Function at 0x45f6d0
Capabilities:
Create new key via cryptacquirecontext
Encrypt or decrypt via wincrypt

Disassembly:
push 0xffffffffffffffff
push 0x4db1eb
mov eax, dword fs:[0]
push eax
mov eax, 0x190
call fcn.00468d20
mov eax, dword [0x5808f0]
xor eax, esp
mov dword [esp + 0x18c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5808f0]
xor eax, esp
push eax
lea eax, [esp + 0x1a4]
mov dword fs:[0], eax
xor ebx, ebx
xor eax, eax
mov esi, ecx
mov dword [esp + 0x148], 7
mov dword [esp + 0x144], ebx
mov word [esp + 0x134], ax
lea ecx, [esp + 0x14c]
mov dword [esp + 0x1ac], ebx
call fcn.00424cc0
mov dword [esp + 0x30], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x2c], vtable.dwcl::AES.0
xor eax, eax
lea ecx, [esp + 0x14]
push ecx
mov byte [esp + 0x1b0], 2
mov byte [esp + 0x174], bl
mov dword [esp + 0x175], eax
mov dword [esp + 0x179], eax
mov dword [esp + 0x17d], eax
mov word [esp + 0x181], ax
mov byte [esp + 0x183], al
mov byte [esp + 0x184], bl
mov dword [esp + 0x185], eax
mov dword [esp + 0x189], eax
mov dword [esp + 0x18d], eax
mov word [esp + 0x191], ax
mov byte [esp + 0x193], al
call fcn.0041ae00
add esp, 4
test eax, eax
jne 0x45f838
push 0x4e4598
call fcn.0041a700
mov eax, dword [esp + 0x34]
add esp, 4
mov dword [esp + 0x2c], vtable.dwcl::AbstractCipher.0
cmp eax, ebx
je 0x45f7ed
push eax
call fcn.004690f0
add esp, 4
mov dword [esp + 0x30], ebx
mov eax, dword [esp + 0x38]
cmp eax, ebx
je 0x45f802
push eax
call fcn.004690f0
add esp, 4
mov dword [esp + 0x38], ebx
lea ecx, [esp + 0x14c]
mov byte [esp + 0x1ac], bl
call fcn.00424ce0
cmp dword [esp + 0x148], 8
jb 0x45fd83
mov edx, dword [esp + 0x134]
push edx
call fcn.004699ce
add esp, 4
jmp 0x45fd83
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push 0x10
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push ebx
lea ebp, [esi + 0x24]
push ebp
call edi
push 8
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push ebx
push ebp
call edi
test eax, eax
jne 0x45f8fd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_acquiring_context__0x_X__n
push 0x3ff
push 0x584090
call fcn.00469c7b
push 0x584090
call fcn.0041a5a0
mov eax, dword [esp + 0x28]
push eax
call fcn.004690f0
mov eax, dword [esp + 0x48]
add esp, 0x18
mov dword [esp + 0x2c], vtable.dwcl::AbstractCipher.0
cmp eax, ebx
je 0x45f8b2
push eax
call fcn.004690f0
add esp, 4
mov dword [esp + 0x30], ebx
mov eax, dword [esp + 0x38]
cmp eax, ebx
je 0x45f8c7
push eax
call fcn.004690f0
add esp, 4
mov dword [esp + 0x38], ebx
lea ecx, [esp + 0x14c]
mov byte [esp + 0x1ac], bl
call fcn.00424ce0
cmp dword [esp + 0x148], 8
jb 0x45fd83
mov ecx, dword [esp + 0x134]
push ecx
call fcn.004699ce
add esp, 4
jmp 0x45fd83
mov eax, dword [esp + 0x14]
push ebx
push ebx
lea edx, [esp + 0x20]
push edx
push ebx
push ebx
push ebx
add eax, 5
push eax
mov dword [esp + 0x34], ebx
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x45f954
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_retrieving_memory_size_for_blob__0x_X__n
push 0x3ff
push 0x584090
call fcn.00469c7b
push 0x584090
call fcn.0041a5a0
mov ecx, dword [esp + 0x28]
push ecx
call fcn.004690f0
add esp, 0x18
jmp 0x45fd5b
mov edx, dword [esp + 0x18]
push edx
call fcn.004691cd
mov edi, eax
add esp, 4
cmp edi, ebx
jne 0x45f99c
mov eax, dword [esp + 0x18]
push eax
push str.Error_allocating_0x_X_bytes_for_blob_n
push 0x3ff
push 0x584090
call fcn.00469c7b
push 0x584090
call fcn.0041a5a0
mov ecx, dword [esp + 0x28]
push ecx
call fcn.004690f0
add esp, 0x18
jmp 0x45fd5b
mov eax, dword [esp + 0x14]
push ebx
push ebx
lea edx, [esp + 0x20]
push edx
push edi
push ebx
push ebx
add eax, 5
push eax
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x45f9f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_converting_key_to_blob__0x_X__n
push 0x3ff
push 0x584090
call fcn.00469c7b
push 0x584090
call fcn.0041a5a0
push edi
call fcn.004690f0
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.004690f0
add esp, 0x1c
jmp 0x45fd5b
mov edx, dword [esp + 0x18]
lea eax, [esi + 0x28]
push eax
mov eax, dword [ebp]
push ebx
push ebx
push edx
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x45fa4c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_importing_blob__0x_X__n
push 0x3ff
push 0x584090
call fcn.00469c7b
push 0x584090
call fcn.0041a5a0
push edi
call fcn.004690f0
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.004690f0
add esp, 0x1c
jmp 0x45fd5b
push edi
call fcn.004690f0
mov edx, dword [esp + 0x18]
push edx
call fcn.004690f0
mov ecx, dword [esi + 0x28]
add esp, 8
push ebx
lea eax, [esp + 0x2c]
push eax
lea edi, [esi + 0x2c]
push edi
push 8
push ecx
mov dword [esp + 0x3c], 4
call dword [sym.imp.ADVAPI32.dll_CryptGetKeyParam]
test eax, eax
jne 0x45faa4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_getting_key_size__0x_X__n
push 0x3ff
push 0x584090
call fcn.00469c7b
add esp, 0x10
jmp 0x45fd5b
shr dword [edi], 3
cmp dword [0x584064], ebx
je 0x45fabb
mov ecx, 0x4f1d20
mov eax, 0x4e2e58
jmp 0x45fac5
mov ecx, 0x4f1ce0
mov eax, str.Choose_encrypted_doc_file
lea edx, [esp + 0x130]
push edx
push ecx
push eax
mov ecx, esi
call fcn.0042bd50
test al, al
je 0x45fd5b
push str..1txt
lea ecx, [esi + 4]
call fcn.0041c900
cmp dword [esp + 0x148], 8
mov eax, dword [esp + 0x134]
jae 0x45fb03
lea eax, [esp + 0x134]
push ebx
push eax
lea ecx, [esp + 0x154]
call fcn.00424d40
lea ecx, [esp + 0x14c]
call fcn.00424740
test al, al
jne 0x45fb33
push str.Error_reading_file_for_test_n
call fcn.0041a700
add esp, 4
jmp 0x45fd5b
lea ecx, [esp + 0x14c]
call fcn.00424be0
mov ebp, dword [edi]
xor ecx, ecx
cmp edx, ecx
lea ebp, [ebp + ebp + 0x13]
jg 0x45fb63
jl 0x45fb51
cmp eax, ebp
jae 0x45fb63
push str.File_is_too_small_n
call fcn.0041a700
add esp, 4
jmp 0x45fd5b
mov ebp, 1
mov dword [esp + 0x20], ebp
jmp 0x45fb72
xor ebx, ebx
push ebx
push 2
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x158]
call fcn.00424be0
mov ecx, dword [edi]
imul ecx, ebp
add ecx, ecx
xor ebx, ebx
mov ebp, 0xfffffffd
sub ebp, ecx
mov ecx, 0xffffffff
sbb ecx, ebx
add eax, ebp
adc edx, ecx
push edx
push eax
lea ecx, [esp + 0x160]
call fcn.00424750
mov ax, word [esp + 0x1c]
cmp al, 0x3a
jne 0x45fbbc
cmp ah, al
je 0x45fbcc
mov ebp, dword [esp + 0x20]
inc ebp
cmp ebp, 2
mov dword [esp + 0x20], ebp
jle 0x45fb70
jmp 0x45fbda
mov edx, dword [edi]
imul edx, dword [esp + 0x20]
lea eax, [edx + edx + 3]
mov dword [esi + 0x30], eax
xor ebx, ebx
cmp dword [esi + 0x30], ebx
jne 0x45fbf3
push str.No_trojans_tail_found_n
call fcn.0041a700
add esp, 4
jmp 0x45fd5b
mov ecx, dword [edi]
add ecx, ecx
push ecx
call fcn.004691cd
add esp, 4
mov dword [esi + 0x34], eax
cmp eax, ebx
jne 0x45fc19
push str.Error_allocating_tail_buffer_n
call fcn.0041a700
add esp, 4
jmp 0x45fd5b
mov edx, dword [edi]
push edx
call fcn.004691cd
add esp, 4
mov dword [esi + 0x38], eax
cmp eax, ebx
jne 0x45fc3d
push str.Error_allocating_binary_tail_buffer_n
call fcn.0041a700
add esp, 4
jmp 0x45fd5b
mov eax, dword [edi]
mov ecx, dword [esi + 0x34]
push ebx
add eax, eax
push eax
push ecx
lea ecx, [esp + 0x158]
call fcn.00424be0
mov ecx, dword [esi + 0x30]
xor ebx, ebx
mov ebp, 2
sub ebp, ecx
mov ecx, ebx
sbb ecx, ebx
add eax, ebp
adc edx, ecx
push edx
push eax
lea ecx, [esp + 0x160]
call fcn.00424750
mov edx, dword [edi]
mov eax, dword [esi + 0x38]
mov ecx, dword [esi + 0x34]
push edx
push eax
push ecx
call fcn.00403440
mov ecx, dword [esi + 0x38]
mov edx, dword [edi]
add esp, 0xc
lea eax, [esp + 0x24]
push eax
push ecx
push ebx
push 1
mov dword [esp + 0x34], edx
mov edx, dword [esi + 0x28]
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x45fcd6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_decrypting_key__0x_X__n
push 0x3ff
push 0x584090
call fcn.00469c7b
push 0x584090
call fcn.0041a5a0
add esp, 0x14
jmp 0x45fd5b
mov ecx, dword [esi + 0x38]
push ebx
push 0x10
lea eax, [esp + 0x178]
push eax
add ecx, 2
push 9
push ecx
call fcn.004053e0
add esp, 0x14
push ebx
push 0x10
lea edx, [esp + 0x198]
push edx
push ebx
push ebx
lea ecx, [esp + 0x160]
call fcn.00424750
lea eax, [esp + 0x180]
push eax
lea ecx, [esp + 0x30]
call fcn.00401540
push ebx
push 0x10
lea ecx, [esp + 0x178]
push ecx
lea ecx, [esp + 0x38]
call fcn.00401b90
push 0x10
lea edx, [esp + 0x194]
push edx
mov eax, edx
push eax
lea ecx, [esp + 0x38]
call fcn.00401a30
lea ecx, [esp + 0x190]
push 0x10
push ecx
call fcn.0041a7a0
add esp, 8
mov byte [esi + 0x20], al
lea ecx, [esp + 0x2c]
call fcn.00402020
lea ecx, [esp + 0x14c]
mov byte [esp + 0x1ac], bl
call fcn.00424ce0
lea ecx, [esp + 0x130]
call fcn.0041b5b0
mov ecx, dword [esp + 0x1a4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x18c]
xor ecx, esp
call fcn.004690b5
add esp, 0x19c
ret