Function at 0x6e912210
Capabilities:
Encrypt or decrypt via wincrypt
Generate random numbers via winapi
Hash data using sha1
Initialize hashing via wincrypt

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x178
mov eax, dword [ecx + 8]
test byte [0x6e928c40], 8
mov ebx, dword [ecx]
mov esi, dword [ecx + 4]
mov dword [ebp - 0x160], eax
mov eax, dword [ecx + 0x14]
mov edi, dword [ecx + 0x10]
mov dword [ebp - 0x164], eax
mov eax, dword [ecx + 0x18]
mov dword [ebp - 0x15c], eax
jne 0x6e9124c0
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0
test ebx, ebx
je 0x6e912388
mov ecx, dword [ebp - 0x15c]
test ecx, ecx
je 0x6e912388
mov eax, dword [ebp - 0x164]
lea edx, [ebx + 4]
mov dword [esp], edi
mov ecx, dword [ebp - 0x160]
mov dword [esp + 4], eax
mov eax, ebx
call fcn.6e911ee0
test byte [0x6e928c40], 8
je 0x6e912446
test esi, esi
mov eax, 0x6e934769
je 0x6e912417
mov eax, esi
shr eax, 0x10
je 0x6e912ae0
mov dword [esp], esi
mov edx, 0xffffffff
mov dword [esp + 4], edx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
sub esp, 8
test eax, eax
jne 0x6e9129b8
cmp word [esi], 0
je 0x6e912bba
lea esi, [esi]
lea edi, [edi]
mov edx, eax
cmp word [esi + edx*2 + 2], 0
lea eax, [eax + 1]
jne 0x6e9122f0
mov dword [ebp - 0x164], ebx
mov ecx, 0x224c
mov edi, esi
mov word [ebp - 0x144], cx
lea ecx, [ebp - 0x142]
jmp 0x6e912358
cmp eax, 9
je 0x6e912a60
cmp eax, 0xa
jne 0x6e9129f5
mov word [ecx], 0x6e5c
add ecx, 2
lea esi, [esi]
lea ebx, [ebp - 0x22]
lea eax, [edx - 1]
cmp ecx, ebx
ja 0x6e9123e8
test edx, edx
jle 0x6e9123e8
mov edx, eax
movzx eax, word [edi]
add edi, 2
cmp eax, 0xd
je 0x6e912a50
jbe 0x6e912320
cmp eax, 0x22
je 0x6e912a40
cmp eax, 0x5c
jne 0x6e9129e8
mov word [ecx], 0x5c5c
add ecx, 2
jmp 0x6e912340
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x57
movzx eax, byte [0x6e928c40]
xor ebx, ebx
and al, 8
mov eax, str.FAIL
je 0x6e9123d2
mov dword [esp + 0x10], eax
mov eax, str.returning__s_n
mov dword [esp + 0xc], eax
mov eax, str.CryptProtectData
mov dword [esp + 8], eax
mov eax, 0x6e928c40
mov dword [esp + 4], eax
mov dword [esp], 3
call fcn.6e911740
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x1c
mov byte [ecx], 0x22
test eax, eax
mov ebx, dword [ebp - 0x164]
jle 0x6e912bd3
mov word [ecx + 1], 0x2e2e
lea eax, [ecx + 4]
mov byte [ecx + 3], 0x2e
mov byte [eax], 0
lea eax, [ebp - 0x144]
mov dword [esp], eax
call fcn.6e9257e0
mov dword [esp + 0x14], eax
mov eax, str._tszDataDescr:__p__s_n
mov dword [esp + 0xc], eax
mov eax, str.CryptProtectData
mov dword [esp + 8], eax
mov eax, 0x6e928c40
mov dword [esp + 0x10], esi
mov dword [esp + 4], eax
mov dword [esp], 3
call fcn.6e911740
test esi, esi
mov eax, 0x6e934822
cmove esi, eax
mov eax, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
mov dword [esp + 8], eax
xor eax, eax
mov ecx, 0xf0000000
mov dword [esp + 4], eax
lea eax, [ebp - 0x154]
mov edi, 1
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edi
mov dword [esp], eax
call sub.advapi32.dll_CryptAcquireContextW
sub esp, 0x14
test eax, eax
jne 0x6e9124f0
movzx eax, byte [0x6e928c40]
test al, 2
jne 0x6e912730
mov edx, dword fs:[0x18]
mov edx, dword [edx + 0x34]
test edx, edx
jne 0x6e91239c
mov edx, dword fs:[0x18]
mov dword [edx + 0x34], 0xd
jmp 0x6e91239c
mov dword [esp], 3
mov eax, str.called_n
mov dword [esp + 0xc], eax
mov eax, str.CryptProtectData
mov dword [esp + 8], eax
mov eax, 0x6e928c40
mov dword [esp + 4], eax
call fcn.6e911740
jmp 0x6e912257
mov eax, dword [ebp - 0x154]
test byte [0x6e928c40], 8
mov dword [ebp - 0x164], eax
jne 0x6e912778
cmp word [esi], 0
je 0x6e912bb0
mov ecx, esi
lea esi, [esi]
lea edi, [edi]
add ecx, 2
cmp word [ecx], 0
jne 0x6e912520
sub ecx, esi
lea edi, [ecx + 2]
xor edx, edx
xor eax, eax
mov dword [ebp + eax - 0x140], edx
mov dword [ebp + eax - 0x13c], edx
add eax, 8
cmp eax, 0x50
jb 0x6e912532
mov eax, 1
mov dword [ebp - 0x144], eax
lea eax, [ebp - 0x140]
call fcn.6e9113c0
mov eax, 1
mov dword [ebp - 0x138], eax
lea eax, [ebp - 0x134]
call fcn.6e9113c0
xor eax, eax
mov dword [esp], edi
mov dword [ebp - 0x12c], eax
call sym.crypt32.dll_CryptMemAlloc
mov dword [ebp - 0x128], eax
sub esp, 4
test eax, eax
je 0x6e9125a0
mov ecx, edi
mov edi, eax
cmp ecx, 8
jae 0x6e9127a8
rep movsb byte es:[edi], byte [esi]
mov eax, 0x6603
mov esi, 0xa0
mov dword [ebp - 0x124], eax
mov eax, 0xa8
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0x11c]
call fcn.6e9113c0
xor edx, edx
mov ecx, 0x8004
mov dword [esp], 0x10
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x10c], esi
call sym.crypt32.dll_CryptMemAlloc
mov dword [ebp - 0x104], eax
sub esp, 4
test eax, eax
je 0x6e912636
mov dword [esp + 8], eax
mov eax, 0x10
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x164]
mov dword [esp], eax
call sub.advapi32.dll_CryptGenRandom
sub esp, 0xc
test eax, eax
je 0x6e912a70
test byte [0x6e928c40], 8
mov esi, 0x10
mov dword [ebp - 0x108], esi
jne 0x6e912b10
mov ecx, dword [ebp - 0x13c]
xor eax, eax
xor edx, edx
mov dword [ebp - 0x100], eax
xor eax, eax
mov dword [ebp - 0xfc], eax
xor eax, eax
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xf4], edx
test ecx, ecx
je 0x6e9127e0
mov eax, dword [ebp - 0x130]
test eax, eax
je 0x6e9127e0
mov eax, dword [ebp - 0x128]
test eax, eax
je 0x6e9127e0
mov edi, dword [ebp - 0x118]
test edi, edi
je 0x6e9127e0
mov esi, dword [ebp - 0x104]
test esi, esi
je 0x6e9127e0
lea eax, [ebp - 0x14c]
mov edx, dword [ebp - 0x120]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x160]
lea ecx, [ebp - 0x108]
mov dword [esp], eax
mov eax, dword [ebp - 0x154]
call fcn.6e911a30
test eax, eax
je 0x6e912720
lea eax, [ebp - 0x150]
xor edi, edi
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 8], eax
mov eax, 0x8004
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x154]
mov dword [esp + 0xc], edi
mov dword [esp], eax
call sub.advapi32.dll_CryptCreateHash
sub esp, 0x14
test eax, eax
jne 0x6e912860
test byte [0x6e928c40], 2
jne 0x6e912c16
mov eax, dword [ebp - 0x14c]
mov dword [esp], eax
call sub.advapi32.dll_CryptDestroyKey
sub esp, 4
lea eax, [ebp - 0x144]
call fcn.6e9117d0
jmp 0x6e912828
mov ecx, str.CryptAcquireContextW_failed_n
mov ebx, str.CryptProtectData
mov dword [esp + 0xc], ecx
mov esi, 0x6e928c40
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], 1
call fcn.6e911740
mov eax, dword fs:[0x18]
mov edi, dword [eax + 0x34]
movzx eax, byte [0x6e928c40]
test edi, edi
je 0x6e9124a7
jmp 0x6e91239c
mov dword [esp], 3
mov eax, str.called_n
mov edx, 0x6e928c40
mov dword [esp + 0xc], eax
mov eax, str.fill_protect_data
mov dword [esp + 8], eax
mov dword [esp + 4], edx
call fcn.6e911740
jmp 0x6e912509
test al, 1
jne 0x6e9129d7
test edi, 2
jne 0x6e9129c2
test edi, 4
je 0x6e91259e
mov eax, dword [esi]
add edi, 4
add esi, 4
sub ecx, 4
mov dword [edi - 4], eax
jmp 0x6e91259e
test byte [0x6e928c40], 2
jne 0x6e912ab0
lea eax, [ebp - 0x144]
call fcn.6e9117d0
test byte [0x6e928c40], 2
je 0x6e912828
mov dword [esp], 1
mov eax, str.fill_protect_data_n
mov dword [esp + 0xc], eax
mov eax, str.CryptProtectData
mov dword [esp + 8], eax
mov eax, 0x6e928c40
mov dword [esp + 4], eax
call fcn.6e911740
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x154]
mov dword [esp], eax
call sub.advapi32.dll_CryptReleaseContext
movzx eax, byte [0x6e928c40]
mov edx, dword fs:[0x18]
mov edx, dword [edx + 0x34]
sub esp, 8
test edx, edx
jne 0x6e91239c
jmp 0x6e9124a7
mov eax, dword [ebx]
xor edx, edx
mov dword [ebp - 0x148], eax
xor eax, eax
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x148]
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 4]
mov dword [esp + 4], edx
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov eax, 1
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x14c]
mov dword [esp], eax
call sub.advapi32.dll_CryptEncrypt
sub esp, 0x1c
test eax, eax
jne 0x6e912bdb
mov edx, dword fs:[0x18]
cmp dword [edx + 0x34], 0xea
movzx eax, byte [0x6e928c40]
jne 0x6e912be2
and al, 8
mov edx, dword [ebp - 0x148]
jne 0x6e912c42
mov dword [esp], edx
mov dword [ebp - 0x100], edx
call sym.crypt32.dll_CryptMemAlloc
mov dword [ebp - 0xfc], eax
sub esp, 4
test eax, eax
mov edi, eax
je 0x6e912c78
mov ecx, dword [ebx]
mov esi, dword [ebx + 4]
cmp ecx, 8
jae 0x6e912cae
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx]
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x100]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x148]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0xfc]
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov eax, 1
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x150]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14c]
mov dword [esp], eax
call sub.advapi32.dll_CryptEncrypt
sub esp, 0x1c
test eax, eax
je 0x6e912ce1
mov eax, dword [ebp - 0x148]
test byte [0x6e928c40], 8
mov dword [ebp - 0x100], eax
jne 0x6e913126
mov ebx, dword [ebp - 0x150]
lea edx, [ebp - 0xf8]
mov eax, ebx
call fcn.6e911880
test eax, eax
jne 0x6e912d24
test byte [0x6e928c40], 2
jne 0x6e9131f5
mov eax, dword [ebp - 0x150]
mov dword [esp], eax
call sub.advapi32.dll_CryptDestroyHash
push esi
jmp 0x6e91270f
mov eax, 0x6e9346c7
jmp 0x6e912417
movzx eax, word [esi]
add edi, 2
add esi, 2
sub ecx, 2
mov word [edi - 2], ax
jmp 0x6e9127bc
movzx eax, byte [esi]
inc edi
inc esi
dec ecx
mov byte [edi - 1], al
jmp 0x6e9127b0
lea ebx, [eax - 0x20]
cmp bx, 0x5e
jbe 0x6e912b00
mov byte [ecx], 0x5c
mov ebx, eax
add ecx, 5
shr ebx, 0xc
movzx ebx, byte [ebx + str.0123456789abcdefreport]
mov byte [ecx - 4], bl
mov ebx, eax
shr ebx, 8
and ebx, 0xf
movzx ebx, byte [ebx + str.0123456789abcdefreport]
mov byte [ecx - 3], bl
mov ebx, eax
and eax, 0xf
shr ebx, 4
movzx eax, byte [eax + str.0123456789abcdefreport]
and ebx, 0xf
movzx ebx, byte [ebx + str.0123456789abcdefreport]
mov byte [ecx - 1], al
mov byte [ecx - 2], bl
jmp 0x6e912340
mov word [ecx], 0x225c
add ecx, 2
jmp 0x6e912340
mov word [ecx], 0x725c
add ecx, 2
jmp 0x6e912340
mov word [ecx], 0x745c
add ecx, 2
jmp 0x6e912340
test byte [0x6e928c40], 2
je 0x6e9127ed
mov dword [esp], 1
mov eax, str.fill_protect_data
mov edi, str.CryptGenRandom_n
mov dword [esp + 8], eax
mov eax, 0x6e928c40
mov dword [esp + 0xc], edi
mov dword [esp + 4], eax
call fcn.6e911740
jmp 0x6e9127ed
mov edx, str.could_not_allocate_protect_data_structures_n
mov ecx, str.fill_protect_data
mov dword [esp + 0xc], edx
mov ebx, 0x6e928c40
mov dword [esp + 8], ecx
mov dword [esp + 4], ebx
mov dword [esp], 1
call fcn.6e911740
jmp 0x6e9127ed
mov dword [esp], 0x6e9346d1
movzx eax, si
mov dword [esp + 4], eax
call fcn.6e911100
jmp 0x6e912417
mov byte [ecx], al
inc ecx
jmp 0x6e912340
mov eax, 0x10
mov edx, str.fill_protect_data
mov dword [esp + 0x14], eax
mov eax, str.pInfo__salt
mov ecx, 0x6e928c40
mov dword [esp + 0x10], eax
mov eax, str._s_cbData:__u_n
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], 3
call fcn.6e911740
test byte [0x6e928c40], 8
je 0x6e912636
mov edx, dword [ebp - 0x108]
mov esi, str.pInfo__salt
mov edi, str._s_pbData____p:_s_n
mov eax, dword [ebp - 0x104]
call fcn.6e911d50
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edi
mov dword [esp], 3
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x104]
mov dword [esp + 0x14], eax
mov eax, str.fill_protect_data
mov dword [esp + 8], eax
mov eax, 0x6e928c40
mov dword [esp + 4], eax
call fcn.6e911740
jmp 0x6e912636
mov edi, 2
jmp 0x6e91252e
mov byte [ebp - 0x142], 0x22
lea ecx, [ebp - 0x142]
mov eax, 0x224c
mov word [ebp - 0x144], ax
lea eax, [ecx + 1]
jmp 0x6e912406
movzx eax, byte [0x6e928c40]
and al, 2
je 0x6e9129a0
mov dword [esp], 1
mov eax, str.CryptProtectData
mov edi, str.CryptEncrypt_n
mov dword [esp + 8], eax
mov eax, 0x6e928c40
mov dword [esp + 0xc], edi
mov dword [esp + 4], eax
call fcn.6e911740
jmp 0x6e9129a0
mov ecx, str.CryptCreateHash_n
mov ebx, str.CryptProtectData
mov dword [esp + 0xc], ecx
mov esi, 0x6e928c40
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], 1
call fcn.6e911740
jmp 0x6e91270f
mov dword [esp + 0x10], edx
mov ecx, str.CryptProtectData
mov edx, str.required_encrypted_storage:__u_n
mov dword [esp + 0xc], edx
mov esi, 0x6e928c40
mov dword [esp + 8], ecx
mov dword [esp + 4], esi
mov dword [esp], 3
call fcn.6e911740
mov edx, dword [ebp - 0x148]
jmp 0x6e9128d6
test byte [0x6e928c40], 2
je 0x6e9129a0
mov dword [esp + 0xc], str.CryptMemAlloc_n
mov dword [esp + 8], str.CryptProtectData
mov dword [esp + 4], 0x6e928c40
mov dword [esp], 1
call fcn.6e911740
jmp 0x6e9129a0
test al, 1
jne 0x6e91325c
test edi, 2
jne 0x6e913247
test edi, 4
je 0x6e912905
mov eax, dword [esi]
add edi, 4
add esi, 4
sub ecx, 4
mov dword [edi - 4], eax
jmp 0x6e912905
test byte [0x6e928c40], 2
je 0x6e9129a0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.CryptEncrypt__u_n
mov dword [esp + 8], str.CryptProtectData
mov dword [esp + 4], 0x6e928c40
mov dword [esp + 0x10], eax
mov dword [esp], 1
call fcn.6e911740
jmp 0x6e9129a0
test byte [0x6e928c40], 8
jne 0x6e91321e
mov edi, dword [ebp - 0x128]
test edi, edi
je 0x6e912fcb
mov eax, dword [ebp - 0x13c]
test eax, eax
je 0x6e912fcb
mov eax, dword [ebp - 0x130]
test eax, eax
je 0x6e912fcb
cmp dword [ebp - 0x118], 0
je 0x6e912fcb
cmp dword [ebp - 0x104], 0
je 0x6e912fcb
cmp dword [ebp - 0xfc], 0
je 0x6e912fcb
cmp dword [ebp - 0xf4], 0
je 0x6e912fcb
cmp dword [ebp - 0x140], 0x10
je 0x6e91328e
test byte [0x6e928c40], 2
jne 0x6e91326a
mov edx, dword [ebp - 0x128]
cmp word [edx], 0
mov eax, edx
je 0x6e912dc0
add eax, 2
cmp word [eax], 0
jne 0x6e912db7
sub eax, edx
mov edx, dword [ebp - 0x11c]
mov dword [ebp - 0x160], eax
mov esi, eax
mov eax, dword [ebp - 0x134]
add eax, dword [ebp - 0x140]
lea ebx, [eax + edx + 0x36]
add ebx, dword [ebp - 0x108]
add ebx, dword [ebp - 0x100]
add ebx, dword [ebp - 0xf8]
add ebx, esi
mov esi, dword [ebp - 0x15c]
mov dword [esi], ebx
mov dword [esp + 4], ebx
mov dword [esp], 0x40
call dword [sym.imp.kernel32.dll_LocalAlloc]
push edi
test eax, eax
push edi
mov dword [esi + 4], eax
je 0x6e912fcb
mov edx, dword [ebp - 0x144]
lea esi, [eax + 4]
mov dword [ebp - 0x164], esi
mov edi, esi
mov dword [eax], edx
mov edx, dword [ebp - 0x140]
mov esi, dword [ebp - 0x13c]
cmp edx, 8
mov ecx, edx
jae 0x6e91333f
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x138]
add edx, dword [ebp - 0x164]
mov dword [edx], eax
lea eax, [edx + 4]
mov esi, eax
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x164], esi
mov edi, esi
mov esi, dword [ebp - 0x130]
cmp eax, 8
mov ecx, eax
jae 0x6e91341b
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebp - 0x12c]
mov esi, dword [ebp - 0x160]
add eax, dword [ebp - 0x164]
mov dword [eax], edx
lea edx, [esi + 2]
lea edi, [eax + 8]
cmp edx, 8
mov esi, dword [ebp - 0x128]
mov dword [ebp - 0x164], edi
mov ecx, edx
mov dword [eax + 4], edx
jae 0x6e9133e4
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x124]
add edx, dword [ebp - 0x164]
mov dword [edx], eax
lea edi, [edx + 0xc]
mov dword [ebp - 0x160], edi
mov eax, dword [ebp - 0x120]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x118]
mov dword [edx + 8], eax
cmp eax, 8
mov ecx, eax
jae 0x6e9133ad
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebp - 0x160]
add edx, eax
mov eax, dword [ebp - 0x114]
lea edi, [edx + 0x10]
mov dword [ebp - 0x160], edi
mov dword [edx], eax
mov eax, dword [ebp - 0x110]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x10c]
mov dword [edx + 8], eax
mov eax, dword [ebp - 0x108]
mov esi, dword [ebp - 0x104]
mov dword [edx + 0xc], eax
cmp eax, 8
mov ecx, eax
jae 0x6e913376
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebp - 0x160]
mov esi, dword [ebp - 0xfc]
add edx, eax
mov eax, dword [ebp - 0x100]
lea edi, [edx + 4]
mov dword [ebp - 0x160], edi
mov dword [edx], eax
cmp eax, 8
mov ecx, eax
jae 0x6e913308
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebp - 0x160]
mov esi, dword [ebp - 0xf4]
add edx, eax
mov eax, dword [ebp - 0xf8]
lea edi, [edx + 4]
mov dword [ebp - 0x160], edi
mov dword [edx], eax
cmp eax, 8
mov ecx, eax
jae 0x6e9132d1
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x15c]
add eax, dword [ebp - 0x160]
sub eax, dword [esi + 4]
cmp ebx, eax
je 0x6e913008
test byte [0x6e928c40], 2
jne 0x6e91344a
mov esi, dword [ebp - 0x15c]
mov eax, dword [esi + 4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LocalFree]
push ecx
mov dword [esi + 4], 0
mov dword [esi], 0
test byte [0x6e928c40], 2
je 0x6e9129a0
mov dword [esp + 0xc], str.serialize_n
mov dword [esp + 8], str.CryptProtectData
mov dword [esp + 4], 0x6e928c40
mov dword [esp], 1
call fcn.6e911740
jmp 0x6e9129a0
mov eax, dword [ebp - 0x150]
xor ebx, ebx
mov dword [esp], eax
call sub.advapi32.dll_CryptDestroyHash
mov eax, dword [ebp - 0x14c]
sub esp, 4
mov dword [esp], eax
call sub.advapi32.dll_CryptDestroyKey
lea eax, [ebp - 0x144]
sub esp, 4
call fcn.6e9117d0
mov eax, dword [ebp - 0x154]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.advapi32.dll_CryptReleaseContext
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0
sub esp, 8
test byte [0x6e928c40], 8
jne 0x6e913080
lea esp, [ebp - 0x10]
mov ebx, 1
pop ecx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x1c
mov edi, dword [ebp - 0x15c]
mov esi, str.pDataOut
mov eax, dword [edi]
mov dword [esp + 0x10], esi
mov dword [esp], 3
mov dword [esp + 0x14], eax
mov eax, str._s_cbData:__u_n
mov dword [esp + 0xc], eax
mov eax, str.CryptProtectData
mov dword [esp + 8], eax
mov eax, 0x6e928c40
mov dword [esp + 4], eax
call fcn.6e911740
test byte [0x6e928c40], 8
je 0x6e913062
mov edx, dword [edi]
mov ebx, 0x6e928c40
mov eax, dword [edi + 4]
call fcn.6e911d50
mov edx, str._s_pbData____p:_s_n
mov ecx, str.CryptProtectData
mov dword [esp + 0x18], eax
mov eax, dword [edi + 4]
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
mov dword [esp + 4], ebx
mov dword [esp + 0x14], eax
mov eax, str.pDataOut
mov dword [esp + 0x10], eax
mov dword [esp], 3
call fcn.6e911740
test byte [0x6e928c40], 8
je 0x6e913062
mov ebx, 1
mov eax, 0x6e934824
jmp 0x6e9123a7
mov dword [esp + 0x14], eax
mov eax, str._s_cbData:__u_n
mov edi, str.protect_data.cipher
mov dword [esp + 0xc], eax
mov eax, str.CryptProtectData
mov dword [esp + 8], eax
mov eax, 0x6e928c40
mov dword [esp + 0x10], edi
mov dword [esp + 4], eax
mov dword [esp], 3
call fcn.6e911740
test byte [0x6e928c40], 8
je 0x6e912978
mov edx, dword [ebp - 0x100]
mov ebx, str.CryptProtectData
mov esi, 0x6e928c40
mov eax, dword [ebp - 0xfc]
call fcn.6e911d50
mov edx, str.protect_data.cipher
mov ecx, str._s_pbData____p:_s_n
mov dword [esp + 8], ebx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], esi
mov dword [esp], 3
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0xfc]
mov dword [esp + 0x14], eax
call fcn.6e911740
mov ebx, dword [ebp - 0x150]
test byte [0x6e928c40], 8
je 0x6e91297e
mov dword [esp], 3
mov eax, str.called_n
mov dword [esp + 0xc], eax
mov eax, str.convert_hash_to_blob
mov dword [esp + 8], eax
mov eax, 0x6e928c40
mov dword [esp + 4], eax
call fcn.6e911740
jmp 0x6e91297e
mov dword [esp + 0xc], str.convert_hash_to_blob_n
mov dword [esp + 8], str.CryptProtectData
mov dword [esp + 4], 0x6e928c40
mov dword [esp], 1
call fcn.6e911740
jmp 0x6e9129a0
mov dword [esp + 0xc], str.called_n
mov dword [esp + 8], str.serialize
mov dword [esp + 4], 0x6e928c40
mov dword [esp], 3
call fcn.6e911740
jmp 0x6e912d31
movzx eax, word [esi]
add edi, 2
add esi, 2
sub ecx, 2
mov word [edi - 2], ax
jmp 0x6e912cc2
movzx eax, byte [esi]
inc edi
inc esi
dec ecx
mov byte [edi - 1], al
jmp 0x6e912cb6
mov dword [esp + 0xc], str.protect_data_t_info0_not_16_bytes_long_n
mov dword [esp + 8], str.serialize
mov dword [esp + 4], 0x6e928c40
mov dword [esp], 1
call fcn.6e911740
cmp dword [ebp - 0x134], 0x10
je 0x6e912da9
test byte [0x6e928c40], 2
je 0x6e912da9
mov dword [esp + 0xc], str.protect_data_t_info1_not_16_bytes_long_n
mov dword [esp + 8], str.serialize
mov dword [esp + 4], 0x6e928c40
mov dword [esp], 1
call fcn.6e911740
jmp 0x6e912da9
test edi, 1
jne 0x6e9134ff
test edi, 2
jne 0x6e9134ea
test edi, 4
je 0x6e912f89
mov edx, dword [esi]
add edi, 4
add esi, 4
sub ecx, 4
mov dword [edi - 4], edx
jmp 0x6e912f89
test edi, 1
jne 0x6e913526
test edi, 2
jne 0x6e913511
test edi, 4
je 0x6e912f5d
mov edx, dword [esi]
add edi, 4
add esi, 4
sub ecx, 4
mov dword [edi - 4], edx
jmp 0x6e912f5d
test edi, 1
jne 0x6e91354d
test edi, 2
jne 0x6e913538
test edi, 4
je 0x6e912e44
mov eax, dword [esi]
add edi, 4
add esi, 4
sub ecx, 4
mov dword [edi - 4], eax
jmp 0x6e912e44
test edi, 1
jne 0x6e9134ad
test edi, 2
jne 0x6e913498
test edi, 4
je 0x6e912f31
mov edx, dword [esi]
add edi, 4
add esi, 4
sub ecx, 4
mov dword [edi - 4], edx
jmp 0x6e912f31
test edi, 1
jne 0x6e913574
test edi, 2
jne 0x6e91355f
test edi, 4
je 0x6e912eea
mov edx, dword [esi]
add edi, 4
add esi, 4
sub ecx, 4
mov dword [edi - 4], edx
jmp 0x6e912eea
test edi, 1
jne 0x6e9134d4
test edi, 2
jne 0x6e9134bf
test edi, 4
je 0x6e912eae
mov eax, dword [esi]
add edi, 4
add esi, 4
sub ecx, 4
mov dword [edi - 4], eax
jmp 0x6e912eae
test edi, 1
jne 0x6e913489
test edi, 2
jne 0x6e913477
test edi, 4
je 0x6e912e78
mov edx, dword [esi]
add edi, 4
add esi, 4
sub ecx, 4
mov dword [edi - 4], edx
jmp 0x6e912e78
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.struct_size_changed___expected__u_n
mov dword [esp + 8], str.serialize
mov dword [esp + 4], 0x6e928c40
mov dword [esp], 1
call fcn.6e911740
jmp 0x6e912fab
movzx edx, word [esi]
add edi, 2
add esi, 2
sub ecx, 2
mov word [edi - 2], dx
jmp 0x6e91342b
movzx ecx, byte [esi]
lea edi, [edx + 5]
inc esi
mov byte [edx + 4], cl
lea ecx, [eax - 1]
jmp 0x6e913423
movzx edx, word [esi]
add edi, 2
add esi, 2
sub ecx, 2
mov word [edi - 2], dx
jmp 0x6e91338e
movzx ecx, byte [esi]
lea edi, [edx + 0x11]
inc esi
mov byte [edx + 0x10], cl
lea ecx, [eax - 1]
jmp 0x6e913382
movzx eax, word [esi]
add edi, 2
add esi, 2
sub ecx, 2
mov word [edi - 2], ax
jmp 0x6e9133fc
movzx ecx, byte [esi]
lea edi, [eax + 9]
inc esi
mov byte [eax + 8], cl
mov ecx, dword [ebp - 0x160]
inc ecx
jmp 0x6e9133f0
movzx edx, word [esi]
add edi, 2
add esi, 2
sub ecx, 2
mov word [edi - 2], dx
jmp 0x6e9132e9
movzx ecx, byte [esi]
lea edi, [edx + 5]
inc esi
mov byte [edx + 4], cl
lea ecx, [eax - 1]
jmp 0x6e9132dd
movzx edx, word [esi]
add edi, 2
add esi, 2
sub ecx, 2
mov word [edi - 2], dx
jmp 0x6e913320
movzx ecx, byte [esi]
lea edi, [edx + 5]
inc esi
mov byte [edx + 4], cl
lea ecx, [eax - 1]
jmp 0x6e913314
movzx eax, word [esi]
add edi, 2
add esi, 2
sub ecx, 2
mov word [edi - 2], ax
jmp 0x6e913357
movzx ecx, byte [esi]
lea edi, [eax + 5]
inc esi
mov byte [eax + 4], cl
lea ecx, [edx - 1]
jmp 0x6e91334b
movzx edx, word [esi]
add edi, 2
add esi, 2
sub ecx, 2
mov word [edi - 2], dx
jmp 0x6e9133c5
movzx ecx, byte [esi]
lea edi, [edx + 0xd]
inc esi
mov byte [edx + 0xc], cl
lea ecx, [eax - 1]
jmp 0x6e9133b9