Function at 0x1000f380
Capabilities:
Create new key via cryptacquirecontext
Encode data using xor
Encrypt data using rc4 via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movaps xmm0, xmmword [0x10066910]
xor ecx, ecx
movups xmmword [ebp - 0x34], xmm0
movaps xmm0, xmmword [0x10066900]
movups xmmword [ebp - 0x24], xmm0
movaps xmm0, xmmword [0x100668f0]
movups xmmword [ebp - 0x14], xmm0
nop dword [eax]
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x2e
jb 0x1000f3b0
push esi
push edi
push 0
push 1
lea eax, [ebp - 0x33]
mov byte [ebp - 5], 0
push eax
push 0
push 0x1007808c
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov esi, dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test eax, eax
jne 0x1000f440
movaps xmm0, xmmword [0x10066950]
xor ecx, ecx
movups xmmword [ebp - 0x34], xmm0
movaps xmm0, xmmword [0x10066960]
movups xmmword [ebp - 0x24], xmm0
movaps xmm0, xmmword [0x100668e0]
movups xmmword [ebp - 0x14], xmm0
nop dword [eax + eax]
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x2e
jb 0x1000f410
push 8
push 1
lea eax, [ebp - 0x33]
mov byte [ebp - 5], 0
push eax
push 0
push 0x1007808c
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1000f440
push eax
call edi
push eax
call esi
push 0x10078090
push 0
push 0
push 0x8004
push dword [0x1007808c]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x1000f464
push eax
call edi
push eax
call esi
movaps xmm0, xmmword [0x100669b0]
xor ecx, ecx
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x10], 0x48104641
movaps xmm0, xmmword [str.pvfGvS]
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0xc], 0x42145260
movaps xmm0, xmmword [str.HGE_nVm]
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 8], 0x1505a75
mov word [ebp - 4], 0x5d
mov al, byte [ebp - 0x40]
xor byte [ebp + ecx - 0x3f], al
inc ecx
cmp ecx, 0x3c
jb 0x1000f4a2
push 1
push 0x3c
lea eax, [ebp - 0x3f]
mov byte [ebp - 3], 0
push eax
push dword [0x10078090]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x1000f4d1
push eax
call edi
push eax
call esi
push 0x10078094
push 0x800000
push dword [0x10078090]
push 0x6801
push dword [0x1007808c]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x1000f4fc
push eax
call edi
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x10078098], eax
call fcn.1005e2d0
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call fcn.1005e7a0
push 0x1000f770
push 0x10078088
call fcn.1005dfe0
call fcn.1005e330
mov edi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
push 0x8f5430
call edi
test eax, eax
jne 0x1000f56c
mov dword [0x10078088], 0x8f5430
call fcn.1005e2d0
call esi
push eax
call fcn.1005e7a0
push 0x1000f770
push 0x10078088
call fcn.1005db40
call fcn.1005e330
call fcn.1005e2d0
call esi
push eax
call fcn.1005e7a0
push 0x1000f6d0
push 0x10078080
call fcn.1005dfe0
call fcn.1005e330
push 4
push 0x450890
call edi
test eax, eax
jne 0x1000f5c5
mov dword [0x10078080], 0x450890
call fcn.1005e2d0
call esi
push eax
call fcn.1005e7a0
push 0x1000f6d0
push 0x10078080
call fcn.1005db40
call fcn.1005e330
call fcn.1005e2d0
call esi
push eax
call fcn.1005e7a0
push 0x1000f810
push 0x10078084
call fcn.1005dfe0
call fcn.1005e330
push 4
push 0x4504c0
call edi
test eax, eax
jne 0x1000f61e
mov dword [0x10078084], 0x4504c0
call fcn.1005e2d0
call esi
push eax
call fcn.1005e7a0
push 0x1000f810
push 0x10078084
call fcn.1005db40
call fcn.1005e330
pop edi
pop esi
mov esp, ebp
pop ebp
ret