Function at 0x417010
Capabilities:
Create new key via cryptacquirecontext
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x445008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xorps xmm0, xmm0
lea esi, [edi + 0x18]
mov ebx, edx
lea eax, [esi + 0x10]
mov dword [ebp - 0xc], eax
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
movups xmmword [esi], xmm0
mov dword [eax], 0
lea eax, [edi + 0x30]
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov dword [eax], 0
mov dword [edi + 0x34], 0
cmp dword [ebx + 0x10], 0
je 0x417253
push 0xf0000000
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x4170c0
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x80090016
jne 0x417253
push 8
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push 0
lea eax, [edi + 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
setne cl
test cl, cl
je 0x417253
cmp dword [ebx + 0x10], 0
je 0x417184
cmp dword [ebx + 0x14], 0x10
mov eax, ebx
mov dword [ebp - 8], 0
jb 0x4170db
mov eax, dword [ebx]
push 0
push 0
lea ecx, [ebp - 8]
push ecx
push 0
push 1
push 0
push eax
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x417184
mov esi, dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x417181
cmp dword [ebx + 0x14], 0x10
mov eax, ebx
jb 0x41711b
mov eax, dword [ebx]
push 0
push 0
lea ecx, [ebp - 8]
push ecx
push esi
push 1
push 0
push eax
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x417170
lea eax, [edi + 0x34]
push eax
push 0x40
push 0
push dword [ebp - 8]
push esi
push dword [edi + 0x30]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x417170
mov eax, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
call eax
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420573
mov esp, ebp
pop ebp
ret
mov eax, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push esi
push 0
call eax
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
lea esi, [edi + 0x18]
mov ecx, dword [ebx + 0x10]
test ecx, ecx
je 0x4171c0
cmp dword [ebx + 0x14], 0x10
jb 0x417193
mov ebx, dword [ebx]
lea eax, [edi + 0x34]
push eax
push 0x40
push 0
push ecx
push ebx
push dword [edi + 0x30]
lea ebx, [edi + 0x30]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x4171c3
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420573
mov esp, ebp
pop ebp
ret
lea ebx, [edi + 0x30]
mov eax, dword [edi + 0x34]
test eax, eax
je 0x4171d8
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov dword [edi + 0x34], 0
mov eax, dword [ebx]
test eax, eax
je 0x4171ed
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [ebx], 0
cmp dword [edi + 0x14], 0x10
mov eax, edi
mov ecx, dword [edi + 0x10]
jb 0x4171fa
mov eax, dword [edi]
test ecx, ecx
je 0x41720b
nop
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x417200
cmp dword [esi + 0x14], 0x10
mov eax, esi
mov ecx, dword [edi + 0x28]
jb 0x417218
mov eax, dword [esi]
test ecx, ecx
je 0x41722b
nop dword [eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x417220
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x417235
mov eax, dword [edi]
mov dword [edi + 0x10], 0
mov byte [eax], 0
cmp dword [esi + 0x14], 0x10
jb 0x417247
mov esi, dword [esi]
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
mov byte [esi], 0
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00420573
mov esp, ebp
pop ebp
ret