Function at 0x406760
Capabilities:
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ecx, 0x25
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x4b0]
lea edi, [ebp - 0xa0]
mov esi, 0x417224
push ebx
lea ebx, [ebp - 0x4a0]
sub esp, 0x4cc
mov dword [ebp - 0x4ac], 0x656e6957
rep movsd dword es:[edi], dword [esi]
mov esi, 0x4172b8
mov edi, ebx
mov dword [ebp - 0x4a8], 0x636f7220
mov dword [ebp - 0x4a4], 0x21736b
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
mov esi, str._f___
mov ecx, 0x20
lea edi, [ebp - 0x420]
rep movsd dword es:[edi], dword [esi]
mov esi, 0x4173b8
mov ecx, 0x20
lea edi, [ebp - 0x3a0]
rep movsd dword es:[edi], dword [esi]
mov esi, 0x417438
mov ecx, 0x20
lea edi, [ebp - 0x320]
rep movsd dword es:[edi], dword [esi]
mov esi, 0x4174b8
mov ecx, 0x20
lea edi, [ebp - 0x2a0]
rep movsd dword es:[edi], dword [esi]
mov esi, 0x417538
mov ecx, 0x20
lea edi, [ebp - 0x220]
rep movsd dword es:[edi], dword [esi]
mov esi, 0x4175b8
mov ecx, 0x20
lea edi, [ebp - 0x1a0]
rep movsd dword es:[edi], dword [esi]
mov esi, 0x417638
mov ecx, 0x20
lea edi, [ebp - 0x120]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0xa0]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x94
mov dword [esp + 4], eax
mov eax, dword [0x42b014]
mov esi, dword fs:[0x18]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_CryptImportKey]
sub esp, 0x18
mov edi, eax
call fcn.00412e10
mov dword [eax], 0x41605d
mov dword [eax + 4], 0x8af
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str._08lx_n
mov dword [esp + 8], eax
mov dword [esp], edi
call fcn.00401ac0
test edi, edi
jne 0x4068b0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x4b4]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x8001
mov eax, dword [0x42b014]
mov dword [esp], eax
mov eax, dword [sym.imp.advapi32.dll_CryptCreateHash]
mov dword [ebp - 0x4b8], eax
call eax
sub esp, 0x14
mov edi, eax
call fcn.00412e10
mov dword [eax], 0x41605d
mov dword [eax + 4], 0x8b3
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str._08lx_n
mov dword [esp + 8], eax
mov dword [esp], edi
call fcn.00401ac0
test edi, edi
je 0x4068a1
lea eax, [ebp - 0x4ac]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0xc
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x4b4]
mov dword [esp], eax
mov eax, dword [sym.imp.advapi32.dll_CryptHashData]
mov dword [ebp - 0x4c0], eax
call eax
sub esp, 0x10
mov edi, eax
mov eax, 0x8b7
call fcn.00401310
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str._08lx_n
mov dword [esp], edi
mov dword [esp + 8], eax
call fcn.00401ac0
test edi, edi
je 0x4068a1
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0x4b0]
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x4b4]
mov dword [esp], eax
mov eax, dword [sym.imp.advapi32.dll_CryptVerifySignatureA]
mov dword [ebp - 0x4bc], eax
call eax
sub esp, 0x18
mov edi, eax
mov eax, 0x8bc
call fcn.00401310
mov eax, dword [esi + 0x34]
test edi, edi
jne 0x4071c0
cmp eax, 0x57
je 0x4071e0
mov dword [esp + 8], eax
mov dword [esp + 4], str.Expected_ERROR_INVALID_PARAMETER_error__got__08lx_n
mov dword [esp], 0
call fcn.00401ac0
mov edi, dword fs:[0x18]
mov dword [edi + 0x34], 0xdeadbeef
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0x4b0]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x4b4]
mov dword [esp], eax
mov eax, dword [ebp - 0x4bc]
call eax
sub esp, 0x18
mov esi, eax
mov eax, 0x8c3
call fcn.00401310
mov eax, dword [edi + 0x34]
test esi, esi
jne 0x407208
xor edx, edx
cmp eax, 0x80090006
sete dl
mov dword [esp + 8], eax
mov dword [esp], edx
mov dword [esp + 4], str.Expected_NTE_BAD_SIGNATURE__got__08lx_n
mov esi, dword fs:[0x18]
call fcn.00401ac0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0x4b0]
mov dword [esp + 4], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 8], pe_nt_image_headers32
mov eax, dword [ebp - 0x4b4]
mov dword [esp], eax
mov edi, dword [ebp - 0x4bc]
call edi
sub esp, 0x18
mov ebx, eax
mov eax, 0x8c8
call fcn.00401310
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str._08lx_n
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.00401ac0
test ebx, ebx
je 0x4068a1
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0x4b0]
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x420]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x4b4]
mov dword [esp], eax
call edi
sub esp, 0x18
mov ebx, eax
mov eax, 0x8cd
call fcn.00401310
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str._08lx_n
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.00401ac0
test ebx, ebx
je 0x4068a1
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0x4b0]
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x420]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x4b4]
mov dword [esp], eax
mov dword [ebp - 0x4bc], edi
call edi
sub esp, 0x18
mov ebx, eax
mov eax, 0x8d1
call fcn.00401310
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str._08lx_n
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.00401ac0
test ebx, ebx
je 0x4068a1
mov eax, dword [ebp - 0x4b4]
mov edi, dword [sym.imp.advapi32.dll_CryptDestroyHash]
mov dword [esp], eax
call edi
lea edx, [ebp - 0x4b4]
sub esp, 4
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x8002
mov eax, dword [0x42b014]
mov dword [esp], eax
mov edx, dword [ebp - 0x4b8]
call edx
sub esp, 0x14
mov ebx, eax
mov eax, 0x8d7
call fcn.00401310
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str._08lx_n
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.00401ac0
test ebx, ebx
je 0x4068a1
lea ebx, [ebp - 0x4ac]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0xc
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x4b4]
mov dword [esp], eax
mov ebx, dword [ebp - 0x4c0]
call ebx
sub esp, 0x10
mov ebx, eax
mov eax, 0x8db
call fcn.00401310
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str._08lx_n
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.00401ac0
test ebx, ebx
je 0x4068a1
mov dword [esp + 0x14], 0
lea ecx, [ebp - 0x3a0]
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0x4b0]
mov dword [esp + 4], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], pe_nt_image_headers32
mov eax, dword [ebp - 0x4b4]
mov dword [esp], eax
mov eax, dword [ebp - 0x4bc]
call eax
sub esp, 0x18
mov ebx, eax
mov eax, 0x8df
call fcn.00401310
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str._08lx_n
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.00401ac0
test ebx, ebx
je 0x4068a1
xor eax, eax
lea ecx, [ebp - 0x320]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x4b0]
mov dword [esp + 4], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], pe_nt_image_headers32
mov eax, dword [ebp - 0x4b4]
mov dword [esp], eax
mov eax, dword [ebp - 0x4bc]
call eax
sub esp, 0x18
mov ebx, eax
mov eax, 0x8e3
call fcn.00401310
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str._08lx_n
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.00401ac0
test ebx, ebx
je 0x4068a1
xor eax, eax
mov dword [esp + 0x14], 1
lea ecx, [ebp - 0x320]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x4b0]
mov dword [esp + 4], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], pe_nt_image_headers32
mov eax, dword [ebp - 0x4b4]
mov dword [esp], eax
mov eax, dword [ebp - 0x4bc]
call eax
sub esp, 0x18
mov ebx, eax
mov eax, 0x8e7
call fcn.00401310
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str._08lx_n
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.00401ac0
test ebx, ebx
je 0x4068a1
mov eax, dword [ebp - 0x4b4]
mov dword [esp], eax
call edi
lea ecx, [ebp - 0x4b4]
push eax
xor eax, eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], 0x8003
mov eax, dword [0x42b014]
mov dword [esp], eax
mov edx, dword [ebp - 0x4b8]
call edx
sub esp, 0x14
mov ebx, eax
mov eax, 0x8ed
call fcn.00401310
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str._08lx_n
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.00401ac0
test ebx, ebx
je 0x4068a1
xor ebx, ebx
lea ecx, [ebp - 0x4ac]
mov dword [esp + 8], 0xc
mov dword [esp + 4], ecx
mov dword [esp + 0xc], ebx
mov eax, dword [ebp - 0x4b4]
mov dword [esp], eax
mov ebx, dword [ebp - 0x4c0]
call ebx
sub esp, 0x10
mov ebx, eax
mov eax, 0x8f1
call fcn.00401310
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str._08lx_n
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.00401ac0
test ebx, ebx
je 0x4068a1
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ecx
mov eax, dword [ebp - 0x4b0]
lea ecx, [ebp - 0x2a0]
mov dword [esp + 4], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], pe_nt_image_headers32
mov eax, dword [ebp - 0x4b4]
mov esi, dword fs:[0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x4bc]
call eax
sub esp, 0x18
mov ebx, eax
mov eax, 0x8f5
call fcn.00401310
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str._08lx_n
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.00401ac0
test ebx, ebx
je 0x4068a1
xor edx, edx
lea ecx, [ebp - 0x220]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], edx
mov eax, dword [ebp - 0x4b0]
mov dword [esp + 4], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], pe_nt_image_headers32
mov eax, dword [ebp - 0x4b4]
mov dword [esp], eax
mov eax, dword [ebp - 0x4bc]
call eax
sub esp, 0x18
mov ebx, eax
mov eax, 0x8f9
call fcn.00401310
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str._08lx_n
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.00401ac0
test ebx, ebx
je 0x4068a1
xor eax, eax
mov dword [esp + 0x14], 1
lea ecx, [ebp - 0x220]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x4b0]
mov dword [esp + 4], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], pe_nt_image_headers32
mov eax, dword [ebp - 0x4b4]
mov dword [esp], eax
mov eax, dword [ebp - 0x4bc]
call eax
sub esp, 0x18
mov ebx, eax
mov eax, 0x8fd
call fcn.00401310
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str._08lx_n
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.00401ac0
test ebx, ebx
je 0x4068a1
mov eax, dword [ebp - 0x4b4]
mov dword [esp], eax
call edi
lea ecx, [ebp - 0x4b4]
push eax
xor eax, eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], 0x8004
mov eax, dword [0x42b014]
mov dword [esp], eax
mov edx, dword [ebp - 0x4b8]
call edx
sub esp, 0x14
mov ebx, eax
mov eax, 0x903
call fcn.00401310
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str._08lx_n
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.00401ac0
test ebx, ebx
je 0x4068a1
xor eax, eax
lea edx, [ebp - 0x4ac]
mov dword [esp + 8], 0xc
mov dword [esp + 4], edx
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x4b4]
mov dword [esp], eax
mov ebx, dword [ebp - 0x4c0]
call ebx
sub esp, 0x10
mov ebx, eax
mov eax, 0x907
call fcn.00401310
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str._08lx_n
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.00401ac0
test ebx, ebx
je 0x4068a1
xor eax, eax
lea edx, [ebp - 0x1a0]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x4b0]
mov dword [esp + 4], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], pe_nt_image_headers32
mov eax, dword [ebp - 0x4b4]
mov dword [esp], eax
mov eax, dword [ebp - 0x4bc]
call eax
sub esp, 0x18
mov ebx, eax
mov eax, 0x90b
call fcn.00401310
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str._08lx_n
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.00401ac0
test ebx, ebx
je 0x4068a1
xor ebx, ebx
lea edx, [ebp - 0x120]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebx
mov eax, dword [ebp - 0x4b0]
mov dword [esp + 4], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], pe_nt_image_headers32
mov eax, dword [ebp - 0x4b4]
mov dword [esp], eax
mov eax, dword [ebp - 0x4bc]
call eax
sub esp, 0x18
mov ebx, eax
mov eax, 0x90f
call fcn.00401310
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str._08lx_n
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.00401ac0
test ebx, ebx
je 0x4068a1
xor ecx, ecx
mov dword [esp + 0x14], 1
lea edx, [ebp - 0x120]
mov dword [esp + 0x10], ecx
mov eax, dword [ebp - 0x4b0]
mov dword [esp + 4], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], pe_nt_image_headers32
mov eax, dword [ebp - 0x4b4]
mov dword [esp], eax
mov eax, dword [ebp - 0x4bc]
call eax
sub esp, 0x18
mov ebx, eax
mov eax, 0x913
call fcn.00401310
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str._08lx_n
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.00401ac0
test ebx, ebx
je 0x4068a1
mov eax, dword [ebp - 0x4b4]
mov dword [esp], eax
call edi
push eax
mov eax, dword [ebp - 0x4b0]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_CryptDestroyKey]
push edx
jmp 0x4068a1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Expected_ERROR_INVALID_PARAMETER_error__got__08lx_n
mov dword [esp], 0
call fcn.00401ac0
jmp 0x4068a1
mov dword [esp + 8], 0x57
mov dword [esp + 4], str.Expected_ERROR_INVALID_PARAMETER_error__got__08lx_n
mov dword [esp], 1
call fcn.00401ac0
jmp 0x4069f2
mov ecx, dword [0x42b050]
xor edx, edx
test ecx, ecx
sete dl
jmp 0x406a5b