Function at 0x401000
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [0x478138]
test eax, eax
je 0x401018
xor eax, eax
jmp 0x40152e
cmp dword [0x478134], 0
jne 0x401364
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [0x4780f4], eax
cmp dword [0x4780f4], 0
jne 0x401043
mov eax, 0xffffff97
jmp 0x40152e
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jne 0x401061
mov eax, 0xffffff97
jmp 0x40152e
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x40107f
mov eax, 0xffffff97
jmp 0x40152e
push 0x450f68
mov ecx, dword [ebp - 0x44]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4780e8], eax
cmp dword [0x4780e8], 0
jne 0x4010a6
mov eax, 0xffffff97
jmp 0x40152e
push 0x450f5c
mov edx, dword [ebp - 0x44]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4780ec], eax
cmp dword [0x4780ec], 0
jne 0x4010cd
mov eax, 0xffffff97
jmp 0x40152e
push 0x450f50
mov eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4780f0], eax
cmp dword [0x4780f0], 0
jne 0x4010f4
mov eax, 0xffffff97
jmp 0x40152e
push 0x450f38
mov ecx, dword [ebp - 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4780f8], eax
cmp dword [0x4780f8], 0
jne 0x40111b
mov eax, 0xffffff97
jmp 0x40152e
push 0x450f24
mov edx, dword [ebp - 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4780fc], eax
cmp dword [0x4780fc], 0
jne 0x401142
mov eax, 0xffffff97
jmp 0x40152e
push str.CryptGenRandom
mov eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x478100], eax
cmp dword [0x478100], 0
jne 0x401169
mov eax, 0xffffff97
jmp 0x40152e
push str.CryptGetUserKey
mov ecx, dword [ebp - 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x478104], eax
cmp dword [0x478104], 0
jne 0x401190
mov eax, 0xffffff97
jmp 0x40152e
push str.CryptGenKey
mov edx, dword [ebp - 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x478108], eax
cmp dword [0x478108], 0
jne 0x4011b7
mov eax, 0xffffff97
jmp 0x40152e
push 0x450ee8
mov eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x47810c], eax
cmp dword [0x47810c], 0
jne 0x4011de
mov eax, 0xffffff97
jmp 0x40152e
push 0x450ed8
mov ecx, dword [ebp - 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x478110], eax
cmp dword [0x478110], 0
jne 0x401205
mov eax, 0xffffff97
jmp 0x40152e
push str.CryptSetHashParam
mov edx, dword [ebp - 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x478114], eax
cmp dword [0x478114], 0
jne 0x40122c
mov eax, 0xffffff97
jmp 0x40152e
push str.CryptGetHashParam
mov eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x478118], eax
cmp dword [0x478118], 0
jne 0x401253
mov eax, 0xffffff97
jmp 0x40152e
push 0x450e9c
mov ecx, dword [ebp - 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x47811c], eax
cmp dword [0x47811c], 0
jne 0x40127a
mov eax, 0xffffff97
jmp 0x40152e
push 0x450e8c
mov edx, dword [ebp - 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x478120], eax
cmp dword [0x478120], 0
jne 0x4012a1
mov eax, 0xffffff97
jmp 0x40152e
push str.CryptEncrypt
mov eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x478124], eax
cmp dword [0x478124], 0
jne 0x4012c8
mov eax, 0xffffff97
jmp 0x40152e
push 0x450e6c
mov ecx, dword [ebp - 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x478128], eax
cmp dword [0x478128], 0
jne 0x4012ef
mov eax, 0xffffff97
jmp 0x40152e
push str.CryptGetKeyParam
mov edx, dword [ebp - 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x47812c], eax
cmp dword [0x47812c], 0
jne 0x401316
mov eax, 0xffffff97
jmp 0x40152e
push str.CryptSetKeyParam
mov eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x478130], eax
cmp dword [0x478130], 0
jne 0x40133d
mov eax, 0xffffff97
jmp 0x40152e
push str.CryptImportKey
mov ecx, dword [ebp - 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x478134], eax
cmp dword [0x478134], 0
jne 0x401364
mov eax, 0xffffff97
jmp 0x40152e
mov dword [ebp - 0x14], 0
push 0
push 0x18
push str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider__Prototype_
push 0
lea edx, [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x40140f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
je 0x4013ec
push 0
push 0x18
push str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
push 0
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x4013ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x4013e0
push 8
push 0x18
push str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
push 0
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x4013de
mov eax, 0xffffff9b
jmp 0x40152e
jmp 0x4013ea
mov eax, 0xffffff9b
jmp 0x40152e
jmp 0x40140f
push 8
push 0x18
push str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider__Prototype_
push 0
lea edx, [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x40140f
mov eax, 0xffffff9b
jmp 0x40152e
mov dword [ebp - 0xc], section..dcfacd
mov dword [ebp - 4], 0x47e3e0
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x18], 0x20
mov dword [ebp - 0x38], 0x80186873
mov dword [ebp - 0x34], 0xdf3eaf
mov dword [ebp - 0x30], 0xee5e3772
mov dword [ebp - 0x2c], 0xf96c8d90
mov dword [ebp - 0x28], 0xd91a55fa
mov dword [ebp - 0x24], 0x39268c66
mov dword [ebp - 0x20], 0x35436865
mov dword [ebp - 0x1c], 0xb95e07c9
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0
push 0x8004
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x4014e6
push 0
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0x38]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x4014e6
lea eax, [ebp - 8]
push eax
push 1
mov ecx, dword [ebp - 0x10]
push ecx
push 0x660e
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x4014e6
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
push 0
push 1
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x4014e6
mov byte [0x478138], 1
cmp dword [ebp - 8], 0
je 0x4014f6
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
cmp dword [ebp - 0x10], 0
je 0x401506
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp dword [ebp - 0x14], 0
je 0x401518
push 0
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
movzx eax, byte [0x478138]
test eax, eax
je 0x401529
xor eax, eax
jmp 0x40152e
mov eax, 0xffffff37
mov esp, ebp
pop ebp
ret