Function at 0x100032d2
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x1c], 0x1001546c
mov ecx, dword [sym.cpcrypt.dll_db_ctx]
xor ebx, ebx
mov dword [ebp - 8], esi
mov dword [ebp - 0x18], 1
test ecx, ecx
je 0x10003327
test dword [ecx], 0x4104104
je 0x10003327
push str.PKCS12_DetourAttach
push 0x1a8
push 0x1000f558
push str._..._
push ecx
call fcn.100030c1
mov ecx, dword [sym.cpcrypt.dll_db_ctx]
add esp, 0x14
push edi
test esi, esi
je 0x10003710
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x44]
push str.CryptExportPKCS8
rep stosd dword es:[edi], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
mov dword [ebp - 4], eax
call eax
mov esi, eax
xor edi, edi
mov dword [ebp - 0x28], esi
test esi, esi
je 0x100034f1
push 0x1c
lea eax, [ebp - 0x44]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x100034f1
and dword [ebp - 0x14], ebx
lfence
mov eax, dword [sym.cpcrypt.dll_db_ctx]
test eax, eax
je 0x100033a9
test dword [eax], 0x10410410
je 0x100033a9
push dword [ebp - 0x38]
push dword [ebp - 0x44]
push esi
push str.PKCS12_DetourAttach
push 0x1b5
push 0x1000f558
push str.CryptExportPKCS8:__p__BaseAddress:__p__RegionSize:__zx
push eax
call fcn.10002ef2
add esp, 0x20
mov ecx, dword [ebp - 0x44]
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x38]
push ecx
push ecx
push eax
lea edx, [ecx + edx]
lea ecx, [edi + esi]
call fcn.100030e6
mov ecx, eax
add esp, 0xc
mov dword [ebp - 0xc], ecx
test ecx, ecx
je 0x1000370a
mov edi, dword [ecx + 1]
sub eax, esi
mov ecx, dword [sym.cpcrypt.dll_db_ctx]
inc eax
add edi, 5
mov dword [ebp - 0x20], eax
test ecx, ecx
je 0x10003412
test dword [ecx], 0x10410410
je 0x10003412
push edi
push str.PKCS12_DetourAttach
push 0x1bd
push 0x1000f558
push str.check_CALL_pattern_with_shift_0x_08X
push ecx
call fcn.10002ef2
mov ecx, dword [sym.cpcrypt.dll_db_ctx]
add esp, 0x18
mov esi, dword [ebp - 0xc]
add esi, edi
mov dword [0x10015a7c], esi
cmp esi, dword [ebp - 8]
jb 0x10003474
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x44]
cmp esi, eax
ja 0x10003474
mov eax, edi
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x100000
jge 0x10003474
and dword [ebp - 0x10], ebx
mov edi, 0x10010354
xor eax, eax
mov edx, edi
mov cl, byte [edx]
cmp cl, 0xaa
je 0x10003452
cmp cl, byte [esi + eax]
jne 0x10003459
inc eax
inc edx
cmp eax, 5
jb 0x10003446
mov ecx, dword [sym.cpcrypt.dll_db_ctx]
push 5
pop edx
cmp eax, edx
je 0x1000348d
mov eax, dword [ebp - 0x10]
add edi, edx
add eax, edx
mov dword [ebp - 0x10], eax
cmp eax, edx
jb 0x10003442
mov eax, dword [ebp - 0x14]
xor edi, edi
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 2
ja 0x100034fd
mov esi, dword [ebp - 0x28]
mov edi, dword [ebp - 0x20]
jmp 0x100033a9
mov ecx, dword [ebp - 0xc]
xor edx, edx
inc edx
xor esi, esi
lfence
push ecx
mov edi, edx
mov dword [ebp - 0x20], edx
push ecx
lea edx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x10015468
push edx
lea edx, [ecx + 0x45]
mov dword [ebp - 0x18], 3
add ecx, 5
mov dword [ebp - 0x24], 0x1001546b
call fcn.100030e6
add esp, 0xc
test eax, eax
je 0x100034e5
push ecx
push ecx
lea ecx, [ebp - 0x24]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0xc]
lfence
lea ecx, [ecx + 5]
call fcn.100030e6
add esp, 0xc
mov esi, eax
xor eax, eax
test esi, esi
setne al
mov dword [0x10015a88], eax
mov esi, dword [0x10015a7c]
mov ecx, dword [sym.cpcrypt.dll_db_ctx]
test ecx, ecx
je 0x10003533
test dword [ecx], 0x10410410
je 0x10003533
push esi
push str.PKCS12_DetourAttach
push 0x1e5
push 0x1000f558
push str.Real_CryptExportPKCS8Ex:__p
push ecx
call fcn.10002ef2
mov ecx, dword [sym.cpcrypt.dll_db_ctx]
add esp, 0x18
mov esi, dword [0x10015a7c]
test edi, edi
je 0x10003710
test esi, esi
je 0x10003710
cmp dword [0x10015a88], ebx
je 0x100035d8
mov dword [0x10015a84], esi
call fcn.1000c547
test eax, eax
je 0x100035a6
xor edi, edi
mov dword [0x10015a84], edi
mov esi, dword [ebp - 4]
xor ebx, ebx
inc ebx
cmp dword [0x10015a78], 0
jne 0x1000358c
push str.CryptImportPKCS8
push dword [ebp - 8]
call esi
mov dword [0x10015a78], eax
test eax, eax
je 0x1000370a
call fcn.1000c547
test eax, eax
je 0x100036de
mov dword [0x10015a78], edi
mov ebx, edi
jmp 0x1000370a
sub esp, 0xc
mov edx, 0x1000319b
mov ecx, 0x10015a84
call fcn.1000c789
test eax, eax
je 0x100035cb
xor edi, edi
mov dword [0x10015a84], edi
call fcn.1000c5b2
jmp 0x10003566
call fcn.1000c62f
xor edi, edi
test eax, eax
je 0x10003566
jmp 0x100035be
push 3
pop edx
push 6
pop ecx
call fcn.10002450
xor edi, edi
test al, al
je 0x1000367d
lea eax, [ebp - 0x14c]
push eax
push edi
push edi
call dword [sym.imp.ntdll.dll_RtlGetNtVersionNumbers]
mov eax, dword [ebp - 0x14c]
and eax, 0xfffffff
cmp eax, 0x24d7
jbe 0x1000367d
mov eax, dword [0x10015a7c]
mov esi, dword [ebp - 4]
mov dword [0x10015a80], eax
test eax, eax
jne 0x10003636
push str.CryptExportPKCS8Ex_b9431
push dword [ebp - 8]
call esi
mov dword [0x10015a80], eax
test eax, eax
je 0x10003569
call fcn.1000c547
test eax, eax
je 0x1000364a
mov dword [0x10015a80], edi
jmp 0x10003569
sub esp, 0xc
mov edx, 0x10005af8
mov ecx, 0x10015a80
call fcn.1000c789
test eax, eax
jne 0x1000366d
call fcn.1000c62f
test eax, eax
je 0x10003569
mov dword [0x10015a80], edi
call fcn.1000c5b2
jmp 0x10003569
mov esi, dword [ebp - 4]
cmp dword [0x10015a7c], ebx
jne 0x1000369f
push str.CryptExportPKCS8Ex
push dword [ebp - 8]
call esi
mov dword [0x10015a7c], eax
test eax, eax
je 0x10003569
call fcn.1000c547
test eax, eax
je 0x100036b3
mov dword [0x10015a7c], edi
jmp 0x10003569
sub esp, 0xc
mov edx, 0x10005ab6
mov ecx, 0x10015a7c
call fcn.1000c789
test eax, eax
jne 0x100036d6
call fcn.1000c62f
test eax, eax
je 0x10003569
mov dword [0x10015a7c], edi
jmp 0x10003673
sub esp, 0xc
mov edx, 0x100069bb
mov ecx, 0x10015a78
call fcn.1000c789
test eax, eax
jne 0x100036fd
call fcn.1000c62f
test eax, eax
je 0x1000370a
mov ebx, edi
mov dword [0x10015a78], edi
call fcn.1000c5b2
mov ecx, dword [sym.cpcrypt.dll_db_ctx]
pop edi
test ecx, ecx
je 0x1000373b
test dword [ecx], 0x4104104
je 0x1000373b
push ebx
push str.PKCS12_DetourAttach
push 0x1fd
push 0x1000f558
push str.returned__X
push ecx
call fcn.100030c1
add esp, 0x18
pop esi
mov eax, ebx
pop ebx
leave
ret