Function at 0x406630
Capabilities:
Contain obfuscated stackstrings
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
push edi
mov edi, eax
push esi
push ebx
mov ebp, edx
mov ebx, ecx
sub esp, 0x5c
lea eax, [esp + 0x20]
mov dword [esp + 0x10], 0xf0000000
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x3f], 0x33323130
mov dword [esp + 0x43], 0x37363534
mov dword [esp + 0x47], 0x62613938
mov dword [esp + 0x4b], 0x66656463
mov byte [esp + 0x4f], 0
call sym._CryptAcquireContextA_20
sub esp, 0x14
test eax, eax
je 0x406a30
lea eax, [esp + 0x24]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x8003
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sym._CryptCreateHash_20
sub esp, 0x14
test eax, eax
mov esi, eax
je 0x4069f0
mov eax, dword [esp + 0x24]
mov dword [esp + 0xc], 0
mov dword [esp + 8], ebp
mov dword [esp + 4], edi
mov dword [esp], eax
call sym._CryptHashData_16
sub esp, 0x10
test eax, eax
mov esi, eax
je 0x406a70
lea eax, [esp + 0x28]
mov dword [esp + 0x10], 0
mov dword [esp + 4], 2
mov dword [esp + 0x28], 0x10
mov dword [esp + 0xc], eax
lea eax, [esp + 0x2f]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._CryptGetHashParam_20
sub esp, 0x14
test eax, eax
je 0x406a51
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4069d8
movzx edx, byte [esp + 0x2f]
mov ecx, edx
and edx, 0xf
shr cl, 4
movzx edx, byte [esp + edx + 0x3f]
cmp eax, 1
movzx ecx, cl
movzx ecx, byte [esp + ecx + 0x3f]
mov byte [ebx + 1], dl
mov byte [ebx], cl
jbe 0x4069d8
movzx edx, byte [esp + 0x30]
mov ecx, edx
and edx, 0xf
shr cl, 4
movzx edx, byte [esp + edx + 0x3f]
cmp eax, 2
movzx ecx, cl
movzx ecx, byte [esp + ecx + 0x3f]
mov byte [ebx + 3], dl
mov byte [ebx + 2], cl
je 0x4069d8
movzx edx, byte [esp + 0x31]
mov ecx, edx
and edx, 0xf
shr cl, 4
movzx edx, byte [esp + edx + 0x3f]
cmp eax, 3
movzx ecx, cl
movzx ecx, byte [esp + ecx + 0x3f]
mov byte [ebx + 5], dl
mov byte [ebx + 4], cl
je 0x4069d8
movzx edx, byte [esp + 0x32]
mov ecx, edx
and edx, 0xf
shr cl, 4
movzx edx, byte [esp + edx + 0x3f]
cmp eax, 4
movzx ecx, cl
movzx ecx, byte [esp + ecx + 0x3f]
mov byte [ebx + 7], dl
mov byte [ebx + 6], cl
je 0x4069d8
movzx edx, byte [esp + 0x33]
mov ecx, edx
and edx, 0xf
shr cl, 4
movzx edx, byte [esp + edx + 0x3f]
cmp eax, 5
movzx ecx, cl
movzx ecx, byte [esp + ecx + 0x3f]
mov byte [ebx + 9], dl
mov byte [ebx + 8], cl
je 0x4069d8
movzx edx, byte [esp + 0x34]
mov ecx, edx
and edx, 0xf
shr cl, 4
movzx edx, byte [esp + edx + 0x3f]
cmp eax, 6
movzx ecx, cl
movzx ecx, byte [esp + ecx + 0x3f]
mov byte [ebx + 0xb], dl
mov byte [ebx + 0xa], cl
je 0x4069d8
movzx edx, byte [esp + 0x35]
mov ecx, edx
and edx, 0xf
shr cl, 4
movzx edx, byte [esp + edx + 0x3f]
cmp eax, 7
movzx ecx, cl
movzx ecx, byte [esp + ecx + 0x3f]
mov byte [ebx + 0xd], dl
mov byte [ebx + 0xc], cl
je 0x4069d8
movzx edx, byte [esp + 0x36]
mov ecx, edx
and edx, 0xf
shr cl, 4
movzx edx, byte [esp + edx + 0x3f]
cmp eax, 8
movzx ecx, cl
movzx ecx, byte [esp + ecx + 0x3f]
mov byte [ebx + 0xf], dl
mov byte [ebx + 0xe], cl
je 0x4069d8
movzx edx, byte [esp + 0x37]
mov ecx, edx
and edx, 0xf
shr cl, 4
movzx edx, byte [esp + edx + 0x3f]
cmp eax, 9
movzx ecx, cl
movzx ecx, byte [esp + ecx + 0x3f]
mov byte [ebx + 0x11], dl
mov byte [ebx + 0x10], cl
je 0x4069d8
movzx edx, byte [esp + 0x38]
mov ecx, edx
and edx, 0xf
shr cl, 4
movzx edx, byte [esp + edx + 0x3f]
cmp eax, 0xa
movzx ecx, cl
movzx ecx, byte [esp + ecx + 0x3f]
mov byte [ebx + 0x13], dl
mov byte [ebx + 0x12], cl
je 0x4069d8
movzx edx, byte [esp + 0x39]
mov ecx, edx
and edx, 0xf
shr cl, 4
movzx edx, byte [esp + edx + 0x3f]
cmp eax, 0xb
movzx ecx, cl
movzx ecx, byte [esp + ecx + 0x3f]
mov byte [ebx + 0x15], dl
mov byte [ebx + 0x14], cl
je 0x4069d8
movzx edx, byte [esp + 0x3a]
mov ecx, edx
and edx, 0xf
shr cl, 4
movzx edx, byte [esp + edx + 0x3f]
cmp eax, 0xc
movzx ecx, cl
movzx ecx, byte [esp + ecx + 0x3f]
mov byte [ebx + 0x17], dl
mov byte [ebx + 0x16], cl
je 0x4069d8
movzx edx, byte [esp + 0x3b]
mov ecx, edx
and edx, 0xf
shr cl, 4
movzx edx, byte [esp + edx + 0x3f]
cmp eax, 0xd
movzx ecx, cl
movzx ecx, byte [esp + ecx + 0x3f]
mov byte [ebx + 0x19], dl
mov byte [ebx + 0x18], cl
je 0x4069d8
movzx edx, byte [esp + 0x3c]
mov ecx, edx
and edx, 0xf
shr cl, 4
movzx edx, byte [esp + edx + 0x3f]
cmp eax, 0xe
movzx ecx, cl
movzx ecx, byte [esp + ecx + 0x3f]
mov byte [ebx + 0x1b], dl
mov byte [ebx + 0x1a], cl
je 0x4069d8
movzx edx, byte [esp + 0x3d]
mov ecx, edx
and edx, 0xf
shr cl, 4
movzx edx, byte [esp + edx + 0x3f]
cmp eax, 0xf
movzx ecx, cl
movzx ecx, byte [esp + ecx + 0x3f]
mov byte [ebx + 0x1d], dl
mov byte [ebx + 0x1c], cl
je 0x4069d8
movzx eax, byte [esp + 0x3e]
mov edx, eax
and eax, 0xf
shr dl, 4
movzx eax, byte [esp + eax + 0x3f]
movzx edx, dl
movzx edx, byte [esp + edx + 0x3f]
mov byte [ebx + 0x1f], al
mov byte [ebx + 0x1e], dl
mov esi, 1
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._CryptDestroyHash_4
sub esp, 4
jmp 0x406a05
call sym._GetLastError_0
mov dword [esp], str.CryptAcquireContext_failed_in_md5Checksum__:__d_r_n
mov dword [esp + 4], eax
call dbg.logEvent
mov eax, dword [esp + 0x20]
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._CryptReleaseContext_8
sub esp, 8
mov eax, esi
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, eax
call sym._GetLastError_0
mov dword [esp], str.CryptAcquireContext_failed_in_md5Checksum__:__d_r_n
mov dword [esp + 4], eax
call dbg.logEvent
add esp, 0x5c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
call sym._GetLastError_0
mov dword [esp], str.CryptGetHashParam_failed:__d_n
mov dword [esp + 4], eax
xor esi, esi
call dbg.logEvent
jmp 0x4069dd
call sym._GetLastError_0
mov dword [esp], str.CryptHashData_failed_in_md5Checksum__:__d_r_n
mov dword [esp + 4], eax
call dbg.logEvent
mov eax, dword [esp + 0x20]
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._CryptReleaseContext_8
sub esp, 8
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._CryptDestroyHash_4
sub esp, 4
mov eax, esi
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret