Function at 0x1000be40
Capabilities:
Contain obfuscated stackstrings
Create new key via cryptacquirecontext
Encode data using xor
Encrypt data using rc4 via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movaps xmm0, xmmword [0x1004a980]
xor edx, edx
movups xmmword [ebp - 0x34], xmm0
mov ecx, edx
movaps xmm0, xmmword [0x1004a990]
movups xmmword [ebp - 0x24], xmm0
movaps xmm0, xmmword [str.O_fCZEHI_fZ]
movups xmmword [ebp - 0x14], xmm0
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x2e
jb 0x1000be6b
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
lea eax, [ebp - 0x33]
push esi
push edi
push edx
push 1
push eax
push edx
push 0x1005b114
mov byte [ebp - 5], dl
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test eax, eax
jne 0x1000bef6
movaps xmm0, xmmword [0x1004a9a0]
xor ecx, ecx
movups xmmword [ebp - 0x34], xmm0
movaps xmm0, xmmword [0x1004a9b0]
movups xmmword [ebp - 0x24], xmm0
movaps xmm0, xmmword [0x1004a8d0]
movups xmmword [ebp - 0x14], xmm0
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x2e
jb 0x1000bec6
push 8
push 1
lea eax, [ebp - 0x33]
mov byte [ebp - 5], 0
push eax
push 0
push 0x1005b114
call ebx
xor ebx, ebx
test eax, eax
jne 0x1000bef8
push ebx
call edi
push eax
call esi
jmp 0x1000bef8
xor ebx, ebx
push 0x1005b118
push ebx
push ebx
push 0x8004
push dword [0x1005b114]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x1000bf1a
push ebx
call edi
push eax
call esi
movaps xmm0, xmmword [0x1004a9c0]
mov ecx, ebx
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x10], 0x732b7d7a
movaps xmm0, xmmword [0x1004a940]
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0xc], 0x792f695b
movaps xmm0, xmmword [0x1004a970]
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 8], 0x3a6b614e
mov word [ebp - 4], 0x66
mov al, byte [ebp - 0x40]
xor byte [ebp + ecx - 0x3f], al
inc ecx
cmp ecx, 0x3c
jb 0x1000bf58
push 1
push 0x3c
lea eax, [ebp - 0x3f]
mov byte [ebp - 3], bl
push eax
push dword [0x1005b118]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x1000bf86
push ebx
call edi
push eax
call esi
push 0x1005b11c
push 0x800000
push dword [0x1005b118]
push 0x6801
push dword [0x1005b114]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x1000bfb1
push ebx
call edi
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x1005b120], eax
call fcn.10043670
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call fcn.10043b40
mov ebx, 0x1000c203
push ebx
push 0x1005b110
call fcn.10043380
call fcn.100436d0
mov edi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
push 0x8f5430
call edi
test eax, eax
jne 0x1000c01e
mov dword [0x1005b110], 0x8f5430
call fcn.10043670
call esi
push eax
call fcn.10043b40
push ebx
push 0x1005b110
call fcn.10042ef0
call fcn.100436d0
call fcn.10043670
call esi
push eax
call fcn.10043b40
mov ebx, 0x1000c16a
push ebx
push 0x1005b108
call fcn.10043380
call fcn.100436d0
push 4
push 0x450890
call edi
test eax, eax
jne 0x1000c074
mov dword [0x1005b108], 0x450890
call fcn.10043670
call esi
push eax
call fcn.10043b40
push ebx
push 0x1005b108
call fcn.10042ef0
call fcn.100436d0
call fcn.10043670
call esi
push eax
call fcn.10043b40
mov ebx, 0x1000c299
push ebx
push 0x1005b10c
call fcn.10043380
call fcn.100436d0
push 4
push 0x4504c0
call edi
test eax, eax
jne 0x1000c0ca
mov dword [0x1005b10c], 0x4504c0
call fcn.10043670
call esi
push eax
call fcn.10043b40
push ebx
push 0x1005b10c
call fcn.10042ef0
call fcn.100436d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret