Function at 0x402270
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x477f38
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x49a324]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp + 8]
xor eax, eax
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x2c], ecx
test ecx, ecx
je 0x402661
test ebx, ebx
je 0x402661
cmp dword [ebp + 0x14], eax
je 0x40230e
push ebx
push ecx
lea eax, [ebp - 0x50]
push eax
call fcn.00402a70
push eax
mov ecx, edi
call fcn.004014b0
mov edx, dword [ebp - 0x3c]
cmp edx, 0x10
jb 0x402387
mov ecx, dword [ebp - 0x50]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x402302
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402683
push edx
push ecx
call fcn.0045edf2
add esp, 8
jmp 0x402387
mov edx, dword [edi + 0x10]
cmp ebx, edx
ja 0x402328
mov dword [edi + 0x10], ebx
mov eax, edi
cmp dword [edi + 0x14], 0x10
jb 0x402322
mov eax, dword [edi]
mov byte [ebx + eax], 0
jmp 0x402372
mov esi, dword [edi + 0x14]
mov ecx, ebx
mov eax, esi
sub ecx, edx
sub eax, edx
mov dword [ebp - 0x24], ecx
cmp ecx, eax
ja 0x40235e
mov dword [edi + 0x10], ebx
mov eax, edi
cmp esi, 0x10
jb 0x402346
mov eax, dword [edi]
push ecx
lea esi, [eax + edx]
push 0
push esi
call fcn.00461a60
mov eax, dword [ebp - 0x24]
add esp, 0xc
mov byte [esi + eax], 0
jmp 0x40236f
push ecx
push ecx
mov byte [ebp - 0x24], 0
push dword [ebp - 0x24]
push ecx
mov ecx, edi
call fcn.00401ca0
mov ecx, dword [ebp - 0x2c]
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x40237c
mov eax, dword [edi]
push ebx
push ecx
push eax
call fcn.00460f60
add esp, 0xc
mov ecx, dword [ebp - 0x38]
xor edx, edx
mov esi, dword [edi + 0x10]
mov eax, esi
mov ecx, dword [ecx + 8]
div ecx
test edx, edx
jne 0x402661
xorps xmm0, xmm0
mov dword [ebp - 0x14], edx
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], edx
mov eax, edi
cmp dword [edi + 0x14], 0x10
jb 0x4023bf
mov eax, dword [edi]
lea edx, [ebp - 0x1c]
push edx
push ecx
push esi
push eax
call fcn.004026b0
mov esi, eax
test esi, esi
je 0x402412
cmp dword [edi + 0x14], 0x10
mov eax, edi
mov dword [edi + 0x10], 0
jb 0x4023e2
mov eax, dword [edi]
mov byte [eax], 0
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
cmp eax, edx
je 0x4023fb
add ecx, dword [eax + 0x10]
add eax, 0x18
cmp eax, edx
jne 0x4023f1
push 0xe32ba4
push ecx
call fcn.0045ee09
add esp, 8
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x40241f
xor esi, esi
lea ecx, [ebp - 0x1c]
call fcn.00401c20
jmp 0x402663
xor ecx, ecx
mov eax, 0x2aaaaaab
mov dword [ebp - 0x34], ecx
xor ebx, ebx
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x1c]
imul ecx
mov dword [ebp - 0x30], ebx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x4024db
xor esi, esi
mov dword [ebp - 0x24], esi
nop dword [eax + eax]
mov ebx, dword [ebp - 0x1c]
add ebx, esi
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x20], eax
mov eax, ebx
cmp dword [ebx + 0x14], 0x10
jb 0x402465
mov eax, dword [ebx]
lea ecx, [ebp - 0x20]
push ecx
push eax
mov eax, dword [ebp - 0x38]
push 0
push 0
push 0
push dword [eax + 4]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov esi, eax
mov dword [ebp - 0x28], esi
test esi, esi
je 0x40262b
cmp dword [ebx + 0x14], 0x10
jb 0x402491
mov ebx, dword [ebx]
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
push esi
push ebx
mov ebx, dword [ebp - 0x30]
add eax, ebx
push eax
call fcn.00460f60
mov ecx, dword [ebp - 0x18]
mov eax, 0x2aaaaaab
sub ecx, dword [ebp - 0x1c]
add ebx, esi
mov esi, dword [ebp - 0x24]
add esp, 0xc
inc dword [ebp - 0x34]
add esi, 0x18
imul ecx
mov dword [ebp - 0x30], ebx
sar edx, 2
mov eax, edx
mov dword [ebp - 0x24], esi
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 0x34], eax
jb 0x402450
mov esi, dword [ebp - 0x28]
test esi, esi
je 0x40262b
mov ecx, dword [edi + 0x10]
cmp ebx, ecx
ja 0x4024fd
mov dword [edi + 0x10], ebx
mov eax, edi
cmp dword [edi + 0x14], 0x10
jb 0x4024f7
mov eax, dword [edi]
mov byte [eax + ebx], 0
jmp 0x402542
mov edx, dword [edi + 0x14]
sub ebx, ecx
mov eax, edx
sub eax, ecx
cmp ebx, eax
ja 0x40252e
mov eax, dword [ebp - 0x30]
mov dword [edi + 0x10], eax
mov eax, edi
cmp edx, 0x10
jb 0x402519
mov eax, dword [edi]
push ebx
lea esi, [eax + ecx]
push 0
push esi
call fcn.00461a60
add esp, 0xc
mov byte [esi + ebx], 0
jmp 0x40253f
push ecx
push ebx
mov byte [ebp - 0x24], 0
mov ecx, edi
push dword [ebp - 0x24]
push ebx
call fcn.00401ca0
mov ebx, dword [ebp - 0x30]
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x40254c
mov eax, dword [edi]
push ebx
push dword [ebp - 0x2c]
push eax
call fcn.00460f60
mov esi, dword [edi + 0x10]
xor eax, eax
add esp, 0xc
mov dword [ebp - 0x28], eax
test esi, esi
je 0x402624
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
cmp eax, 5
ja case.default.0x402578
jmp dword [eax*4 + 0x402694]
mov esi, 1
jmp 0x40262b
cmp dword [edi + 0x14], 0x10
mov ebx, edi
jb 0x402593
mov ebx, dword [edi]
test esi, esi
je 0x4025e6
push esi
push 0
push ebx
call fcn.00477dd0
mov edx, eax
add esp, 0xc
test edx, edx
je 0x4025e6
sub edx, ebx
cmp edx, 0xffffffff
je 0x4025e6
cmp esi, edx
jb 0x402688
mov eax, esi
mov ebx, esi
sub eax, edx
cmp eax, esi
cmovb ebx, eax
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x4025cd
mov eax, dword [edi]
sub esi, ebx
lea ecx, [eax + edx]
mov dword [edi + 0x10], esi
lea eax, [ecx + ebx]
sub esi, edx
inc esi
push esi
push eax
push ecx
call fcn.004614e0
add esp, 0xc
mov esi, 1
jmp 0x40262b
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x4025f7
mov eax, dword [edi]
movsx eax, byte [eax + esi - 1]
mov ecx, esi
sub ecx, eax
js case.default.0x402578
cmp ecx, esi
jae case.default.0x402578
ja 0x40268d
mov dword [edi + 0x10], ecx
mov eax, edi
cmp dword [edi + 0x14], 0x10
jb 0x402619
mov eax, dword [edi]
mov byte [eax + ecx], 0
mov esi, 1
jmp 0x40262b
xor esi, esi
jmp 0x40262b
mov esi, dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.0045edbd
add esp, 4
test esi, esi
jne 0x402652
cmp dword [edi + 0x14], 0x10
mov dword [edi + 0x10], esi
jb 0x402645
mov edi, dword [edi]
lea ecx, [ebp - 0x1c]
mov byte [edi], 0
call fcn.00401c20
jmp 0x402663
lea ecx, [ebp - 0x1c]
mov esi, 1
call fcn.00401c20
jmp 0x402663
xor esi, esi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045edac
mov esp, ebp
pop ebp
ret 0x10
call fcn.00463b59
call fcn.00401740
call fcn.00401740
nop
jg 0x4026bb
inc eax
add byte [ecx - 0x12ffbfdb], cl
and eax, 0x25ed0040
inc eax
add ch, ch
and eax, 0x25ed0040
inc eax
add ah, cl
int3