Function at 0x47e53a
Capabilities:
Encrypt data using rc4 via systemfunction033

Disassembly:
sub esp, 0x94
push ebx
push ebp
push esi
mov eax, ecx
xor ebx, ebx
push edi
push 0x10
pop esi
mov edi, dword [eax]
lea ecx, [esp + 0x90]
mov dword [esp + 0x28], eax
mov ebp, edx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], ecx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
test edi, edi
je 0x47e772
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x47e772
movzx edx, word [edi + ebp + 2]
mov eax, edx
sub eax, 1
je 0x47e626
sub eax, 1
je 0x47e5ac
push edx
push str.ERROR_kuhl_m_lsadump_getHash___Unknow_SAM_HASH_revision___hu__n
call fcn.00409cda
pop ecx
pop ecx
jmp 0x47e761
cmp dword [edi + ebp + 4], esi
jb 0x47e772
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [ecx - 0x18]
mov ecx, dword [esp + 0xb0]
push eax
lea eax, [ebp + 0x18]
add eax, edi
lea edx, [ebp + 8]
push eax
add edx, edi
call fcn.004040eb
add esp, 0x10
test eax, eax
je 0x47e761
mov eax, dword [esp + 0x24]
push eax
push 0x40
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [esp + 0x20], eax
test eax, eax
je 0x47e617
push dword [esp + 0x24]
push dword [esp + 0x18]
push eax
call fcn.0049fa90
xor ebx, ebx
add esp, 0xc
inc ebx
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x47e711
cmp ecx, 6
jb 0x47e772
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.cryptdll.dll_MD5Init]
push esi
push dword [esp + 0xac]
mov esi, dword [sym.imp.cryptdll.dll_MD5Update]
lea eax, [esp + 0x40]
push eax
call esi
push 4
lea eax, [esp + 0xb0]
push eax
lea eax, [esp + 0x40]
push eax
call esi
mov edx, dword [esp + 0xb4]
test edx, edx
push 0xb
pop eax
push 0x12
pop ecx
cmovne eax, ecx
mov dword [esp + 0x14], str.LMPASSWORD
push eax
mov eax, str.NTPASSWORD
mov ecx, str.NTPASSWORDHISTORY
cmove ecx, eax
mov eax, str.LMPASSWORDHISTORY
cmove eax, dword [esp + 0x18]
cmp dword [esp + 0xb4], ebx
cmovne eax, ecx
push eax
lea eax, [esp + 0x40]
push eax
call esi
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.cryptdll.dll_MD5Final]
mov ecx, dword [esp + 0x28]
mov eax, dword [ecx + 4]
add eax, 0xfffffffc
push eax
push 0x40
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, eax
mov dword [esp + 0x20], ecx
test ecx, ecx
je 0x47e772
push dword [esp + 0x18]
lea eax, [ebp + 4]
add eax, edi
push eax
push ecx
call fcn.0049fa90
add esp, 0xc
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_SystemFunction033]
xor ebx, ebx
test eax, eax
setns bl
test eax, eax
jns 0x47e711
push str.ERROR_kuhl_m_lsadump_getHash___RtlDecryptData2_n
call fcn.00409cda
pop ecx
test ebx, ebx
je 0x47e761
cmp dword [esp + 0xb4], 0
mov eax, str.NTLM
push dword [esp + 0xb4]
mov ecx, str.ntlm
mov edx, str.LM
cmove ecx, eax
mov eax, str.lm
cmove eax, edx
cmp dword [esp + 0xb4], 0
mov edx, dword [esp + 0x1c]
cmovne eax, ecx
mov ecx, dword [esp + 0x24]
push eax
push dword [esp + 0xb4]
call fcn.00490001
add esp, 0xc
cmp dword [esp + 0x20], 0
je 0x47e772
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x94
ret