Function at 0x4044b0
Capabilities:
Create new key via cryptacquirecontext
Encrypt or decrypt via wincrypt
Import public key
Query or enumerate registry value
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub esp, 0x428
mov eax, dword [0x417024]
xor eax, esp
mov dword [esp + 0x424], eax
mov ecx, dword [esp + 0x434]
push ebx
push esi
mov esi, dword [esp + 0x438]
xor ebx, ebx
mov eax, esi
push edi
mov dword [esp + 0x20], ebx
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4044e0
sub eax, edi
mov edi, dword [0x418a4c]
xor edx, edx
mov word [edi + 7], dx
mov edx, dword [0x418a4c]
mov dword [edx + 3], 1
mov edx, dword [0x418a4c]
mov dword [edx + 9], ebx
mov edi, dword [0x418a4c]
add edi, 0x11
mov dl, byte [esi]
mov byte [edi], dl
inc esi
inc edi
test dl, dl
jne 0x404514
mov edx, dword [0x418a4c]
mov esi, ecx
lea edi, [edx + eax + 0x12]
lea ebx, [ebx]
mov dl, byte [esi]
mov byte [edi], dl
inc esi
inc edi
test dl, dl
jne 0x404530
lea esi, [ecx + 1]
lea ecx, [ecx]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x404540
mov edi, dword [0x418a4c]
sub ecx, esi
lea esi, [eax + ecx + 2]
add edi, 0x11
cmp esi, 0x100
jge 0x404574
mov edi, edi
call fcn.00405fcb
mov word [edi + esi], ax
add esi, 2
cmp esi, 0x100
jl 0x404560
mov edi, dword [0x418a4c]
add edi, 0x121
mov dword [esp + 0xc], ebx
call fcn.00405fcb
mov ecx, dword [esp + 0xc]
mov word [esp + ecx + 0x230], ax
add ecx, 2
cmp ecx, 0x200
mov dword [esp + 0xc], ecx
jl 0x404584
cmp dword [0x417fd0], ebx
jne 0x4045f4
mov eax, dword [str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider]
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push ebx
push 0x18
push eax
push ebx
push 0x417fd0
call esi
test eax, eax
jne 0x4045f4
mov ecx, dword [str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider]
push 8
push 0x18
push ecx
push ebx
push 0x417fd0
call esi
test eax, eax
jne 0x4045f4
mov edx, dword [str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider]
push 0xf0000008
push 0x18
push edx
push ebx
push 0x417fd0
call esi
mov ecx, dword [0x417fcc]
mov edx, dword [0x417fc8]
lea eax, [esp + 0x20]
push eax
mov eax, dword [0x417fd0]
push ebx
push ebx
push ecx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov ecx, dword [0x418a4c]
mov dword [ecx + 0xd], ebx
mov esi, 0x200
cmp esi, 0x75
mov eax, 0x75
jg 0x40462f
mov eax, esi
push eax
mov dword [esp + 0x10], eax
mov eax, dword [0x418a4c]
mov ecx, dword [eax + 0xd]
lea edx, [esp + 0x434]
sub edx, esi
push edx
add ecx, edi
push ecx
call fcn.004061a0
mov eax, dword [0x418a4c]
mov ecx, dword [eax + 0xd]
sub esi, dword [esp + 0x18]
mov eax, dword [esp + 0x2c]
add esp, 0xc
push 0x200
lea edx, [esp + 0x10]
push edx
xor edx, edx
add ecx, edi
cmp esi, ebx
sete dl
push ecx
push ebx
push edx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x404695
mov eax, dword [0x418a4c]
mov ecx, dword [esp + 0xc]
add dword [eax + 0xd], ecx
cmp esi, ebx
jne 0x404623
jmp 0x40469b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x4046aa
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0x200
lea edx, [esp + 0x234]
push edx
push 0x418ab4
push 0x418c60
call fcn.00403900
push 0x200
lea eax, [esp + 0x244]
push eax
push 0x418ac0
push 0x418ae0
call fcn.004039c0
mov eax, dword [0x418a4c]
mov ecx, dword [0x418ac0]
add eax, 0x11
push eax
push eax
push 0x100
push ecx
push 0x418ae0
call fcn.00403a80
add esp, 0x34
test byte [0x417fc4], 2
je 0x404903
mov edx, dword [0x418a4c]
mov esi, dword [edx + 0xd]
push ebp
push 0x414b24
push ebx
mov dword [esp + 0x24], ebx
call dword [sym.imp.CRYPT32.dll_CertOpenSystemStoreA]
mov ebp, eax
mov dword [esp + 0x2c], ebp
cmp ebp, ebx
je 0x404902
mov eax, dword [0x418c34]
push eax
mov dword [esp + 0x24], 0x200
mov byte [esp + 0x38], bl
call sub.WSOCK32.dll_inet_ntoa
mov ecx, dword [0x418c28]
push eax
push str.ClientCert_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 0x20]
push edx
mov edx, dword [0x418c28]
lea eax, [esp + 0x38]
push eax
mov eax, dword [0x418aa8]
lea ecx, [esp + 0x1c]
push ecx
push ebx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x20]
lea edx, [ecx + ecx + 2]
push edx
call fcn.004060ca
add esp, 4
mov edi, eax
mov eax, dword [esp + 0x20]
lea ecx, [eax + eax + 2]
push ecx
push edi
push 0xffffffffffffffff
lea edx, [esp + 0x40]
push edx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebx
push edi
push 0x80007
push ebx
push 0x10001
push ebp
call dword [sym.imp.CRYPT32.dll_CertFindCertificateInStore]
mov ebx, eax
mov dword [esp + 0x30], ebx
test ebx, ebx
jne 0x4047f9
push 0x10
push str.Cant_Find_Cert
push edi
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push edi
call fcn.00405fed
add esp, 4
push ebx
push ebp
call dword [sym.imp.CRYPT32.dll_CertCloseStore]
jmp 0x404900
push edi
call fcn.00405fed
mov ecx, dword [ebx + 0xc]
mov edx, dword [0x417fd0]
add esp, 4
lea eax, [esp + 0x1c]
push eax
add ecx, 0x38
push ecx
push 0x10001
push edx
call dword [sym.imp.CRYPT32.dll_CryptImportPublicKeyInfo]
mov ebx, dword [0x418a4c]
push esi
add ebx, 0x121
call fcn.004060ca
push esi
mov ebp, eax
push ebx
push ebp
call fcn.004061a0
add esp, 0x10
mov dword [esp + 0x28], ebp
mov dword [esp + 0x18], 0
test esi, esi
je 0x4048bf
nop
cmp esi, 0x75
mov edi, 0x75
jg 0x40485c
mov edi, esi
push edi
lea eax, [esp + 0x38]
push ebp
push eax
mov dword [esp + 0x20], edi
call fcn.004061a0
add esp, 0xc
push 0x200
mov eax, 0
add ebp, edi
sub esi, edi
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x24]
sete al
lea edx, [esp + 0x3c]
push edx
push 0
push eax
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x4048bf
mov edx, dword [esp + 0x14]
push edx
lea eax, [esp + 0x38]
push eax
push ebx
call fcn.004061a0
mov eax, dword [esp + 0x20]
add dword [esp + 0x24], eax
add esp, 0xc
add ebx, eax
test esi, esi
jne 0x404850
mov ecx, dword [esp + 0x28]
push ecx
call fcn.00405fed
mov eax, dword [esp + 0x20]
add esp, 4
test eax, eax
je 0x4048db
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
mov eax, dword [esp + 0x2c]
push 0
push eax
call dword [sym.imp.CRYPT32.dll_CertCloseStore]
mov ecx, dword [0x418a4c]
mov edx, dword [esp + 0x18]
mov dword [ecx + 0xd], edx
xor ebx, ebx
pop ebp
mov eax, dword [0x418a4c]
mov edi, dword [esp + 0x438]
mov ecx, 0x121
add cx, word [eax + 0xd]
push ebx
mov word [eax + 1], cx
mov edx, dword [0x418a4c]
mov byte [edx], 0x1a
mov eax, dword [0x418a4c]
movzx ecx, word [eax + 1]
push ecx
push eax
push edi
call sub.WSOCK32.dll_send
xor esi, esi
lea esp, [esp]
mov edx, dword [0x418c28]
push ebx
push 0x8000
add edx, esi
push edx
push edi
call sub.WSOCK32.dll_recv
cmp eax, ebx
jle 0x404960
add esi, eax
cmp esi, 2
jb 0x404940
mov ecx, dword [0x418c28]
movzx edx, word [ecx]
cmp esi, edx
jge 0x404992
lea ecx, [ecx]
push ebx
push 0x8000
add ecx, esi
push ecx
push edi
call sub.WSOCK32.dll_recv
cmp eax, ebx
jle 0x404996
mov ecx, dword [0x418c28]
movzx edx, word [ecx]
add esi, eax
cmp esi, edx
jl 0x404970
cmp eax, ebx
jg 0x4049b3
pop edi
pop esi
mov eax, 0xffffff9c
pop ebx
mov ecx, dword [esp + 0x424]
xor ecx, esp
call fcn.00405fbc
add esp, 0x428
ret
mov eax, dword [ecx + 6]
cmp eax, ebx
je 0x4049d9
add ecx, 0xa
push ecx
push ecx
push eax
mov eax, dword [0x418ab4]
push eax
push 0x418c60
call fcn.00403ce0
mov ecx, dword [0x418c28]
add esp, 0x14
mov eax, dword [ecx + 2]
cmp eax, ebx
je 0x4049e5
cmp eax, 1
jne 0x404a17
movzx edx, word [ecx + 0xa]
mov dword [0x418c24], edx
mov eax, dword [ecx + 0xe]
mov dword [0x418a38], eax
mov edx, dword [ecx + 0x12]
add ecx, 0x16
push ecx
mov dword [0x418a50], edx
call fcn.004068ca
mov ecx, dword [0x418c28]
add esp, 4
mov dword [0x417008], eax
mov eax, dword [ecx + 2]
mov ecx, dword [esp + 0x430]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00405fbc
add esp, 0x428
ret