Function at 0x140001070
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using rc4 via systemfunction032
Generate random numbers via winapi
Get file size
Read file on windows

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x70], rax
xor edi, edi
mov r14, rdx
mov esi, edi
cmp ecx, 2
je 0x1400010d1
mov rcx, qword [r14]
lea edx, [rdi + 0x5c]
call qword [sym.imp.VCRUNTIME140.dll_strrchr]
mov rcx, qword [r14]
test rax, rax
je 0x1400010b8
lea edx, [rdi + 0x5c]
call qword [sym.imp.VCRUNTIME140.dll_strrchr]
lea rcx, [rax + 1]
mov rdx, rcx
lea rcx, str.____Usage:__s__Payload.bin___n
call fcn.140001010
mov eax, 0xffffffff
jmp 0x1400014fb
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xc8], r12
mov qword [rsp + 0x68], rdi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r12, rax
test rax, rax
jne 0x14000110f
lea rbx, str.____HeapAlloc_Failed_With_Error:__d__n
jmp 0x140001172
mov r9d, 0x18
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
lea rcx, [rsp + 0x68]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x14000113a
lea rbx, str.____CryptAcquireContextA_Failed_With_Error:__d__n
jmp 0x140001172
mov rcx, qword [rsp + 0x68]
mov r8, r12
mov edx, 0x10
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x14000115a
lea rbx, str.____CryptGenRandom_Failed_With_Error:__d__n
jmp 0x140001172
mov rcx, qword [rsp + 0x68]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test eax, eax
jne 0x140001198
lea rbx, str.____CryptReleaseContext_Failed_With_Error:__d__n
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.140001010
mov edx, 0x9d
lea rcx, str.____Failed_To_Generate_A_Random_Encryption_Key:__d_n
call fcn.140001010
jmp 0x1400014e9
mov rcx, qword [r14 + 8]
mov qword [rsp + 0xc0], rbp
mov qword [rsp + 0x80], r15
mov dword [rsp + 0x60], edi
test rcx, rcx
je 0x140001496
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x140001201
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____CreateFileA_Failed_With_Error:__d__n
call fcn.140001010
jmp 0x140001496
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r15d, eax
cmp eax, 0xffffffff
jne 0x140001236
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____GetFileSize_Failed_With_Error:__d__n
call fcn.140001010
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001496
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r15
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x140001277
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____HeapAlloc_Failed_With_Error:__d__n
call fcn.140001010
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001496
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], rdi
mov r8d, r15d
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000145d
cmp r15d, dword [rsp + 0x60]
jne 0x14000145d
mov rcx, rbp
mov rsi, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15d, r15d
je 0x140001496
mov eax, r15d
mov qword [rsp + 0x58], rbx
mov r14d, r15d
mov dword [rsp + 0x40], 0x10
and r14d, 0x3ff
mov dword [rsp + 0x44], 0x10
sub eax, r14d
mov qword [rsp + 0x48], r12
add eax, 0x400
lea rcx, str.Advapi32
test r14d, r14d
mov rbp, rbx
cmove eax, r15d
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x54], eax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.SystemFunction032
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14000132a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.____GetProcAddress_Failed_With_Error:__d__n
jmp 0x140001341
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call rax
test eax, eax
je 0x14000135e
lea rcx, str.____SystemFunction032_Failed_With_Error:_0x_0.8X__n
mov edx, eax
call fcn.140001010
mov edx, 0xa7
lea rcx, str.____Failed_To_Encrypt_Payload:__d__n
call fcn.140001010
jmp 0x1400014b1
mov r8d, 0x10
mov qword [rsp + 0x88], r13
lea rdx, str.Rc4Key
lea rcx, str._nunsigned_char__s__d___
call fcn.140001010
mov rbx, rdi
lea r13, str.0x_0.2X_
nop dword [rax]
test bl, 0xf
jne 0x1400013a1
lea rcx, [0x1400032ec]
call fcn.140001010
movzx edx, byte [r12 + rbx]
cmp rbx, 0xf
je 0x1400013bf
mov rcx, r13
call fcn.140001010
inc rbx
cmp rbx, 0x10
jb 0x140001390
jmp 0x1400013cb
lea rcx, str.0x_0.2X
call fcn.140001010
lea rcx, str._n__n
call fcn.140001010
lea rcx, [0x1400035a4]
call fcn.140001010
mov r8d, r15d
lea rdx, str.Rc4EncData
sub r8d, r14d
lea rcx, str._nunsigned_char__s__d___
add r8d, 0x400
test r14d, r14d
cmove r8d, r15d
mov ebx, r8d
call fcn.140001010
test rbx, rbx
je 0x140001447
lea r14, [rbx - 1]
test dil, 0xf
jne 0x140001428
lea rcx, [0x1400032ec]
call fcn.140001010
movzx edx, byte [rdi + rbp]
lea rcx, str.0x_0.2X
cmp rdi, r14
cmovne rcx, r13
call fcn.140001010
inc rdi
cmp rdi, rbx
jb 0x140001416
lea rcx, str._n__n
call fcn.140001010
mov r13, qword [rsp + 0x88]
jmp 0x1400014ac
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, dword [rsp + 0x60]
lea rcx, str.____ReadFile_Failed_With_Error:__d__n_i__Read__d_Of__d_Bytes__n
mov edx, eax
mov r9d, r15d
call fcn.140001010
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdx, qword [r14 + 8]
lea rcx, str.____Failed_To_Read___s__From_Disk:__d__n
mov r8d, 0xa2
call fcn.140001010
test rsi, rsi
je 0x1400014c5
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r15, qword [rsp + 0x80]
mov rbp, qword [rsp + 0xc0]
mov r12, qword [rsp + 0xc8]
xor eax, eax
mov rbx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140001530
add rsp, 0x90
pop r14
pop rdi
pop rsi
ret