Function at 0x1006d050
Capabilities:
Encrypt data using curve25519
Generate random numbers via rtlgenrandom
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x1010f16c]
xor eax, ebp
mov dword [ebp - 8], eax
movups xmm0, xmmword [0x100f3420]
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
mov dword [ebp - 0x50], eax
push esi
push edi
mov edi, dword [eax + 0x20]
lea esi, [ebx + 0xfc]
movups xmmword [ebx + 0x11c], xmm0
push 0x20
movups xmm0, xmmword [0x100f3430]
lea eax, [ebx + 0x160]
mov dword [ebp - 0x40], edi
push eax
movups xmmword [ebx + 0x12c], xmm0
push 0x20
movups xmm0, xmmword [0x100f3448]
push esi
mov ecx, esi
movups xmmword [esi], xmm0
movups xmm0, xmmword [0x100f3458]
movups xmmword [esi + 0x10], xmm0
call fcn.1006c5f0
mov eax, dword [0x101160c8]
add esp, 0x10
test eax, eax
jne 0x1006d0ea
push str.SystemFunction036
push str.ADVAPI32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x101160c8], eax
test eax, eax
je 0x1006d0f9
lea ecx, [ebx + 0x13c]
push 0x20
push ecx
call eax
test al, al
jne 0x1006d101
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov al, byte [ebx + 0x15b]
lea edx, [ebx + 0x13c]
and byte [ebx + 0x13c], 0xf8
and al, 0x3f
or al, 0x40
mov byte [ebx + 0x15b], al
lea eax, [edi + 8]
push 0x100f33d0
mov ecx, eax
mov dword [ebp - 0x3c], eax
call fcn.100683a0
lea edi, [ebx + 0x11c]
push edi
push 0x20
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x9c]
call fcn.10061f10
add esp, 0xc
mov byte [ebp - 0x7c], 1
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x7c]
push 1
push eax
mov ecx, eax
call fcn.10061f10
push 0x20
lea eax, [ebp - 0x7c]
push eax
push edi
call fcn.100a82c0
add esp, 0x1c
lea edi, [ebp - 0x9c]
xor al, al
mov ecx, 0x41
rep stosb byte es:[edi], al
push 0x20
push dword [ebp - 0x3c]
mov ecx, esi
push 0x20
push esi
call fcn.1006c5f0
lea eax, [ebx + 0x160]
push eax
lea ecx, [ebx + 0x13c]
push ecx
lea edx, [ebp - 0x28]
lea ecx, [ebx + 0x11c]
call fcn.1006c690
mov esi, dword [ebp - 0x40]
lea eax, [ebp - 0x28]
mov edx, dword [ebx]
lea edi, [ebx + 0xfc]
push eax
push 0
push 0
push 0x20
add esi, 0x28
add edx, 0xe0
push edi
push 0x20
mov ecx, esi
call fcn.10064f80
push 0x30
push esi
push 0x20
push edi
mov ecx, edi
call fcn.1006c5f0
add esp, 0x3c
lea esi, [ebx + 0x11c]
lea eax, [ebx + 0x1a0]
lea ecx, [ebp - 0x9c]
push esi
push 0x20
push eax
call fcn.10061f10
add esp, 0xc
mov byte [ebp - 0x7c], 1
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x7c]
push 1
push eax
mov ecx, eax
call fcn.10061f10
push 0x20
lea eax, [ebp - 0x7c]
push eax
push esi
call fcn.100a82c0
add esp, 0x18
mov byte [ebp - 0x5c], 2
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x7c]
push 0x21
push eax
mov ecx, eax
call fcn.10061f10
push 0x20
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.100a82c0
xor al, al
lea edi, [ebp - 0x9c]
mov ecx, 0x41
add esp, 0x1c
rep stosb byte es:[edi], al
mov edi, dword [ebp - 0x40]
xorps xmm0, xmm0
movlpd qword [ebp - 0x4c], xmm0
lea eax, [edi + 0x58]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov esi, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x48]
add esi, 0x2ac18000
push 0
push 0x989680
adc eax, 0xfe624e21
push eax
push esi
call fcn.100918f0
mov ecx, eax
add ecx, 0xa
bswap ecx
adc edx, 0x40000000
mov dword [edi + 0x5c], ecx
imul eax, eax, 0x989680
push ecx
bswap edx
mov ecx, ebx
mov dword [edi + 0x58], edx
sub esi, eax
imul eax, esi, 0x64
bswap eax
mov dword [edi + 0x60], eax
lea eax, [edi + 0x68]
push eax
call fcn.1006de10
mov ecx, dword [ebx]
mov esi, eax
mov eax, dword [ecx + 0x18]
mov dword [ebp - 0x48], eax
test eax, eax
je 0x1006d307
mov ecx, dword [eax]
lea eax, [edi + 8]
push eax
lea eax, [edi + 0x68]
add eax, esi
mov edx, dword [ecx + 0x1c]
mov ecx, 0x560
sub ecx, esi
push ecx
mov ecx, dword [ebp - 0x48]
push eax
push ebx
call edx
add esi, eax
test esi, esi
je 0x1006d315
mov dword [edi + 0x64], 0x5354
add esi, 4
mov edx, dword [ebp - 0x3c]
lea eax, [ebp - 0x28]
push eax
push 0
push 0
push 0x20
lea edi, [ebx + 0xfc]
mov ecx, edx
lea eax, [esi + 0xc]
push edi
push eax
call fcn.10064f80
lea eax, [esi + 0x1c]
mov ecx, edi
push eax
push dword [ebp - 0x3c]
push 0x20
push edi
call fcn.1006c5f0
mov ecx, dword [ebp - 0x50]
lea eax, [esi + 0x94]
add esp, 0x28
mov dword [ecx + 0x1c], eax
mov ecx, dword [ebx]
push 0
push ebx
call fcn.1006c430
mov edx, dword [ebp - 0x40]
lea edi, [ebp - 0x28]
mov ecx, 8
mov dword [edx + 4], eax
xor eax, eax
rep stosd dword es:[edi], eax
lea eax, [edx + 0x74]
mov dword [edx], 1
add eax, esi
mov ecx, ebx
push eax
push edx
call fcn.1006e2c0
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100908e7
mov esp, ebp
pop ebp
ret 4