Function at 0x427614
Capabilities:
Encrypt data using dpapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
push 0xf0000000
xor eax, eax
mov dword [ebp - 0x24], ecx
push 1
push eax
push eax
mov esi, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
mov ebx, edx
push eax
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x4277e2
xor ecx, ecx
lea eax, [ebp - 0xc]
push eax
push ecx
push ecx
push 0x8004
push dword [ebp - 0x18]
mov dword [ebp - 0xc], ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x427726
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
lea eax, [eax*2 + 2]
push eax
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x42771d
push esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x14
push eax
lea eax, [ebp - 0x54]
push eax
push 2
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x42771d
push 0x100
mov byte [ebp - 5], 0
call fcn.00444a12
mov esi, eax
xor edi, edi
xor eax, eax
pop ecx
mov word [esi], ax
cmp dword [ebp - 0x14], eax
jbe 0x4276fb
mov bl, al
mov al, byte [ebp + edi - 0x54]
add bl, al
movzx eax, al
push eax
lea eax, [ebp - 0x40]
push 0x47a3bc
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x40]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
inc edi
cmp edi, dword [ebp - 0x14]
jb 0x4276c8
mov byte [ebp - 5], bl
mov ebx, dword [ebp - 0x1c]
movzx eax, byte [ebp - 5]
push eax
lea eax, [ebp - 0x40]
push 0x47a3bc
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x40]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test esi, esi
je 0x4277e2
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push 0
push ecx
push eax
push esi
mov edx, str.SoftwareMicrosoftInternet_ExplorerIntelliFormsStorage2
mov ecx, 0x80000001
call fcn.00433c35
mov edi, eax
add esp, 0x10
test edi, edi
je 0x4277db
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4277db
and dword [ebp - 0x1c], 0
push ebx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor ecx, ecx
lea eax, [eax*2 + 2]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
push eax
push 1
push ecx
push ecx
lea eax, [ebp - 0x10]
push eax
push ecx
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x4277d4
cmp dword [ebp - 0x1c], 0
je 0x4277d4
mov eax, dword [ebp + 8]
test eax, eax
je 0x4277b2
push 0x3f
pop ecx
mov word [eax], cx
mov ecx, dword [ebp - 0x24]
push 0
push 0
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push ebx
push 4
pop edx
call fcn.004273e7
add esp, 0x14
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push edi
call fcn.00443c35
pop ecx
push esi
call fcn.00443c35
pop ecx
pop edi
pop esi
pop ebx
leave
ret