Function at 0x426420
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x154
mov eax, dword [0x4ff684]
xor eax, esp
mov dword [esp + 0x150], eax
push ebx
push esi
push edi
mov dword [esp + 0x2c], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov byte [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0x34], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x34
mov dword [esp + 0x20], eax
call fcn.004964ef
mov ebx, eax
add esp, 4
mov dword [esp + 0x10], ebx
test ebx, ebx
je 0x426d20
mov dword [ebx + 4], 0
push 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
push 0x40000000
mov dword [ebx + 0x14], 0
push 3
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
push 0
mov dword [ebx + 0x20], 0
push 0
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x28], 0
push 0xc0000000
mov dword [ebx + 0x2c], 0
push str..WGUARDNT
mov dword [ebx + 0x30], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x42651f
push 0
push 0x40000000
push 3
push 0
push 0
push 0xc0000000
push str..GlobalWGUARDNT
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x42651f
mov dword [ebx], 0
jmp 0x426525
mov dword [ebx], eax
test eax, eax
jne 0x42652a
mov byte [esp + 0x14], 1
push 0
push 0x40000000
push 3
push 0
push 0
push SysReAllocString
push str..WGUARDNT
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x4265b5
push 0
push 0x40000000
push 3
push 0
push 0
push SysReAllocString
push str..GlobalWGUARDNT
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x4265b5
push 0
push 0x40000000
push 3
push 0
push 0
push 0xc0000000
push str..WGUARDNT
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x4265b5
push 0
push 0x40000000
push 3
push 0
push 0
push 0xc0000000
push str..GlobalWGUARDNT
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, eax
xor eax, eax
mov edx, 1
cmp ecx, 0xffffffff
push 0x104
cmovne eax, ecx
mov ecx, dword [esp + 0x18]
test eax, eax
mov dword [ebx + 8], eax
movzx ecx, cl
lea eax, [esp + 0x54]
cmove ecx, edx
push 0
push eax
mov dword [esp + 0x20], ecx
call fcn.0048b4c0
add esp, 0xc
lea eax, [ebx + 0x14]
mov dword [esp + 0x3c], eax
push eax
call dword [sym.imp.RPCRT4.dll_UuidCreate]
test eax, eax
jne 0x426dbb
lea eax, [ebx + 0x24]
push eax
mov dword [esp + 0x24], eax
call dword [sym.imp.RPCRT4.dll_UuidCreate]
test eax, eax
jne 0x426dbb
mov dword [esp + 0x30], eax
lea edi, [ebx + 0x10]
push ecx
lea eax, [esp + 0x34]
mov dword [esp + 0x1c], edi
push eax
mov edx, str.AacControl6
call fcn.00426340
mov esi, str.AacControl6
test eax, eax
je 0x42669a
nop dword [eax]
cmp esi, str.AacControl6
jne 0x42664f
mov esi, str.AacControl5
jmp 0x426689
cmp esi, str.AacControl5
jne 0x42665e
mov esi, str.AacControl4
jmp 0x426689
cmp esi, str.AacControl4
jne 0x42666d
mov esi, str.AacControl3
jmp 0x426689
cmp esi, str.AacControl3
jne 0x42667c
mov esi, str.AacControl2
jmp 0x426689
cmp esi, str.AacControl2
jne 0x42669a
mov esi, str.AacControl
push ecx
lea eax, [esp + 0x34]
mov edx, esi
push eax
call fcn.00426340
test eax, eax
jne 0x426640
mov dword [edi], 0
test eax, eax
jne 0x426dbb
mov edi, dword [esp + 0x30]
push 0
push dword [esp + 0x40]
mov eax, dword [edi]
push dword [esp + 0x20]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x4ce328]
mov ecx, edi
call esi
mov edi, dword [esp + 0x30]
mov ebx, eax
mov ecx, dword [edi]
mov esi, dword [ecx + 4]
mov ecx, esi
call dword [0x4ce328]
mov ecx, edi
call esi
test ebx, ebx
jne 0x426db7
mov ebx, dword [esp + 0x18]
mov edi, dword [ebx]
test edi, edi
je 0x426db7
mov eax, dword [edi]
mov esi, dword [eax + 8]
lea eax, [esp + 0x2c]
push eax
mov ecx, esi
call dword [0x4ce328]
mov ecx, edi
call esi
test eax, eax
jne 0x426db7
cmp dword [esp + 0x2c], eax
je 0x426db7
push dword [esp + 0x1c]
lea eax, [esp + 0x54]
push dword [esp + 0x38]
push str.accesslib_policy__x:_x
push 0x82
push eax
call fcn.00425870
mov edi, dword [esp + 0x40]
add esp, 0x14
mov eax, dword [edi]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x4ce328]
mov ecx, edi
call esi
mov edi, dword [esp + 0x2c]
lea ecx, [esp + 0x50]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x4ce328]
mov ecx, edi
call esi
mov edi, dword [esp + 0x2c]
push dword [esp + 0x20]
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x4ce328]
mov ecx, edi
call esi
mov edi, dword [esp + 0x2c]
push 4
mov eax, dword [edi]
mov esi, dword [eax + 0x28]
mov ecx, esi
call dword [0x4ce328]
mov ecx, edi
call esi
mov edi, dword [esp + 0x2c]
mov eax, dword [edi]
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [0x4ce328]
mov ecx, edi
call esi
test eax, eax
je 0x426db7
mov edi, dword [ebx]
push eax
mov ecx, dword [edi]
mov esi, dword [ecx + 0x1c]
mov ecx, esi
call dword [0x4ce328]
mov ecx, edi
call esi
mov edx, dword [esp + 0x14]
test eax, eax
mov edi, dword [ebx]
mov eax, 1
movzx ecx, dl
cmovne ecx, eax
mov dword [esp + 0x14], ecx
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
lea eax, [esp + 0x24]
push eax
mov ecx, esi
call dword [0x4ce328]
mov ecx, edi
call esi
test eax, eax
jne 0x426d1c
cmp dword [esp + 0x24], eax
je 0x426d1c
mov edi, dword [ebx]
mov eax, dword [edi]
mov esi, dword [eax + 0x10]
lea eax, [esp + 0x28]
push eax
mov ecx, esi
call dword [0x4ce328]
mov ecx, edi
call esi
test eax, eax
jne 0x426d1c
cmp dword [esp + 0x28], eax
je 0x426d1c
mov eax, dword [esp + 0x34]
push eax
push eax
push str.al_delete_policy_on_terminate_process_0x_x___d__rule
lea eax, [esp + 0x5c]
push 0x82
push eax
call fcn.00425870
mov edi, dword [esp + 0x38]
add esp, 0x14
mov eax, dword [edi]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x4ce328]
mov ecx, edi
call esi
mov edi, dword [esp + 0x24]
lea ecx, [esp + 0x50]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x4ce328]
mov ecx, edi
call esi
lea esi, [esp + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x426887
push 0xf0000000
push 1
push 0
push 0
lea eax, [esp + 0x4c]
mov dword [esp + 0x4c], 0
sub esi, ecx
mov dword [esp + 0x40], 0
push eax
sar esi, 1
mov dword [esp + 0x4c], 0x10
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x426915
lea eax, [esp + 0x30]
push eax
push 0
push 0
push 0x8003
push dword [esp + 0x4c]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x426915
push 0
lea eax, [esi + esi]
push eax
lea eax, [esp + 0x58]
push eax
push dword [esp + 0x3c]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x426915
push 0
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x48]
push eax
push 2
push dword [esp + 0x40]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [esp + 0x30]
test eax, eax
je 0x426924
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x426935
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov edi, dword [esp + 0x24]
lea ecx, [esp + 0x40]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x4ce328]
mov ecx, edi
call esi
mov edi, dword [esp + 0x28]
push 4
mov eax, dword [edi]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x4ce328]
mov ecx, edi
call esi
mov edi, dword [esp + 0x28]
push 0
push 1
push 0x4ea0bc
mov eax, dword [edi]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x4ce328]
mov ecx, edi
call esi
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov eax, dword [eax]
mov ebx, dword [eax + 0x1c]
mov eax, dword [edi]
mov esi, dword [eax + 0x40]
mov ecx, esi
call dword [0x4ce328]
mov ecx, edi
call esi
push 1
push eax
mov ecx, ebx
call dword [0x4ce328]
mov ecx, dword [esp + 0x2c]
call ebx
mov edi, dword [esp + 0x28]
push 4
mov eax, dword [edi]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x4ce328]
mov ecx, edi
call esi
mov edi, dword [esp + 0x28]
push 0
push 0x23
push 0
mov eax, dword [edi]
push dword [esp + 0x40]
mov esi, dword [eax + 0x28]
mov ecx, esi
call dword [0x4ce328]
mov ecx, edi
call esi
mov edi, dword [esp + 0x28]
push 0
push 0xb
push 0
mov eax, dword [edi]
push 0x800
mov esi, dword [eax + 0x34]
mov ecx, esi
call dword [0x4ce328]
mov ecx, edi
call esi
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov eax, dword [eax]
mov ebx, dword [eax + 0x1c]
mov eax, dword [edi]
mov esi, dword [eax + 0x40]
mov ecx, esi
call dword [0x4ce328]
mov ecx, edi
call esi
push 2
push eax
mov ecx, ebx
call dword [0x4ce328]
mov ecx, dword [esp + 0x2c]
call ebx
mov edi, dword [esp + 0x24]
push 0
push 1
push 0
mov eax, dword [edi]
mov esi, dword [eax + 0x14]
mov ecx, esi
call dword [0x4ce328]
mov ecx, edi
call esi
mov edi, dword [esp + 0x24]
push 8
mov eax, dword [edi]
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x4ce328]
mov ecx, edi
call esi
mov ecx, dword [esp + 0x18]
mov edi, dword [esp + 0x24]
mov eax, dword [ecx]
mov dword [esp + 0x38], eax
mov eax, dword [eax]
mov ebx, dword [eax + 0x38]
mov eax, dword [edi]
mov esi, dword [eax + 0x24]
mov ecx, esi
call dword [0x4ce328]
mov ecx, edi
call esi
push 1
push dword [esp + 0x24]
mov ecx, ebx
push eax
call dword [0x4ce328]
mov ecx, dword [esp + 0x44]
call ebx
test eax, eax
jne 0x426d1c
mov eax, dword [esp + 0x1c]
push eax
push eax
push str.al_disable_rules_on_terminate_thread_0x_x___d__rule
lea eax, [esp + 0x5c]
push 0x82
push eax
call fcn.00425870
mov edi, dword [esp + 0x38]
add esp, 0x14
mov eax, dword [edi]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x4ce328]
mov ecx, edi
call esi
mov edi, dword [esp + 0x24]
lea ecx, [esp + 0x50]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x4ce328]
mov ecx, edi
call esi
lea esi, [esp + 0x50]
lea ecx, [esi + 2]
nop
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x426b00
push 0xf0000000
push 1
push 0
push 0
lea eax, [esp + 0x44]
mov dword [esp + 0x44], 0
sub esi, ecx
mov dword [esp + 0x40], 0
push eax
sar esi, 1
mov dword [esp + 0x4c], 0x10
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x426b8e
lea eax, [esp + 0x30]
push eax
push 0
push 0
push 0x8003
push dword [esp + 0x44]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x426b8e
push 0
lea eax, [esi + esi]
push eax
lea eax, [esp + 0x58]
push eax
push dword [esp + 0x3c]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x426b8e
push 0
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x48]
push eax
push 2
push dword [esp + 0x40]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [esp + 0x30]
test eax, eax
je 0x426b9d
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [esp + 0x34]
test eax, eax
je 0x426bae
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov edi, dword [esp + 0x24]
lea ecx, [esp + 0x40]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x4ce328]
mov ecx, edi
call esi
mov edi, dword [esp + 0x28]
push 4
mov eax, dword [edi]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x4ce328]
mov ecx, edi
call esi
mov edi, dword [esp + 0x28]
push 0
push 1
push 0x4ea0bc
mov eax, dword [edi]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x4ce328]
mov ecx, edi
call esi
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov eax, dword [eax]
mov ebx, dword [eax + 0x1c]
mov eax, dword [edi]
mov esi, dword [eax + 0x40]
mov ecx, esi
call dword [0x4ce328]
mov ecx, edi
call esi
push 1
push eax
mov ecx, ebx
call dword [0x4ce328]
mov ecx, dword [esp + 0x2c]
call ebx
mov edi, dword [esp + 0x28]
push 5
mov eax, dword [edi]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x4ce328]
mov ecx, edi
call esi
mov edi, dword [esp + 0x28]
push 0
push 0x20
push 0
mov eax, dword [edi]
push dword [esp + 0x28]
mov esi, dword [eax + 0x28]
mov ecx, esi
call dword [0x4ce328]
mov ecx, edi
call esi
mov edi, dword [esp + 0x28]
push 0
push 0xb
push 0
mov eax, dword [edi]
push 0x800
mov esi, dword [eax + 0x34]
mov ecx, esi
call dword [0x4ce328]
mov ecx, edi
call esi
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov eax, dword [eax]
mov ebx, dword [eax + 0x1c]
mov eax, dword [edi]
mov esi, dword [eax + 0x40]
mov ecx, esi
call dword [0x4ce328]
mov ecx, edi
call esi
push 2
push eax
mov ecx, ebx
call dword [0x4ce328]
mov ecx, dword [esp + 0x2c]
call ebx
mov edi, dword [esp + 0x24]
push 0
push 1
push 0
mov eax, dword [edi]
mov esi, dword [eax + 0x14]
mov ecx, esi
call dword [0x4ce328]
mov ecx, edi
call esi
mov edi, dword [esp + 0x24]
push 4
mov eax, dword [edi]
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x4ce328]
mov ecx, edi
call esi
mov ecx, dword [esp + 0x18]
mov edi, dword [esp + 0x24]
mov eax, dword [ecx]
mov dword [esp + 0x38], eax
mov eax, dword [eax]
mov ebx, dword [eax + 0x38]
mov eax, dword [edi]
mov esi, dword [eax + 0x24]
mov ecx, esi
call dword [0x4ce328]
mov ecx, edi
call esi
push 1
push dword [esp + 0x24]
mov ecx, ebx
push eax
call dword [0x4ce328]
mov ecx, dword [esp + 0x44]
call ebx
mov ebx, dword [esp + 0x10]
push ebx
push str.Created_access_handle__p_n
push 1
call fcn.0041d4c0
add esp, 0xc
cmp byte [esp + 0x14], 0
je 0x426d55
test ebx, ebx
je 0x426d55
cmp dword [ebx], 0
jne 0x426d55
cmp dword [ebx + 8], 0
jne 0x426d55
cmp dword [ebx + 0x10], 0
jne 0x426d55
mov ecx, ebx
call fcn.00427550
xor ebx, ebx
mov edi, dword [esp + 0x24]
test edi, edi
je 0x426d6e
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x4ce328]
mov ecx, edi
call esi
mov edi, dword [esp + 0x28]
test edi, edi
je 0x426d87
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x4ce328]
mov ecx, edi
call esi
mov edi, dword [esp + 0x2c]
test edi, edi
je 0x426da0
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x4ce328]
mov ecx, edi
call esi
mov ecx, dword [esp + 0x15c]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00488f07
mov esp, ebp
pop ebp
ret
mov ebx, dword [esp + 0x10]
push ebx
push str.Created_access_handle__p_n
push 1
call fcn.0041d4c0
add esp, 0xc
jmp 0x426d3b