Function at 0x404630
Capabilities:
Create new key via cryptacquirecontext
Encrypt or decrypt via wincrypt
Import public key
Query or enumerate registry value
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub esp, 0x428
mov eax, dword [0x415020]
xor eax, esp
mov dword [esp + 0x424], eax
mov ecx, dword [esp + 0x434]
push ebx
push esi
mov esi, dword [esp + 0x438]
xor ebx, ebx
mov eax, esi
push edi
mov dword [esp + 0x20], ebx
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x404660
mov edx, dword [0x416a48]
sub eax, edi
mov di, word [0x416c02]
mov word [edx + 7], di
mov edx, dword [0x416a48]
mov dword [edx + 3], 1
mov edx, dword [0x416a48]
mov dword [edx + 9], ebx
mov edi, dword [0x416a48]
add edi, 0x11
lea esp, [esp]
mov dl, byte [esi]
mov byte [edi], dl
inc esi
inc edi
test dl, dl
jne 0x4046a0
mov edx, dword [0x416a48]
mov esi, ecx
lea edi, [edx + eax + 0x12]
mov dl, byte [esi]
mov byte [edi], dl
inc esi
inc edi
test dl, dl
jne 0x4046b6
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4046c3
mov edi, dword [0x416a48]
sub ecx, esi
lea esi, [eax + ecx + 2]
add edi, 0x11
cmp esi, 0x100
jge 0x4046f5
call fcn.00405cab
mov word [edi + esi], ax
add esi, 2
cmp esi, 0x100
jl 0x4046e1
mov edi, dword [0x416a48]
add edi, 0x121
mov dword [esp + 0xc], ebx
call fcn.00405cab
mov ecx, dword [esp + 0xc]
mov word [esp + ecx + 0x230], ax
add ecx, 2
cmp ecx, 0x200
mov dword [esp + 0xc], ecx
jl 0x404705
cmp dword [0x415fd4], ebx
jne 0x404775
mov eax, dword [0x415004]
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push ebx
push 0x18
push eax
push ebx
push 0x415fd4
call esi
test eax, eax
jne 0x404775
mov ecx, dword [0x415004]
push 8
push 0x18
push ecx
push ebx
push 0x415fd4
call esi
test eax, eax
jne 0x404775
mov edx, dword [0x415004]
push 0xf0000008
push 0x18
push edx
push ebx
push 0x415fd4
call esi
mov ecx, dword [0x415fd0]
mov edx, dword [0x415fcc]
lea eax, [esp + 0x20]
push eax
mov eax, dword [0x415fd4]
push ebx
push ebx
push ecx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov ecx, dword [0x416a48]
mov dword [ecx + 0xd], ebx
mov esi, 0x200
cmp esi, 0x75
mov eax, 0x75
jg 0x4047b0
mov eax, esi
push eax
mov dword [esp + 0x10], eax
mov eax, dword [0x416a48]
mov ecx, dword [eax + 0xd]
lea edx, [esp + 0x434]
sub edx, esi
push edx
add ecx, edi
push ecx
call fcn.00405e80
mov eax, dword [0x416a48]
mov ecx, dword [eax + 0xd]
sub esi, dword [esp + 0x18]
mov eax, dword [esp + 0x2c]
add esp, 0xc
push 0x200
lea edx, [esp + 0x10]
push edx
xor edx, edx
add ecx, edi
cmp esi, ebx
sete dl
push ecx
push ebx
push edx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x404816
mov eax, dword [0x416a48]
mov ecx, dword [esp + 0xc]
add dword [eax + 0xd], ecx
cmp esi, ebx
jne 0x4047a4
jmp 0x40481c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x40482b
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0x200
lea edx, [esp + 0x234]
push edx
push 0x416a90
push 0x416c20
call fcn.00403900
push 0x200
lea eax, [esp + 0x244]
push eax
push 0x416a98
push 0x416ac0
call fcn.004039c0
mov eax, dword [0x416a48]
mov ecx, dword [0x416a98]
add eax, 0x11
push eax
push eax
push 0x100
push ecx
push 0x416ac0
call fcn.00403a80
add esp, 0x34
test byte [0x416a44], 2
je 0x404a83
mov edx, dword [0x416a48]
mov esi, dword [edx + 0xd]
push ebp
push 0x412bb0
push ebx
mov dword [esp + 0x24], ebx
call dword [sym.imp.CRYPT32.dll_CertOpenSystemStoreA]
mov ebp, eax
mov dword [esp + 0x2c], ebp
cmp ebp, ebx
je 0x404a82
mov eax, dword [0x416c10]
push eax
mov dword [esp + 0x24], 0x200
mov byte [esp + 0x38], bl
call sub.WSOCK32.dll_inet_ntoa
mov ecx, dword [0x416c08]
push eax
push str.ClientCert_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 0x20]
push edx
mov edx, dword [0x416c08]
lea eax, [esp + 0x38]
push eax
mov eax, dword [0x416a88]
lea ecx, [esp + 0x1c]
push ecx
push ebx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x20]
lea edx, [ecx + ecx + 2]
push edx
call fcn.00405daa
add esp, 4
mov edi, eax
mov eax, dword [esp + 0x20]
lea ecx, [eax + eax + 2]
push ecx
push edi
push 0xffffffffffffffff
lea edx, [esp + 0x40]
push edx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebx
push edi
push 0x80007
push ebx
push 0x10001
push ebp
call dword [sym.imp.CRYPT32.dll_CertFindCertificateInStore]
mov ebx, eax
mov dword [esp + 0x30], ebx
test ebx, ebx
jne 0x40497a
push 0x10
push str.Cant_Find_Cert
push edi
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push edi
call fcn.00405ccd
add esp, 4
push ebx
push ebp
call dword [sym.imp.CRYPT32.dll_CertCloseStore]
jmp 0x404a80
push edi
call fcn.00405ccd
mov ecx, dword [ebx + 0xc]
mov edx, dword [0x415fd4]
add esp, 4
lea eax, [esp + 0x1c]
push eax
add ecx, 0x38
push ecx
push 0x10001
push edx
call dword [sym.imp.CRYPT32.dll_CryptImportPublicKeyInfo]
mov ebx, dword [0x416a48]
push esi
add ebx, 0x121
call fcn.00405daa
push esi
mov ebp, eax
push ebx
push ebp
call fcn.00405e80
add esp, 0x10
mov dword [esp + 0x28], ebp
mov dword [esp + 0x18], 0
test esi, esi
je 0x404a3f
cmp esi, 0x75
mov edi, 0x75
jg 0x4049dc
mov edi, esi
push edi
lea eax, [esp + 0x38]
push ebp
push eax
mov dword [esp + 0x20], edi
call fcn.00405e80
add esp, 0xc
push 0x200
mov eax, 0
add ebp, edi
sub esi, edi
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x24]
sete al
lea edx, [esp + 0x3c]
push edx
push 0
push eax
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x404a3f
mov edx, dword [esp + 0x14]
push edx
lea eax, [esp + 0x38]
push eax
push ebx
call fcn.00405e80
mov eax, dword [esp + 0x20]
add dword [esp + 0x24], eax
add esp, 0xc
add ebx, eax
test esi, esi
jne 0x4049d0
mov ecx, dword [esp + 0x28]
push ecx
call fcn.00405ccd
mov eax, dword [esp + 0x20]
add esp, 4
test eax, eax
je 0x404a5b
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
mov eax, dword [esp + 0x2c]
push 0
push eax
call dword [sym.imp.CRYPT32.dll_CertCloseStore]
mov ecx, dword [0x416a48]
mov edx, dword [esp + 0x18]
mov dword [ecx + 0xd], edx
xor ebx, ebx
pop ebp
mov eax, dword [0x416a48]
mov edi, dword [esp + 0x438]
mov ecx, 0x121
add cx, word [eax + 0xd]
push ebx
mov word [eax + 1], cx
mov edx, dword [0x416a48]
mov byte [edx], 0x1a
mov eax, dword [0x416a48]
movzx ecx, word [eax + 1]
push ecx
push eax
push edi
call sub.WSOCK32.dll_send
xor esi, esi
lea esp, [esp]
mov edx, dword [0x416c08]
push ebx
push 0x8000
add edx, esi
push edx
push edi
call sub.WSOCK32.dll_recv
cmp eax, ebx
jle 0x404ae0
add esi, eax
cmp esi, 2
jb 0x404ac0
mov ecx, dword [0x416c08]
movzx edx, word [ecx]
cmp esi, edx
jge 0x404b12
lea ecx, [ecx]
push ebx
push 0x8000
add ecx, esi
push ecx
push edi
call sub.WSOCK32.dll_recv
cmp eax, ebx
jle 0x404b16
mov ecx, dword [0x416c08]
movzx edx, word [ecx]
add esi, eax
cmp esi, edx
jl 0x404af0
cmp eax, ebx
jg 0x404b33
pop edi
pop esi
mov eax, 0xffffff9c
pop ebx
mov ecx, dword [esp + 0x424]
xor ecx, esp
call fcn.00405c9c
add esp, 0x428
ret
mov eax, dword [ecx + 6]
cmp eax, ebx
je 0x404b59
add ecx, 0xa
push ecx
push ecx
push eax
mov eax, dword [0x416a90]
push eax
push 0x416c20
call fcn.00403ce0
mov ecx, dword [0x416c08]
add esp, 0x14
mov eax, dword [ecx + 2]
cmp eax, ebx
je 0x404b65
cmp eax, 1
jne 0x404b80
movzx edx, word [ecx + 0xa]
mov dword [0x416c04], edx
mov eax, dword [ecx + 0xe]
mov dword [0x416a38], eax
mov edx, dword [ecx + 0x12]
mov dword [0x416a50], edx
mov eax, dword [ecx + 2]
mov ecx, dword [esp + 0x430]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00405c9c
add esp, 0x428
ret