Function at 0x5b45660
Capabilities:
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x864
mov eax, dword [0x5c51004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
mov dword [ebp - 0x854], edi
push 0x401
lea eax, [ebp - 0x440]
mov dword [ebp - 0x85c], ebx
push edi
push eax
mov dword [ebp - 0x84c], edi
mov dword [ebp - 0x850], edi
call fcn.05b02790
add esp, 0xc
lea eax, [ebp - 0x440]
push 0x400
push eax
push str.HarpyLicenseTicket
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x5b4591f
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, eax
xor esi, esi
mov dword [ebp - 0x858], ecx
test cl, 1
jne 0x5b4591f
test ecx, ecx
jle 0x5b45746
mov bl, byte [ebp + esi - 0x43f]
mov dl, byte [ebp + esi - 0x440]
mov cl, bl
sar cl, 6
and cl, 1
mov al, cl
shl al, 3
sub al, cl
mov cl, dl
sub bl, al
sar cl, 6
and cl, 1
and bl, 0xf
mov al, cl
shl al, 3
sub al, cl
mov ecx, dword [ebp - 0x858]
sub dl, al
mov eax, esi
shr eax, 1
add esi, 2
shl dl, 4
or bl, dl
mov byte [ebp + eax - 0x440], bl
cmp esi, ecx
jl 0x5b456f0
mov ebx, dword [ebp - 0x85c]
mov eax, esi
cdq
sub eax, edx
sar eax, 1
cmp eax, 0x401
jae 0x5b4597b
mov byte [ebp + eax - 0x440], 0
mov eax, ecx
push 0xf0000000
cdq
push 1
sub eax, edx
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
mov esi, eax
lea eax, [ebp - 0x854]
push 0
push eax
sar esi, 1
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x5b4591f
lea eax, [ebp - 0x84c]
push eax
push 0
push 0
push 0x8004
push dword [ebp - 0x854]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x5b4591f
mov eax, dword [0x5c48bb4]
mov ecx, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [0x5c48bb8]
mov dword [ebp - 8], eax
test bl, bl
jne 0x5b457cb
not ecx
and ecx, 0xffffffaa
mov al, cl
and al, 0x55
xor al, 0x4a
mov byte [ebp - 0xc], al
mov al, cl
and al, 0xaa
xor al, 0x86
mov byte [ebp - 0xb], al
mov al, cl
and al, 0xfc
not al
and al, 0x57
mov byte [ebp - 0xa], al
mov al, cl
and al, 0xa8
mov byte [ebp - 9], al
mov al, cl
and al, 0x50
not al
and al, 0xf3
mov byte [ebp - 8], al
mov al, cl
and al, 0xa0
xor al, 0x71
mov byte [ebp - 7], al
mov al, cl
and al, 0x40
and cl, 0xc1
xor al, 0xad
not cl
push 0
mov byte [ebp - 6], al
and cl, 0xbe
push 8
lea eax, [ebp - 0xc]
mov byte [ebp - 5], cl
push eax
push dword [ebp - 0x84c]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x5b4591f
lea eax, [ebp - 0x850]
push eax
push 0
push dword [ebp - 0x84c]
push 0x6801
push dword [ebp - 0x854]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x5b4591f
lea eax, [ebp - 0x860]
mov dword [ebp - 0x860], esi
push eax
lea eax, [ebp - 0x440]
push eax
push 0
push 1
push 0
push dword [ebp - 0x850]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x5b4591f
push 0x401
lea eax, [ebp - 0x848]
push 0
push eax
call fcn.05b02790
push ebx
lea eax, [ebp - 0x848]
push str.Harpy_SDK_v1.12_License_Ticket_for_Process__lu
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x27
lea eax, [ebp - 0x34]
push 0
push eax
call fcn.05b02790
add esp, 0x24
lea eax, [ebp - 0x34]
push 0x26
push eax
push str.HarpyTicketId
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x5b45904
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0x24
jne 0x5b4591f
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x848]
push 0x5c3abbc
push eax
call esi
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x848]
push eax
call esi
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x5b4591f
lea edi, [eax + 1]
mov eax, dword [ebp - 0x850]
test eax, eax
je 0x5b4593a
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov dword [ebp - 0x850], 0
mov eax, dword [ebp - 0x84c]
test eax, eax
je 0x5b45955
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov dword [ebp - 0x84c], 0
mov ecx, dword [ebp - 0x854]
test ecx, ecx
je 0x5b45968
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.05b011bc
mov esp, ebp
pop ebp
ret
call fcn.05b012f0
int3