Function at 0x417450
Capabilities:
Create new key via cryptacquirecontext
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt
Print debug messages
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x41a3c6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa0
mov al, byte [0x42052c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0xc0]
mov ebp, ecx
push edi
mov byte [esp + 0x2c], al
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0x2d]
push esi
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x30]
push 2
push ecx
mov ecx, ebp
call fcn.004178b0
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
xor ebx, ebx
push ebx
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
lea edx, [esp + 0x20]
push esi
push edx
call edi
test eax, eax
jne 0x4174f0
push 8
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
lea eax, [esp + 0x20]
push esi
push eax
call edi
test eax, eax
jne 0x4174e0
push 0x41fc2c
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
xor eax, eax
jmp 0x4176b2
push ebx
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
lea ecx, [esp + 0x20]
push esi
push ecx
call edi
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push ebx
push ebx
push 0x8003
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov edx, dword [esp + 0x18]
push ebx
lea ecx, [esp + 0x30]
push 0x80
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
lea eax, [esp + 0x2c]
push 0x80
push eax
mov ecx, ebp
call fcn.00417830
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x24]
push ecx
push 0x800000
push edx
push 0x6602
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
lea ecx, [esp + 0x10]
call fcn.00419ce8
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
xor ebp, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0xb8], ebx
je 0x4175c5
lea ecx, [esp + 0x1c]
call fcn.00419ce8
xor ecx, ecx
lea edx, [esp + 0x1c]
mov cl, byte [esi + ebp]
mov byte [esp + 0xb8], 1
push ecx
push 0x41fc28
push edx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x10]
push eax
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x1c]
mov byte [esp + 0xb8], bl
call sub.MFC42.DLL_CString::CString
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
inc ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ebp, ecx
jb 0x41756d
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
lea edx, [esp + 0x20]
mov dword [esp + 0x18], ebx
push edx
push 0xf003f
push ebx
push str.CLSIDE0A466DE_165D_4033_BDEC_2267EC81D1C9VersionIndependentProgID
push SysReAllocString
mov dword [esp + 0x34], ebx
mov dword [esp + 0x3c], 3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x41761a
lea ecx, [esp + 0x10]
mov dword [esp + 0xb8], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
jmp 0x4176b2
mov esi, dword [esp + 0xc0]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x20]
push 0x41fb7c
lea eax, [esp + 0x2c]
push esi
push eax
push ebx
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
je 0x417666
lea ecx, [esp + 0x10]
mov dword [esp + 0xb8], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
jmp 0x4176b2
mov ecx, dword [esp + 0x24]
push 0x41fb7c
push esi
push ebx
push ebx
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x417689
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x417699
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea ecx, [esp + 0x10]
mov dword [esp + 0xb8], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, 1
mov ecx, dword [esp + 0xb0]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xac
ret 8