Function at 0x1041a94
Capabilities:
Create new key via cryptacquirecontext
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x104a328]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x41
pop ecx
push 0x42
mov word [ebp - 0x118], cx
pop ecx
push 0x43
mov word [ebp - 0x116], cx
pop ecx
push 0x44
mov word [ebp - 0x114], cx
pop ecx
push 0x45
mov word [ebp - 0x112], cx
pop ecx
push 0x46
mov word [ebp - 0x110], cx
pop ecx
push 0x47
mov word [ebp - 0x10e], cx
pop ecx
push 0x48
mov word [ebp - 0x10c], cx
pop ecx
push 0x49
mov word [ebp - 0x10a], cx
pop ecx
push 0x4a
mov word [ebp - 0x108], cx
pop ecx
push 0x4b
mov word [ebp - 0x106], cx
pop ecx
push 0x4c
mov word [ebp - 0x104], cx
pop ecx
push 0x4d
mov word [ebp - 0x102], cx
pop ecx
push 0x4e
mov word [ebp - 0x100], cx
pop ecx
push 0x4f
mov word [ebp - 0xfe], cx
pop ecx
push 0x50
mov word [ebp - 0xfc], cx
pop ecx
push 0x51
mov word [ebp - 0xfa], cx
pop ecx
push 0x52
mov word [ebp - 0xf8], cx
pop ecx
push 0x53
mov esi, dword [ebp + 8]
mov word [ebp - 0xf6], cx
pop ecx
push 0x54
mov word [ebp - 0xf4], cx
pop ecx
push 0x55
mov word [ebp - 0xf2], cx
pop ecx
push 0x56
mov word [ebp - 0xf0], cx
pop ecx
push 0x57
mov word [ebp - 0xee], cx
pop ecx
push 0x58
xor edi, edi
xor eax, eax
mov word [ebp - 0xec], cx
pop ecx
inc eax
mov dword [ebp - 0x120], edi
mov dword [ebp - 0x11c], eax
mov word [ebp - 0xea], cx
push 0x59
pop ecx
push 0x5a
mov word [ebp - 0xe8], cx
pop ecx
push 0x61
mov word [ebp - 0xe6], cx
pop ecx
push 0x62
mov word [ebp - 0xe4], cx
pop ecx
push 0x63
mov word [ebp - 0xe2], cx
pop ecx
push 0x64
mov word [ebp - 0xe0], cx
pop ecx
push 0x65
mov word [ebp - 0xde], cx
pop ecx
push 0x66
mov word [ebp - 0xdc], cx
pop ecx
push 0x67
mov word [ebp - 0xda], cx
pop ecx
push 0x68
mov word [ebp - 0xd8], cx
pop ecx
push 0x69
mov word [ebp - 0xd6], cx
pop ecx
push 0x6a
mov word [ebp - 0xd4], cx
pop ecx
push 0x6b
mov word [ebp - 0xd2], cx
pop ecx
push 0x6c
mov word [ebp - 0xd0], cx
pop ecx
push 0x6d
mov word [ebp - 0xce], cx
pop ecx
push 0x6e
mov word [ebp - 0xcc], cx
pop ecx
push 0x6f
mov word [ebp - 0xca], cx
pop ecx
push 0x70
mov word [ebp - 0xc8], cx
pop ecx
push 0x71
mov word [ebp - 0xc6], cx
pop ecx
push 0x72
mov word [ebp - 0xc4], cx
pop ecx
push 0x73
mov word [ebp - 0xc2], cx
pop ecx
push 0x74
mov word [ebp - 0xc0], cx
pop ecx
push 0x75
mov word [ebp - 0xbe], cx
pop ecx
push 0x76
mov word [ebp - 0xbc], cx
pop ecx
push 0x77
mov word [ebp - 0xba], cx
pop ecx
push 0x78
mov word [ebp - 0xb8], cx
pop ecx
push 0x79
mov word [ebp - 0xb6], cx
pop ecx
mov word [ebp - 0xb4], cx
push 0x7a
pop ecx
push 0x30
mov word [ebp - 0xb2], cx
pop ecx
push 0x31
mov word [ebp - 0xb0], cx
pop ecx
push 0x32
mov word [ebp - 0xae], cx
pop ecx
push 0x33
mov word [ebp - 0xac], cx
pop ecx
push 0x34
mov word [ebp - 0xaa], cx
pop ecx
push 0x35
mov word [ebp - 0xa8], cx
pop ecx
push 0x36
mov word [ebp - 0xa6], cx
pop ecx
push 0x37
mov word [ebp - 0xa4], cx
pop ecx
push 0x38
mov word [ebp - 0xa2], cx
pop ecx
push 0x39
mov word [ebp - 0xa0], cx
pop ecx
push 0x2a
mov word [ebp - 0x9e], cx
pop ecx
push 0x5f
mov word [ebp - 0x9c], cx
pop ecx
push 0x21
mov word [ebp - 0x9a], cx
pop ecx
push 0x40
mov word [ebp - 0x30], cx
pop ecx
push 0x23
mov word [ebp - 0x2e], cx
pop ecx
push 0x24
mov word [ebp - 0x2c], cx
pop ecx
push 0x5e
mov word [ebp - 0x2a], cx
pop ecx
push 0x26
mov word [ebp - 0x28], cx
pop ecx
push 0x2a
mov word [ebp - 0x26], cx
pop ecx
push 0x28
mov word [ebp - 0x24], cx
pop ecx
push 0x29
mov word [ebp - 0x22], cx
pop ecx
push 0x2d
mov word [ebp - 0x20], cx
pop ecx
push 0x2b
mov word [ebp - 0x1e], cx
pop ecx
push 0x3d
mov word [ebp - 0x1c], cx
pop ecx
push 0x30
mov word [ebp - 0x1a], cx
pop ecx
push 0x31
mov word [ebp - 0x18], cx
pop ecx
mov word [ebp - 0x16], cx
push 0x32
pop ecx
push 0x33
mov word [ebp - 0x14], cx
pop ecx
push 0x34
mov word [ebp - 0x12], cx
pop ecx
push 0x35
mov word [ebp - 0x10], cx
pop ecx
push 0x36
mov word [ebp - 0xe], cx
pop ecx
push 0x37
mov word [ebp - 0xc], cx
pop ecx
push 0x38
mov word [ebp - 0xa], cx
pop ecx
push 0x39
mov word [ebp - 8], cx
pop ecx
push 0x41
mov word [ebp - 6], cx
pop ecx
push 0x42
mov word [ebp - 0x64], cx
pop ecx
push 0x43
mov word [ebp - 0x62], cx
pop ecx
push 0x44
mov word [ebp - 0x60], cx
pop ecx
push 0x45
mov word [ebp - 0x5e], cx
pop ecx
push 0x46
mov word [ebp - 0x5c], cx
pop ecx
push 0x47
mov word [ebp - 0x5a], cx
pop ecx
push 0x48
mov word [ebp - 0x58], cx
pop ecx
push 0x49
mov word [ebp - 0x56], cx
pop ecx
push 0x4a
mov word [ebp - 0x54], cx
pop ecx
push 0x4b
mov word [ebp - 0x52], cx
pop ecx
push 0x4c
mov word [ebp - 0x50], cx
pop ecx
push 0x4d
mov word [ebp - 0x4e], cx
pop ecx
push 0x4e
mov word [ebp - 0x4c], cx
pop ecx
push 0x4f
mov word [ebp - 0x4a], cx
pop ecx
push 0x50
mov word [ebp - 0x48], cx
pop ecx
push 0x51
mov word [ebp - 0x46], cx
pop ecx
push 0x52
mov word [ebp - 0x44], cx
pop ecx
push 0x53
mov word [ebp - 0x42], cx
pop ecx
mov word [ebp - 0x40], cx
push 0x54
pop ecx
push 0x55
mov word [ebp - 0x3e], cx
pop ecx
push 0x56
mov word [ebp - 0x3c], cx
pop ecx
push 0x57
mov word [ebp - 0x3a], cx
pop ecx
push 0x58
mov word [ebp - 0x38], cx
pop ecx
push 0x59
mov word [ebp - 0x36], cx
pop ecx
push 0x5a
mov word [ebp - 0x34], cx
pop ecx
push 0x61
mov word [ebp - 0x32], cx
pop ecx
push 0x62
mov word [ebp - 0x98], cx
pop ecx
push 0x63
mov word [ebp - 0x96], cx
pop ecx
push 0x64
mov word [ebp - 0x94], cx
pop ecx
push 0x65
mov word [ebp - 0x92], cx
pop ecx
push 0x66
mov word [ebp - 0x90], cx
pop ecx
push 0x67
mov word [ebp - 0x8e], cx
pop ecx
push 0x68
mov word [ebp - 0x8c], cx
pop ecx
push 0x69
mov word [ebp - 0x8a], cx
pop ecx
push 0x6a
mov word [ebp - 0x88], cx
pop ecx
push 0x6b
mov word [ebp - 0x86], cx
pop ecx
push 0x6c
mov word [ebp - 0x84], cx
pop ecx
push 0x6d
mov word [ebp - 0x82], cx
pop ecx
push 0x6e
mov word [ebp - 0x80], cx
pop ecx
push 0x6f
mov word [ebp - 0x7e], cx
pop ecx
push 0x70
mov word [ebp - 0x7c], cx
pop ecx
push 0x71
mov word [ebp - 0x7a], cx
pop ecx
push 0x72
mov word [ebp - 0x78], cx
pop ecx
push 0x73
mov word [ebp - 0x76], cx
pop ecx
push 0x74
mov word [ebp - 0x74], cx
pop ecx
mov word [ebp - 0x72], cx
push 0x75
pop ecx
push 0x76
mov word [ebp - 0x70], cx
pop ecx
push 0x77
mov word [ebp - 0x6e], cx
pop ecx
push 0x78
mov word [ebp - 0x6c], cx
pop ecx
push 0x79
mov word [ebp - 0x6a], cx
pop ecx
push 0x7a
mov word [ebp - 0x68], cx
pop ecx
push 0xf0000000
push eax
push edi
push edi
lea eax, [ebp - 0x120]
push eax
mov word [ebp - 0x66], cx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1041f8d
mov dword [ebp - 0x11c], edi
jmp 0x1042140
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.msvcrt.dll_time]
push dword [ebp - 0x128]
call dword [sym.imp.msvcrt.dll_srand]
pop ecx
pop ecx
lea eax, [ebp - 0x118]
push eax
push 0x80
push dword [ebp - 0x120]
call fcn.01041a31
test eax, eax
je 0x104206b
mov dword [ebp - 0x124], edi
cmp dword [ebp - 0x11c], 1
jne 0x1042014
lea eax, [ebp - 0x11c]
push eax
push dword [ebp - 0x120]
call fcn.010419f4
cmp dword [ebp - 0x11c], edi
je 0x1042014
mov ecx, dword [ebp - 0x124]
and eax, 0x3f
inc dword [ebp - 0x124]
cmp dword [ebp - 0x124], 0xe
mov ax, word [ebp + eax*2 - 0x118]
mov word [esi + ecx*2], ax
jl 0x1041fcd
lea eax, [ebp - 0x30]
push eax
push 0x18
push dword [ebp - 0x120]
call fcn.01041a31
test eax, eax
je 0x104206b
lea eax, [ebp - 0x18]
push eax
push 0x14
push dword [ebp - 0x120]
call fcn.01041a31
test eax, eax
je 0x104206b
lea eax, [ebp - 0x64]
push eax
push 0x34
push dword [ebp - 0x120]
call fcn.01041a31
test eax, eax
je 0x104206b
lea eax, [ebp - 0x98]
push eax
push 0x34
push dword [ebp - 0x120]
call fcn.01041a31
test eax, eax
jne 0x1042076
mov dword [ebp - 0x11c], edi
jmp 0x104212b
lea eax, [ebp - 0x11c]
push eax
push dword [ebp - 0x120]
call fcn.010419f4
cmp dword [ebp - 0x11c], edi
je 0x104212b
push 0xc
pop ecx
xor edx, edx
div ecx
mov ax, word [ebp + edx*2 - 0x30]
mov word [esi + 4], ax
lea eax, [ebp - 0x11c]
push eax
push dword [ebp - 0x120]
call fcn.010419f4
cmp dword [ebp - 0x11c], edi
je 0x104212b
push 0xa
pop ecx
xor edx, edx
div ecx
mov ax, word [ebp + edx*2 - 0x18]
mov word [esi + 6], ax
lea eax, [ebp - 0x11c]
push eax
push dword [ebp - 0x120]
call fcn.010419f4
cmp dword [ebp - 0x11c], edi
je 0x104212b
push 0x1a
pop ecx
xor edx, edx
div ecx
mov ax, word [ebp + edx*2 - 0x64]
mov word [esi + 8], ax
lea eax, [ebp - 0x11c]
push eax
push dword [ebp - 0x120]
call fcn.010419f4
cmp dword [ebp - 0x11c], edi
je 0x104212b
push 0x1a
xor edx, edx
pop ecx
div ecx
mov ax, word [ebp + edx*2 - 0x98]
mov word [esi + 0xa], ax
xor eax, eax
mov word [esi + 0x1c], ax
cmp dword [ebp - 0x120], edi
je 0x1042140
push edi
push dword [ebp - 0x120]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x11c]
pop edi
xor ecx, ebp
pop esi
call fcn.0102da5f
leave
ret 4