Function at 0x1000f2c0
Capabilities:
Create new key via cryptacquirecontext
Encode data using xor
Encrypt data using rc4 via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movaps xmm0, xmmword [0x10065910]
xor ecx, ecx
movups xmmword [ebp - 0x34], xmm0
movaps xmm0, xmmword [0x10065900]
movups xmmword [ebp - 0x24], xmm0
movaps xmm0, xmmword [0x100658f0]
movups xmmword [ebp - 0x14], xmm0
nop dword [eax]
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x2e
jb 0x1000f2f0
push esi
push edi
push 0
push 1
lea eax, [ebp - 0x33]
mov byte [ebp - 5], 0
push eax
push 0
push 0x1007608c
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov esi, dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test eax, eax
jne 0x1000f380
movaps xmm0, xmmword [0x10065980]
xor ecx, ecx
movups xmmword [ebp - 0x34], xmm0
movaps xmm0, xmmword [0x100659a0]
movups xmmword [ebp - 0x24], xmm0
movaps xmm0, xmmword [0x100658d0]
movups xmmword [ebp - 0x14], xmm0
nop dword [eax + eax]
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x2e
jb 0x1000f350
push 8
push 1
lea eax, [ebp - 0x33]
mov byte [ebp - 5], 0
push eax
push 0
push 0x1007608c
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1000f380
push eax
call edi
push eax
call esi
push 0x10076090
push 0
push 0
push 0x8004
push dword [0x1007608c]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x1000f3a4
push eax
call edi
push eax
call esi
movaps xmm0, xmmword [0x10065920]
xor ecx, ecx
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x10], 0xa520403
movaps xmm0, xmmword [0x100659b0]
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0xc], 0x561022
movaps xmm0, xmmword [0x10065990]
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 8], 0x43121837
mov word [ebp - 4], 0x1f
mov al, byte [ebp - 0x40]
xor byte [ebp + ecx - 0x3f], al
inc ecx
cmp ecx, 0x3c
jb 0x1000f3e2
push 1
push 0x3c
lea eax, [ebp - 0x3f]
mov byte [ebp - 3], 0
push eax
push dword [0x10076090]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x1000f411
push eax
call edi
push eax
call esi
push 0x10076094
push 0x800000
push dword [0x10076090]
push 0x6801
push dword [0x1007608c]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x1000f43c
push eax
call edi
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x10076098], eax
call fcn.1005d390
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call fcn.1005d860
push 0x1000f6b0
push 0x10076088
call fcn.1005d0a0
call fcn.1005d3f0
mov edi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
push 0x8f5430
call edi
test eax, eax
jne 0x1000f4ac
mov dword [0x10076088], 0x8f5430
call fcn.1005d390
call esi
push eax
call fcn.1005d860
push 0x1000f6b0
push 0x10076088
call fcn.1005cc10
call fcn.1005d3f0
call fcn.1005d390
call esi
push eax
call fcn.1005d860
push 0x1000f610
push 0x10076080
call fcn.1005d0a0
call fcn.1005d3f0
push 4
push 0x450890
call edi
test eax, eax
jne 0x1000f505
mov dword [0x10076080], 0x450890
call fcn.1005d390
call esi
push eax
call fcn.1005d860
push 0x1000f610
push 0x10076080
call fcn.1005cc10
call fcn.1005d3f0
call fcn.1005d390
call esi
push eax
call fcn.1005d860
push 0x1000f750
push 0x10076084
call fcn.1005d0a0
call fcn.1005d3f0
push 4
push 0x4504c0
call edi
test eax, eax
jne 0x1000f55e
mov dword [0x10076084], 0x4504c0
call fcn.1005d390
call esi
push eax
call fcn.1005d860
push 0x1000f750
push 0x10076084
call fcn.1005cc10
call fcn.1005d3f0
pop edi
pop esi
mov esp, ebp
pop ebp
ret