Function at 0x441ace
Capabilities:
Create new key via cryptacquirecontext
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
xor edi, edi
push edi
push edi
push str.live
push dword [ebp + 0xc]
mov ebx, eax
push dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], edi
call fcn.0040a7d9
push edi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040a7d9
add esp, 0x28
test eax, eax
jne 0x441b2d
push edi
lea eax, [ebp - 4]
push eax
push 0x46933c
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040a7d9
add esp, 0x14
cmp dword [ebp - 0xc], edi
jne 0x441b3b
cmp dword [ebp - 4], edi
je 0x441d0d
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x1c], eax
cmp eax, edi
je 0x441d0d
push ebx
push dword [ebp + 0x1c]
push eax
call sub.msvcrt.dll_memcpy
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0xc]
add esp, 0xc
cmp ebx, edi
je 0x441b85
mov eax, str.machine
cmp esi, edi
jne 0x441b74
mov eax, str.user
push eax
push dword [ebp + 0x10]
push str.___Live_Key__:__s____s_:
call fcn.00407017
add esp, 0xc
cmp dword [0x4872e4], 0xa28
mov eax, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider__Prototype_
jbe 0x441b9b
mov eax, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
mov ecx, ebx
neg ecx
sbb ecx, ecx
and ecx, 0x10000000
add ecx, 0xf0000000
neg esi
sbb esi, esi
and esi, 0x20
or ecx, esi
push ecx
push 0x18
push eax
mov eax, ebx
neg eax
sbb eax, eax
and eax, dword [ebp + 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x441cf1
cmp ebx, edi
je 0x441be6
push 0x469eec
call fcn.00407017
jmp 0x441c48
push dword [ebp - 4]
lea esi, [ebp - 0x24]
lea ebx, [ebp - 0x10]
call fcn.0040560b
pop ecx
test eax, eax
je 0x441c4e
push dword [ebp - 4]
push dword [ebp + 0x10]
push str.___PVK_file__:__s____s_:
call fcn.00407017
add esp, 0xc
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push edi
push edi
push dword [eax + 0x14]
add eax, 0x18
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x441c36
push 0x469eec
call fcn.00407017
pop ecx
jmp 0x441c4e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kuhl_m_iis_apphost_provider_decrypt___CryptImportKey__RSA___0x_08x__n
call fcn.00407017
pop ecx
pop ecx
cmp dword [ebp - 0xc], edi
jne 0x441c57
cmp dword [ebp - 8], edi
je 0x441cd7
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp - 8]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov esi, dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
test eax, eax
je 0x441cb5
mov ebx, dword [ebp - 0x1c]
lea eax, [ebp - 0x20]
push eax
push ebx
push edi
push edi
push edi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x441c9b
add ebx, 4
push ebx
push str.___Password__:__s_n
jmp 0x441ca7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kuhl_m_iis_apphost_provider_decrypt___CryptDecrypt__0x_08x__n
call fcn.00407017
pop ecx
pop ecx
push dword [ebp - 0x18]
call esi
jmp 0x441cc8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kuhl_m_iis_apphost_provider_decrypt___CryptImportKey__session___0x_08x__n
call fcn.00407017
pop ecx
pop ecx
cmp dword [ebp - 0xc], edi
jne 0x441ce5
cmp dword [ebp - 8], edi
je 0x441cd7
push dword [ebp - 8]
call esi
cmp dword [ebp - 0x10], edi
je 0x441ce5
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push edi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x441d04
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kuhl_m_iis_apphost_provider_decrypt___CryptAcquireContext__0x_08x__n
call fcn.00407017
pop ecx
pop ecx
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
pop ebx
leave
ret