Function at 0x1001ef01
Capabilities:
Create new key via cryptacquirecontext
Encode data using xor
Encrypt data using aes via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x974
mov eax, dword [ebp + 0x10]
push ebx
lea edx, [eax - 0xc]
push esi
mov ecx, eax
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 0x20], edx
cmp eax, edx
jbe case.0x1001ed76.206
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x10]
jmp 0x1001ed60
lea eax, [ecx - 0xbc]
cmp eax, 0x18
ja case.0x1001ed76.189
movzx eax, byte [eax + 0x1001f248]
jmp dword [eax*4 + 0x1001f214]
mov ecx, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x1c], ecx
jmp case.0x1001ed76.189
mov edx, dword [ebp + 8]
cmp dword [edx + 0xac], 0
jne 0x1001edca
push str.use_of_a_module_not_declared_used:__0
push 0x1003455f
push 0
push 0x1003455f
push 0x1003455c
push 2
call fcn.100021f0
add esp, 0x18
mov dword [ebp + 0x10], 7
mov dword [ebp - 4], 0xcf
jmp case.0x1001ed76.189
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xbc], 1
jne 0x1001ede3
mov ecx, dword [ebp + 0x14]
fldz
mov dword [ecx], 0
jmp 0x1001edfa
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
fild dword [edx]
test eax, eax
jns 0x1001edf4
fadd qword [0x10036a00]
fdiv qword [0x100369f8]
push 0
fstp qword [ebp - 0x18]
push 0
lea esi, [ebx + 0x54]
push esi
push 0xdd
call fcn.100037c0
add esp, 0x10
mov eax, 3
mov dword [ebp - 4], eax
lea ebx, [ebx]
cmp eax, 3
ja case.default.0x1001ee29
jmp dword [eax*4 + 0x1001f264]
fldz
fcomp qword [ebp - 0x18]
fnstsw ax
test ah, 1
je 0x1001ef57
lea ecx, [ebp - 0x28]
push 0xa3
push ecx
call fcn.1000d670
push 0
lea edx, [ebx + 0x38]
push 0xa4
push edx
call fcn.1001eaa0
push esi
push 0
push 0x9f
call fcn.10021740
add esp, 0x20
mov edi, eax
jmp case.default.0x1001ee29
push esi
push 0
push 0x9f
call fcn.10021740
or eax, 0x80000000
add esp, 0xc
cmp byte [ebp + 0x13], 0
mov edi, eax
je case.default.0x1001ee29
mov dword [ebp - 4], 0xd1
jmp case.0x1001ed76.189
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x50]
push ecx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x44]
lea edx, [ebp - 0x40]
push 0x2d
push edx
mov dword [ebp - 0x4c], eax
call fcn.10005ef0
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push 0xee
push eax
mov dword [ebp - 0x2c], edx
call fcn.1000e840
fld qword [ebp - 0x18]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
fsub qword [ebp - 0x38]
add esp, 0x14
fst qword [ebp - 0x18]
fldz
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 0x41
jne 0x1001ef3d
fstp qword [ebp - 0x18]
jmp case.default.0x1001ee29
test edi, edi
jns 0x1001ef1f
lea ecx, [ebx + 0x50]
push ecx
push 0x56
lea edx, [ebx + 0x38]
push edx
lea eax, [ebp - 0xc]
push eax
call fcn.10003080
add esp, 0x10
test eax, eax
jne 0x1001ef71
lea ecx, [ebx + 0x38]
push 0x1c
push ecx
call fcn.1000a240
lea edx, [ebp - 0x48]
push 0xa3
push edx
call fcn.1000d670
add esp, 0x10
jmp case.default.0x1001ee29
fstp st(0)
mov eax, dword [ebp - 4]
dec eax
lea ecx, [eax + 0x2d]
mov dword [ebp - 4], eax
cmp ecx, 0x2c
ja 0x1001ee20
jmp 0x1001ee12
push 0x98
push esi
call fcn.100020b0
add esp, 8
mov dword [ebp - 4], 0xcf
jmp case.0x1001ed76.189
push 0x98
push esi
call fcn.100020b0
lea edx, [ebx + 0x38]
push 0x1c
push edx
call fcn.1000a240
add esp, 0x10
mov dword [ebp - 4], 0xcf
jmp case.0x1001ed76.189
cmp dword [0x100403e0], 0
jne case.0x1001ed76.189
push 0
push 0x10013450
lea eax, [ebp - 0xc]
push 0x4b
push eax
mov dword [0x100403e0], 1
mov dword [ebp - 0xc], 0x8000
call fcn.1000e570
add esp, 0x10
jmp case.0x1001ed76.189
cmp dword [ebp + 8], 0
mov dword [ebp + 0x10], 1
jne 0x1001efe2
push str.NULL_NA_class
jmp 0x1001efef
test ebx, ebx
jne case.0x1001ed76.189
push str.EnumSTATDATA
push 0x1003455f
push 0
push 0x1003455f
push 0x1003455c
push 2
call fcn.100021f0
add esp, 0x18
mov dword [ebp + 0x10], 2
mov dword [ebp - 4], 0xcf
jmp case.0x1001ed76.189
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov esi, dword [ebp + 8]
push 0xf0000040
push 0x18
push 0
mov dword [esi + 0x18], edx
mov dword [esi + 0x24], 0
push 0
add esi, 4
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
mov eax, dword [ebp + 8]
je 0x1001f0c5
cmp dword [eax + 0x18], 1
jne 0x1001f0c5
mov edx, dword [eax + 0x20]
lea ecx, [eax + 0xc]
mov eax, dword [esi]
push ecx
shl edx, 0x10
or edx, 1
push edx
push 0xa400
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenKey]
mov dword [ebp - 8], eax
test eax, eax
je case.0x1001ed76.189
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x974]
push ecx
push edx
push 0x88
call fcn.10006710
add esp, 0xc
mov dword [ebp - 8], eax
test eax, eax
je case.0x1001ed76.189
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x974]
add eax, 0x14
push eax
mov eax, dword [esi]
push 0
push 0
push ecx
lea edx, [ebp - 0x970]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov dword [ebp - 8], eax
jmp case.0x1001ed76.189
mov ecx, dword [esi]
add eax, 0x14
push eax
push 0
push 0
push 0x114
push 0x1003e498
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov dword [ebp - 8], eax
jmp case.0x1001ed76.189
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x6c], 0x6610
mov dword [eax + 0x20], 0x800
jmp case.0x1001ed76.189
test edi, edi
jle 0x1001f135
push 0
lea esi, [ebx + 0x38]
push 0xa4
push esi
call fcn.1001eaa0
push 0xda
lea edx, [ebx + 0x50]
push edx
push 0
call fcn.10001050
push 0x1c
push esi
call fcn.1000a240
add esp, 0x20
mov dword [ebp - 4], 0xcf
jmp case.0x1001ed76.189
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
jmp case.0x1001ed76.189
mov eax, dword [ebx + 8]
push 0
push eax
push 0x2c
call fcn.100211e0
add esp, 0xc
test al, al
je 0x1001f1bf
lea eax, [ebx + 0x14]
push eax
push 0
push 0x9f
call fcn.10021740
add esp, 0xc
test eax, eax
jne 0x1001f1bf
fld qword [ebp - 0x18]
mov edx, dword [ebp + 0xc]
fmul qword [0x100369f8]
fnstcw word [ebp + 0x12]
movzx eax, word [ebp + 0x12]
or eax, 0xc00
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
fldcw word [ebp - 0xc]
fistp qword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
push ecx
push edx
push eax
mov eax, dword [eax + 0xac]
fldcw word [ebp + 0x12]
call eax
add esp, 0xc
mov dword [ebp + 0x10], eax
jmp 0x1001f1c6
mov dword [ebp + 0x10], 0
mov dword [ebp - 4], 0xd0
lea esi, [ebx + 0x54]
push esi
push 0
push 0x9f
call fcn.10021740
lea edi, [eax - 1]
add esp, 0xc
xor edi, 0x80000000
cmp byte [ebp + 0x13], 0
je 0x1001f1d0
mov ecx, dword [ebp - 4]
dec ecx
mov dword [ebp - 4], ecx
cmp ecx, dword [ebp - 0x20]
ja 0x1001ed60
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret