Function at 0x180006b40
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x18009a918]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r14, r9
mov r12, r8
mov r13, rdx
mov r15, rcx
test rcx, rcx
jne 0x180006b92
mov eax, 0xc00000ef
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18005e1d0
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
test r12, r12
jne 0x180006b9e
mov eax, 0xc00000f0
jmp 0x180006b75
test r14, r14
jne 0x180006baa
mov eax, 0xc00000f1
jmp 0x180006b75
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x20], ebx
lea r9d, [rbx + 0x18]
mov r8, qword [0x18009d670]
xor edx, edx
lea rcx, [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x180006c92
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea rdi, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rdi
je 0x180006c1b
test byte [rcx + 0x1c], 1
je 0x180006c1b
cmp byte [rcx + 0x19], 3
jb 0x180006c1b
mov edx, 0xa2
lea r8, [0x1800909f8]
mov rcx, qword [rcx + 0x10]
call fcn.180001070
cmp esi, 0x80090016
jne 0x180006c81
mov dword [rsp + 0x20], 8
mov r9d, 0x18
mov r8, qword [0x18009d670]
xor edx, edx
lea rcx, [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x180006c99
mov rcx, qword [0x18009b358]
cmp rcx, rdi
je 0x180006c81
test byte [rcx + 0x1c], 1
je 0x180006c81
cmp byte [rcx + 0x19], 2
jb 0x180006c81
mov edx, 0xa3
mov dword [rsp + 0x20], esi
lea r9, str.Acquire_context
lea r8, [0x1800909f8]
mov rcx, qword [rcx + 0x10]
call fcn.1800012d0
mov ebx, 0xc000028b
lea rsi, str.E:_buildsARK23181_2_trufos_dlldecrypt.c
jmp 0x180006f0e
lea rdi, [0x18009b358]
mov eax, dword [r15]
add eax, 0xc
cmp byte [0x18009b380], 0
je 0x180006cd7
mov ecx, 0xc2c
lea rsi, str.E:_buildsARK23181_2_trufos_dlldecrypt.c
mov qword [rsp + 0x28], rsi
mov word [rsp + 0x20], cx
xor r9d, r9d
mov r8d, 0x4b45443a
mov edx, eax
lea rcx, [0x18009cc40]
call fcn.18004b960
jmp 0x180006cf7
mov r8d, eax
xor edx, edx
mov rcx, qword [0x18009ccf0]
mov rax, qword [0x18009b430]
call qword [0x18007d538]
lea rsi, str.E:_buildsARK23181_2_trufos_dlldecrypt.c
mov rcx, rax
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x180006d3b
mov rcx, qword [0x18009b358]
cmp rcx, rdi
je 0x180006d31
test byte [rcx + 0x1c], 1
je 0x180006d31
cmp byte [rcx + 0x19], 2
jb 0x180006d31
mov edx, 0xa4
lea r8, [0x1800909f8]
mov rcx, qword [rcx + 0x10]
call fcn.180001070
mov ebx, 0xc000009a
jmp 0x180006f0e
mov eax, dword [r15 + 8]
mov dword [rcx + 4], eax
mov rax, qword [rsp + 0x30]
mov byte [rax], 8
mov rax, qword [rsp + 0x30]
mov byte [rax + 1], 2
mov rax, qword [rsp + 0x30]
mov word [rax + 2], bx
mov ecx, dword [r15]
mov rax, qword [rsp + 0x30]
mov dword [rax + 8], ecx
mov r8d, dword [r15]
lea rdx, [r15 + 0x10]
mov rcx, qword [rsp + 0x30]
add rcx, 0xc
call fcn.18005f360
mov r8d, dword [r15]
add r8d, 0xc
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x180006df0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x18009b358]
cmp rcx, rdi
je 0x180006de6
test byte [rcx + 0x1c], 1
je 0x180006de6
cmp byte [rcx + 0x19], 2
jb 0x180006de6
mov edx, 0xa5
lea r9, str.Import_key
mov dword [rsp + 0x20], eax
lea r8, [0x1800909f8]
mov rcx, qword [rcx + 0x10]
call fcn.1800012d0
mov ebx, 0xc000028b
jmp 0x180006f0e
mov dword [rsp + 0x50], 4
mov dword [rsp + 0x20], ebx
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x40]
mov edx, 8
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptGetKeyParam]
test eax, eax
jne 0x180006e46
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x18009b358]
cmp rcx, rdi
je 0x180006de6
test byte [rcx + 0x1c], 1
je 0x180006de6
cmp byte [rcx + 0x19], 2
jb 0x180006de6
mov edx, 0xa6
lea r9, str.Get_block_length
jmp 0x180006dd2
shr dword [rsp + 0x40], 3
xor r9d, r9d
mov r8, r13
lea edx, [r9 + 1]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
jne 0x180006e9f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x18009b358]
cmp rcx, rdi
je 0x180006de6
test byte [rcx + 0x1c], 1
je 0x180006de6
cmp byte [rcx + 0x19], 2
jb 0x180006de6
mov edx, 0xa7
lea r9, str.Set_crypt_param
jmp 0x180006dd2
mov eax, dword [r14]
mov dword [rsp + 0x44], eax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x180006f07
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x18009b358]
cmp rcx, rdi
je 0x180006de6
test byte [rcx + 0x1c], 1
je 0x180006de6
cmp byte [rcx + 0x19], 2
jb 0x180006de6
mov edx, 0xa8
lea r9, str.Decrypt_file
jmp 0x180006dd2
mov eax, dword [rsp + 0x44]
mov dword [r14], eax
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x180006f1e
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x180006f30
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
cmp qword [rsp + 0x30], 0
je 0x180006f85
cmp byte [0x18009b380], 0
je 0x180006f6a
mov r9d, 0xc7e
mov qword [rsp + 0x20], rsi
mov r8d, 0x4b45443a
lea rdx, [rsp + 0x30]
lea rcx, [0x18009cc40]
call fcn.18004be40
mov eax, ebx
jmp 0x180006b75
mov r8, qword [rsp + 0x30]
xor edx, edx
mov rcx, qword [0x18009ccf0]
mov rax, qword [0x18009b440]
call qword [0x18007d538]
mov eax, ebx
jmp 0x180006b75