Function at 0x47f7a6
Capabilities:
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0x24
push ebp
push edi
xor edi, edi
mov dword [esp + 0xc], edi
mov ebp, edi
mov dword [esp + 0x28], ebp
mov dword [esp + 8], edi
mov dword [esp + 0x10], edi
cmp edx, 0x41
jbe 0x47fb0f
cmp dword [ecx], 0x70707553
push esi
jne 0x47f7e5
cmp dword [ecx + 4], 0x61746144
jne 0x47f7e5
mov eax, dword [ecx + 0x14]
lea esi, [ecx + 0x18]
sub eax, 0x40
jmp 0x47f7ea
mov esi, ecx
lea eax, [edx - 0x40]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x20]
push eax
push edi
push edi
push 0x8004
push dword [esp + 0x48]
call ebx
test eax, eax
je 0x47fb0d
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0x20
push esi
push dword [esp + 0x2c]
call edi
mov ebp, dword [sym.imp.ADVAPI32.dll_CryptSignHashW]
lea eax, [esp + 0x14]
push eax
xor eax, eax
push eax
push eax
push eax
push dword [esp + 0x4c]
push dword [esp + 0x34]
call ebp
test eax, eax
je 0x47faec
push dword [esp + 0x14]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [esp + 0x2c], eax
test eax, eax
je 0x47faff
lea ecx, [esp + 0x14]
push ecx
push eax
push 0
push 0
push dword [esp + 0x4c]
push dword [esp + 0x34]
call ebp
test eax, eax
je 0x47facd
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0x8004
push dword [esp + 0x48]
call ebx
test eax, eax
je 0x47fae0
xor ebx, ebx
push ebx
push dword [esp + 0x18]
push dword [esp + 0x34]
push dword [esp + 0x28]
call edi
push ebx
push 0x20
lea eax, [esi + 0x20]
push eax
push dword [esp + 0x28]
call edi
lea eax, [esp + 0x28]
push eax
push ebx
push dword [esp + 0x24]
push 0x6801
push dword [esp + 0x48]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x47faae
lea eax, [esp + 0x24]
push eax
lea eax, [esi + 0x40]
push eax
push ebx
push 1
push ebx
push dword [esp + 0x3c]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov dword [esp + 0x30], eax
test eax, eax
je 0x47fa8f
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x10]
push 0x40f001
push eax
lea ecx, [esi + 0x58]
lea edx, [edx - 0x18]
call fcn.0040d530
pop ecx
pop ecx
test eax, eax
je 0x47faa2
mov eax, dword [esp + 0x10]
mov ebp, ebx
cmp dword [eax], ebx
jbe 0x47fa7f
mov esi, ebx
add eax, 4
add eax, esi
push eax
push ebp
push str.____u___wZ
call fcn.00409cda
mov eax, dword [esp + 0x1c]
add esp, 0xc
add eax, 4
add eax, esi
push 1
push eax
push 0x4d12d4
call dword [sym.imp.ntdll.dll_RtlEqualUnicodeString]
test al, al
mov eax, dword [esp + 0x10]
je 0x47f9d4
mov edi, dword [esi + eax + 0x10]
mov eax, dword [edi]
test eax, eax
je 0x47f99b
cmp eax, 4
je 0x47f979
push eax
push str._nUnknown_version:__u_n
call fcn.00409cda
pop ecx
jmp 0x47fa63
test byte [edi + 4], 2
je 0x47fa64
push str._n__NTLM:
call fcn.00409cda
lea ecx, [edi + 0xc]
push ebx
push 0x10
pop edx
call fcn.0040f762
jmp 0x47f973
mov eax, dword [edi + 4]
test al, 1
je 0x47f9bd
push str._n____LM:
call fcn.00409cda
push ebx
push 0x10
lea ecx, [edi + 8]
pop edx
call fcn.0040f762
mov eax, dword [edi + 4]
pop ecx
pop ecx
test al, 2
je 0x47fa64
push str._n__NTLM:
call fcn.00409cda
lea ecx, [edi + 0x18]
jmp 0x47f990
add eax, 4
push 1
add eax, esi
push eax
push 0x4d1170
call dword [sym.imp.ntdll.dll_RtlEqualUnicodeString]
test al, al
je 0x47fa41
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push 0x40eb1d
push eax
mov edx, dword [esi + ecx + 0xc]
mov ecx, dword [esi + ecx + 0x10]
call fcn.0040d530
pop ecx
pop ecx
test eax, eax
je 0x47fa64
mov eax, dword [esp + 0x18]
cmp dword [eax], 0
jbe 0x47fa2f
xor edi, edi
lea ecx, [eax + 4]
xor edx, edx
add ecx, edi
call fcn.0049a8a7
mov eax, dword [esp + 0x18]
inc ebx
add edi, 0x10
cmp ebx, dword [eax]
jb 0x47fa17
mov edx, 0x40eb3b
lea ecx, [esp + 0x18]
call fcn.0040d613
xor ebx, ebx
jmp 0x47fa64
push 0x4c75d0
call fcn.00409cda
mov ecx, dword [esp + 0x14]
mov dword [esp], 0x100001
mov edx, dword [esi + ecx + 0xc]
mov ecx, dword [esi + ecx + 0x10]
call fcn.0040f762
pop ecx
push 0x4c75d0
call fcn.00409cda
mov eax, dword [esp + 0x14]
inc ebp
add esi, 0x10
pop ecx
cmp ebp, dword [eax]
jb 0x47f926
mov edx, 0x40f01f
lea ecx, [esp + 0x10]
call fcn.0040d613
jmp 0x47faa2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kuhl_m_lsadump_decryptSCCache___CryptDecrypt__0x_08x__n
call fcn.00409cda
pop ecx
pop ecx
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
jmp 0x47fac1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kuhl_m_lsadump_decryptSCCache___CryptDeriveKey_RC4___0x_08x__n
call fcn.00409cda
pop ecx
pop ecx
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x47fae0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kuhl_m_lsadump_decryptSCCache___CryptSignHash_data___0x_08x__n
call fcn.00409cda
pop ecx
pop ecx
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x47faff
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kuhl_m_lsadump_decryptSCCache___CryptSignHash_init___0x_08x__n
call fcn.00409cda
pop ecx
pop ecx
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov ebp, dword [esp + 0x30]
pop ebx
pop esi
pop edi
mov eax, ebp
pop ebp
add esp, 0x24
ret