Function at 0x409779
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
xor eax, eax
cmp dword [ebp + 8], 0x200
push ebx
push esi
sete al
push edi
mov edi, eax
mov eax, dword [ecx + 0xa0]
xor ebx, ebx
cmp edi, ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0xc], 0x400
lea esi, [eax + 0x6b0]
jne 0x4097b8
lea esi, [eax + 0x6c8]
cmp edi, ebx
lea ecx, [eax + 0x6c4]
jne 0x4097c8
lea ecx, [eax + 0x6f0]
cmp edi, ebx
mov dword [ebp - 4], ecx
je 0x4097d6
add eax, 0x6b4
jmp 0x4097db
add eax, 0x6cc
cmp edi, ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], str.Microsoft_Base_Cryptographic_Provider_v1.0
jne 0x4097f0
mov dword [ebp - 0x10], str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push 0x20
mov dword [ebp - 0x2c], ebx
pop edx
mov dword [ebp - 0x40], ebx
push 0x28
mov dword [ebp - 0x30], edx
neg edi
pop ecx
mov dword [ebp - 0x44], edx
sbb edi, edi
or dword [ebp - 0x20], 0xffffffff
or dword [ebp - 0x34], 0xffffffff
push 8
and edi, 0xfffe0fff
pop eax
add edi, 0x20002
cmp dword [ebp - 0x14], ebx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x3c], ecx
lea eax, [ebp - 0x30]
jne 0x409834
lea eax, [ebp - 0x44]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x94]
add eax, edx
push eax
lea eax, [ebp - 0x444]
push dword [ebp + 8]
push str.ipmsg.rsa_d._s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [esi]
add esp, 0x10
cmp eax, ebx
je 0x40986b
push ebx
push eax
call dword [0x42c060]
mov dword [esi], ebx
call fcn.00419f82
test eax, eax
je 0x409882
call fcn.00419f42
test eax, eax
je 0x409882
call fcn.004096ea
test byte [ebp + 0xc], 1
je 0x4098d0
mov eax, dword [ebp - 0x18]
cmp dword [eax], ebx
jne 0x4098d0
push 0x30
push 1
push dword [ebp - 0x10]
lea eax, [ebp - 0x444]
push eax
push esi
call dword [0x42c06c]
test eax, eax
jne 0x4098bb
test byte [ebp + 0xc], 2
je 0x4098bb
push ebx
push str.CryptAcquireContext_destroy_
call fcn.0040cb67
pop ecx
pop ecx
push 0x10
push 1
push dword [ebp - 0x10]
lea eax, [ebp - 0x444]
push eax
push esi
call dword [0x42c06c]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx]
cmp eax, 0xffffffff
je 0x409905
mov dword [ebp + 8], ecx
push eax
push 1
push dword [ebp - 0x10]
lea eax, [ebp - 0x444]
mov dword [esi], ebx
push eax
push esi
call dword [0x42c06c]
test eax, eax
jne 0x409905
add dword [ebp + 8], 4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cmp eax, 0xffffffff
jne 0x4098dd
cmp dword [esi], ebx
jne 0x409928
cmp dword [ebp - 0x14], ebx
je 0x409921
test byte [ebp + 0xc], 2
je 0x409921
push ebx
push str.CryptAcquireContext
call fcn.0040cb67
pop ecx
pop ecx
xor eax, eax
jmp 0x409ad4
cmp dword [ebp - 0x14], ebx
jne 0x4099ff
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + 0xa0]
cmp dword [eax + 0x6dc], ebx
je 0x4099ff
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x444]
push eax
call fcn.00409b27
test eax, eax
je 0x4099a9
push dword [ebp - 4]
lea eax, [ebp - 0x444]
push 1
push ebx
push dword [ebp - 0xc]
push eax
push dword [esi]
call dword [0x42c050]
test eax, eax
jne 0x4099a9
test byte [ebp + 0xc], 2
je 0x409989
push ebx
push str.CryptImportKey_blob_
call fcn.0040cb67
pop ecx
pop ecx
push ebx
push dword [esi]
call dword [0x42c060]
push 0x20
push 1
push dword [ebp - 0x10]
lea eax, [ebp - 0x444]
mov dword [esi], ebx
push eax
push esi
call dword [0x42c06c]
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
jne 0x4099ff
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + 0xa0]
cmp dword [eax + 0x6e4], 1
jne 0x4099de
cmp dword [eax + 0x6e8], ebx
je 0x4099de
push ebx
push ebx
push 2
call fcn.00407df7
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ecx + 0xa0]
push dword [eax + 0x6dc]
call fcn.0041b8e8
mov eax, dword [ebp - 8]
pop ecx
mov eax, dword [eax + 0xa0]
mov dword [eax + 0x6dc], ebx
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
jne 0x409a3e
push eax
push 1
push dword [esi]
call dword [0x42c04c]
test eax, eax
jne 0x409a3e
push dword [ebp - 4]
push 1
push 0xa400
push dword [esi]
call dword [0x42c044]
test eax, eax
jne 0x409a3e
test byte [ebp + 0xc], 2
je 0x409a3e
push ebx
push str.CryptGenKey
call fcn.0040cb67
pop ecx
pop ecx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x444]
push eax
mov eax, dword [ebp - 4]
push ebx
push 6
push ebx
push dword [eax]
call dword [0x42c048]
test eax, eax
je 0x409a6e
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x444]
push edi
push eax
call fcn.00409adb
jmp 0x409a81
test byte [ebp + 0xc], 2
je 0x409a81
push ebx
push str.CryptExportKey
call fcn.0040cb67
pop ecx
pop ecx
cmp dword [ebp - 0x14], ebx
jne 0x409ad1
mov esi, dword [ebp - 8]
mov eax, dword [esi + 0xa0]
cmp dword [eax + 0x6dc], ebx
jne 0x409ad1
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
je 0x409ad1
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], 0x400
push ecx
lea ecx, [ebp - 0x444]
push ecx
push ebx
push 7
push ebx
push dword [eax]
call dword [0x42c048]
test eax, eax
je 0x409ad1
push dword [ebp - 0xc]
lea eax, [ebp - 0x444]
mov ecx, esi
push eax
call fcn.00409cf3
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 8