Function at 0x10002880
Capabilities:
Encrypt data using aes via winapi
Encrypt data using des via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ebp - 0x14], ecx
push edi
mov edi, edx
mov dword [ebp - 8], esi
mov ebx, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
mov ecx, esi
mov dword [ebp - 0x18], 4
mov edx, dword [edi + 8]
mov dword [eax], esi
movzx eax, byte [edx + ecx]
mov edx, str.1.2.643.2.2.21
cmp al, byte [edx + ecx]
mov edx, dword [edi + 8]
jne 0x100028cd
inc ecx
cmp ecx, 0xf
jne 0x100028af
mov esi, 0x661e
jmp 0x10002941
mov ecx, esi
movzx eax, byte [edx + ecx]
mov edx, str.1.2.643.7.1.1.5.1.1
cmp al, byte [edx + ecx]
mov edx, dword [edi + 8]
jne 0x100028e8
inc ecx
cmp ecx, 0x14
jne 0x100028cf
jmp 0x10002901
mov ecx, esi
movzx eax, byte [edx + ecx]
mov edx, str.1.2.643.7.1.1.5.1.2
cmp al, byte [edx + ecx]
mov edx, dword [edi + 8]
jne 0x10002908
inc ecx
cmp ecx, 0x14
jne 0x100028ea
mov esi, 0x6630
jmp 0x10002941
mov ecx, esi
movzx eax, byte [edx + ecx]
mov edx, str.1.2.643.7.1.1.5.2.1
cmp al, byte [edx + ecx]
mov edx, dword [edi + 8]
jne 0x10002923
inc ecx
cmp ecx, 0x14
jne 0x1000290a
jmp 0x1000293c
mov ecx, esi
movzx eax, byte [edx + ecx]
mov edx, str.1.2.643.7.1.1.5.2.2
cmp al, byte [edx + ecx]
mov edx, dword [edi + 8]
jne 0x10002949
inc ecx
cmp ecx, 0x14
jne 0x10002925
mov esi, 0x6631
xor ebx, ebx
inc ebx
jmp 0x10002a0b
mov ecx, esi
movzx eax, byte [edx + ecx]
mov edx, str.1.3.14.3.2.7
cmp al, byte [edx + ecx]
mov edx, dword [edi + 8]
jne 0x1000296c
inc ecx
cmp ecx, 0xd
jne 0x1000294b
mov esi, 0x6601
jmp 0x10002a0b
mov ecx, esi
movzx eax, byte [edx + ecx]
mov edx, str.1.2.840.113549.3.7
cmp al, byte [edx + ecx]
mov edx, dword [edi + 8]
jne 0x1000298c
inc ecx
cmp ecx, 0x13
jne 0x1000296e
mov esi, 0x6603
jmp 0x10002a0b
mov ecx, esi
movzx eax, byte [edx + ecx]
mov edx, str.1.2.840.113549.3.2
cmp al, byte [edx + ecx]
mov edx, dword [edi + 8]
jne 0x100029ac
inc ecx
cmp ecx, 0x13
jne 0x1000298e
mov esi, 0x6602
jmp 0x10002a0b
mov ecx, esi
movzx eax, byte [edx + ecx]
mov edx, str.2.16.840.1.101.3.4.1.2
cmp al, byte [edx + ecx]
mov edx, dword [edi + 8]
jne 0x100029cc
inc ecx
cmp ecx, 0x17
jne 0x100029ae
mov esi, 0x660e
jmp 0x10002a0b
mov ecx, esi
movzx eax, byte [edx + ecx]
mov edx, str.2.16.840.1.101.3.4.1.22
cmp al, byte [edx + ecx]
mov edx, dword [edi + 8]
jne 0x100029ec
inc ecx
cmp ecx, 0x18
jne 0x100029ce
mov esi, 0x660f
jmp 0x10002a0b
mov ecx, esi
mov esi, str.2.16.840.1.101.3.4.1.42
movzx eax, byte [edx + ecx]
cmp al, byte [esi + ecx]
jne 0x10002c21
inc ecx
cmp ecx, 0x18
jne 0x100029f3
mov esi, 0x6610
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x10002a1d
mov edx, dword [eax]
test edx, edx
je 0x10002a1d
add edx, 0x38
jmp 0x10002a44
mov eax, dword [edi + 0x20]
test eax, eax
je 0x10002c21
cmp dword [eax], 1
je 0x10002a36
cmp dword [eax], 2
jne 0x10002c21
mov edx, dword [eax + 4]
test edx, edx
je 0x10002c21
add edx, 4
mov edi, dword [edx]
test edi, edi
je 0x10002c21
test ebx, ebx
je 0x10002aaf
xor ecx, ecx
movzx eax, byte [edi + ecx]
mov edi, str.1.2.643.2.2.19
cmp al, byte [edi + ecx]
mov edi, dword [edx]
jne 0x10002a6c
inc ecx
cmp ecx, 0xf
jne 0x10002a54
jmp 0x10002aa2
xor ecx, ecx
movzx eax, byte [edi + ecx]
mov edi, str.1.2.643.7.1.1.1.1
cmp al, byte [edi + ecx]
mov edi, dword [edx]
jne 0x10002a86
inc ecx
cmp ecx, 0x12
jne 0x10002a6e
jmp 0x10002aa2
xor ecx, ecx
movzx eax, byte [edi + ecx]
mov edi, str.1.2.643.7.1.1.1.2
cmp al, byte [edi + ecx]
mov edi, dword [edx]
jne 0x10002c21
inc ecx
cmp ecx, 0x12
jne 0x10002a88
lea edi, [edx + 4]
cmp dword [edi], 0xd
jae 0x10002ab2
jmp 0x10002c21
lea edi, [edx + 4]
push 0xf0000000
push 0x50
push 0
push 0
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x10002bfb
push 4
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xac
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptGetProvParam]
test eax, eax
je 0x10002bfb
cmp dword [ebp - 0xc], 0
je 0x10002bfb
test ebx, ebx
je 0x10002b2e
push ecx
lea edx, [ebp - 0x2c]
mov ecx, edi
call fcn.100027b7
pop ecx
test eax, eax
je 0x10002bfb
lea edx, [ebp - 0x2c]
mov edi, str.1.2.643.2.2.36.0
xor ecx, ecx
movzx eax, byte [edx + ecx]
cmp al, byte [edi + ecx]
jne 0x10002bf4
inc ecx
cmp ecx, 0x11
jne 0x10002b1b
xor edi, edi
inc edi
lea eax, [ebp - 4]
push eax
mov eax, edi
xor eax, 1
shl eax, 6
or eax, 0x80001
push eax
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptGenKey]
test eax, eax
je 0x10002bfb
test edi, edi
jne 0x10002b71
push edi
lea eax, [ebp - 0x2c]
push eax
push 0x6a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x10002bfb
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x100
push eax
lea eax, [ebp - 0x12c]
push eax
push 0x800000fe
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGetKeyParam]
test eax, eax
je 0x10002bfb
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 0x10]
push ebx
mov dword [esi], eax
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
lea eax, [ebp - 0x12c]
push eax
lea eax, [esi + 0x1e]
mov word [esi + 0x1b], 0x8113
push eax
mov byte [esi + 0x1d], bl
call sub.msvcrt.dll_memcpy
mov ecx, dword [ebp - 0x14]
lea edi, [esi + 8]
mov esi, str.1.2.643.7.1.3.44.5
lea eax, [ebx + 3]
add esp, 0xc
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [ecx + 0x11c], eax
lea eax, [ecx + 0x1b]
mov dword [ecx + 0x120], eax
mov eax, dword [ebp + 8]
mov dword [eax], 1
jmp 0x10002bfe
xor edi, edi
jmp 0x10002b31
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x10002c21
mov eax, dword [ebp - 4]
test eax, eax
je 0x10002c11
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov eax, dword [ebp - 8]
test eax, eax
je 0x10002c21
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
pop esi
pop ebx
leave
ret