Function at 0x4783e5
Capabilities:
Encrypt data using rc4 via systemfunction033

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [ebx]
push esi
push edi
xor ecx, ecx
push 0x10
lea edi, [eax + edx]
pop esi
lea edx, [ebp - 0x38]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
cmp eax, ecx
je 0x4785e4
mov edx, dword [ebx + 4]
cmp edx, ecx
je 0x4785e4
movzx eax, word [edi + 2]
mov ecx, eax
dec ecx
je 0x4784b4
dec ecx
je 0x478447
push eax
push str.ERROR_kuhl_m_lsadump_getHash___Unknow_SAM_HASH_revision___hu__n
call fcn.00409709
pop ecx
pop ecx
jmp 0x4785d5
cmp dword [edi + 4], esi
jb 0x4785e4
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
add edx, 0xffffffe8
push edx
lea eax, [edi + 0x18]
push eax
add edi, 8
push edi
push dword [ebp + 8]
call fcn.00403f72
add esp, 0x18
test eax, eax
je 0x4785d5
mov eax, dword [ebp - 0x18]
push eax
push 0x40
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 8], eax
test eax, eax
je 0x4784a6
push dword [ebp - 0x18]
push dword [ebp - 0x14]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [ebp - 4], 1
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x478591
cmp edx, 6
jb 0x4785e4
lea eax, [ebp - 0x90]
push eax
call sub.cryptdll.dll_MD5Init
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x90]
push eax
call sub.cryptdll.dll_MD5Update
push 4
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x90]
push eax
call sub.cryptdll.dll_MD5Update
mov eax, dword [ebp + 0x14]
xor esi, esi
neg eax
sbb eax, eax
and eax, 7
add eax, 0xb
cmp dword [ebp + 0x10], esi
je 0x478512
cmp dword [ebp + 0x14], esi
je 0x47850b
mov ecx, str.NTPASSWORDHISTORY
jmp 0x478521
mov ecx, str.NTPASSWORD
jmp 0x478521
mov ecx, str.LMPASSWORDHISTORY
cmp dword [ebp + 0x14], esi
jne 0x478521
mov ecx, str.LMPASSWORD
push eax
push ecx
lea eax, [ebp - 0x90]
push eax
call sub.cryptdll.dll_MD5Update
lea eax, [ebp - 0x90]
push eax
call sub.cryptdll.dll_MD5Final
mov eax, dword [ebx + 4]
sub eax, 4
push eax
push 0x40
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 8], eax
cmp eax, esi
je 0x4785e4
push dword [ebp - 0x10]
add edi, 4
push edi
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
call sub.ADVAPI32.dll_SystemFunction033
xor ecx, ecx
test eax, eax
setge cl
mov dword [ebp - 4], ecx
cmp ecx, esi
jne 0x478597
push str.ERROR_kuhl_m_lsadump_getHash___RtlDecryptData2_n
call fcn.00409709
pop ecx
cmp dword [ebp - 4], 0
je 0x4785d5
xor eax, eax
cmp dword [ebp + 0x10], eax
je 0x4785b1
cmp dword [ebp + 0x14], eax
je 0x4785aa
mov eax, str.ntlm
jmp 0x4785c0
mov eax, str.NTLM
jmp 0x4785c0
cmp dword [ebp + 0x14], eax
mov eax, str.lm
jne 0x4785c0
mov eax, str.LM
push dword [ebp + 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0x10]
push dword [ebp - 8]
call fcn.00489a35
add esp, 0x14
cmp dword [ebp - 8], 0
je 0x4785e4
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret