Function at 0x14000bdc0
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Import public key
Initialize hashing via wincrypt
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x11c8
call fcn.140028ba0
sub rsp, rax
movaps xmmword [rsp + 0x11b0], xmm6
mov r15d, r9d
mov rax, qword [0x140049030]
xor rax, rsp
mov qword [rsp + 0x11a8], rax
mov qword [rsp + 0x80], 0
xorps xmm0, xmm0
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
mov ebp, r9d
test r9d, r9d
je 0x14000c05e
mov rsi, rcx
test rcx, rcx
je 0x14000c05e
mov r14, rdx
test rdx, rdx
je 0x14000c05e
mov rbx, r8
test r8, r8
je 0x14000c05e
mov dword [rsp + 0x20], 0xf0000000
lea r8, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
lea rcx, [rsp + 0x80]
xor edx, edx
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x14000bef5
mov dword [rsp + 0x20], 0xf0000008
lea r8, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
lea rcx, [rsp + 0x80]
xor edx, edx
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x14000bef5
mov dword [rsp + 0x20], 0xf0000000
lea rcx, [rsp + 0x80]
xor edx, edx
xor r8d, r8d
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x14000bef5
mov dword [rsp + 0x20], 0xf0000008
lea rcx, [rsp + 0x80]
xor edx, edx
xor r8d, r8d
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x14000c5a8
mov qword [rsp + 0x68], rsi
mov dword [rsp + 0x64], r15d
lea r15, [rsp + 0xa0]
xor edi, edi
xorps xmm6, xmm6
mov rsi, qword [sym.imp.CRYPT32.dll_CryptQueryObject]
mov r12, qword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
mov rax, qword [r14 + rdi*8]
test rax, rax
je 0x14000c089
mov r13, qword [rsp + 0x80]
test r13, r13
je 0x14000c089
mov ecx, dword [rbx + rdi*4]
mov dword [rsp + 0x160], ecx
mov qword [rsp + 0x168], rax
lea rax, [rsp + 0x1160]
mov qword [rsp + 0x50], rax
movups xmmword [rsp + 0x38], xmm6
movups xmmword [rsp + 0x28], xmm6
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x20], 0
mov ecx, 2
lea rdx, [rsp + 0x160]
mov r8d, 2
mov r9d, 2
call rsi
test eax, eax
je 0x14000c089
mov rax, qword [rsp + 0x1160]
mov r8, qword [rax + 0x18]
add r8, 0x60
mov rcx, r13
mov edx, 0x10001
mov r9, r15
call qword [sym.imp.CRYPT32.dll_CryptImportPublicKeyInfo]
mov r13, rbp
mov ebp, eax
mov rcx, qword [rsp + 0x1160]
call r12
test ebp, ebp
mov rbp, r13
je 0x14000c089
inc rdi
add r15, 8
cmp rbp, rdi
jne 0x14000bf1a
mov rsi, qword [rsp + 0x80]
lea rdx, [rsp + 0x88]
mov qword [rdx], 0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x120], xmm0
movaps xmmword [rsp + 0x130], xmm0
movaps xmmword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xf0], xmm0
movaps xmmword [rsp + 0x100], xmm0
movaps xmmword [rsp + 0x110], xmm0
mov r8d, 0x10
mov rdi, qword [rsp + 0x68]
mov rcx, rdi
call fcn.14000ce50
test eax, eax
je 0x14000c10a
mov ecx, 2
call fcn.140015d78
lea rcx, str.ERROR:_Could_not_seek_to_the_signature_block._n
mov edx, 0x2e
jmp 0x14000c09f
mov ecx, 2
call fcn.140015d78
lea rcx, str.ERROR:_Invalid_parameter_specified._n
mov edx, 0x24
mov r8d, 1
mov r9, rax
call fcn.140021128
mov edi, 0xffffffff
jmp 0x14000c0b7
mov ecx, 2
call fcn.140015d78
lea rcx, str.ERROR:_Could_not_load_public_key._n
mov edx, 0x22
mov r8d, 1
mov r9, rax
call fcn.140021128
mov edi, 0xffffffff
mov r15d, dword [rsp + 0x64]
test r15d, r15d
je 0x14000c0dc
xor esi, esi
mov rbx, qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + rsi*8 + 0xa0]
test rcx, rcx
je 0x14000c0d4
call rbx
inc rsi
cmp rbp, rsi
jne 0x14000c0c5
mov rcx, qword [rsp + 0x11a8]
xor rcx, rsp
call fcn.140026460
mov eax, edi
movaps xmm6, xmmword [rsp + 0x11b0]
add rsp, 0x11c8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rdx, [rsp + 0x94]
lea r8, [rsp + 0x88]
mov r9d, 4
mov rcx, rdi
call fcn.14000cdd0
test eax, eax
je 0x14000c147
mov ecx, 2
call fcn.140015d78
lea rcx, str.ERROR:_Could_not_read_number_of_signatures._n
mov edx, 0x2c
jmp 0x14000c09f
mov ecx, dword [rsp + 0x94]
call qword [sym.imp.WS2_32.dll_ntohl]
mov dword [rsp + 0x94], eax
cmp eax, 8
ja 0x14000c732
test eax, eax
je 0x14000c5e2
mov qword [rsp + 0x78], rsi
xor esi, esi
lea r14, [rsp + 0x88]
mov r12, qword [sym.imp.WS2_32.dll_ntohl]
xor r15d, r15d
lea rdx, [rsp + rsi]
add rdx, 0x120
mov r9d, 4
mov rcx, rdi
mov r8, r14
call fcn.14000cdd0
test eax, eax
jne 0x14000c613
mov ecx, dword [rsp + r15*4 + 0x120]
call r12
mov dword [rsp + r15*4 + 0x120], eax
mov r9d, 4
mov rcx, rdi
lea rdx, [rsp + 0x90]
mov r8, r14
call fcn.14000cdd0
test eax, eax
mov rbp, r13
jne 0x14000c62b
mov ecx, dword [rsp + 0x90]
call r12
mov dword [rsp + 0x90], eax
cmp eax, 0x801
jae 0x14000c646
mov rbx, r12
mov r12d, eax
mov rcx, r12
call fcn.140021688
mov qword [rsp + r15*8 + 0xe0], rax
test rax, rax
je 0x14000c659
mov rcx, rdi
mov rdx, rax
mov r8, r14
mov r9, r12
call fcn.14000cdd0
test eax, eax
jne 0x14000c674
cmp dword [rsp + r15*4 + 0x120], 2
jne 0x14000c6d3
inc r15
mov ebp, dword [rsp + 0x94]
add rsi, 4
cmp r15, rbp
mov r12, rbx
jb 0x14000c185
mov qword [rsp + 0x98], 0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x1160], xmm0
movaps xmmword [rsp + 0x1170], xmm0
movaps xmmword [rsp + 0x1180], xmm0
movaps xmmword [rsp + 0x1190], xmm0
movaps xmmword [rsp + 0x140], xmm0
movaps xmmword [rsp + 0x150], xmm0
test rbp, rbp
je 0x14000c5e2
mov r15, qword [rsp + 0x78]
test r15, r15
je 0x14000c756
lea rsi, [rbp*8]
xor edi, edi
mov r14, qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
lea rax, [rsp + rdi]
add rax, 0x1160
mov qword [rax], 0
mov qword [rsp + 0x20], rax
mov rcx, r15
mov edx, 0x800d
xor r8d, r8d
xor r9d, r9d
call r14
test eax, eax
je 0x14000c756
add rdi, 8
cmp rsi, rdi
jne 0x14000c2c4
lea rax, str.signature_block
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebp
lea rsi, [rsp + 0x1160]
mov qword [rsp + 0x20], rsi
lea rdx, [rsp + 0x98]
lea r8, [rsp + 0x160]
mov rcx, qword [rsp + 0x68]
mov r9d, 0x14
call fcn.14000bcd0
test eax, eax
jne 0x14000c606
cmp ebp, 2
mov eax, 1
cmovae eax, ebp
mov qword [rsp + 0x70], rax
lea rax, [rax*4]
mov qword [rsp + 0x78], rax
xor edi, edi
lea r14, [rsp + 0x98]
mov r15, rsi
mov rsi, qword [rsp + 0x68]
lea rcx, str.signature_algorithm_ID
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov rdx, r14
lea r8, [rsp + 0x160]
mov r9d, 4
call fcn.14000bcd0
test eax, eax
jne 0x14000c606
lea r12, [rsp + rdi]
add r12, 0x140
lea rax, str.signature_length
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov rdx, r14
mov r8, r12
mov r9d, 4
call fcn.14000bcd0
test eax, eax
jne 0x14000c606
mov ecx, dword [r12]
call rbx
mov dword [r12], eax
cmp eax, 0x801
jae 0x14000c771
mov r8d, eax
mov rcx, qword [rsp + 0x68]
mov rdx, r14
call fcn.14000ce50
test eax, eax
jne 0x14000c787
add rdi, 4
cmp qword [rsp + 0x78], rdi
lea r15, [rsp + 0x1160]
jne 0x14000c370
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x68]
cmp rax, qword [rcx + 8]
jae 0x14000c4a5
lea r14, [rsp + 0x160]
lea r15, [rsp + 0x98]
mov rsi, qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rbx, qword [rsp + 0x70]
mov r9d, 0x1000
mov rcx, qword [rsp + 0x68]
mov rdx, r14
mov r8, r15
call fcn.14000ce10
mov ebp, eax
xor edi, edi
mov rcx, qword [rsp + rdi*8 + 0x1160]
mov rdx, r14
mov r8d, ebp
xor r9d, r9d
call rsi
test eax, eax
je 0x14000c7a2
inc rdi
cmp rbx, rdi
jne 0x14000c46f
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x68]
cmp rax, qword [rcx + 8]
jb 0x14000c455
xor r15d, r15d
mov r12, qword [sym.imp.ADVAPI32.dll_CryptVerifySignatureA]
mov edi, dword [rsp + r15*4 + 0x140]
test rdi, rdi
je 0x14000c7bd
mov rsi, qword [rsp + r15*8 + 0xe0]
test rsi, rsi
je 0x14000c7bd
mov rcx, rdi
call fcn.140021688
test rax, rax
je 0x14000c7bd
mov r14, rax
mov rax, rdi
neg rax
lea ecx, [rdi - 1]
xor edx, edx
mov r8d, ecx
mov r8b, byte [rsi + r8]
mov byte [r14 + rdx], r8b
inc rdx
dec ecx
mov r8, rax
add r8, rdx
jne 0x14000c4f0
mov r9, qword [rsp + r15*8 + 0xa0]
mov rcx, qword [rsp + r15*8 + 0x1160]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rdx, r14
mov r8d, edi
call r12
mov edi, eax
mov rcx, r14
call fcn.140021114
test edi, edi
je 0x14000c7bd
inc r15
cmp r15, qword [rsp + 0x70]
jne 0x14000c4af
cmp dword [rsp + 0x94], 0
je 0x14000c7d8
xor esi, esi
mov rcx, qword [rsp + rsi*8 + 0xe0]
call fcn.140021114
inc rsi
mov r14d, dword [rsp + 0x94]
cmp rsi, r14
jb 0x14000c562
mov rax, qword [rsp + 0x70]
cmp eax, dword [rsp + 0x64]
jne 0x14000c7db
xor edi, edi
cmp dword [rsp + 0x70], r14d
mov rbp, r13
mov r15d, dword [rsp + 0x64]
je 0x14000c0b7
jmp 0x14000c7e3
mov qword [rsp + 0x80], 0
mov ecx, 2
call fcn.140015d78
lea rcx, str.ERROR:_Could_not_init_crytpo_library._n
mov edx, 0x26
mov r8d, 1
mov r9, rax
call fcn.140021128
mov edi, 0xffffffff
jmp 0x14000c0bc
mov ecx, 2
call fcn.140015d78
lea rcx, str.ERROR:_There_must_be_at_least_one_signature._n
mov edx, 0x2d
mov r8d, 1
mov r9, rax
call fcn.140021128
mov edi, 0xffffffff
mov rbp, r13
jmp 0x14000c0b2
mov ecx, 2
call fcn.140015d78
lea rcx, str.ERROR:_Could_not_read_signatures_algorithm_ID._n
mov edx, 0x2f
jmp 0x14000c5f8
mov ecx, 2
call fcn.140015d78
lea rcx, str.ERROR:_Could_not_read_signatures_length._n
mov edx, 0x29
jmp 0x14000c09f
mov ecx, 2
call fcn.140015d78
lea rcx, str.ERROR:_Signature_length_is_too_large_to_verify._n
jmp 0x14000c66a
mov ecx, 2
call fcn.140015d78
lea rcx, str.ERROR:_Could_not_allocate_buffer_for_signature._n
mov edx, 0x30
jmp 0x14000c09f
mov ecx, 2
call fcn.140015d78
lea rcx, str.ERROR:_Could_not_read_extracted_signature._n
mov edx, 0x2b
mov r8d, 1
mov r9, rax
call fcn.140021128
mov edi, 0xffffffff
cmp dword [rsp + 0x94], 0
mov r15d, dword [rsp + 0x64]
je 0x14000c0b7
xor esi, esi
mov rcx, qword [rsp + rsi*8 + 0xe0]
call fcn.140021114
inc rsi
mov eax, dword [rsp + 0x94]
cmp rsi, rax
jb 0x14000c6b2
jmp 0x14000c0b7
mov ecx, 2
call fcn.140015d78
lea rcx, str.ERROR:_Unknown_signature_algorithm_ID._n
mov edx, 0x27
mov r8d, 1
mov r9, rax
call fcn.140021128
mov edi, 0xffffffff
cmp dword [rsp + 0x94], 0
je 0x14000c0b2
xor esi, esi
mov r15d, dword [rsp + 0x64]
mov rcx, qword [rsp + rsi*8 + 0xe0]
call fcn.140021114
inc rsi
mov eax, dword [rsp + 0x94]
cmp rsi, rax
jb 0x14000c711
jmp 0x14000c0b7
mov ecx, 2
call fcn.140015d78
lea rdx, str.ERROR:_At_most__d_signatures_can_be_specified._n
mov rcx, rax
mov r8d, 8
call fcn.1400356a0
jmp 0x14000c0ad
mov ecx, 2
call fcn.140015d78
lea rcx, str.ERROR:_Could_not_initialize_signature_handle._n
mov edx, 0x2e
jmp 0x14000c5f8
mov ecx, 2
call fcn.140015d78
lea rcx, str.ERROR:_Embedded_signature_length_is_too_large._n
jmp 0x14000c624
mov ecx, 2
call fcn.140015d78
lea rcx, str.ERROR:_Could_not_seek_past_signature._n
mov edx, 0x26
jmp 0x14000c5f8
mov ecx, 2
call fcn.140015d78
lea rcx, str.ERROR:_Error_updating_verify_context_with_data_block._n
mov edx, 0x36
jmp 0x14000c5f8
mov ecx, 2
call fcn.140015d78
lea rcx, str.ERROR:_Error_verifying_signature._n
mov edx, 0x22
jmp 0x14000c5f8
xor r14d, r14d
mov rbp, r13
mov r15d, dword [rsp + 0x64]
mov ecx, 2
call fcn.140015d78
lea rdx, str.ERROR:_Only__d_of__d_signatures_were_verified._n
mov rcx, rax
mov r8, qword [rsp + 0x70]
mov r9d, r14d
call fcn.1400356a0
jmp 0x14000c082