Function at 0x476ebf
Capabilities:
Create new key via cryptacquirecontext
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
xor esi, esi
push esi
push esi
push str.live
push dword [ebp + 0xc]
mov ebx, eax
push dword [ebp + 8]
mov edi, ecx
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], esi
call fcn.0040f224
push esi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040f224
add esp, 0x28
test eax, eax
jne 0x476f1e
push esi
lea eax, [ebp - 4]
push eax
push 0x4c4c6c
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040f224
add esp, 0x14
cmp dword [ebp - 0xc], esi
jne 0x476f2c
cmp dword [ebp - 4], esi
je 0x4770fa
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x1c], eax
cmp eax, esi
je 0x4770fa
push ebx
push dword [ebp + 0x1c]
push eax
call sub.msvcrt.dll_memcpy
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0xc]
add esp, 0xc
cmp ebx, esi
je 0x476f76
mov eax, str.machine
cmp edi, esi
jne 0x476f65
mov eax, str.user
push eax
push dword [ebp + 0x10]
push str.___Live_Key__:__s____s_:
call fcn.00409709
add esp, 0xc
cmp dword [0x4fe330], 0xa28
mov eax, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider__Prototype_
jbe 0x476f8c
mov eax, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
mov ecx, ebx
neg ecx
sbb ecx, ecx
and ecx, 0x10000000
add ecx, 0xf0000000
neg edi
sbb edi, edi
and edi, 0x20
or ecx, edi
push ecx
push 0x18
push eax
mov eax, ebx
neg eax
sbb eax, eax
and eax, dword [ebp + 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x4770de
cmp ebx, esi
mov ebx, dword [sym.imp.ADVAPI32.dll_CryptImportKey]
je 0x476fdd
push 0x4c1b0c
call fcn.00409709
jmp 0x47703d
push esi
push dword [ebp - 4]
lea eax, [ebp - 0x24]
lea edi, [ebp - 0x10]
call fcn.00407b36
pop ecx
pop ecx
test eax, eax
je 0x477043
push dword [ebp - 4]
push dword [ebp + 0x10]
push str.___PVK_file__:__s____s_:
call fcn.00409709
add esp, 0xc
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push esi
push esi
push dword [eax + 0x14]
add eax, 0x18
push eax
push dword [ebp - 0x14]
call ebx
test eax, eax
je 0x47702b
push 0x4c1b0c
call fcn.00409709
pop ecx
jmp 0x477043
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kuhl_m_iis_apphost_provider_decrypt___CryptImportKey__RSA___0x_08x__n
call fcn.00409709
pop ecx
pop ecx
cmp dword [ebp - 0xc], esi
jne 0x477048
cmp dword [ebp - 8], esi
je 0x4770c4
lea eax, [ebp - 0x18]
push eax
push esi
push dword [ebp - 8]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp - 0x14]
call ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
test eax, eax
je 0x4770a2
mov edi, dword [ebp - 0x1c]
lea eax, [ebp - 0x20]
push eax
push edi
push esi
push esi
push esi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x477088
add edi, 4
push edi
push str.___Password__:__s_n
jmp 0x477094
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kuhl_m_iis_apphost_provider_decrypt___CryptDecrypt__0x_08x__n
call fcn.00409709
pop ecx
pop ecx
push dword [ebp - 0x18]
call ebx
jmp 0x4770b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kuhl_m_iis_apphost_provider_decrypt___CryptImportKey__session___0x_08x__n
call fcn.00409709
pop ecx
pop ecx
cmp dword [ebp - 0xc], esi
jne 0x4770d2
cmp dword [ebp - 8], esi
je 0x4770c4
push dword [ebp - 8]
call ebx
cmp dword [ebp - 0x10], esi
je 0x4770d2
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x4770f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kuhl_m_iis_apphost_provider_decrypt___CryptAcquireContext__0x_08x__n
call fcn.00409709
pop ecx
pop ecx
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
pop ebx
leave
ret