Function at 0x140001070
Capabilities:
Acquire debug privileges
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Get file size
Hash data via wincrypt
Initialize hashing via wincrypt
Read file on windows

Disassembly:
push rbp
push rbx
push r12
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x14001e008]
xor rax, rsp
mov qword [rbp + 0x27], rax
xor r12d, r12d
xorps xmm0, xmm0
mov qword [rbp + 7], r12
mov rbx, rdx
mov dword [rbp - 0x15], r12d
mov byte [rbp - 0x19], r12b
movups xmmword [rbp + 0x17], xmm0
cmp ecx, 2
jge 0x1400010be
lea rcx, str._nUsage:_inject.exe__file___pid_
call fcn.140001010
jmp 0x14000140a
mov qword [rsp + 0xd0], rdi
mov qword [rsp + 0x98], r14
mov qword [rsp + 0x90], r15
jne 0x1400010e4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r14, qword [rbx + 8]
jmp 0x1400010f1
mov rcx, qword [rdx + 0x10]
mov r14, qword [rdx + 8]
call fcn.140005480
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, r14
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140001147
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Failed_to_open_the_DLL_file
lea rcx, str._____s._Error_d
call fcn.140001010
jmp 0x1400013f2
xor edx, edx
mov qword [rsp + 0xc0], rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea ecx, [rsi - 1]
cmp ecx, 0xfffffffd
ja 0x1400013ce
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, esi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x1400013ce
lea r9, [rbp - 0x15]
mov qword [rsp + 0x20], r12
mov r8d, esi
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400011b6
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Failed_to_alloc_a_buffer_
jmp 0x1400013a9
mov r9d, 0x18
mov dword [rbp - 0x11], esi
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
lea rcx, [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x14000139c
mov rcx, qword [rbp - 9]
lea rax, [rbp - 1]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x14000139c
mov rcx, qword [rbp - 1]
lea rdx, [0x14001ea30]
xor r9d, r9d
lea r8d, [r9 + 0x10]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x14000139c
mov r8, qword [rbp - 1]
lea rax, [rbp + 0xf]
mov rcx, qword [rbp - 9]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x14000139c
mov rcx, qword [rbp + 0xf]
lea rax, [rbp - 0x11]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x14000139c
mov rcx, qword [rbp - 9]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rbp - 1]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp + 0xf]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 7]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400012fb
lea r8, [rbp + 0x1b]
mov dword [rbp + 0x17], 1
lea rdx, str.SeDebugPrivilege
mov dword [rbp + 0x23], 2
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x1400012f1
mov rcx, qword [rbp + 7]
lea r8, [rbp + 0x17]
mov qword [rsp + 0x28], r12
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rbp + 7]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, r15d
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
jne 0x140001325
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Failed_to_open_the_target_process
jmp 0x1400013a9
lea r9, [rbp - 0x19]
mov r8d, esi
mov rdx, rbx
mov rcx, rdi
call fcn.140001750
mov rsi, rax
test rax, rax
jne 0x14000135d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Failed_to_inject_the_DLL
lea rcx, str._____s._Error_d
call fcn.140001010
jmp 0x14000137d
mov r8d, r15d
lea rcx, str.___Injected_the__s_DLL_into_process__d.
mov rdx, r14
call fcn.140001010
mov edx, 0xffffffff
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400013ea
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Failed_to_decrypt_file_
mov r8d, eax
lea rcx, str._____s._Error_d
call fcn.140001010
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400013ea
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Failed_to_get_the_DLL_file_size
lea rcx, str._____s._Error_d
call fcn.140001010
mov rsi, qword [rsp + 0xc0]
mov r15, qword [rsp + 0x90]
mov r14, qword [rsp + 0x98]
mov rdi, qword [rsp + 0xd0]
xor eax, eax
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140001860
add rsp, 0xa0
pop r12
pop rbx
pop rbp
ret