Function at 0x4c90e0
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x51d788]
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
push ebx
push esi
push edi
test ecx, ecx
js 0x4c95c4
mov ebx, dword [0x51d784]
mov edi, dword [ebp + 8]
test ebx, ebx
je 0x4c930f
cmp eax, 0xffffffff
je 0x4c930f
mov eax, dword [ebp + 0x10]
and ecx, 0xfffffff8
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0x14]
mov esi, dword [eax + 4]
cmp edx, esi
mov eax, edx
cmovbe eax, esi
cmp ecx, eax
ja 0x4c9137
cmp edx, esi
mov ecx, esi
cmova ecx, edx
push 0
lea eax, [ecx*8]
mov dword [ebp - 4], ecx
push eax
push edi
push ebx
call sub.bcrypt.dll_BCryptGenerateKeyPair
test eax, eax
js 0x4c95c4
mov eax, dword [ebp - 4]
lea ebx, [eax*2 + 0xc]
push ebx
call fcn.0042d9fe
mov esi, eax
add esp, 4
test esi, esi
je 0x4c95c4
mov eax, dword [ebp + 0x14]
mov dword [esi], ebx
mov dword [esi + 4], 0x4d504844
mov ecx, dword [ebp - 4]
mov dword [esi + 8], ecx
push dword [eax + 4]
push dword [eax]
lea eax, [esi + 0xc]
push dword [ebp - 4]
push eax
call fcn.004c99d0
mov eax, dword [ebp + 0x10]
push dword [eax + 4]
push dword [eax]
mov eax, dword [ebp - 4]
push eax
add eax, 0xc
add eax, esi
push eax
call fcn.004c99d0
add esp, 0x20
push 0
push ebx
push esi
push str.DHParameters
push dword [edi]
call sub.bcrypt.dll_BCryptSetProperty
mov dword [edi + 4], esi
test eax, eax
js 0x4c95c4
push 0
push dword [edi]
call sub.bcrypt.dll_BCryptFinalizeKeyPair
test eax, eax
js 0x4c95c4
cmp dword [ebp - 0xc], 1
mov eax, str.DHPRIVATEBLOB
push 0
mov ebx, str.DHPUBLICBLOB
mov dword [ebp - 4], 0
cmovne ebx, eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push ebx
push 0
push dword [edi]
call sub.bcrypt.dll_BCryptExportKey
test eax, eax
js 0x4c95c4
push dword [ebp - 4]
call fcn.0042d9fe
mov esi, eax
add esp, 4
test esi, esi
je 0x4c95c4
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push esi
push ebx
push 0
push dword [edi]
call sub.bcrypt.dll_BCryptExportKey
test eax, eax
js 0x4c964e
push dword [esi + 4]
mov ebx, dword [ebp + 0xc]
push ebx
call fcn.004ca310
add esp, 8
test eax, eax
jne 0x4c961d
mov eax, dword [esi + 4]
push eax
add eax, 4
lea eax, [esi + eax*2]
push eax
push dword [ebx]
call fcn.004095d0
add esp, 0xc
cmp dword [esi], 0x56504844
jne 0x4c95f5
call fcn.004c77e0
mov dword [edi + 8], eax
test eax, eax
je 0x4c95ce
push dword [esi + 4]
push eax
call fcn.004ca310
add esp, 8
test eax, eax
jne 0x4c959f
mov ecx, dword [esi + 4]
push ecx
lea eax, [esi + ecx*2]
add ecx, 8
add eax, ecx
push eax
mov eax, dword [edi + 8]
push dword [eax]
call fcn.004095d0
mov eax, dword [edi + 8]
add esp, 0xc
mov ecx, dword [eax + 4]
mov eax, dword [eax]
test byte [ecx + eax - 1], 1
jne 0x4c95f5
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x4c92db
mov eax, esi
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4c92d0
push esi
call fcn.00421011
push edi
call fcn.004c98d0
mov ecx, dword [ebp + 0x18]
add esp, 8
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov ebx, dword [0x51d784]
test ebx, ebx
jne 0x4c9116
call fcn.004c77e0
mov esi, eax
mov dword [edi + 8], esi
test esi, esi
je 0x4c95c4
mov eax, dword [ebp + 0x18]
sub esp, 8
lea eax, [eax*8 - 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x4f7a48]
movsd qword [ebp - 0x10], xmm0
fld qword [ebp - 0x10]
fstp qword [esp]
call fcn.0045dd60
add esp, 8
fstp qword [ebp - 0x10]
movsd xmm0, qword [ebp - 0x10]
call fcn.004dec80
mov ecx, dword [esi + 4]
mov ebx, eax
cmp ebx, ecx
je 0x4c93a3
mov eax, dword [esi]
test eax, eax
je 0x4c938b
test ecx, ecx
je 0x4c938b
cmp ebx, ecx
jae 0x4c938b
lea eax, [eax + ebx]
sub ecx, ebx
je 0x4c938b
nop dword [eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4c9380
push ebx
push dword [esi]
call fcn.004474e7
add esp, 8
test eax, eax
je 0x4c95c4
mov dword [esi], eax
mov dword [esi + 4], ebx
mov esi, dword [esi]
push ebx
push esi
call fcn.004c7800
add esp, 8
test eax, eax
jne 0x4c95c4
mov ecx, dword [ebp + 0x18]
lea eax, [ecx*8 - 1]
and eax, reloc.WS2_32.dll_getsockopt
jns 0x4c93cf
dec eax
or eax, 0xfffffff8
add eax, 1
mov edx, 8
cmovne edx, eax
mov al, 1
mov ecx, edx
shl al, cl
dec al
movzx ecx, al
movzx eax, byte [esi]
and ecx, eax
lea eax, [edx - 1]
bts ecx, eax
mov byte [esi], cl
or byte [esi + ebx - 1], 1
cmp dword [ebp + 0xc], 0
mov esi, dword [edi + 8]
je 0x4c95c4
cmp dword [ebp + 0x10], 0
je 0x4c95c4
test esi, esi
je 0x4c95c4
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4c95c4
mov edi, dword [eax + 4]
add edi, 0x18
mov dword [ebp - 8], 0x18
add edi, dword [esi + 4]
push edi
call fcn.0042d9fe
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4c95c4
mov eax, dword [ebp + 0x14]
mov dword [ebx], 0x31415352
mov ecx, dword [eax + 4]
shl ecx, 3
mov dword [ebx + 4], ecx
mov ecx, dword [esi + 4]
mov dword [ebx + 8], ecx
mov eax, dword [eax + 4]
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
push dword [esi + 4]
mov eax, dword [ebp - 8]
push dword [esi]
add eax, ebx
push eax
call fcn.004095d0
mov eax, dword [ebp + 0x14]
push dword [eax + 4]
push dword [eax]
mov eax, dword [esi + 4]
add eax, ebx
add eax, dword [ebp - 8]
push eax
call fcn.004095d0
add esp, 0x18
mov dword [ebp - 8], 0
lea eax, [ebp - 0x14]
push 0
push edi
push ebx
push eax
push str.RSAPUBLICBLOB
push 0
push dword [0x51d76c]
call sub.bcrypt.dll_BCryptImportKeyPair
mov esi, eax
test esi, esi
js 0x4c9690
push 1
lea eax, [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x10]
push 0
push 0
push 0
push 0
push 0
push dword [eax + 4]
push dword [eax]
push dword [ebp - 0x14]
call sub.bcrypt.dll_BCryptEncrypt
mov esi, eax
test esi, esi
js 0x4c9688
push dword [ebp + 0x18]
push dword [ebp + 0xc]
call fcn.004ca310
add esp, 8
test eax, eax
jne 0x4c9683
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x18]
cmp dword [eax + 4], ecx
cmova ecx, dword [eax + 4]
push ecx
mov dword [ebp + 0x18], ecx
call fcn.0042d9fe
mov esi, eax
add esp, 4
mov dword [ebp - 0xc], esi
test esi, esi
je 0x4c9683
mov eax, dword [ebp + 0x10]
push dword [eax + 4]
push dword [eax]
push dword [ebp + 0x18]
push esi
call fcn.004c99d0
add esp, 0x10
lea eax, [ebp - 8]
push 1
push eax
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push dword [eax]
push 0
push 0
push 0
push dword [ebp + 0x18]
push esi
push dword [ebp - 0x14]
call sub.bcrypt.dll_BCryptEncrypt
mov ecx, dword [ebp + 0x18]
mov esi, eax
mov edx, dword [ebp - 0xc]
test ecx, ecx
je 0x4c957b
mov eax, edx
nop dword [eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4c9570
push edx
call fcn.00421011
add esp, 4
test esi, esi
js 0x4c9688
push dword [ebp - 8]
push dword [ebp + 0xc]
call fcn.004ca310
add esp, 8
jmp 0x4c9688
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x4c95bb
mov eax, esi
nop dword [eax + eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4c95b0
push esi
call fcn.00421011
add esp, 4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x4c95bb
mov eax, esi
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4c95d7
push esi
call fcn.00421011
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x4c960b
mov eax, esi
nop
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4c9600
push esi
call fcn.00421011
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0xc], 1
je 0x4c95bb
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x4c95bb
mov eax, esi
nop dword [eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4c9630
push esi
call fcn.00421011
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0xc], 1
je 0x4c95bb
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x4c95bb
mov eax, esi
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4c9665
push esi
call fcn.00421011
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, 0xc0000017
push dword [ebp - 0x14]
call sub.bcrypt.dll_BCryptDestroyKey
test edi, edi
je 0x4c96a1
mov eax, ebx
mov byte [eax], 0
lea eax, [eax + 1]
sub edi, 1
jne 0x4c9696
push ebx
call fcn.00421011
add esp, 4
sar esi, 0x1f
neg esi
sbb esi, esi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret