Function at 0x474440
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 8]
push edi
push ebx
push 0xb7
push str..._rsautil.c
push str._s___d_:_File__s___
mov dword [ebp - 0xc], edx
mov edi, 0xffffffe9
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 1
call fcn.00473420
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
lea edx, [ebp - 8]
call fcn.004734e0
add esp, 0x14
test eax, eax
je 0x474641
push esi
push 0x2e
push ebx
call fcn.0059fab0
mov esi, dword [ebp - 8]
add esp, 8
test eax, eax
je 0x47461a
xor ecx, ecx
mov word [eax], cx
cmp dword [esi], 0x414e4157
jne 0x474609
cmp dword [esi + 4], 0x21595243
jne 0x474609
lea eax, [esi + 8]
push eax
lea ecx, [esi + 0xc]
push ecx
push 0
push 1
push 0
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x4745db
lea eax, [ebp - 4]
push eax
push ecx
push dword [esi + 8]
mov ecx, dword [ebp - 0x10]
lea eax, [esi + 0xc]
push eax
call fcn.004743d0
add esp, 0x10
test eax, eax
je 0x474631
push 0
lea eax, [ebp - 0x14]
push eax
push 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x4745c2
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
add eax, 0xfffffee8
push ecx
mov dword [ebp - 0x1c], eax
lea eax, [esi + 0x118]
push eax
push 0
push 0
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x4745a4
push dword [esi + 0x110]
lea edx, [esi + 0x118]
mov ecx, ebx
call fcn.00473470
add esp, 4
test eax, eax
je 0x47458c
push 0xc9
push str..._rsautil.c
push str._s___d_:_OK_n
call fcn.00473420
add esp, 0xc
xor edi, edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xcc
push str..._rsautil.c
push str._s___d_:_ERROR_rsautil_decryptFileWithKey___kull_m_file_writeData__0x_08x__n
jmp 0x4745ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xce
push str..._rsautil.c
push str._s___d_:_ERROR_rsautil_decryptFileWithKey___CryptDecrypt__0x_08x__n
call fcn.00473420
add esp, 0x10
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xd3
push str..._rsautil.c
push str._s___d_:_ERROR_rsautil_decryptFileWithKey___CryptDecrypt__0x_08x__n
call fcn.00473420
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xd5
push str..._rsautil.c
push str._s___d_:_ERROR_rsautil_decryptFileWithKey___ERROR:_WANACRY__magic_number_not_found_n
jmp 0x474629
push 0xd7
push str..._rsautil.c
push str._s___d_:_ERROR_rsautil_decryptFileWithKey___ERROR:_no_._at_the_end_of_the_user_file___n
call fcn.00473420
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xda
push str..._rsautil.c
push str._s___d_:_ERROR_rsautil_decryptFileWithKey___kull_m_file_readData__0x_08x__n
call fcn.00473420
add esp, 0x10
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret