Function at 0x1400eb2c0
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push rbx
push rdi
push r12
push r13
sub rsp, 0xb8
mov r13, rdx
mov ebx, r9d
lea rdx, [rsp + 0x70]
mov r12d, r8d
mov rdi, rcx
call qword [sym.imp.ntdll.dll_RtlStringFromGUID]
test eax, eax
js 0x1400eb954
movzx r8d, word [rsp + 0x70]
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0xe0], rbp
mov qword [rsp + 0xe8], rsi
xor esi, esi
mov qword [rsp + 0xf8], r14
shr r8, 1
mov qword [rsp + 0xb0], r15
mov word [rax + r8*2 - 2], si
mov r14, qword [rsp + 0x78]
mov edx, dword [r13]
add r14, 2
mov eax, edx
sub eax, 1
je 0x1400eb7ce
cmp eax, 1
je 0x1400eb445
lea rcx, str.___Unknown_key__seen_as__08x__n
call fcn.14000afb0
mov r8d, 0x200000
mov edx, r12d
mov rcx, r13
call fcn.1400124b0
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.14000afb0
test ebx, ebx
je 0x1400eb929
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [r14 + rbx*2], si
jne 0x1400eb380
add rbx, 0x1d
mov ecx, 0x40
lea rdx, [rbx + rbx]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x1400eb43d
lea rax, [0x14016b4f0]
mov rdx, rbx
mov qword [rsp + 0x38], rax
lea r9, str.ntds
mov qword [rsp + 0x30], r14
lea rax, str.unknown
mov dword [rsp + 0x28], esi
lea r8, str._s__s__u__s._s
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.140005150
cmp eax, 0xffffffff
jne 0x1400eb3fc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdi, rax
mov rbp, r13
jmp 0x1400eb8e0
movzx ecx, word [rdi]
test cx, cx
je 0x1400eb43d
mov rdx, rdi
mov ebp, Ordinal_127
movabs r15, 0x400000035002101
lea eax, [rcx - 0x22]
cmp ax, 0x3a
ja 0x1400eb425
bt r15, rax
jb 0x1400eb42b
cmp cx, 0x7c
jne 0x1400eb42e
mov word [rdx], bp
inc esi
movzx ecx, word [rdi + rsi*2]
lea rdx, [rdi + rsi*2]
test cx, cx
jne 0x1400eb416
mov rbp, r13
jmp 0x1400eb8e0
lea rcx, str.___RSA_key_n
call fcn.14000afb0
mov r8d, dword [r13 + 4]
lea rbp, [r13 + 0xc]
mov rdx, rbp
mov qword [rsp + 0x60], rbp
mov r9d, 1
mov rcx, rdi
call fcn.1400ce940
mov edx, dword [r13 + 4]
lea rax, str.ntds
mov dword [rsp + 0x40], ebx
mov r9d, 1
mov qword [rsp + 0x38], r14
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rcx, rbp
mov dword [rsp + 0x20], 1
call fcn.1400dd210
test ebx, ebx
je 0x1400eb929
mov eax, dword [r13 + 4]
mov rbx, 0xffffffffffffffff
add rax, 0xc
mov rdi, rbx
add rax, r13
mov qword [rsp + 0x50], rax
mov eax, dword [r13 + 8]
mov dword [rsp + 0xf0], eax
nop
inc rdi
cmp word [r14 + rdi*2], si
jne 0x1400eb4d0
add rdi, 0x1a
mov ecx, 0x40
lea rdx, [rdi + rdi]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebp, Ordinal_127
lea rcx, str.capi
mov r12, rax
movabs r15, 0x400000035002101
test rax, rax
je 0x1400eb55b
lea rax, [0x140168350]
mov rdx, rdi
mov qword [rsp + 0x38], rax
lea r9, str.ntds
mov qword [rsp + 0x30], r14
lea r8, str._s__s__u__s._s
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rcx
mov rcx, r12
call fcn.140005150
cmp eax, ebx
jne 0x1400eb5ec
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r12, rax
test rax, rax
jne 0x1400eb62c
lea r13, [0x140168358]
inc rbx
cmp word [r14 + rbx*2], si
jne 0x1400eb562
add rbx, 0x1a
mov ecx, 0x40
lea rdx, [rbx + rbx]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x1400eb7bc
lea rax, [0x140174840]
mov rdx, rbx
mov qword [rsp + 0x38], rax
lea r9, str.ntds
mov qword [rsp + 0x30], r14
lea rax, str.capi
mov dword [rsp + 0x28], esi
lea r8, str._s__s__u__s._s
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.140005150
cmp eax, 0xffffffff
jne 0x1400eb787
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbp, qword [rsp + 0x50]
mov rdi, rax
mov r12d, dword [rsp + 0xf0]
jmp 0x1400eb8e7
movzx ecx, word [r12]
mov r8d, esi
test cx, cx
je 0x1400eb62c
mov rdx, r12
nop dword [rax]
lea eax, [rcx - 0x22]
cmp ax, 0x3a
ja 0x1400eb612
movzx eax, ax
bt r15, rax
jb 0x1400eb618
cmp cx, 0x7c
jne 0x1400eb61b
mov word [rdx], bp
inc r8d
movzx ecx, word [r12 + r8*2]
lea rdx, [r12 + r8*2]
test cx, cx
jne 0x1400eb600
mov r13d, dword [r13 + 4]
lea rax, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
mov qword [rsp + 0x88], rax
mov edi, esi
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x90], 1
mov dword [rsp + 0x98], esi
mov qword [rsp + 0xa0], rsi
mov dword [rsp + 0xa8], 1
call fcn.140012760
mov qword [rsp + 0x80], rax
test rax, rax
je 0x1400eb756
mov r9d, dword [rsp + 0x90]
lea rcx, [rsp + 0x58]
mov r8, qword [rsp + 0x88]
mov rdx, rax
mov dword [rsp + 0x20], 8
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1400eb734
mov rdx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov r8d, r13d
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x1400eb714
mov edx, dword [rsp + 0xf0]
lea r8, [rsp + 0x80]
mov rcx, qword [rsp + 0x50]
mov r9, r12
call fcn.1400048c0
mov rcx, qword [rsp + 0x68]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x58]
call fcn.140003460
jmp 0x1400eb748
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_kull_m_crypto_DerAndKeyToPfx___CryptImportKey__0x_08x__n
call fcn.14000afb0
mov rcx, qword [rsp + 0x58]
call fcn.140003460
jmp 0x1400eb748
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_kull_m_crypto_DerAndKeyToPfx___CryptAcquireContext__0x_08x__n
call fcn.14000afb0
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_LocalFree]
test edi, edi
lea rdx, [0x140168360]
lea r13, [0x140168358]
mov r8, r12
cmovne rdx, r13
lea rcx, str._tPFX_container__:__s____s_n
call fcn.14000afb0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1400eb562
movzx ecx, word [rdi]
test cx, cx
je 0x1400eb7bc
mov rdx, rdi
lea eax, [rcx - 0x22]
cmp ax, 0x3a
ja 0x1400eb7a4
movzx eax, ax
bt r15, rax
jb 0x1400eb7aa
cmp cx, 0x7c
jne 0x1400eb7ad
mov word [rdx], bp
inc esi
movzx ecx, word [rdi + rsi*2]
lea rdx, [rdi + rsi*2]
test cx, cx
jne 0x1400eb792
mov rbp, qword [rsp + 0x50]
mov r12d, dword [rsp + 0xf0]
jmp 0x1400eb8e7
lea rcx, str.___Legacy_key_n
call fcn.14000afb0
lea rbp, [r13 + 4]
add r12d, 0xfffffffc
mov r8d, r12d
mov qword [rsp + 0x50], rbp
mov rdx, rbp
xor r9d, r9d
mov rcx, rdi
call fcn.1400ce940
mov r8d, 0x200000
mov edx, r12d
mov rcx, rbp
call fcn.1400124b0
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.14000afb0
test ebx, ebx
je 0x1400eb929
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [r14 + rbx*2], si
jne 0x1400eb824
add rbx, 0x1c
mov ecx, 0x40
lea rdx, [rbx + rbx]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x1400eb8e0
lea rax, [0x14016b4f0]
mov rdx, rbx
mov qword [rsp + 0x38], rax
lea r9, str.ntds
mov qword [rsp + 0x30], r14
lea rax, str.legacy
mov dword [rsp + 0x28], esi
lea r8, str._s__s__u__s._s
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.140005150
cmp eax, 0xffffffff
jne 0x1400eb89a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdi, rax
jmp 0x1400eb8e0
movzx ecx, word [rdi]
test cx, cx
je 0x1400eb8e0
mov rdx, rdi
mov ebp, Ordinal_127
movabs r15, 0x400000035002101
lea eax, [rcx - 0x22]
cmp ax, 0x3a
ja 0x1400eb8c3
bt r15, rax
jb 0x1400eb8c9
cmp cx, 0x7c
jne 0x1400eb8cc
mov word [rdx], bp
inc esi
movzx ecx, word [rdi + rsi*2]
lea rdx, [rdi + rsi*2]
test cx, cx
jne 0x1400eb8b4
mov rbp, qword [rsp + 0x50]
lea r13, [0x140168358]
test rdi, rdi
je 0x1400eb929
test rbp, rbp
je 0x1400eb920
test r12d, r12d
je 0x1400eb920
mov r8d, r12d
mov rdx, rbp
mov rcx, rdi
call fcn.140008cd0
test eax, eax
lea rdx, [0x140168360]
mov r8, rdi
lea rcx, str._tExport_________:__s____s_n
cmovne rdx, r13
call fcn.14000afb0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov r15, qword [rsp + 0xb0]
mov r14, qword [rsp + 0xf8]
mov rsi, qword [rsp + 0xe8]
mov rbp, qword [rsp + 0xe0]
add rsp, 0xb8
pop r13
pop r12
pop rdi
pop rbx
ret