Function at 0x1400e72e0
Capabilities:
Create new key via cryptacquirecontext
Delete file
Generate random numbers via winapi
Write file on windows

Disassembly:
push rdi
push r12
sub rsp, 0x2c8
mov rax, qword [0x140136e20]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
cmp qword [rcx + 0x18], 8
mov r12d, edx
mov rdi, rcx
jb 0x1400e730d
mov rcx, qword [rcx]
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x1400e7555
mov ecx, dword [rsp + 0x60]
mov qword [rsp + 0x2e8], rbx
mov qword [rsp + 0x2c0], r13
and cl, 0x10
xor r13d, r13d
cmp cl, 0x10
mov rcx, rax
mov ebx, r13d
sete bl
call qword [sym.imp.KERNEL32.dll_FindClose]
test ebx, ebx
jne 0x1400e7545
lea rdx, [rsp + 0x50]
mov rcx, rdi
mov qword [rsp + 0x2f8], rsi
call fcn.140097390
cmp qword [rdi + 0x18], 8
jb 0x1400e7377
mov rcx, qword [rdi]
jmp 0x1400e737a
mov rcx, rdi
xor r9d, r9d
mov qword [rsp + 0x30], r13
xor r8d, r8d
lea edx, [r9 + 2]
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400e753d
mov rbx, qword [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov rdx, rbx
mov qword [rsp + 0x2f0], rbp
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov byte [rsp + 0x41], r13b
mov ebp, r13d
test rbx, rbx
jle 0x1400e7418
nop
lea r9, [rsp + 0x44]
lea rdx, [rsp + 0x41]
mov r8d, 1
mov rcx, rsi
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
inc ebp
movsxd rax, ebp
cmp rax, rbx
jl 0x1400e73f0
cmp r12d, 2
jne 0x1400e7510
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov byte [rsp + 0x40], 0xff
mov ebp, r13d
test rbx, rbx
jle 0x1400e7468
lea r9, [rsp + 0x44]
lea rdx, [rsp + 0x40]
mov r8d, 1
mov rcx, rsi
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
inc ebp
movsxd rax, ebp
cmp rax, rbx
jl 0x1400e7440
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea rdx, [0x140103d98]
lea rcx, [rsp + 0x48]
mov r9d, ILCombine
xor r8d, r8d
mov dword [rsp + 0x20], 8
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov ebp, r13d
test rbx, rbx
jle 0x1400e74ed
nop word [rax + rax]
mov rcx, qword [rsp + 0x48]
lea r8, [rsp + 0x42]
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
lea r9, [rsp + 0x44]
lea rdx, [rsp + 0x42]
mov r8d, 1
mov rcx, rsi
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
inc ebp
movsxd rax, ebp
cmp rax, rbx
jl 0x1400e74b0
lea rdx, [0x140103db8]
lea rcx, [rsp + 0x48]
mov r9d, ILCombine
xor r8d, r8d
mov dword [rsp + 0x20], reloc.SHELL32.dll_ILFindLastID
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rdi + 0x18], 8
mov rbp, qword [rsp + 0x2f0]
jb 0x1400e7534
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rsi, qword [rsp + 0x2f8]
mov rbx, qword [rsp + 0x2e8]
mov r13, qword [rsp + 0x2c0]
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.14004ae00
add rsp, 0x2c8
pop r12
pop rdi
ret