Function at 0x420e70
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt
Set file attributes
Write file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4da964
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x268
mov eax, dword [0x50d080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x25c], ecx
mov esi, dword [ebx + 0xc]
mov byte [ebp - 0x255], 0
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x248], 0
lea eax, [ebp - 0x254]
mov dword [ebp - 4], 0
push eax
push 8
mov ecx, eax
call fcn.00417a50
mov ecx, dword [ebp - 0x248]
mov eax, dword [ebp - 0x254]
mov dword [eax + ecx], 2
mov edx, dword [ebp - 0x248]
mov edi, dword [esi + 0x10]
add edx, 4
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x248], edx
jb 0x420f2d
mov esi, dword [esi]
mov ecx, dword [ebp - 0x250]
lea edi, [edi*2 + 2]
sub ecx, dword [ebp - 0x254]
lea eax, [edi + edx]
cmp eax, ecx
jbe 0x420f6e
mov eax, edi
sub eax, ecx
lea ecx, [ebp - 0x254]
add eax, edx
add eax, eax
sub eax, dword [ebp - 0x254]
add eax, dword [ebp - 0x250]
push ecx
push eax
call fcn.00417a50
mov edx, dword [ebp - 0x248]
mov eax, dword [ebp - 0x254]
push edi
add eax, edx
push esi
push eax
call fcn.0047e830
mov ecx, dword [ebp - 0x248]
add esp, 0xc
mov eax, dword [ebp - 0x25c]
add ecx, edi
mov edi, dword [ebp - 0x250]
mov esi, edi
mov edx, dword [ebp - 0x254]
sub esi, edx
mov dword [ebp - 0x248], ecx
mov eax, dword [eax + 4]
mov dword [ebp - 0x264], eax
lea eax, [ecx + 4]
cmp eax, esi
jbe 0x420fdb
sub ecx, esi
lea eax, [ecx*2 + 8]
sub eax, edx
lea ecx, [ebp - 0x254]
add eax, edi
push ecx
push eax
call fcn.00417a50
mov ecx, dword [ebp - 0x248]
mov edx, dword [ebp - 0x254]
mov eax, dword [ebp - 0x264]
mov dword [edx + ecx], eax
mov eax, dword [ebp - 0x25c]
mov ecx, dword [ebp - 0x248]
add ecx, 4
mov dword [ebp - 0x248], ecx
mov eax, dword [eax]
mov esi, dword [eax]
cmp eax, esi
je 0x4210f1
cmp dword [esi + 0x24], 8
lea edi, [esi + 0x10]
mov edx, dword [edi + 0x10]
jb 0x421013
mov edi, dword [edi]
mov eax, dword [ebp - 0x250]
lea edx, [edx*2 + 2]
sub eax, dword [ebp - 0x254]
mov dword [ebp - 0x268], eax
lea eax, [edx + ecx]
mov dword [ebp - 0x264], edx
cmp eax, dword [ebp - 0x268]
jbe 0x42106e
mov eax, edx
sub eax, dword [ebp - 0x268]
add eax, ecx
lea ecx, [ebp - 0x254]
add eax, eax
sub eax, dword [ebp - 0x254]
add eax, dword [ebp - 0x250]
push ecx
push eax
call fcn.00417a50
mov ecx, dword [ebp - 0x248]
mov edx, dword [ebp - 0x264]
mov eax, dword [ebp - 0x254]
push edx
add eax, ecx
push edi
push eax
call fcn.0047e830
mov eax, dword [ebp - 0x264]
lea ecx, [ebp - 0x254]
add dword [ebp - 0x248], eax
add esp, 0xc
lea eax, [esi + 0x28]
push eax
call fcn.00431fe0
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
je 0x4210c4
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x4210c0
nop
cmp esi, dword [eax + 8]
jne 0x4210c0
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x4210b0
mov esi, eax
jmp 0x4210dc
mov esi, eax
mov ecx, dword [esi]
cmp byte [ecx + 0xd], 0
jne 0x4210dc
nop
mov eax, dword [ecx]
mov esi, ecx
mov ecx, eax
cmp byte [eax + 0xd], 0
je 0x4210d0
mov eax, dword [ebp - 0x25c]
cmp dword [eax], esi
je 0x4210f1
mov ecx, dword [ebp - 0x248]
jmp 0x421005
mov eax, dword [ebp - 0x250]
sub eax, dword [ebp - 0x254]
lea ecx, [eax - 4]
and ecx, 7
jbe 0x421124
sub eax, ecx
mov byte [ebp - 0x25d], 0
lea edx, [ebp - 0x25d]
add eax, 8
push edx
push eax
lea ecx, [ebp - 0x254]
call fcn.00421890
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 0xf
mov byte [ebp - 0x240], 0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x240]
mov dword [ebp - 0x20], 0x34536b31
mov dword [ebp - 0x1c], 0xf3f5537e
mov word [ebp - 0x18], 0xe9
call fcn.0040fbc0
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov byte [ebp - 4], 3
xor edi, edi
mov eax, dword [ebp - 0x254]
mov dword [ebp - 0x25c], edi
cmp eax, dword [ebp - 0x250]
je 0x4212a7
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
lea eax, [ebp - 0x244]
push 0xf0000008
push 1
push edi
push edi
push eax
call esi
test eax, eax
jne 0x421207
push eax
push 1
push eax
push str.Spreadsheet_Tools
lea eax, [ebp - 0x244]
push eax
call esi
test eax, eax
jne 0x421207
push 8
push 1
push eax
push str.Spreadsheet_Tools
lea eax, [ebp - 0x244]
push eax
call esi
test eax, eax
jne 0x421207
push 0x20
push 1
push eax
push str.Spreadsheet_Tools
lea eax, [ebp - 0x244]
push eax
call esi
test eax, eax
je 0x421294
lea eax, [ebp - 0x25c]
push eax
push 0
push 0
push 0x8003
push dword [ebp - 0x244]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x421294
mov ecx, dword [ebp - 0x250]
mov eax, dword [ebp - 0x254]
sub ecx, eax
push 0
push ecx
push eax
push dword [ebp - 0x25c]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x421284
lea eax, [ebp - 0x20]
mov dword [ebp - 0x264], 0x10
push eax
push 0x10
mov ecx, eax
call fcn.00417a50
push 0
lea eax, [ebp - 0x264]
push eax
push dword [ebp - 0x20]
push 2
push dword [ebp - 0x25c]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
mov ecx, 1
cmovne edi, ecx
push dword [ebp - 0x25c]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
test edi, edi
jne 0x4212a7
lea eax, [ebp - 0x20]
push eax
push 1
mov ecx, eax
call fcn.00417a50
mov eax, dword [ebp - 0x20]
mov byte [eax], 0x17
mov dword [ebp - 0x278], 0
mov dword [ebp - 0x274], 0
mov dword [ebp - 0x270], 0
mov dword [ebp - 0x26c], 0
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x278]
call fcn.00431fe0
push dword [ebp - 0x264]
lea ecx, [ebp - 0x254]
push dword [ebp - 0x274]
push dword [ebp - 0x278]
push dword [ebp - 0x254]
call fcn.00422ab0
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x278]
test ecx, ecx
je 0x421361
mov edx, dword [ebp - 0x270]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x421339
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x421509
push edx
push ecx
call fcn.0047cf1c
add esp, 8
mov dword [ebp - 0x278], 0
mov dword [ebp - 0x274], 0
mov dword [ebp - 0x270], 0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x421399
mov edx, dword [ebp - 0x18]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x42138f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42150e
push edx
push ecx
call fcn.0047cf1c
add esp, 8
lea eax, [ebp - 0x254]
push eax
lea ecx, [ebp - 0x244]
call fcn.00433b80
mov ax, word [ebx + 8]
movups xmm0, xmmword [str.:lockxls.data]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov word [ebp - 0x228], ax
mov eax, dword [0x4fade8]
mov dword [ebp - 0x20e], eax
movzx eax, word [0x4fadec]
mov word [ebp - 0x20a], ax
lea eax, [ebp - 0x228]
movups xmmword [ebp - 0x226], xmm0
push 0x80
movq xmm0, qword [0x4fade0]
push eax
movq qword [ebp - 0x216], xmm0
call edi
lea eax, [ebp - 0x228]
push 0x4fadc8
push eax
call fcn.0048bd9c
mov esi, eax
add esp, 8
test esi, esi
je 0x421458
mov edx, dword [ebp - 0x254]
mov ecx, dword [ebp - 0x250]
cmp edx, ecx
je 0x42143a
push esi
sub ecx, edx
push ecx
push 1
push edx
call fcn.004ab013
add esp, 0x10
push esi
call fcn.004aacac
add esp, 4
lea eax, [ebp - 0x228]
push 0x82
push eax
call edi
mov byte [ebp - 0x255], 1
mov edx, dword [ebp - 0x22c]
cmp edx, 0x10
jb 0x421492
mov ecx, dword [ebp - 0x240]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x421488
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x421513
push edx
push ecx
call fcn.0047cf1c
add esp, 8
mov ecx, dword [ebp - 0x254]
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 0xf
mov byte [ebp - 0x240], 0
test ecx, ecx
je 0x4214e3
mov edx, dword [ebp - 0x24c]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x4214d9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x421518
push edx
push ecx
call fcn.0047cf1c
add esp, 8
mov al, byte [ebp - 0x255]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0047cf2f
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
call fcn.004896af
call fcn.004896af
call fcn.004896af
call fcn.004896af
int3