Function at 0x40c6c0
Capabilities:
Generate random numbers via winapi
Terminate process

Disassembly:
sub esp, 0x154
mov eax, dword [0x6009e4]
xor eax, esp
mov dword [esp + 0x14c], eax
mov eax, dword [esp + 0x158]
push ebx
push ebp
push esi
mov dword [esp + 0x4c], eax
xor ebp, ebp
xor eax, eax
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x168]
xor ebx, ebx
push edi
xor esi, esi
mov dword [esp + 0x6c], ecx
xor edi, edi
mov dword [esp + 0x24], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x28], 0xc00
mov dword [esp + 0x60], 1
mov dword [esp + 0x5c], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x4c], eax
cmp dword [0x6234a0], eax
je 0x40ce45
cmp dword [0x6234a4], eax
je 0x40ce45
cmp dword [0x62349c], eax
je 0x40ce45
push edi
mov dword [ecx], eax
xorps xmm0, xmm0
push 0x5ec8d8
lea eax, [esp + 0x3c]
push eax
movups xmmword [esp + 0xa0], xmm0
movups xmmword [esp + 0xb0], xmm0
call dword [sym.imp.ncrypt.dll_NCryptOpenStorageProvider]
test eax, eax
js 0x40cdae
push 0x80
push 1
push 0x5ec8c4
push 0x5ec928
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x48]
call dword [sym.imp.ncrypt.dll_NCryptCreatePersistedKey]
test eax, eax
js 0x40cdae
push 0x80000040
push 4
lea eax, [esp + 0x30]
push eax
push 0x5ec930
push dword [esp + 0x28]
call dword [sym.imp.ncrypt.dll_NCryptSetProperty]
test eax, eax
jns 0x40c818
push 0x80000040
push 4
lea eax, [esp + 0x30]
mov dword [esp + 0x30], 0x800
push eax
push str.Length
push dword [esp + 0x28]
call dword [sym.imp.ncrypt.dll_NCryptSetProperty]
test eax, eax
js 0x40cdae
push 0x80000040
push 4
lea eax, [esp + 0x68]
push eax
push str.Export_Policy
push dword [esp + 0x28]
call dword [sym.imp.ncrypt.dll_NCryptSetProperty]
test eax, eax
js 0x40cdae
push 0x40
push dword [esp + 0x1c]
call dword [sym.imp.ncrypt.dll_NCryptFinalizeKey]
test eax, eax
js 0x40cdae
lea eax, [esp + 0x10]
push eax
push 0
push 1
push 1
push dword [esp + 0x28]
call dword [sym.imp.CRYPT32.dll_CryptExportPublicKeyInfo]
test eax, eax
je 0x40cdae
push dword [esp + 0x10]
call fcn.0058d200
mov esi, eax
add esp, 4
mov dword [esp + 0x40], esi
test esi, esi
je 0x40ce62
lea eax, [esp + 0x10]
push eax
push esi
push 1
push 1
push dword [esp + 0x28]
call dword [sym.imp.CRYPT32.dll_CryptExportPublicKeyInfo]
test eax, eax
je 0x40cdae
push 0
lea eax, [esp + 0x30]
push eax
push 0
push 0
push 3
push str.CNMeshNodeCertificate
push 1
call dword [sym.imp.CRYPT32.dll_CertStrToNameA]
test eax, eax
je 0x40cdae
push dword [esp + 0x2c]
call fcn.0058d200
add esp, 4
mov dword [esp + 0x38], eax
test eax, eax
je 0x40cea3
push 0
lea ecx, [esp + 0x30]
push ecx
push eax
push 0
push 3
push str.CNMeshNodeCertificate
push 1
call dword [sym.imp.CRYPT32.dll_CertStrToNameA]
test eax, eax
je 0x40cdae
mov eax, dword [esp + 0x2c]
push 0
mov dword [esp + 0x68], eax
lea eax, [esp + 0x34]
push eax
push 0
push 0
push 3
push dword [esp + 0x30]
push 1
call dword [sym.imp.CRYPT32.dll_CertStrToNameW]
test eax, eax
je 0x40cdae
push dword [esp + 0x30]
call fcn.0058d200
add esp, 4
mov dword [esp + 0x3c], eax
test eax, eax
je 0x40cee4
push 0
lea ecx, [esp + 0x34]
push ecx
push eax
push 0
push 3
push dword [esp + 0x30]
push 1
call dword [sym.imp.CRYPT32.dll_CertStrToNameW]
test eax, eax
je 0x40cdae
mov eax, dword [esp + 0x30]
push 0x70
mov dword [esp + 0x6c], eax
lea eax, [esp + 0xd4]
push 0
push eax
call fcn.005869c0
add esp, 0xc
lea eax, [esp + 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov esi, dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, 0xffff
add word [esp + 0x144], ax
lea eax, [esp + 0x84]
push eax
lea eax, [esp + 0x148]
push eax
call esi
add word [esp + 0x144], 0x1e
lea eax, [esp + 0x8c]
push eax
lea eax, [esp + 0x148]
push eax
call esi
push 0
push 0
push 0x5ec7a8
lea eax, [esp + 0x28]
mov dword [esp + 0x28], ebx
push eax
call dword [sym.imp.ncrypt.dll_BCryptOpenAlgorithmProvider]
test eax, eax
js 0x40c9fa
push 1
push 8
lea eax, [esp + 0x15c]
push eax
push dword [esp + 0x28]
call dword [sym.imp.ncrypt.dll_BCryptGenRandom]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40ca0b
push 0
push eax
call dword [sym.imp.ncrypt.dll_BCryptCloseAlgorithmProvider]
mov esi, dword [esp + 0x40]
lea eax, [esp + 0x154]
mov dword [esp + 0xd8], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0xe8], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0xec], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 0xf0], eax
mov eax, dword [esp + 0x88]
mov dword [esp + 0xf4], eax
mov eax, dword [esp + 0x8c]
mov dword [esp + 0xf8], eax
mov eax, dword [esp + 0x90]
mov dword [esp + 0xfc], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x104], eax
lea eax, [esp + 0x17]
mov dword [esp + 0xd0], 2
mov dword [esp + 0xd4], 8
mov dword [esp + 0xdc], str.1.2.840.113549.1.1.12
movups xmm0, xmmword [esi]
mov byte [esp + 0x17], 0xa8
movups xmmword [esp + 0x108], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [esp + 0x118], xmm0
xorps xmm0, xmm0
movq qword [esp + 0x78], xmm0
mov dword [esp + 0x7c], eax
lea eax, [esp + 0x10]
push eax
push 0
lea eax, [esp + 0x80]
mov dword [esp + 0x78], 4
push eax
push 0xe
push 1
mov dword [esp + 0x88], 0x603af4
mov dword [esp + 0x94], ebx
mov dword [esp + 0x8c], 1
call dword [sym.imp.CRYPT32.dll_CryptEncodeObject]
test eax, eax
je 0x40cdae
push dword [esp + 0x10]
call fcn.0058d200
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x40cf25
lea eax, [esp + 0x10]
push eax
push ebx
lea eax, [esp + 0x80]
push eax
push 0xe
push 1
call dword [sym.imp.CRYPT32.dll_CryptEncodeObject]
test eax, eax
je 0x40cdae
mov eax, dword [esp + 0x10]
mov dword [esp + 0x9c], eax
lea eax, [esp + 0x10]
push eax
push 0
lea eax, [esp + 0x78]
mov dword [esp + 0x9c], str.2.5.29.15
push eax
push 0x24
push 1
mov dword [esp + 0xac], edi
mov dword [esp + 0xb4], ebx
call dword [sym.imp.CRYPT32.dll_CryptEncodeObject]
test eax, eax
je 0x40cdae
push dword [esp + 0x10]
call fcn.0058d200
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x40cf66
lea eax, [esp + 0x10]
push eax
push ebp
lea eax, [esp + 0x78]
push eax
push 0x24
push 1
call dword [sym.imp.CRYPT32.dll_CryptEncodeObject]
test eax, eax
je 0x40cdae
mov eax, dword [esp + 0x10]
mov dword [esp + 0xac], eax
lea eax, [esp + 0x94]
mov dword [esp + 0x13c], eax
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x5c]
mov dword [esp + 0xa8], str.2.5.29.37
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0xb0], edi
push eax
push 0
push 0x10040
push dword [0x62349c]
mov dword [esp + 0xc8], ebp
mov dword [esp + 0x150], 2
call dword [sym.imp.CRYPT32.dll_CryptAcquireCertificatePrivateKey]
test eax, eax
je 0x40cdae
lea eax, [esp + 0x20]
push eax
push 0
push 0
lea eax, [esp + 0xe8]
push eax
lea eax, [esp + 0xe0]
push eax
push 2
push 1
push 1
push dword [esp + 0x44]
call dword [sym.imp.CRYPT32.dll_CryptSignAndEncodeCertificate]
test eax, eax
je 0x40cdae
push dword [esp + 0x20]
call fcn.0058d200
add esp, 4
mov dword [esp + 0x40], eax
test eax, eax
je 0x40cfa7
lea ecx, [esp + 0x20]
push ecx
push eax
push 0
lea eax, [esp + 0xe8]
push eax
lea eax, [esp + 0xe0]
push eax
push 2
push 1
push 1
push dword [esp + 0x44]
call dword [sym.imp.CRYPT32.dll_CryptSignAndEncodeCertificate]
test eax, eax
je 0x40cdae
push 0
push 0x2000
push 0
push 1
push 2
call dword [sym.imp.CRYPT32.dll_CertOpenStore]
mov edi, eax
test edi, edi
je 0x40cdae
lea eax, [esp + 0x4c]
push eax
push 1
push dword [esp + 0x28]
push dword [esp + 0x4c]
push 1
push edi
call dword [sym.imp.CRYPT32.dll_CertAddEncodedCertificateToStore]
test eax, eax
je 0x40cdae
lea eax, [esp + 0xb4]
mov dword [esp + 0xcc], 0
push eax
push 0
xorps xmm0, xmm0
mov dword [esp + 0xd4], 0
movups xmmword [esp + 0xbc], xmm0
push 2
push dword [esp + 0x58]
movq qword [esp + 0xd4], xmm0
mov dword [esp + 0xc4], str.MeshDummy
mov dword [esp + 0xc8], str.Microsoft_Software_Key_Storage_Provider
mov dword [esp + 0xcc], 0
mov dword [esp + 0xd0], 0
call dword [sym.imp.CRYPT32.dll_CertSetCertificateContextProperty]
test eax, eax
je 0x40cdae
push 4
push dword [esp + 0x54]
lea eax, [esp + 0x4c]
xorps xmm0, xmm0
push eax
push edi
movq qword [esp + 0x54], xmm0
call dword [sym.imp.CRYPT32.dll_PFXExportCertStore]
test eax, eax
je 0x40cdae
push dword [esp + 0x44]
call fcn.0058d200
add esp, 4
mov dword [esp + 0x48], eax
test eax, eax
je 0x40cfe8
push 4
push dword [esp + 0x54]
lea eax, [esp + 0x4c]
push eax
push edi
call dword [sym.imp.CRYPT32.dll_PFXExportCertStore]
test eax, eax
je 0x40cdae
mov ecx, dword [esp + 0x6c]
mov eax, dword [esp + 0x48]
mov dword [ecx], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x34]
mov ecx, dword [sym.imp.ncrypt.dll_NCryptFreeObject]
test eax, eax
je 0x40cdc5
push eax
call ecx
mov ecx, dword [sym.imp.ncrypt.dll_NCryptFreeObject]
cmp dword [esp + 0x54], 0
je 0x40cde9
mov eax, dword [esp + 0x24]
test eax, eax
je 0x40cde9
cmp dword [esp + 0x58], 0xffffffff
jne 0x40cde0
push eax
call ecx
jmp 0x40cde9
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test esi, esi
je 0x40cdf6
push esi
call fcn.0058bf82
add esp, 4
mov eax, dword [esp + 0x38]
test eax, eax
je 0x40ce07
push eax
call fcn.0058bf82
add esp, 4
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x40ce18
push eax
call fcn.0058bf82
add esp, 4
test edi, edi
je 0x40ce25
push 0
push edi
call dword [sym.imp.CRYPT32.dll_CertCloseStore]
test ebp, ebp
je 0x40ce32
push ebp
call fcn.0058bf82
add esp, 4
test ebx, ebx
je 0x40ce3f
push ebx
call fcn.0058bf82
add esp, 4
mov eax, dword [esp + 0x5c]
jmp 0x40ce47
xor eax, eax
mov ecx, dword [esp + 0x15c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00584a28
add esp, 0x154
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x228
mov edx, 0x5ec96c
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x228
push 0x5ec988
push 0x5ec9a4
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x22d
mov edx, 0x5ec9c8
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x22d
push 0x5ec9e4
push 0x5eca00
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x234
mov edx, 0x5eca24
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x234
push 0x5eca40
push 0x5eca5c
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x26e
mov edx, 0x5eca98
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x26e
push 0x5ecab4
push 0x5ecad0
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x277
mov edx, 0x5ecb00
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x277
push 0x5ecb1c
push 0x5ecb38
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x285
mov edx, 0x5ecb68
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x285
push 0x5ecb84
push 0x5ecba0
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x2a0
mov edx, 0x5ecc28
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x2a0
push str...meshcorewincrypto.cpp
push 0x5ecc60
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3