp + 0x18]
mov esi, eax
mov edx, dword [ebp - 0xc]
test ecx, ecx
je 0x4af97b
mov eax, edx
nop dword [eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4af970
push edx
call fcn.004bae64
add esp, 4
test esi, esi
js 0x4afa88
push dword [ebp - 8]
push dword [ebp + 0xc]
call fcn.004b03b0
add esp, 8
jmp 0x4afa88
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x4af9bb
mov eax, esi
nop dword [eax + eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4af9b0
push esi
call fcn.004bae64
add esp, 4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x4af9bb
mov eax, esi
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4af9d7
push esi
call fcn.004bae64
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x4afa0b
mov eax, esi
nop
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4afa00
push esi
call fcn.004bae64
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0xc], 1
je 0x4af9bb
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x4af9bb
mov eax, esi
nop dword [eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4afa30
push esi
call fcn.004bae64
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0xc], 1
je 0x4af9bb
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x4af9bb
mov eax, esi
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4afa65
push esi
call fcn.004bae64
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, 0xc0000017
push dword [ebp - 0x14]
call sub.bcrypt.dll_BCryptDestroyKey
test edi, edi
je 0x4afaa1
mov eax, ebx
mov byte [eax], 0
lea eax, [eax + 1]
sub edi, 1
jne 0x4afa96
push ebx
call fcn.004bae64
add esp, 4
sar esi, 0x1f
neg esi
sbb esi, esi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret