Function at 0x410fa5
Capabilities:
Generate random numbers via winapi
Terminate process

Disassembly:
sub esp, 0x15c
mov eax, dword [0x6d9d44]
xor eax, esp
mov dword [esp + 0x154], eax
mov eax, dword [esp + 0x160]
or dword [esp + 0x14], 0xffffffff
push ebx
push ebp
push esi
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x174]
push edi
xor edi, edi
mov dword [esp + 0x50], eax
mov eax, edi
mov dword [esp + 0x1c], edx
mov esi, edi
mov edx, dword [esp + 0x17c]
mov ebp, edi
mov dword [esp + 0x6c], ecx
mov ebx, edi
mov dword [esp + 0x70], edx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x34], 0xc00
mov dword [esp + 0x74], 1
mov dword [esp + 0x60], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x20], edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x5c], edi
mov dword [esp + 0x64], edi
cmp dword [ecx], edi
je 0x4117d2
cmp dword [ecx + 4], edi
je 0x4117d2
cmp dword [ecx + 8], edi
je 0x4117d2
push 8
pop ecx
mov dword [edx], edi
lea edi, [esp + 0x9c]
push ebx
rep stosd dword es:[edi], eax
push 0x6c2288
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.ncrypt.dll_NCryptOpenStorageProvider]
test eax, eax
js 0x411745
push 0x80
push 1
push 0x6c2274
push 0x6c22d8
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x3c]
call dword [sym.imp.ncrypt.dll_NCryptCreatePersistedKey]
test eax, eax
js 0x411745
mov edi, dword [sym.imp.ncrypt.dll_NCryptSetProperty]
lea eax, [esp + 0x34]
push 0x80000040
push 4
push eax
push 0x6c22e0
push dword [esp + 0x28]
call edi
test eax, eax
jns 0x4110e6
push 0x80000040
push 4
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], 0x800
push eax
push str.Length
push dword [esp + 0x28]
call edi
test eax, eax
js 0x411745
push 0x80000040
push 4
lea eax, [esp + 0x7c]
push eax
push str.Export_Policy
push dword [esp + 0x28]
call edi
test eax, eax
js 0x411745
push 0x40
push dword [esp + 0x1c]
call dword [sym.imp.ncrypt.dll_NCryptFinalizeKey]
test eax, eax
js 0x411745
lea eax, [esp + 0x10]
push eax
push 0
push 1
push 1
push dword [esp + 0x28]
call dword [sym.imp.CRYPT32.dll_CryptExportPublicKeyInfo]
test eax, eax
je 0x411745
push dword [esp + 0x10]
call fcn.0060a440
mov edi, eax
mov dword [esp + 0x60], edi
pop ecx
test edi, edi
je 0x4117ef
lea eax, [esp + 0x10]
push eax
push edi
push 1
push 1
push dword [esp + 0x28]
call dword [sym.imp.CRYPT32.dll_CryptExportPublicKeyInfo]
test eax, eax
je 0x411745
xor ecx, ecx
lea eax, [esp + 0x38]
push ecx
push eax
push ecx
push ecx
push 3
push dword [esp + 0x30]
push 1
call dword [sym.imp.CRYPT32.dll_CertStrToNameA]
test eax, eax
je 0x411745
push dword [esp + 0x38]
call fcn.0060a440
mov dword [esp + 0x44], eax
pop ecx
test eax, eax
jne 0x4111ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x25f
push esi
push edi
mov edx, 0x6c2378
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push edi
push 0x6c2394
push 0x6c23b0
jmp 0x41181c
push 0
lea ecx, [esp + 0x3c]
push ecx
push eax
push 0
push 3
push dword [esp + 0x30]
push 1
call dword [sym.imp.CRYPT32.dll_CertStrToNameA]
test eax, eax
je 0x411745
mov eax, dword [esp + 0x38]
xor ecx, ecx
push ecx
mov dword [esp + 0x6c], eax
lea eax, [esp + 0x24]
push eax
push ecx
push ecx
push 3
push dword [esp + 0x44]
push 1
call dword [sym.imp.CRYPT32.dll_CertStrToNameW]
test eax, eax
je 0x411745
push dword [esp + 0x20]
call fcn.0060a440
mov dword [esp + 0x48], eax
pop ecx
test eax, eax
jne 0x41125a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x266
push esi
push edi
mov edx, 0x6c23d4
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push edi
push 0x6c23f0
push 0x6c240c
jmp 0x41181c
push 0
lea ecx, [esp + 0x24]
push ecx
push eax
push 0
push 3
push dword [esp + 0x44]
push 1
call dword [sym.imp.CRYPT32.dll_CertStrToNameW]
test eax, eax
je 0x411745
mov eax, dword [esp + 0x20]
push 0x70
mov dword [esp + 0x34], eax
lea eax, [esp + 0xdc]
push 0
push eax
call fcn.005c37d0
add esp, 0xc
lea eax, [esp + 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov esi, dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, 0xffff
add word [esp + 0x14c], ax
lea eax, [esp + 0x8c]
push eax
lea eax, [esp + 0x150]
push eax
call esi
add word [esp + 0x14c], 0x1e
lea eax, [esp + 0x94]
push eax
lea eax, [esp + 0x150]
push eax
call esi
xor esi, esi
lea eax, [esp + 0x1c]
push esi
push esi
push 0x6c2158
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.ncrypt.dll_BCryptOpenAlgorithmProvider]
test eax, eax
js 0x411316
push 1
push 8
lea eax, [esp + 0x164]
push eax
push dword [esp + 0x28]
call dword [sym.imp.ncrypt.dll_BCryptGenRandom]
cmp dword [esp + 0x1c], ebx
je 0x411327
push esi
push dword [esp + 0x20]
call dword [sym.imp.ncrypt.dll_BCryptCloseAlgorithmProvider]
lea eax, [esp + 0x15c]
mov dword [esp + 0xd8], 2
mov dword [esp + 0xe0], eax
mov esi, edi
mov eax, dword [esp + 0x68]
lea edi, [esp + 0x110]
mov dword [esp + 0xf0], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0xf4], eax
mov eax, dword [esp + 0x8c]
mov dword [esp + 0xf8], eax
mov eax, dword [esp + 0x90]
mov dword [esp + 0xfc], eax
mov eax, dword [esp + 0x94]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x98]
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x44]
push 6
mov dword [esp + 0x110], eax
xor eax, eax
pop ecx
mov dword [esp + 0xdc], 8
mov dword [esp + 0xe4], str.1.2.840.113549.1.1.12
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x80]
mov dword [esp + 0x78], 4
stosd dword es:[edi], eax
xor esi, esi
xor ecx, ecx
mov dword [esp + 0x7c], 0x6e0780
inc ecx
mov byte [esp + 0x17], 0xa8
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x17]
mov edi, dword [sym.imp.CRYPT32.dll_CryptEncodeObject]
mov dword [esp + 0x84], eax
lea eax, [esp + 0x10]
push eax
push esi
lea eax, [esp + 0x88]
mov dword [esp + 0x88], ecx
push eax
push 0xe
push ecx
call edi
test eax, eax
je 0x411743
push dword [esp + 0x10]
call fcn.0060a440
mov ebp, eax
pop ecx
test ebp, ebp
jne 0x411463
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x2a0
push esi
push edi
mov edx, 0x6c2448
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push edi
push 0x6c2464
push 0x6c2480
jmp 0x41181c
lea eax, [esp + 0x10]
push eax
push ebp
lea eax, [esp + 0x88]
push eax
push 0xe
push 1
call edi
test eax, eax
je 0x411743
mov eax, dword [esp + 0x10]
mov dword [esp + 0xa4], eax
lea eax, [esp + 0x10]
push eax
push esi
lea eax, [esp + 0x80]
mov dword [esp + 0xa4], str.2.5.29.15
push eax
push 0x24
push 1
mov dword [esp + 0xb4], esi
mov dword [esp + 0xbc], ebp
call edi
test eax, eax
je 0x411743
push dword [esp + 0x10]
call fcn.0060a440
mov esi, eax
pop ecx
test esi, esi
jne 0x411501
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x2a9
push esi
push edi
mov edx, 0x6c24b0
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push edi
push 0x6c24cc
push 0x6c24e8
jmp 0x41181c
lea eax, [esp + 0x10]
push eax
push esi
lea eax, [esp + 0x80]
push eax
push 0x24
push 1
call edi
test eax, eax
je 0x411745
mov eax, dword [esp + 0x10]
xor edi, edi
mov dword [esp + 0xb4], eax
lea eax, [esp + 0x9c]
mov dword [esp + 0x144], eax
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x5c]
mov dword [esp + 0xb0], str.2.5.29.37
push eax
lea eax, [esp + 0x34]
mov dword [esp + 0xb8], edi
push eax
mov eax, dword [esp + 0x78]
push edi
push 0x10040
mov dword [esp + 0xcc], esi
push dword [eax + 8]
mov dword [esp + 0x158], 2
call dword [sym.imp.CRYPT32.dll_CryptAcquireCertificatePrivateKey]
test eax, eax
je 0x411745
lea eax, [esp + 0x24]
push eax
push edi
push edi
lea eax, [esp + 0xf0]
push eax
lea eax, [esp + 0xe8]
push eax
push 2
push 1
push 1
push dword [esp + 0x4c]
call dword [sym.imp.CRYPT32.dll_CryptSignAndEncodeCertificate]
test eax, eax
je 0x411745
push dword [esp + 0x24]
call fcn.0060a440
mov edi, eax
pop ecx
test edi, edi
jne 0x4115f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x2b7
push esi
push edi
mov edx, 0x6c2518
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push edi
push 0x6c2534
push 0x6c2550
jmp 0x41181c
lea eax, [esp + 0x24]
push eax
push edi
push 0
lea eax, [esp + 0xf0]
push eax
lea eax, [esp + 0xe8]
push eax
push 2
push 1
push 1
push dword [esp + 0x4c]
call dword [sym.imp.CRYPT32.dll_CryptSignAndEncodeCertificate]
test eax, eax
je 0x411745
push 0
push 0x2000
push 0
push 1
push 2
call dword [sym.imp.CRYPT32.dll_CertOpenStore]
mov ebx, eax
test ebx, ebx
je 0x411745
lea eax, [esp + 0x64]
push eax
push 1
push dword [esp + 0x2c]
push edi
push 1
push ebx
call dword [sym.imp.CRYPT32.dll_CertAddEncodedCertificateToStore]
test eax, eax
je 0x411745
push 7
pop ecx
xor eax, eax
lea edi, [esp + 0xbc]
rep stosd dword es:[edi], eax
xor edi, edi
mov dword [esp + 0xbc], str.MeshDummy
lea eax, [esp + 0xbc]
mov dword [esp + 0xc0], str.Microsoft_Software_Key_Storage_Provider
push eax
push edi
push 2
push dword [esp + 0x70]
mov dword [esp + 0xd4], edi
mov dword [esp + 0xd8], edi
mov dword [esp + 0xe4], edi
call dword [sym.imp.CRYPT32.dll_CertSetCertificateContextProperty]
test eax, eax
je 0x411745
push 4
push dword [esp + 0x54]
lea eax, [esp + 0x50]
mov dword [esp + 0x50], edi
push eax
mov dword [esp + 0x58], edi
mov edi, dword [sym.imp.CRYPT32.dll_PFXExportCertStore]
push ebx
call edi
test eax, eax
je 0x411745
push dword [esp + 0x48]
call fcn.0060a440
mov dword [esp + 0x50], eax
pop ecx
test eax, eax
jne 0x41171d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x2d2
push esi
push edi
mov edx, 0x6c25d8
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push edi
push str...meshcorewincrypto.cpp
push 0x6c2610
jmp 0x41181c
push 4
push dword [esp + 0x54]
lea eax, [esp + 0x50]
push eax
push ebx
call edi
test eax, eax
je 0x411745
mov ecx, dword [esp + 0x70]
mov eax, dword [esp + 0x4c]
mov dword [ecx], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x60], eax
jmp 0x411745
mov esi, ebx
cmp dword [esp + 0x28], 0
mov edi, dword [sym.imp.ncrypt.dll_NCryptFreeObject]
je 0x411758
push dword [esp + 0x28]
call edi
cmp dword [esp + 0x54], 0
je 0x41177c
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x41177c
cmp dword [esp + 0x58], 0xffffffff
jne 0x411773
push eax
call edi
jmp 0x41177c
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [esp + 0x5c]
test eax, eax
je 0x41178b
push eax
call fcn.00609c30
pop ecx
mov eax, dword [esp + 0x40]
test eax, eax
je 0x41179a
push eax
call fcn.00609c30
pop ecx
mov eax, dword [esp + 0x44]
test eax, eax
je 0x4117a9
push eax
call fcn.00609c30
pop ecx
test ebx, ebx
je 0x4117b6
push 0
push ebx
call dword [sym.imp.CRYPT32.dll_CertCloseStore]
test esi, esi
je 0x4117c1
push esi
call fcn.00609c30
pop ecx
test ebp, ebp
je 0x4117cc
push ebp
call fcn.00609c30
pop ecx
mov eax, dword [esp + 0x60]
jmp 0x4117d4
xor eax, eax
mov ecx, dword [esp + 0x164]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005c0db0
add esp, 0x15c
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x25a
push esi
push edi
mov edx, 0x6c231c
xor ecx, ecx
call fcn.0048f95e
add esp, 0xc
push edi
push 0x6c2338
push 0x6c2354
call fcn.00401109
add esp, 0xc
push esi
call fcn.005d0820
int3