Function at 0x100011e0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Get mac address on windows
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100085c6
mov eax, dword fs:[0]
push eax
sub esp, 0x364
mov eax, dword [0x1000e008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x118]
mov esi, dword [ebp + 0xc]
push 0x104
push 0
push eax
mov dword [ebp - 0x330], edi
call sub.VCRUNTIME140.dll_memset
mov ecx, esi
mov dword [ebp - 0x334], 0x104
add esp, 0xc
mov dword [ebp - 0x368], 0
xor eax, eax
mov dword [ebp - 0x330], 3
mov dword [ebp - 0x33c], 0
mov dword [ebp - 0x338], 7
lea edx, [ecx + 2]
mov word [ebp - 0x34c], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10001270
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x34c]
call fcn.10001a60
push str.SoftwareHNCSharedHancomDocsAccounts
lea ecx, [ebp - 0x34c]
mov dword [ebp - 4], 0
call fcn.10001bb0
cmp dword [ebp - 0x338], 8
lea ecx, [ebp - 0x368]
push ecx
push 0x20019
lea eax, [ebp - 0x34c]
cmovae eax, dword [ebp - 0x34c]
push 0
push eax
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000179f
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x330]
push eax
push 0
push 0x1000a37c
push dword [ebp - 0x368]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x368]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x1000179f
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x338]
cmp edx, 8
jb 0x10001360
mov ecx, dword [ebp - 0x34c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10001356
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10001356
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.100076ee
add esp, 8
push 0x208
lea eax, [ebp - 0x320]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x368], 0x288
push 0x66840
call fcn.100076fc
mov esi, eax
add esp, 4
test esi, esi
je 0x100017e6
mov ebx, dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
lea eax, [ebp - 0x368]
push eax
push esi
call ebx
cmp eax, 0x6f
jne 0x100013de
push esi
call fcn.100076b9
mov eax, dword [ebp - 0x368]
xor ecx, ecx
add esp, 4
mov edx, 0x288
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100076fc
mov esi, eax
add esp, 4
test esi, esi
je 0x100017e6
lea eax, [ebp - 0x368]
push eax
push esi
call ebx
test eax, eax
jne 0x10001435
test esi, esi
je 0x10001435
movzx eax, byte [esi + 0x199]
push eax
movzx eax, byte [esi + 0x198]
push eax
movzx eax, byte [esi + 0x197]
push eax
movzx eax, byte [esi + 0x196]
push eax
movzx eax, byte [esi + 0x195]
push eax
movzx eax, byte [esi + 0x194]
push eax
lea eax, [ebp - 0x320]
push str._02X_02X_02X_02X_02X_02X
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x20
push esi
call fcn.100076b9
add esp, 4
mov dword [ebp - 0x324], 0
lea eax, [ebp - 0x324]
mov dword [ebp - 0x328], 0
mov dword [ebp - 0x32c], 0
push 0xf0000000
push 0x18
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x100017e6
lea eax, [ebp - 0x328]
push eax
push 0
push 0
push 0x8004
push dword [ebp - 0x324]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x100014ca
mov eax, dword [ebp - 0x324]
test eax, eax
je 0x100014b9
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [ebp - 0x324], 0
push 0x1000a320
mov ecx, edi
call fcn.100019c0
jmp 0x10001807
lea ecx, [ebp - 0x320]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100014d3
sub ecx, edx
sar ecx, 1
push 0
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x320]
push eax
push dword [ebp - 0x328]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x1000151c
mov eax, dword [ebp - 0x328]
test eax, eax
je 0x1000149c
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov dword [ebp - 0x328], 0
jmp 0x1000149c
lea eax, [ebp - 0x32c]
push eax
push 4
push dword [ebp - 0x328]
push 0x6610
push dword [ebp - 0x324]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x1000155d
mov eax, dword [ebp - 0x32c]
test eax, eax
je 0x100014ff
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov dword [ebp - 0x32c], 0
jmp 0x100014ff
mov ebx, dword [ebp - 0x334]
xorps xmm0, xmm0
push ecx
push ebx
lea ecx, [ebp - 0x340]
movq qword [ebp - 0x340], xmm0
mov dword [ebp - 0x338], 0
call fcn.10001880
mov dword [ebp - 4], 1
mov esi, dword [ebp - 0x340]
test ebx, ebx
je 0x100015bf
test esi, esi
jne 0x100015ae
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], 0x16
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
jmp 0x100015bf
push ebx
lea eax, [ebp - 0x118]
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x36c]
mov dword [ebp - 0x36c], ebx
push eax
push esi
push 0
push 1
push 0
push dword [ebp - 0x32c]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x10001685
mov eax, dword [ebp - 0x32c]
test eax, eax
je 0x10001602
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov dword [ebp - 0x32c], 0
mov eax, dword [ebp - 0x328]
test eax, eax
je 0x1000161d
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov dword [ebp - 0x328], 0
mov eax, dword [ebp - 0x324]
test eax, eax
je 0x1000163a
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [ebp - 0x324], 0
push 0x1000a320
mov ecx, edi
call fcn.100019c0
test esi, esi
je 0x10001807
mov ecx, dword [ebp - 0x338]
mov eax, esi
sub ecx, esi
cmp ecx, 0x1000
jb 0x10001676
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10001676
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push esi
call fcn.100076ee
add esp, 8
jmp 0x10001807
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x354], 0
mov dword [ebp - 0x350], 7
mov byte [esi + eax], 0
xor eax, eax
mov ebx, dword [ebp - 0x36c]
add ebx, esi
mov word [ebp - 0x364], ax
mov eax, ebx
sub eax, esi
cmp eax, 7
jbe 0x100016e0
mov byte [ebp - 0x330], 0
lea ecx, [ebp - 0x364]
push dword [ebp - 0x330]
push eax
call fcn.10002110
mov dword [ebp - 0x354], 0
push dword [ebp - 0x330]
lea ecx, [ebp - 0x364]
push ebx
push esi
call fcn.10002060
mov eax, dword [ebp - 0x32c]
test eax, eax
je 0x1000170e
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov dword [ebp - 0x32c], 0
mov eax, dword [ebp - 0x328]
test eax, eax
je 0x10001729
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov dword [ebp - 0x328], 0
mov eax, dword [ebp - 0x324]
test eax, eax
je 0x10001746
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [ebp - 0x324], 0
lea eax, [ebp - 0x364]
mov ecx, edi
push eax
call fcn.10001980
mov edx, dword [ebp - 0x350]
cmp edx, 8
jb 0x10001646
mov ecx, dword [ebp - 0x364]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10001790
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10001790
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.100076ee
add esp, 8
jmp 0x10001646
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x338]
cmp edx, 8
jb 0x100017e6
mov ecx, dword [ebp - 0x34c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100017dc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10001670
push edx
push ecx
call fcn.100076ee
add esp, 8
mov dword [edi + 0x10], 0
xor eax, eax
push 0
mov dword [edi + 0x14], 7
mov ecx, edi
push 0x1000a320
mov word [edi], ax
call fcn.10001a60
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100076a8
mov esp, ebp
pop ebp
ret 8