Function at 0x441f90
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5abe38
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x62c2a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
xor ebx, ebx
mov dword [ebp - 0x30], 1
xor esi, esi
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 2
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x14], 0x10
mov ecx, dword [edi + 0x10]
jb 0x441fff
mov eax, dword [edi]
mov dword [ebp + 0xc], eax
jmp 0x442002
mov dword [ebp + 0xc], edi
mov eax, 0x17
mov edx, 0x5fe0d4
cmp ecx, eax
cmovb eax, ecx
mov ecx, dword [ebp + 0xc]
push eax
call fcn.004188f0
mov ecx, dword [edi + 0x10]
add esp, 4
test eax, eax
jne 0x442033
cmp ecx, 0x17
jb 0x442033
cmp ecx, 0x17
setne al
test eax, eax
je 0x442080
cmp dword [edi + 0x14], 0x10
jb 0x442040
mov eax, dword [edi]
mov dword [ebp + 0xc], eax
jmp 0x442043
mov dword [ebp + 0xc], edi
mov eax, 0x17
mov edx, 0x5fed08
cmp ecx, eax
cmovb eax, ecx
mov ecx, dword [ebp + 0xc]
push eax
call fcn.004188f0
add esp, 4
test eax, eax
jne 0x44210e
mov ecx, dword [edi + 0x10]
cmp ecx, 0x17
jb 0x44210e
cmp ecx, 0x17
setne al
test eax, eax
jne 0x44210e
mov ebx, dword [ebp - 0x10]
lea eax, [ebp - 0x38]
push eax
push edi
push 0x40
push 2
mov ecx, ebx
mov dword [ebp + 0xc], 5
call fcn.00442670
cmp dword [edi + 0x14], 0x10
mov esi, dword [edi + 0x10]
jb 0x4420a7
mov ecx, dword [edi]
jmp 0x4420a9
mov ecx, edi
cmp esi, 0x17
mov eax, 0x17
mov edx, 0x5fe0d4
cmovb eax, esi
push eax
call fcn.004188f0
add esp, 4
test eax, eax
jne 0x4420f0
cmp esi, 0x17
jb 0x4420f0
cmp esi, 0x17
setne al
test eax, eax
jne 0x4420f0
lea eax, [ebp - 0x28]
mov ecx, ebx
push eax
push edi
push 0x28
push 1
call fcn.00442670
mov esi, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x38]
jmp 0x4421ea
lea eax, [ebp - 0x28]
mov ecx, ebx
push eax
push edi
push 0x80
push 1
call fcn.00442670
mov esi, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x38]
jmp 0x4421ea
mov edx, 0x5fe3b8
mov ecx, edi
call fcn.0041b0a0
test al, al
je 0x442142
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x38]
push eax
push edi
push 0x40
push 2
mov dword [ebp + 0xc], 3
call fcn.00442670
lea eax, [ebp - 0x28]
push eax
push edi
push 0xc0
jmp 0x442174
mov edx, 0x5febf0
mov ecx, edi
call fcn.0041b0a0
test al, al
je 0x442186
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x38]
push eax
push edi
push 0x40
push 2
mov dword [ebp + 0xc], 2
call fcn.00442670
lea eax, [ebp - 0x28]
push eax
push edi
push 0x80
mov ecx, dword [ebp - 0x10]
push 1
call fcn.00442670
mov esi, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x38]
jmp 0x4421ea
mov edx, 0x5fec08
mov ecx, edi
call fcn.0041b0a0
test al, al
jne 0x4421bb
mov edx, 0x5febd4
mov ecx, edi
call fcn.0041b0a0
test al, al
jne 0x4421bb
push 0x6256a0
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0xa
push eax
call fcn.00586852
mov edx, 0x5fec08
mov dword [ebp + 0xc], 4
mov ecx, edi
call fcn.0041b0a0
mov ecx, dword [ebp - 0x10]
test al, al
lea eax, [ebp - 0x28]
push eax
push edi
je 0x4421de
push 0x28
jmp 0x4421e3
push 0x80
push 1
call fcn.00442670
mov edi, dword [ebp - 0x28]
lea ecx, [ebp - 0x18]
push 1
push ebx
push dword [ebp - 0x24]
push edi
push dword [ebp + 0xc]
call fcn.004329c0
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
add eax, 4
push eax
push ecx
push 0
push 1
push 0
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
mov eax, dword [ebp - 0x14]
jne 0x44229b
test eax, eax
je 0x44222a
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x44223a
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test edi, edi
je 0x442260
mov ecx, dword [ebp - 0x1c]
mov eax, edi
test ecx, ecx
je 0x442250
mov byte [eax], 0
lea eax, [eax + 1]
dec ecx
jne 0x442247
push edi
call fcn.00582cf0
add esp, 4
mov dword [ebp - 0x28], 0
test ebx, ebx
je 0x442282
mov eax, ebx
test esi, esi
je 0x442279
lea ebx, [ebx]
mov byte [eax], 0
lea eax, [eax + 1]
dec esi
jne 0x442270
push ebx
call fcn.00582cf0
add esp, 4
mov eax, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test eax, eax
je 0x4422a6
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4422b6
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test edi, edi
je 0x4422dc
mov ecx, dword [ebp - 0x1c]
mov eax, edi
test ecx, ecx
je 0x4422cc
mov byte [eax], 0
lea eax, [eax + 1]
dec ecx
jne 0x4422c3
push edi
call fcn.00582cf0
add esp, 4
mov dword [ebp - 0x28], 0
test ebx, ebx
je 0x4422f8
mov eax, ebx
test esi, esi
je 0x4422ef
mov byte [eax], 0
lea eax, [eax + 1]
dec esi
jne 0x4422e6
push ebx
call fcn.00582cf0
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8