Function at 0x47b260
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fc4d2
mov eax, dword fs:[0]
push eax
sub esp, 0x6cc
mov eax, dword [0x57b070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x694], edx
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x6a8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x698], eax
lea eax, [ebp - 0x674]
mov byte [ebp - 0x681], 0
mov dword [ebp - 0x680], 0
mov dword [ebp - 0x67c], 0x200
mov dword [ebp - 0x678], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 0x464]
mov dword [ebp - 0x470], 0
mov dword [ebp - 0x46c], 0x200
mov dword [ebp - 0x468], eax
xor ebx, ebx
mov dword [ebp - 0x6bc], fcn.004b12a2
mov dword [ebp - 0x6b8], fcn.004b2dab
mov dword [ebp - 0x6b4], fcn.004ac7ec
mov dword [ebp - 0x6b0], ebx
mov dword [ebp - 0x6ac], 0x1fff8
mov dword [ebp - method.allocator_unsigned_char__class_TAllocDefault_.virtual_0], vtable.t_heap.0
lea ecx, [ebp - 0x260]
call fcn.00461c60
lea ecx, [ebp - 0x138]
call fcn.00461c60
xor edi, edi
mov byte [ebp - 4], 4
mov dword [ebp - 0x688], ebx
test esi, esi
je 0x47b3c9
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47b360
sub ecx, edx
sar ecx, 1
je 0x47b3c9
push esi
lea eax, [ebp - 0x260]
push 0x558df8
push eax
call fcn.004623d0
mov eax, dword [ebp - 0x25c]
lea ecx, [ebp - 0x6c0]
add esp, 0xc
lea esi, [eax*2 + 2]
push esi
call fcn.0042e100
push esi
mov ebx, eax
push 0
push ebx
mov dword [ebp - 0x688], ebx
call fcn.004a64e0
add esp, 0xc
lea eax, [esi - 1]
lea ecx, [ebp - 0x260]
push eax
push ebx
call fcn.00462650
mov ebx, dword [ebp - 0x6b0]
mov edx, dword [ebp - 0x694]
test edx, edx
je 0x47b443
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47b3e0
sub ecx, esi
sar ecx, 1
je 0x47b443
push edx
lea eax, [ebp - 0x138]
push 0x558df8
push eax
call fcn.004623d0
mov eax, dword [ebp - 0x134]
lea ecx, [ebp - 0x6c0]
add esp, 0xc
lea esi, [eax*2 + 2]
push esi
call fcn.0042e100
push esi
mov edi, eax
push 0
push edi
call fcn.004a64e0
add esp, 0xc
lea eax, [esi - 1]
lea ecx, [ebp - 0x138]
push eax
push edi
call fcn.00462650
mov ebx, dword [ebp - 0x6b0]
lea eax, [ebp - 0x470]
push eax
lea eax, [ebp - 0x680]
push eax
xor eax, eax
sub esp, 8
cmp dword [ebp - 0x134], eax
cmove edi, eax
xor ecx, ecx
cmp dword [ebp - 0x25c], eax
mov edx, edi
mov eax, dword [ebp - 0x688]
cmove eax, ecx
mov ecx, eax
call fcn.004973a0
add esp, 0x10
mov dword [ebp - 0x694], eax
test eax, eax
je 0x47b7d1
mov dword [ebp - 0x6d4], fcn.004b12a2
mov dword [ebp - 0x6d0], fcn.004b2dab
mov dword [ebp - 0x6cc], fcn.004ac7ec
mov dword [ebp - 0x6c8], 0
mov dword [ebp - 0x6c4], 0x1fff8
mov dword [ebp - method.allocator_unsigned_char__class_TAllocDefault_.virtual_0], vtable.t_heap.0
mov eax, dword [ebp - 0x698]
lea ecx, [ebp - 0x6d8]
mov byte [ebp - 4], 5
mov edi, dword [eax]
add edi, edi
push edi
call fcn.0042e100
mov esi, dword [ebp - 0x470]
mov dword [ebp - 0x688], eax
mov eax, dword [ebp - 0x468]
push edi
mov edi, dword [ebp - 0x688]
push edi
mov byte [eax + esi], 0
mov ecx, dword [ebp - 0x678]
mov eax, dword [ebp - 0x680]
mov edx, dword [ebp - 0x468]
push esi
mov byte [ecx + eax], 0
mov ecx, dword [ebp - 0x678]
call fcn.00418680
add esp, 0xc
mov esi, eax
test edi, edi
je 0x47b7a0
test esi, esi
je 0x47b7a0
lea eax, [esi*4]
mov dword [ebp - 0x68c], 0
push eax
call fcn.004a3bb6
mov ecx, dword [ebp - 0x688]
add esp, 4
mov edi, eax
mov edx, esi
lea eax, [ebp - 0x68c]
mov dword [ebp - 0x690], edi
push eax
push edi
call fcn.0049cb40
mov esi, dword [ebp - 0x68c]
add esp, 8
mov dword [ebp - 0x6a0], esi
mov dword [ebp - 0x688], esi
test edi, edi
je 0x47b633
cmp esi, 0xffffffff
je 0x47b633
xor eax, eax
mov dword [ebp - 0x68c], eax
call fcn.0049ce00
mov dword [ebp - 0x69c], eax
test eax, eax
je 0x47b71c
mov ecx, dword [ebp - 0x694]
push ecx
lea edx, [ecx + 0x10]
mov ecx, eax
call fcn.0049d070
add esp, 4
mov dword [ebp - 0x6a4], eax
test eax, eax
je 0x47b70e
mov esi, dword [ebp - 0x688]
push esi
call fcn.004a3bb6
add esp, 4
mov edi, eax
mov dword [ebp - 0x68c], edi
push esi
push 0
push edi
call fcn.004a64e0
add esp, 0xc
push dword [ebp - 0x688]
push dword [ebp - 0x690]
push edi
call fcn.004a5f60
mov esi, dword [ebp - 0x6a4]
lea eax, [ebp - 0x688]
add esp, 0xc
push eax
push edi
push 0
push 1
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x47b6fb
push edi
call fcn.004a3611
add esp, 4
xor esi, esi
mov dword [ebp - 0x68c], esi
push dword [ebp - 0x690]
call fcn.004a3611
add esp, 4
test esi, esi
je 0x47b7a0
mov edi, dword [esi]
bswap edi
test edi, edi
je 0x47b795
push edi
call fcn.004a3bb6
mov edx, dword [ebp - 0x6a0]
lea ecx, [esi + 4]
push edi
push eax
add edx, 0xfffffffc
mov dword [ebp - 0x690], eax
call fcn.0049c840
mov eax, dword [ebp - 0x68c]
add esp, 0xc
push 1
push eax
call fcn.004a3815
mov eax, dword [ebp - 0x690]
add esp, 8
test eax, eax
je 0x47b7a0
test edi, edi
je 0x47b7a0
mov ecx, dword [ebp - 0x6a8]
test ecx, ecx
je 0x47b78a
mov edx, dword [ebp - 0x698]
mov esi, dword [edx]
cmp edi, esi
ja 0x47b788
mov byte [ebp - 0x681], 1
test ecx, ecx
jne 0x47b727
call fcn.004a93fd
mov dword [eax], 0x16
call fcn.004a92f4
mov eax, dword [ebp - 0x698]
mov dword [eax], edi
mov eax, dword [ebp - 0x690]
push eax
call fcn.004a3611
add esp, 4
jmp 0x47b7a0
mov eax, dword [ebp - 0x688]
push esi
mov dword [ebp - 0x6a0], eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push dword [ebp - 0x69c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov esi, dword [ebp - 0x68c]
jmp 0x47b63b
cmp esi, edi
jb 0x47b74f
push edi
push eax
push ecx
call fcn.004a5f60
mov eax, dword [ebp - 0x698]
add esp, 0xc
mov dword [eax], edi
mov eax, dword [ebp - 0x690]
push eax
call fcn.004a3611
add esp, 4
jmp 0x47b7a0
push esi
push 0
push ecx
call fcn.004a64e0
add esp, 0xc
cmp esi, edi
jae 0x47b76f
call fcn.004a93fd
mov dword [eax], 0x22
call fcn.004a92f4
mov eax, dword [ebp - 0x698]
mov dword [eax], edi
mov eax, dword [ebp - 0x690]
push eax
call fcn.004a3611
add esp, 4
jmp 0x47b7a0
mov dword [edx], edi
push eax
call fcn.004a3611
add esp, 4
jmp 0x47b7a0
push 1
push esi
call fcn.004a3815
add esp, 8
push 0x30
push dword [ebp - 0x694]
call fcn.004a3815
add esp, 8
mov byte [ebp - 4], 6
mov esi, dword [ebp - 0x6c8]
test esi, esi
je 0x47b7d1
mov edi, dword [ebp - 0x6cc]
push esi
mov esi, dword [esi + 4]
call edi
add esp, 4
test esi, esi
jne 0x47b7c4
cmp byte [ebp - 0x1c], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x47b7fa
mov eax, dword [ebp - 0x130]
lea ecx, [ebp - 0x12c]
cmp eax, ecx
je 0x47b7fa
push eax
call fcn.004ac7ec
add esp, 4
cmp byte [ebp - 0x144], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x47b826
mov eax, dword [ebp - 0x258]
lea ecx, [ebp - 0x254]
cmp eax, ecx
je 0x47b826
push eax
call fcn.004ac7ec
add esp, 4
mov byte [ebp - 4], 7
test ebx, ebx
je 0x47b841
mov esi, dword [ebp - 0x6b4]
push ebx
mov ebx, dword [ebx + 4]
call esi
add esp, 4
test ebx, ebx
jne 0x47b834
mov eax, dword [ebp - 0x468]
lea ecx, [ebp - 0x464]
cmp eax, ecx
je 0x47b85a
push eax
call fcn.004ac7ec
add esp, 4
mov ecx, dword [ebp - 0x678]
lea eax, [ebp - 0x674]
cmp ecx, eax
je 0x47b873
push ecx
call fcn.004ac7ec
add esp, 4
mov al, byte [ebp - 0x681]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a35cb
mov esp, ebp
pop ebp
ret