Function at 0x14000c690
Capabilities:
Contain obfuscated stackstrings
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x14016d408]
xor rax, rsp
mov qword [rbp + 0x30], rax
mov r12, rdx
mov r15, rcx
mov qword [rbp - 0x28], rcx
xor r13d, r13d
mov dword [rsp + 0x30], r13d
mov r14, r8
cmp qword [r8 + 0x18], 0x10
jb 0x14000c6e1
mov r14, qword [r8]
mov rsi, qword [r8 + 0x10]
mov rdi, rsi
and edi, 3
mov eax, edi
neg rax
sbb rbx, rbx
and ebx, 2
mov rax, rsi
shr rax, 2
lea rax, [rax + rax*2]
add rbx, rax
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.140007140
mov dword [rsp + 0x30], 2
lea rax, [rsp + 0x70]
cmp qword [rbp - 0x78], 0x10
cmovae rax, qword [rsp + 0x70]
lea rdx, [r14 + rsi]
mov qword [rsp + 0x20], rax
mov r9, rbx
mov r8d, edi
mov rcx, r14
call fcn.14000ae80
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140007000
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], r13
mov qword [rbp + 0x18], r13
mov rax, qword [rbp - 0x80]
cmp rax, 5
jb 0x14000cd56
mov r14, 0xffffffffffffffff
mov qword [rbp + 0x20], r14
add rax, 0xfffffffffffffffb
mov qword [rbp - 0x50], rax
mov r8, r14
cmp rax, r14
cmovb r8, rax
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0x10
cmovae rdx, qword [rsp + 0x70]
add rdx, 5
lea rcx, [rbp]
call fcn.140007bd0
nop
mov dword [rsp + 0x30], 4
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x14000c7ef
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c7ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cd5c
call fcn.1400e117c
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x70], 0
mov r13, r12
cmp qword [r12 + 0x18], 0x10
jb 0x14000c80f
mov r13, qword [r12]
mov rsi, qword [r12 + 0x10]
mov rdi, rsi
and edi, 3
mov rax, rsi
shr rax, 2
lea rbx, [rax + rax*2]
mov eax, edi
neg rax
sbb rcx, rcx
and ecx, 2
add rbx, rcx
xor r8d, r8d
mov rdx, rbx
lea rcx, [rbp - 0x70]
call fcn.140007140
mov dword [rsp + 0x30], recvfrom
lea rax, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae rax, qword [rbp - 0x70]
lea rdx, [rsi + r13]
mov qword [rsp + 0x20], rax
mov r9, rbx
mov r8d, edi
mov rcx, r13
call fcn.14000ae80
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.140007000
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xor esi, esi
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], rsi
mov rax, qword [rbp - 0x60]
cmp rax, 0xc
jb 0x14000cd62
mov qword [rbp + 0x28], r14
add rax, 0xfffffffffffffff4
mov qword [rbp - 0x48], rax
mov r8, r14
cmp rax, r14
cmovb r8, rax
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae rdx, qword [rbp - 0x70]
add rdx, 0xc
lea rcx, [rbp - 0x20]
call fcn.140007bd0
nop
mov dword [rsp + 0x30], reloc.WS2_32.dll_sendto
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x14000c912
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c90d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cd68
call fcn.1400e117c
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x70], 0
mov rcx, qword [rbp - 0x10]
inc rcx
call fcn.1400e11b0
mov rdi, rax
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rdx, qword [rbp - 0x20]
sub rax, rdx
movzx ecx, byte [rdx]
mov byte [rax + rdx], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x14000c942
mov byte [rsp + 0x38], 0x5a
mov byte [rsp + 0x39], 0x76
mov byte [rsp + 0x3a], reloc.WS2_32.dll_WSASetLastError
mov byte [rsp + 0x3b], 0x7f
mov byte [rsp + 0x3c], 0x7c
mov byte [rsp + 0x3d], 0x80
mov byte [rsp + 0x3e], 0x7c
mov byte [rsp + 0x3f], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x40], 0x81
mov byte [rsp + 0x41], 0x2d
mov byte [rsp + 0x42], 0x52
mov byte [rsp + 0x43], 0x7b
mov byte [rsp + 0x44], 0x75
mov byte [rsp + 0x45], WSASetLastError
mov byte [rsp + 0x46], 0x7b
mov byte [rsp + 0x47], reloc.WS2_32.dll_WSASetLastError
mov byte [rsp + 0x48], WSAStartup
mov byte [rsp + 0x49], WSAStartup
mov byte [rsp + 0x4a], 0x2d
mov byte [rsp + 0x4b], 0x5f
mov byte [rsp + 0x4c], 0x60
mov byte [rsp + 0x4d], 0x4e
mov byte [rsp + 0x4e], 0x2d
mov byte [rsp + 0x4f], WSASetLastError
mov byte [rsp + 0x50], 0x7b
mov byte [rsp + 0x51], WSAStartup
mov byte [rsp + 0x52], 0x2d
mov byte [rsp + 0x53], 0x4e
mov byte [rsp + 0x54], 0x52
mov byte [rsp + 0x55], 0x60
mov byte [rsp + 0x56], 0x2d
mov byte [rsp + 0x57], 0x50
mov byte [rsp + 0x58], 0x7f
mov byte [rsp + 0x59], 0x86
mov byte [rsp + 0x5a], 0x7d
mov byte [rsp + 0x5b], 0x81
mov byte [rsp + 0x5c], 0x7c
mov byte [rsp + 0x5d], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x5e], 0x7f
mov byte [rsp + 0x5f], WSASetLastError
mov byte [rsp + 0x60], 0x7d
mov byte [rsp + 0x61], 0x75
mov byte [rsp + 0x62], 0x76
mov byte [rsp + 0x63], reloc.WS2_32.dll_WSASetLastError
mov byte [rsp + 0x64], 0x2d
mov byte [rsp + 0x65], 0x5d
mov byte [rsp + 0x66], 0x7f
mov byte [rsp + 0x67], 0x7c
mov byte [rsp + 0x68], 0x83
mov byte [rsp + 0x69], 0x76
mov byte [rsp + 0x6a], WSAStartup
mov byte [rsp + 0x6b], WSAStartup
mov byte [rsp + 0x6c], 0x7f
mov byte [rsp + 0x6d], cl
movzx eax, byte [rsp + 0x38]
mov rcx, rsi
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x38]
sub al, 0xd
mov byte [rsp + rcx + 0x38], al
inc rcx
cmp rcx, 0x35
jb 0x14000ca70
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 0x18
lea r8, [rsp + 0x38]
xor edx, edx
lea rcx, [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x14000cae2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, str.cacf
lea rcx, [0x140174320]
call fcn.14000b970
mov edx, ebx
mov rcx, rax
call fcn.14000cd80
mov rcx, rax
mov dl, 0xa
call fcn.14000f0e0
xor edx, edx
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800c
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x14000cb3f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, str.cchf
lea rcx, [0x140174320]
call fcn.14000b970
mov edx, ebx
mov rcx, rax
call fcn.14000cd80
mov rcx, rax
mov dl, 0xa
call fcn.14000f0e0
xor edx, edx
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea rdx, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae rdx, qword [rbp]
xor r9d, r9d
mov r8d, dword [rbp + 0x10]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x14000cb91
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, str.chdf
lea rcx, [0x140174320]
call fcn.14000b970
mov edx, ebx
mov rcx, rax
call fcn.14000cd80
mov rcx, rax
mov dl, 0xa
call fcn.14000f0e0
lea rdx, str.chds_n
lea rcx, [0x140174320]
call fcn.14000b970
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, qword [rbp - 0x30]
mov edx, 0x660e
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x14000cc02
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, str.cdkf
lea rcx, [0x140174320]
call fcn.14000b970
mov edx, ebx
mov rcx, rax
call fcn.14000cd80
mov rcx, rax
mov dl, 0xa
call fcn.14000f0e0
xor edx, edx
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea rdx, str.cdcs_n
lea rcx, [0x140174320]
call fcn.14000b970
mov dword [rbp - 0x38], esi
lea rax, [rbp - 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x14000cc6c
lea rdx, str.cdf
lea rcx, [0x140174320]
call fcn.14000b970
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.14000cd80
mov rcx, rax
mov dl, 0xa
call fcn.14000f0e0
mov rdx, rdi
lea rcx, [0x140174320]
call fcn.14000b970
mov rcx, rax
mov dl, 0xa
call fcn.14000f0e0
xorps xmm0, xmm0
movups xmmword [r15], xmm0
mov qword [r15 + 0x10], rsi
mov qword [r15 + 0x18], rsi
inc r14
cmp byte [rdi + r14], 0
jne 0x14000cc94
mov r8, r14
mov rdx, rdi
mov rcx, r15
call fcn.140007bd0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x14000cce9
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cce3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cd6e
call fcn.1400e117c
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x14000cd20
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cd1b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cd50
call fcn.1400e117c
mov rax, r15
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.1400e0e00
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400e82e4
nop
call fcn.14000ef80
nop
call fcn.1400e82e4
nop
call fcn.14000ef80
nop
call fcn.1400e82e4
nop
call fcn.1400e82e4
int3