Function at 0x100f867
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push 0x84
mov eax, 0x10121a2
call fcn.01010a4e
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0xc]
mov edi, ecx
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x68], ebx
push ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x78], ebx
call fcn.0100ed3b
mov esi, eax
cmp esi, ebx
jl 0x100fbb2
push dword [edi + 0x38]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
lea ecx, [ebp - 0x78]
push ecx
lea ecx, [ebp - 0x64]
push ecx
mov dword [ebp - 0x78], eax
push dword [ebp - 0x78]
mov eax, dword [edi + 0x38]
push eax
mov ecx, edi
call fcn.0100ee26
mov esi, eax
cmp esi, ebx
jge 0x100f8fa
push esi
push 0x10035d0
push 0x316
push 0x1003278
push 0x1001570
mov ecx, 0x10156c0
call fcn.01011507
jmp 0x100fb84
lea esi, [edi + 0x28]
push esi
push ebx
push ebx
push dword [ebp - 0x78]
push dword [ebp - 0x64]
push dword [edi + 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x100f936
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x100f927
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
push 0x10035d0
push 0x321
jmp 0x100f8e1
mov eax, dword [ebp - 0x6c]
add edi, 0x2c
push edi
push 1
push 0x6602
push dword [eax + 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptGenKey]
test eax, eax
jne 0x100f977
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x100f965
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
push 0x10035d0
push 0x32e
jmp 0x100f8e1
mov ecx, dword [ebp - 0x6c]
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x7c]
push eax
push 1
push dword [esi]
push dword [edi]
call fcn.0100f4c9
mov esi, eax
cmp esi, ebx
jge 0x100f9a6
push esi
push 0x10035d0
push 0x338
jmp 0x100f8e1
mov eax, dword [ebp - 0x80]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x100f9ac
mov esi, dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x70]
push eax
push ebx
push ebx
push 1
push ebx
push dword [edi]
call esi
test eax, eax
jne 0x100fa03
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x100f9f1
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
push 0x10035d0
push 0x350
jmp 0x100f8e1
cmp dword [ebp - 0x64], ebx
je 0x100fa12
push dword [ebp - 0x64]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push dword [ebp - 0x70]
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
mov dword [ebp - 0x64], eax
cmp eax, ebx
jne 0x100fa38
mov esi, 0x8007000e
push esi
push 0x10035d0
push 0x359
jmp 0x100f8e1
push dword [ebp - 0x70]
push ebx
push eax
call sub.msvcrt.dll_memset
push dword [ebp - 0x84]
push dword [ebp - 0x80]
push dword [ebp - 0x64]
call sub.msvcrt.dll_memcpy
add esp, 0x18
push dword [ebp - 0x70]
lea eax, [ebp - 0x84]
push eax
push dword [ebp - 0x64]
push ebx
push 1
push ebx
push dword [edi]
call esi
test eax, eax
jne 0x100fa95
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x100fa83
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
push 0x10035d0
push 0x368
jmp 0x100f8e1
mov ecx, dword [ebp - 0x6c]
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x70]
push dword [ebp - 0x64]
call fcn.0100f17f
mov esi, eax
cmp esi, ebx
jge 0x100fac4
push esi
push 0x10035d0
push 0x36f
jmp 0x100f8e1
mov eax, dword [ebp - 0x88]
cmp eax, ebx
je 0x100fb12
add eax, 2
push eax
push 0x10035c4
lea eax, [ebp - 0x60]
push 0x28
push eax
call fcn.01009e2c
mov esi, eax
add esp, 0x10
cmp esi, ebx
jge 0x100fafb
push esi
push 0x10035d0
push 0x37a
jmp 0x100f8e1
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x68]
call fcn.0100827f
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x68]
call fcn.0100d068
mov eax, dword [ebp - 0x90]
cmp eax, ebx
je 0x100fb76
add eax, 2
push eax
push 0x10035b8
lea eax, [ebp - 0x60]
push 0x28
push eax
call fcn.01009e2c
mov esi, eax
add esp, 0x10
cmp esi, ebx
jge 0x100fb49
push esi
push 0x10035d0
push 0x38c
jmp 0x100f8e1
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x68]
call fcn.0100f159
mov esi, eax
cmp esi, ebx
jge 0x100fb6b
push esi
push 0x10035d0
push 0x392
jmp 0x100f8e1
push dword [ebp - 0x74]
lea ecx, [ebp - 0x68]
call fcn.0100d068
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x68], ebx
mov dword [ecx], eax
cmp dword [ebp - 0x64], ebx
je 0x100fb93
push dword [ebp - 0x64]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
cmp dword [ebp - 0x7c], ebx
je 0x100fba1
push dword [ebp - 0x7c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp dword [ebp - 0x74], ebx
je 0x100fbaf
push dword [ebp - 0x74]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov edi, dword [ebp - 0x6c]
mov eax, dword [edi + 0x28]
mov edi, dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
cmp eax, ebx
je 0x100fbc2
push eax
call edi
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax + 0x2c]
cmp eax, ebx
je 0x100fbcf
push eax
call edi
push dword [ebp - 0x68]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, esi
call fcn.01010ae0
ret 8