Function at 0x103c005
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x1079e94]
and dword [ebp - 0x28], 0
and dword [ebp - 0x24], 0
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x1c]
inc dword [eax + 4]
mov esi, ebx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x28]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x14]
push eax
movsd dword es:[edi], dword [esi]
call fcn.01054749
mov esi, eax
test esi, esi
je 0x103c064
push esi
push 0x19490139
call fcn.01053610
jmp 0x103c46b
mov eax, dword [ebp + 0x14]
add eax, 0xfffffff0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
add ebx, 0x10
push 1
mov dword [ebp - 0x18], ebx
call fcn.0103ad42
mov esi, eax
test esi, esi
je 0x103c094
push esi
push 0x19510139
jmp 0x103c05a
mov eax, dword [ebp - 0x20]
shr eax, 1
lea eax, [eax + eax + 2]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
jne 0x103c0b9
mov esi, 0x8007000e
push esi
push 0x19590139
jmp 0x103c05a
mov ecx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x18]
mov eax, ecx
shr ecx, 2
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x20]
shr eax, 1
xor edi, edi
mov word [ebx + eax*2], di
cmp dword [0x107b258], edi
je 0x103c10f
push 0x100c9e4
call fcn.0105b329
mov dword [esp], 0x8d4
call fcn.01052a94
push eax
call fcn.0105b329
push dword [ebp - 0x28]
push ebx
push 0x100c9c8
call fcn.0105b329
add esp, 0x10
mov eax, dword [ebp - 0x20]
add dword [ebp - 0x18], eax
sub dword [ebp - 0x1c], eax
je 0x103c469
cmp dword [0x107b258], edi
mov ebx, 0x1003410
je 0x103c132
push ebx
call fcn.0105b329
pop ecx
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
call fcn.0103ad42
mov esi, eax
cmp esi, edi
jne 0x103c4ab
cmp dword [0x107b258], 1
jle 0x103c16f
push ebx
call fcn.0105b329
pop ecx
push dword [ebp - 0x38]
mov eax, 0x1009588
push eax
push eax
push 1
call fcn.01035fd9
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 1
call fcn.0103ad42
mov esi, eax
cmp esi, edi
jne 0x103c4b6
cmp dword [0x107b274], edi
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x30], eax
je 0x103c1bc
push ebx
call fcn.0105b329
pop ecx
push 0xffffffffffffffff
push dword [ebp - 0x30]
push esi
call fcn.0103b7ac
mov esi, eax
cmp esi, edi
jne 0x103c4c1
mov eax, dword [ebp - 0x20]
add dword [ebp - 0x18], eax
sub dword [ebp - 0x1c], eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
call fcn.0103ad42
mov esi, eax
cmp esi, edi
jne 0x103c4cc
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
call fcn.0103ad42
mov esi, eax
cmp esi, edi
jne 0x103c4d7
cmp dword [0x107b258], edi
je 0x103c223
lea eax, [ebp - 0x58]
push eax
push edi
push 0x20f
call fcn.0102591e
cmp eax, edi
je 0x103c223
push eax
push 0x19a60139
call fcn.01053610
mov eax, dword [ebp - 0x34]
push 8
pop edi
test dword [ebp - 0x38], edi
jne 0x103c25b
inc dword [eax + 8]
cmp dword [0x107b258], 0
je 0x103c45e
push 0x8a9
call fcn.01052a94
push eax
call fcn.0105b329
push ebx
call fcn.0105b329
pop ecx
pop ecx
jmp 0x103c45e
inc dword [eax + 0xc]
inc dword [eax + 0x20]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 1
call fcn.0103ad42
mov esi, eax
test esi, esi
jne 0x103c4e2
cmp dword [0x107b258], 1
jle 0x103c2a0
push 0x100c9bc
call fcn.0105b329
pop ecx
push edi
push dword [ebp - 0x18]
push 0xe04
call fcn.01052b92
cmp dword [ebp + 0x18], 0
je 0x103c2ca
push 0
push dword [ebp - 0x18]
push 1
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
jne 0x103c2ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x103c4ed
add dword [ebp - 0x18], edi
sub dword [ebp - 0x1c], edi
sub dword [ebp - 0x20], edi
cmp dword [0x107b258], 1
jle 0x103c309
push ebx
call fcn.0105b329
mov dword [esp], 0x8d5
call fcn.01052a94
push eax
call fcn.0105b329
push ebx
call fcn.0105b329
pop ecx
pop ecx
push dword [ebp - 0x20]
push dword [ebp - 0x18]
push 0
call fcn.01052b92
cmp dword [ebp + 0x18], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x44], eax
je 0x103c455
push eax
push 0
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov dword [ebp - 0x24], eax
je 0x103c4f8
mov ecx, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x18]
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x20]
push ecx
push eax
xor ebx, ebx
push ebx
push 1
push ebx
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x103c374
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x19f50139
call fcn.01053610
jmp 0x103c438
cmp dword [0x107b258], 1
jle 0x103c3b2
mov esi, 0x1003410
push esi
call fcn.0105b329
mov dword [esp], 0x8d6
call fcn.01052a94
push eax
call fcn.0105b329
push esi
call fcn.0105b329
pop ecx
pop ecx
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push 0x1000
call fcn.01024ccd
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0xa400
push dword [ebp - 0x2c]
push dword [ebp - 0x24]
call fcn.0103aef0
mov esi, eax
cmp esi, ebx
jne 0x103c508
mov esi, dword [ebp - 0x50]
mov edi, dword [ebp - 0x4c]
push ebx
push 1
push esi
push edi
push dword [ebp - 0x30]
push dword [ebp - 0x3c]
call fcn.0103b584
cmp eax, ebx
je 0x103c3f9
push eax
push 0x1a130139
call fcn.01053610
push dword [ebp - 0x34]
push ebx
push esi
push edi
push dword [ebp - 0x30]
push dword [ebp - 0x3c]
push dword [ebp - 0x48]
push dword [ebp - 0x40]
call fcn.0103bd37
cmp eax, ebx
je 0x103c424
push 0x80090006
push eax
push 0x1a1e0139
call fcn.0105362d
cmp esi, ebx
mov eax, edi
je 0x103c431
mov byte [eax], 0
inc eax
dec esi
jne 0x103c42a
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0x2c]
cmp ecx, ebx
mov eax, dword [ebp - 0x24]
je 0x103c449
mov byte [eax], 0
inc eax
dec ecx
jne 0x103c442
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x24], ebx
mov eax, dword [ebp - 0x44]
add dword [ebp - 0x18], eax
sub dword [ebp - 0x1c], eax
xor edi, edi
cmp dword [ebp - 0x1c], edi
ja 0x103c11e
xor esi, esi
cmp dword [ebp - 0x28], 0
je 0x103c47a
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x24], 0
je 0x103c49a
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
mov eax, dword [ebp - 0x24]
je 0x103c491
mov byte [eax], 0
inc eax
dec ecx
jne 0x103c48a
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.0104b509
leave
ret 0x18
push esi
push 0x19760139
jmp 0x103c05a
push esi
push 0x19830139
jmp 0x103c05a
push esi
push 0x198d0139
jmp 0x103c05a
push esi
push 0x199a0139
jmp 0x103c05a
push esi
push 0x19a10139
jmp 0x103c05a
push esi
push 0x19bb0139
jmp 0x103c05a
push esi
push 0x19d30139
jmp 0x103c05a
mov esi, 0x8007000e
push esi
push 0x19ef0139
jmp 0x103c05a
push esi
push 0x1a0a0139
jmp 0x103c05a