Function at 0x14001253c
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x1402e8ed8]
xor rax, rsp
mov qword [rbp + 0x178], rax
or dword [rsp + 0x5c], 0xffffffff
mov rdi, rcx
mov rax, qword [rbp + 0x1e8]
xor ecx, ecx
mov qword [rsp + 0x78], rdx
mov r15d, ecx
mov qword [rbp - 0x38], rax
mov r13d, ecx
mov r12d, ecx
mov qword [rbp - 0x78], rcx
mov esi, ecx
mov dword [rbp - 0x7c], ecx
mov r14d, ecx
mov dword [rbp - 0x80], ecx
mov ebx, ecx
mov qword [rsp + 0x70], rcx
mov dword [rsp + 0x60], 0xc00
mov dword [rbp - 0x70], 1
mov dword [rsp + 0x50], ecx
mov qword [rbp - 0x68], rcx
mov dword [rsp + 0x54], ecx
mov qword [rbp - 0x50], rcx
cmp qword [rdi], rcx
je 0x140012d1f
cmp qword [rdi + 8], rcx
je 0x140012d1f
cmp qword [rdi + 0x10], rcx
je 0x140012d1f
mov qword [rax], rcx
lea r8d, [rcx + 0x40]
lea rcx, [rbp + 0x50]
xor edx, edx
call fcn.1401cbcd0
xor r8d, r8d
lea rdx, str.Microsoft_Software_Key_Storage_Provider
lea rcx, [rbp - 0x68]
call qword [sym.imp.ncrypt.dll_NCryptOpenStorageProvider]
test eax, eax
js 0x140012c94
mov rcx, qword [rbp - 0x68]
lea r9, str.MeshDummy
mov dword [rsp + 0x28], 0x80
lea r8, [0x14025e910]
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x20], 1
call qword [sym.imp.ncrypt.dll_NCryptCreatePersistedKey]
test eax, eax
js 0x140012c94
mov rcx, qword [rsp + 0x70]
lea r9d, [rbx + 4]
lea r8, [rsp + 0x60]
mov dword [rsp + 0x20], 0x80000040
lea rdx, str.Length
call qword [sym.imp.ncrypt.dll_NCryptSetProperty]
test eax, eax
jns 0x14001269e
mov rcx, qword [rsp + 0x70]
lea r9d, [rbx + 4]
lea r8, [rsp + 0x60]
mov dword [rsp + 0x60], 0x800
lea rdx, str.Length
mov dword [rsp + 0x20], 0x80000040
call qword [sym.imp.ncrypt.dll_NCryptSetProperty]
test eax, eax
js 0x140012c94
mov rcx, qword [rsp + 0x70]
lea r8, [rbp - 0x70]
mov r9d, 4
mov dword [rsp + 0x20], 0x80000040
lea rdx, str.Export_Policy
call qword [sym.imp.ncrypt.dll_NCryptSetProperty]
test eax, eax
js 0x140012c94
mov rcx, qword [rsp + 0x70]
mov edx, 0x40
call qword [sym.imp.ncrypt.dll_NCryptFinalizeKey]
test eax, eax
js 0x140012c94
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x54]
xor r9d, r9d
mov qword [rsp + 0x20], rax
lea eax, [r9 + 1]
mov r8d, eax
mov edx, eax
call qword [sym.imp.CRYPT32.dll_CryptExportPublicKeyInfo]
test eax, eax
je 0x140012c94
mov ecx, dword [rsp + 0x54]
call fcn.1401d7f54
mov r14, rax
test rax, rax
je 0x140012d4b
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x54]
mov qword [rsp + 0x20], rax
mov r9, r14
mov eax, 1
mov r8d, eax
mov edx, eax
call qword [sym.imp.CRYPT32.dll_CryptExportPublicKeyInfo]
test eax, eax
je 0x140012c94
and qword [rsp + 0x30], rbx
lea rax, [rsp + 0x64]
mov rdx, qword [rsp + 0x78]
xor r9d, r9d
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], rbx
lea r8d, [r9 + 3]
lea ecx, [r9 + 1]
call qword [sym.imp.CRYPT32.dll_CertStrToNameA]
test eax, eax
je 0x140012c94
mov ecx, dword [rsp + 0x64]
call fcn.1401d7f54
mov r15, rax
test rax, rax
je 0x140012d91
and qword [rsp + 0x30], rbx
lea rax, [rsp + 0x64]
mov rdx, qword [rsp + 0x78]
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r8d, [r9 + 3]
lea ecx, [r9 + 1]
call qword [sym.imp.CRYPT32.dll_CertStrToNameA]
test eax, eax
je 0x140012c94
mov eax, dword [rsp + 0x64]
lea rdx, str.CNlocalhost
and qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rbp - 8], eax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], rbx
lea r8d, [r9 + 3]
mov qword [rbp], r15
lea ecx, [r9 + 1]
call qword [sym.imp.CRYPT32.dll_CertStrToNameW]
test eax, eax
je 0x140012c94
mov ecx, dword [rsp + 0x68]
call fcn.1401d7f54
mov r13, rax
test rax, rax
je 0x140012dd7
and qword [rsp + 0x30], rbx
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, str.CNlocalhost
mov qword [rsp + 0x20], r13
lea r8d, [r9 + 3]
lea ecx, [r9 + 1]
call qword [sym.imp.CRYPT32.dll_CertStrToNameW]
test eax, eax
je 0x140012c94
mov eax, dword [rsp + 0x68]
lea rcx, [rbp + 0x90]
xor edx, edx
mov dword [rbp + 8], eax
mov r8d, 0xd0
mov qword [rbp + 0x10], r13
call fcn.1401cbcd0
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov eax, 0xffff
lea rdx, [rbp - 0x48]
add word [rbp + 0x160], ax
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
add word [rbp + 0x160], 0x1e
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
and qword [rsp + 0x78], rbx
lea rdx, [0x14025ea20]
xor r9d, r9d
lea rcx, [rsp + 0x78]
xor r8d, r8d
call qword [sym.imp.ncrypt.dll_BCryptOpenAlgorithmProvider]
test eax, eax
js 0x1400128ea
mov rcx, qword [rsp + 0x78]
lea rdx, [rbp + 0x170]
mov r9d, 1
lea r8d, [r9 + 7]
call qword [sym.imp.ncrypt.dll_BCryptGenRandom]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400128fc
xor edx, edx
call qword [sym.imp.ncrypt.dll_BCryptCloseAlgorithmProvider]
movups xmm0, xmmword [rbp - 8]
mov dword [rbp + 0x90], 2
lea rax, [rbp + 0x170]
mov qword [rbp + 0xa0], rax
lea r8, [rbp - 0x20]
movdqu xmmword [rbp + 0xc0], xmm0
mov dword [rbp + 0x98], 8
mov ecx, 1
movups xmm0, xmmword [rbp + 8]
lea rax, str.1.2.840.113549.1.1.12
mov byte [rsp + 0x58], 0xa8
mov qword [rbp + 0xa8], rax
xor r9d, r9d
mov rax, qword [rbp - 0x48]
lea edx, [rcx + 0xd]
mov qword [rbp + 0xd0], rax
mov rax, qword [rbp - 0x40]
mov qword [rbp + 0xd8], rax
lea rax, str.1.3.6.1.5.5.7.3.2
movdqu xmmword [rbp + 0xe0], xmm0
movups xmm1, xmmword [r14]
movaps xmmword [rbp + 0xf0], xmm1
movups xmm0, xmmword [r14 + 0x10]
movaps xmmword [rbp + 0x100], xmm0
movups xmm1, xmmword [r14 + 0x20]
and dword [rbp - 0x1c], ebx
and qword [rbp - 0x10], rbx
mov qword [rbp - 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rbp - 0x18], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x20], rax
movaps xmmword [rbp + 0x110], xmm1
mov dword [rbp - 0x30], 4
mov dword [rbp - 0x20], ecx
call qword [sym.imp.CRYPT32.dll_CryptEncodeObject]
test eax, eax
je 0x140012c94
mov ecx, dword [rsp + 0x54]
call fcn.1401d7f54
mov rsi, rax
test rax, rax
je 0x140012e1d
mov edx, reloc.WS2_32.dll_ntohl
lea rax, [rsp + 0x54]
mov r9, rsi
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x20]
lea ecx, [rdx - 0xd]
call qword [sym.imp.CRYPT32.dll_CryptEncodeObject]
test eax, eax
je 0x140012c94
and dword [rbp + 0x58], ebx
lea rax, str.2.5.29.15
mov qword [rbp + 0x50], rax
lea r8, [rbp - 0x30]
mov eax, dword [rsp + 0x54]
xor r9d, r9d
mov dword [rbp + 0x60], eax
lea rax, [rsp + 0x54]
mov qword [rbp + 0x68], rsi
mov qword [rsp + 0x20], rax
lea edx, [r9 + 0x24]
lea ecx, [rdx - 0x23]
call qword [sym.imp.CRYPT32.dll_CryptEncodeObject]
test eax, eax
je 0x140012c94
mov ecx, dword [rsp + 0x54]
call fcn.1401d7f54
mov r12, rax
test rax, rax
je 0x140012e63
mov edx, 0x24
lea rax, [rsp + 0x54]
mov r9, r12
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x30]
lea ecx, [rdx - 0x23]
call qword [sym.imp.CRYPT32.dll_CryptEncodeObject]
test eax, eax
je 0x140012c94
mov rcx, qword [rdi + 0x10]
lea rax, str.2.5.29.37
and dword [rbp + 0x78], ebx
lea r9, [rbp - 0x78]
mov qword [rbp + 0x70], rax
xor r8d, r8d
mov eax, dword [rsp + 0x54]
mov edx, 0x10040
mov dword [rbp + 0x80], eax
lea rax, [rbp + 0x50]
mov qword [rbp + 0x158], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x20], rax
mov qword [rbp + 0x88], r12
mov dword [rbp + 0x150], 2
call qword [sym.imp.CRYPT32.dll_CryptAcquireCertificatePrivateKey]
test eax, eax
je 0x140012c94
mov rcx, qword [rbp - 0x78]
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0xa8]
and qword [rsp + 0x38], rbx
and qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x90]
mov qword [rsp + 0x20], rax
mov eax, 1
mov r8d, eax
mov edx, eax
lea r9d, [rax + 1]
call qword [sym.imp.CRYPT32.dll_CryptSignAndEncodeCertificate]
test eax, eax
je 0x140012c94
mov ecx, dword [rsp + 0x5c]
call fcn.1401d7f54
mov rdi, rax
test rax, rax
je 0x140012ea9
mov rcx, qword [rbp - 0x78]
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x38], rdi
and qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x90]
mov qword [rsp + 0x20], rax
mov eax, 1
mov r8d, eax
mov edx, eax
lea r9d, [rax + 1]
call qword [sym.imp.CRYPT32.dll_CryptSignAndEncodeCertificate]
test eax, eax
je 0x140012c94
and qword [rsp + 0x20], rbx
xor r8d, r8d
mov r9d, 0x2000
lea edx, [r8 + 1]
lea ecx, [rdx + 1]
call qword [sym.imp.CRYPT32.dll_CertOpenStore]
mov rbx, rax
test rax, rax
je 0x140012c8e
mov r9d, dword [rsp + 0x5c]
lea rax, [rbp - 0x50]
mov qword [rsp + 0x28], rax
mov r8, rdi
mov eax, 1
mov rcx, rbx
mov edx, eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.CRYPT32.dll_CertAddEncodedCertificateToStore]
xor edi, edi
test eax, eax
je 0x140012c96
mov rcx, qword [rbp - 0x50]
lea rax, str.MeshDummy
mov qword [rbp + 0x18], rax
lea r9, [rbp + 0x18]
lea rax, str.Microsoft_Software_Key_Storage_Provider
mov qword [rbp + 0x40], rdi
xorps xmm0, xmm0
mov qword [rbp + 0x20], rax
xor r8d, r8d
mov qword [rbp + 0x28], rdi
lea edx, [rdi + 2]
movdqu xmmword [rbp + 0x30], xmm0
call qword [sym.imp.CRYPT32.dll_CertSetCertificateContextProperty]
test eax, eax
je 0x140012c96
xorps xmm0, xmm0
lea r9d, [rdi + 4]
lea r8, [0x14025bbc8]
mov rcx, rbx
lea rdx, [rbp - 0x60]
movups xmmword [rbp - 0x60], xmm0
call qword [sym.imp.CRYPT32.dll_PFXExportCertStore]
test eax, eax
je 0x140012c96
mov ecx, dword [rbp - 0x60]
call fcn.1401d7f54
mov qword [rbp - 0x58], rax
test rax, rax
je 0x140012eef
lea r9d, [rdi + 4]
mov rcx, rbx
lea r8, [0x14025bbc8]
lea rdx, [rbp - 0x60]
call qword [sym.imp.CRYPT32.dll_PFXExportCertStore]
test eax, eax
je 0x140012c96
mov rcx, qword [rbp - 0x38]
mov rax, qword [rbp - 0x58]
mov edi, dword [rbp - 0x60]
mov qword [rcx], rax
jmp 0x140012c96
mov edi, dword [rsp + 0x50]
jmp 0x140012c96
mov edi, ebx
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x140012ca5
call qword [sym.imp.ncrypt.dll_NCryptFreeObject]
cmp dword [rbp - 0x80], 0
je 0x140012cca
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x140012cca
cmp dword [rbp - 0x7c], 0xffffffff
jne 0x140012cc2
call qword [sym.imp.ncrypt.dll_NCryptFreeObject]
jmp 0x140012cca
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test r14, r14
je 0x140012cd7
mov rcx, r14
call fcn.1401d6b80
test r15, r15
je 0x140012ce4
mov rcx, r15
call fcn.1401d6b80
test r13, r13
je 0x140012cf1
mov rcx, r13
call fcn.1401d6b80
test rbx, rbx
je 0x140012d01
xor edx, edx
mov rcx, rbx
call qword [sym.imp.CRYPT32.dll_CertCloseStore]
test r12, r12
je 0x140012d0e
mov rcx, r12
call fcn.1401d6b80
test rsi, rsi
je 0x140012d1b
mov rcx, rsi
call fcn.1401d6b80
mov eax, edi
jmp 0x140012d21
xor eax, eax
mov rcx, qword [rbp + 0x178]
xor rcx, rsp
call fcn.1401c9740
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x280
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0xfe
lea rdx, str.C:UsersDELLDesktopProjektySUPMANMeshAgentmeshcorewincrypto.cpp
mov edi, 0x25a
mov dword [rsp + 0x20], eax
mov r9d, ebx
mov r8d, edi
xor ecx, ecx
call fcn.1400a1918
mov r8d, edi
lea rdx, str.C:UsersDELLDesktopProjektySUPMANMeshAgentmeshcorewincrypto.cpp
lea rcx, str.CRITICALEXIT__FILE:__s__LINE:__d_r_n
call fcn.140001128
mov ecx, ebx
call fcn.1401d00dc
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0xfe
lea rdx, str.C:UsersDELLDesktopProjektySUPMANMeshAgentmeshcorewincrypto.cpp
mov edi, 0x25f
mov dword [rsp + 0x20], eax
mov r9d, ebx
mov r8d, edi
xor ecx, ecx
call fcn.1400a1918
mov r8d, edi
lea rdx, str.C:UsersDELLDesktopProjektySUPMANMeshAgentmeshcorewincrypto.cpp
lea rcx, str.CRITICALEXIT__FILE:__s__LINE:__d_r_n
call fcn.140001128
mov ecx, ebx
call fcn.1401d00dc
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0xfe
lea rdx, str.C:UsersDELLDesktopProjektySUPMANMeshAgentmeshcorewincrypto.cpp
mov edi, 0x266
mov dword [rsp + 0x20], eax
mov r9d, ebx
mov r8d, edi
xor ecx, ecx
call fcn.1400a1918
mov r8d, edi
lea rdx, str.C:UsersDELLDesktopProjektySUPMANMeshAgentmeshcorewincrypto.cpp
lea rcx, str.CRITICALEXIT__FILE:__s__LINE:__d_r_n
call fcn.140001128
mov ecx, ebx
call fcn.1401d00dc
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0xfe
lea rdx, str.C:UsersDELLDesktopProjektySUPMANMeshAgentmeshcorewincrypto.cpp
mov edi, 0x2a0
mov dword [rsp + 0x20], eax
mov r9d, ebx
mov r8d, edi
xor ecx, ecx
call fcn.1400a1918
mov r8d, edi
lea rdx, str.C:UsersDELLDesktopProjektySUPMANMeshAgentmeshcorewincrypto.cpp
lea rcx, str.CRITICALEXIT__FILE:__s__LINE:__d_r_n
call fcn.140001128
mov ecx, ebx
call fcn.1401d00dc
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0xfe
lea rdx, str.C:UsersDELLDesktopProjektySUPMANMeshAgentmeshcorewincrypto.cpp
mov edi, 0x2a9
mov dword [rsp + 0x20], eax
mov r9d, ebx
mov r8d, edi
xor ecx, ecx
call fcn.1400a1918
mov r8d, edi
lea rdx, str.C:UsersDELLDesktopProjektySUPMANMeshAgentmeshcorewincrypto.cpp
lea rcx, str.CRITICALEXIT__FILE:__s__LINE:__d_r_n
call fcn.140001128
mov ecx, ebx
call fcn.1401d00dc
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0xfe
lea rdx, str.C:UsersDELLDesktopProjektySUPMANMeshAgentmeshcorewincrypto.cpp
mov edi, 0x2b7
mov dword [rsp + 0x20], eax
mov r9d, ebx
mov r8d, edi
xor ecx, ecx
call fcn.1400a1918
mov r8d, edi
lea rdx, str.C:UsersDELLDesktopProjektySUPMANMeshAgentmeshcorewincrypto.cpp
lea rcx, str.CRITICALEXIT__FILE:__s__LINE:__d_r_n
call fcn.140001128
mov ecx, ebx
call fcn.1401d00dc
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0xfe
lea rdx, str.C:UsersDELLDesktopProjektySUPMANMeshAgentmeshcorewincrypto.cpp
mov edi, 0x2d2
mov dword [rsp + 0x20], eax
mov r9d, ebx
mov r8d, edi
xor ecx, ecx
call fcn.1400a1918
mov r8d, edi
lea rdx, str.C:UsersDELLDesktopProjektySUPMANMeshAgentmeshcorewincrypto.cpp
lea rcx, str.CRITICALEXIT__FILE:__s__LINE:__d_r_n
call fcn.140001128
mov ecx, ebx
call fcn.1401d00dc
int3