Function at 0x404bc0
Capabilities:
Contain obfuscated stackstrings
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ecx, 0x23
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x184]
mov esi, 0x417060
push ebx
lea ebx, [ebp - 0x98]
mov edi, ebx
sub esp, 0x1b0
mov byte [ebp - 0xdf], 0
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x114], 0x8003
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x104], 0
mov dword [ebp - 0xff], 0x65707553
mov dword [ebp - 0xfb], 0x65532072
mov dword [ebp - 0xf7], 0x74657263
mov dword [ebp - 0xf3], 0x72655320
mov dword [ebp - 0xef], 0x20726576
mov dword [ebp - 0xeb], 0x72636553
mov dword [ebp - 0xe7], 0x31207465
mov dword [ebp - 0xe3], 0x35343332
mov dword [ebp - 0xde], 0x65707553
mov dword [ebp - 0xda], 0x65532072
mov dword [ebp - 0xd6], 0x74657263
mov dword [ebp - 0xd2], 0x696c4320
mov dword [ebp - 0xce], 0x20746e65
mov dword [ebp - 0xca], 0x72636553
mov dword [ebp - 0xc6], 0x31207465
mov dword [ebp - 0xc2], 0x35343332
mov byte [ebp - 0xbe], 0
mov dword [ebp - 0xbd], 0x34333231
mov dword [ebp - 0xb9], 0x38373635
mov dword [ebp - 0xb5], 0x32313039
mov dword [ebp - 0xb1], 0x36353433
mov dword [ebp - 0xad], 0x30393837
mov dword [ebp - 0xa9], 0x34333231
mov dword [ebp - 0xa5], 0x38373635
mov dword [ebp - 0xa1], 0x32313039
mov dword [ebp - 0x9d], 0x36353433
mov byte [ebp - 0x99], 0
mov dword [ebp - 0x158], 0x65696c63
mov dword [ebp - 0x154], 0x6620746e
mov dword [ebp - 0x150], 0x73696e69
mov dword [ebp - 0x14c], 0x646568
mov dword [ebp - 0x148], 0x656e6957
mov dword [ebp - 0x144], 0x636f7220
mov dword [ebp - 0x140], 0x21736b
mov dword [ebp - 0x13c], 0
mov dword [esp], eax
mov eax, dword [sym.imp.advapi32.dll_CryptAcquireContextA]
mov dword [esp + 0x10], 0xf0000008
mov dword [esp + 0xc], 0xc
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [ebp - 0x188], eax
call eax
sub esp, 0x14
test eax, eax
je 0x4051a8
mov esi, eax
call fcn.00412e10
mov dword [eax], 0x41605d
mov dword [eax + 4], 0xb73
mov edi, dword fs:[0x18]
mov eax, dword [edi + 0x34]
mov dword [esp], esi
mov dword [esp + 4], str._08lx_n
mov dword [esp + 8], eax
call fcn.00401ac0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x184]
mov dword [esp], eax
mov eax, dword [sym.imp.advapi32.dll_CryptReleaseContext]
mov dword [ebp - 0x18c], eax
call eax
lea eax, [ebp - 0x184]
sub esp, 8
mov dword [esp + 0x10], 0xf0000000
mov dword [esp + 0xc], 0xc
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [ebp - 0x188]
call eax
sub esp, 0x14
mov esi, eax
call fcn.00412e10
mov dword [eax], 0x41605d
mov dword [eax + 4], 0xb78
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str._08lx_n
mov dword [esp + 8], eax
mov dword [esp], esi
call fcn.00401ac0
test esi, esi
jne 0x404e70
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x180]
mov edx, dword [sym.imp.advapi32.dll_CryptImportKey]
mov dword [ebp - 0x164], 0x254
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x254
mov dword [esp + 4], 0x414cc0
mov eax, dword [ebp - 0x184]
mov dword [esp], eax
mov dword [ebp - 0x190], edx
call edx
sub esp, 0x18
mov esi, eax
mov eax, 0xb80
call fcn.00401310
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str._08lx_n
mov dword [esp], esi
mov dword [esp + 8], eax
call fcn.00401ac0
test esi, esi
je 0x404e68
mov dword [ebp - 0x164], 0x8c
lea eax, [ebp - 0x17c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0x180]
mov dword [esp + 4], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x8c
mov eax, dword [ebp - 0x184]
mov dword [esp], eax
mov edx, dword [ebp - 0x190]
call edx
sub esp, 0x18
mov ebx, eax
mov eax, 0xb85
call fcn.00401310
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str._08lx_n
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.00401ac0
test ebx, ebx
je 0x404e68
lea eax, [ebp - 0x170]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x17c]
mov dword [esp + 4], 0x4c02
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x184]
mov dword [esp], eax
mov eax, dword [sym.imp.advapi32.dll_CryptCreateHash]
mov dword [ebp - 0x190], eax
call eax
sub esp, 0x14
mov ebx, eax
mov eax, 0xb8e
call fcn.00401310
mov edx, dword [edi + 0x34]
xor eax, eax
test ebx, ebx
jne 0x404fb0
xor eax, eax
cmp edx, 0x57
sete al
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], str.expected_ERROR_INVALID_PARAMETER__got__08lx_n
mov esi, dword fs:[0x18]
call fcn.00401ac0
lea eax, [ebp - 0xde]
mov dword [ebp - 0x160], 0x21
mov edi, dword [sym.imp.advapi32.dll_CryptSetKeyParam]
mov dword [ebp - 0x15c], eax
lea eax, [ebp - 0x160]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0x15
mov eax, dword [ebp - 0x17c]
mov dword [esp], eax
call edi
sub esp, 0x10
mov ebx, eax
mov eax, 0xb96
call fcn.00401310
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str._08lx_n
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.00401ac0
test ebx, ebx
je 0x404e68
mov dword [ebp - 0x160], 0x21
lea eax, [ebp - 0xff]
mov dword [ebp - 0x15c], eax
lea eax, [ebp - 0x160]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0x16
mov eax, dword [ebp - 0x17c]
mov dword [esp], eax
call edi
sub esp, 0x10
mov ebx, eax
mov eax, 0xb9c
call fcn.00401310
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str._08lx_n
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.00401ac0
test ebx, ebx
je 0x404e68
lea eax, [ebp - 0x170]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x17c]
mov dword [esp + 4], 0x4c02
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x184]
mov dword [esp], eax
mov eax, dword [ebp - 0x190]
call eax
sub esp, 0x14
mov ebx, eax
mov eax, 0xba0
call fcn.00401310
mov eax, dword [esi + 0x34]
test ebx, ebx
jne 0x4051c6
mov edx, dword [0x42b050]
mov dword [esp + 8], eax
mov dword [esp + 4], str._08lx_n
test edx, edx
je 0x405910
mov dword [esp], 0
call fcn.00401ac0
mov eax, 0xba5
call fcn.00401310
mov dword [esp], str.Broken_TLS1_hash_creation_n
call fcn.00404020
mov eax, dword [ebp - 0x180]
mov ebx, dword [sym.imp.advapi32.dll_CryptDestroyKey]
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x17c]
sub esp, 4
mov dword [esp], eax
call ebx
sub esp, 4
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x184]
mov dword [esp], eax
mov eax, dword [ebp - 0x18c]
call eax
lea eax, [ebp - 0x184]
sub esp, 8
mov dword [esp + 0x10], 0x10
mov dword [esp + 0xc], 0xc
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [ebp - 0x188]
call eax
sub esp, 0x14
jmp 0x404e68
mov eax, 0xb70
call fcn.00401310
mov dword [esp], str.no_PROV_RSA_SCHANNEL_support_n
call fcn.00404020
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], eax
mov dword [esp + 4], str._08lx_n
mov dword [esp], 1
call fcn.00401ac0
lea eax, [ebp - 0x178]
mov dword [esp + 0xc], 0x400
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x170]
mov dword [esp + 4], 0x4c07
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x184]
mov dword [esp], eax
mov eax, dword [sym.imp.advapi32.dll_CryptDeriveKey]
mov dword [ebp - 0x194], eax
call eax
sub esp, 0x14
mov ebx, eax
mov eax, 0xbb1
call fcn.00401310
mov edx, dword [esi + 0x34]
xor eax, eax
test ebx, ebx
jne 0x40523c
xor eax, eax
cmp dword [esi + 0x34], 0x80090009
sete al
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], str.expected_NTE_BAD_FLAGS__got__08lx_n
mov esi, dword fs:[0x18]
call fcn.00401ac0
mov eax, dword [ebp - 0x170]
mov dword [esp], eax
mov eax, dword [sym.imp.advapi32.dll_CryptDestroyHash]
mov dword [ebp - 0x198], eax
call eax
lea edx, [ebp - 0x128]
mov dword [ebp - 0x128], 1
mov dword [ebp - 0x124], 0x6601
sub esp, 4
mov dword [ebp - 0x120], 0x40
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0
mov dword [esp + 8], edx
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x14
mov eax, dword [ebp - 0x17c]
mov dword [esp], eax
call edi
sub esp, 0x10
mov ebx, eax
mov eax, 0xbbc
call fcn.00401310
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str._08lx_n
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.00401ac0
test ebx, ebx
je 0x404e68
mov dword [ebp - 0x128], 0
lea edx, [ebp - 0x128]
mov dword [ebp - 0x124], 0x8003
mov dword [ebp - 0x120], pe_nt_image_headers32
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0
mov dword [esp + 8], edx
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x14
mov eax, dword [ebp - 0x17c]
mov dword [esp], eax
call edi
sub esp, 0x10
mov ebx, eax
mov eax, 0xbc5
call fcn.00401310
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str._08lx_n
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.00401ac0
test ebx, ebx
je 0x404e68
lea eax, [ebp - 0x170]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x17c]
mov dword [esp + 4], 0x4c02
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x184]
mov dword [esp], eax
mov eax, dword [ebp - 0x190]
call eax
sub esp, 0x14
mov ebx, eax
mov eax, 0xbc9
call fcn.00401310
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str._08lx_n
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.00401ac0
test ebx, ebx
je 0x404e68
lea eax, [ebp - 0x178]
mov dword [esp + 0xc], 0x400
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x170]
mov dword [esp + 4], 0x4c07
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x184]
mov dword [esp], eax
mov eax, dword [ebp - 0x194]
call eax
sub esp, 0x14
mov ebx, eax
mov eax, 0xbce
call fcn.00401310
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str._08lx_n
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.00401ac0
test ebx, ebx
je 0x404e68
lea eax, [ebp - 0x164]
lea edi, [ebp - 0x148]
mov dword [ebp - 0x164], 0xc
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 0x18], 0x10
mov dword [esp + 0x10], edi
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x178]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_CryptEncrypt]
sub esp, 0x1c
mov ebx, eax
mov eax, 0xbd4
call fcn.00401310
mov esi, dword [esi + 0x34]
test ebx, ebx
je 0x4054c9
xor ebx, ebx
cmp dword [ebp - 0x164], 0x10
jne 0x4054c9
mov dword [esp + 8], 0x10
xor ebx, ebx
mov dword [esp + 4], 0x4188c0
mov dword [esp], edi
call sub.msvcrt.dll_memcmp
test eax, eax
sete bl
mov dword [esp + 8], esi
mov dword [esp], ebx
xor ebx, ebx
mov dword [esp + 4], str._08lx_n
mov esi, dword fs:[0x18]
call fcn.00401ac0
lea eax, [ebp - 0x16c]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x17c]
mov dword [esp + 4], 0x800a
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x184]
mov dword [esp], eax
mov eax, dword [ebp - 0x190]
call eax
sub esp, 0x14
mov ebx, eax
mov eax, 0xbd8
call fcn.00401310
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str._08lx_n
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.00401ac0
test ebx, ebx
je 0x404e68
lea eax, [ebp - 0xbd]
xor ecx, ecx
mov dword [ebp - 0x160], 0x24
mov dword [ebp - 0x15c], eax
lea eax, [ebp - 0x160]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], 7
mov eax, dword [ebp - 0x16c]
mov dword [esp], eax
mov eax, dword [sym.imp.advapi32.dll_CryptSetHashParam]
mov dword [ebp - 0x19c], eax
call eax
sub esp, 0x10
mov ebx, eax
mov eax, 0xbdf
call fcn.00401310
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str._08lx_n
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.00401ac0
test ebx, ebx
je 0x404e68
xor edx, edx
lea eax, [ebp - 0x158]
mov dword [ebp - 0x160], 0xf
mov dword [ebp - 0x15c], eax
mov dword [esp + 0xc], edx
lea edx, [ebp - 0x160]
mov dword [esp + 8], edx
mov dword [esp + 4], 6
mov eax, dword [ebp - 0x16c]
mov dword [esp], eax
mov eax, dword [ebp - 0x19c]
call eax
sub esp, 0x10
mov ebx, eax
mov eax, 0xbe5
call fcn.00401310
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str._08lx_n
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.00401ac0
test ebx, ebx
je 0x404e68
mov dword [ebp - 0x164], 0x10
xor eax, eax
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x164]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
mov dword [esp + 4], 2
mov eax, dword [ebp - 0x16c]
mov dword [esp], eax
mov eax, dword [sym.imp.advapi32.dll_CryptGetHashParam]
mov dword [ebp - 0x1a0], eax
call eax
sub esp, 0x14
mov ebx, eax
mov eax, 0xbeb
call fcn.00401310
mov esi, dword [esi + 0x34]
test ebx, ebx
je 0x4056a0
xor ebx, ebx
cmp dword [ebp - 0x164], 0x10
jne 0x4056a0
mov dword [esp + 8], 0x10
xor ebx, ebx
mov dword [esp + 4], 0x4188b0
mov dword [esp], edi
call sub.msvcrt.dll_memcmp
test eax, eax
sete bl
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], str._08lx_n
mov esi, dword fs:[0x18]
call fcn.00401ac0
lea eax, [ebp - 0x174]
mov dword [esp + 0xc], 0x400
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x170]
mov dword [esp + 4], 0x4c03
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x184]
mov dword [esp], eax
mov eax, dword [ebp - 0x194]
call eax
sub esp, 0x14
mov ebx, eax
mov eax, 0xbf1
call fcn.00401310
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str._08lx_n
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.00401ac0
test ebx, ebx
je 0x404e68
lea eax, [ebp - 0x168]
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x174]
mov dword [esp + 4], 0x8009
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x184]
mov dword [esp], eax
mov eax, dword [ebp - 0x190]
call eax
sub esp, 0x14
mov ebx, eax
mov eax, 0xbf5
call fcn.00401310
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str._08lx_n
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.00401ac0
test ebx, ebx
je 0x404e68
xor eax, eax
mov dword [esp + 4], 5
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x114]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x168]
mov dword [esp], eax
mov eax, dword [ebp - 0x19c]
call eax
sub esp, 0x10
mov ebx, eax
mov eax, 0xbf9
call fcn.00401310
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str._08lx_n
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.00401ac0
test ebx, ebx
je 0x404e68
xor eax, eax
mov dword [esp + 8], 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 4], edi
mov eax, dword [ebp - 0x168]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_CryptHashData]
sub esp, 0x10
mov ebx, eax
mov eax, 0xbfd
call fcn.00401310
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str._08lx_n
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.00401ac0
test ebx, ebx
je 0x404e68
xor eax, eax
lea edi, [ebp - 0x138]
mov dword [ebp - 0x164], 0x10
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x164]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
mov dword [esp + 4], 2
mov eax, dword [ebp - 0x168]
mov dword [esp], eax
mov eax, dword [ebp - 0x1a0]
call eax
sub esp, 0x14
mov ebx, eax
mov eax, 0xc02
call fcn.00401310
mov esi, dword [esi + 0x34]
test ebx, ebx
je 0x4058a2
xor ebx, ebx
cmp dword [ebp - 0x164], 0x10
jne 0x4058a2
mov dword [esp + 8], 0x10
xor ebx, ebx
mov dword [esp + 4], 0x4188a0
mov dword [esp], edi
call sub.msvcrt.dll_memcmp
test eax, eax
sete bl
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], str._08lx_n
call fcn.00401ac0
mov eax, dword [ebp - 0x168]
mov dword [esp], eax
mov ebx, dword [ebp - 0x198]
call ebx
push eax
mov eax, dword [ebp - 0x16c]
mov dword [esp], eax
call ebx
push edx
mov eax, dword [ebp - 0x170]
mov dword [esp], eax
call ebx
mov ebx, dword [sym.imp.advapi32.dll_CryptDestroyKey]
push ecx
mov eax, dword [ebp - 0x174]
mov dword [esp], eax
call ebx
push esi
mov eax, dword [ebp - 0x178]
mov dword [esp], eax
call ebx
push edi
mov eax, dword [ebp - 0x180]
mov dword [esp], eax
jmp 0x40513d
mov dword [esp], 1
call fcn.00401ac0
jmp 0x405118