Function at 0x140022860
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140073010]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, qword gs:[0x58]
mov rbx, qword [rax]
mov ecx, 0x1a0
mov eax, dword [rcx + rbx]
mov edi, 0x178
test al, 1
jne 0x1400228f7
or eax, 1
mov dword [rcx + rbx], eax
mov byte [rdi + rbx + 0x1a], 1
mov dword [rdi + rbx], 0x69009a
mov dword [rdi + rbx + 4], 0xfe003f
mov dword [rdi + rbx + 8], 0xdc0031
mov dword [rdi + rbx + 0xc], 0xed009c
mov dword [rdi + rbx + 0x10], 0x6900f5
mov dword [rdi + rbx + 0x14], 0xf30025
mov eax, 0x41
mov word [rdi + rbx + 0x18], ax
lea rcx, [0x140067b80]
call fcn.140048870
nop
lea rcx, [rdi + rbx]
cmp byte [rcx + 0x1a], 0
je 0x14002295a
mov r8d, 0xdb
xor word [rcx], r8w
xor word [rcx + 2], 0xd
xor word [rcx + 4], 0x49
mov edx, 0x9f
xor word [rcx + 6], dx
xor word [rcx + 8], 0x41
mov eax, 0xb5
xor word [rcx + 0xa], ax
mov eax, 0xaf
xor word [rcx + 0xc], ax
mov eax, 0xdf
xor word [rcx + 0xe], ax
xor word [rcx + 0x10], r8w
xor word [rcx + 0x12], 0xd
xor word [rcx + 0x14], 0x49
xor word [rcx + 0x16], dx
xor word [rcx + 0x18], 0x41
mov byte [rcx + 0x1a], 0
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbp, rax
mov eax, 0x194
mov ecx, dword [rax + rbx]
mov edi, 0x138
mov esi, 0xa7
lea r14d, [rsi + 0x2e]
test cl, 1
jne 0x1400229c3
or ecx, 1
mov dword [rax + rbx], ecx
mov byte [rbx + rdi + 0x16], 1
mov dword [rbx + rdi], 0x8a00e5
mov dword [rbx + rdi + 4], 0x3a00a7
mov dword [rbx + rdi + 8], 0x230019
mov dword [rbx + rdi + 0xc], 0x3700cd
mov dword [rbx + rdi + 0x10], 0x8500cb
mov word [rbx + rdi + 0x14], r14w
lea rcx, [0x140067b50]
call fcn.140048870
nop
lea rcx, [rbx + rdi]
cmp byte [rcx + 0x16], 0
je 0x140022a0c
xor word [rcx], si
mov edx, 0xe9
xor word [rcx + 2], dx
xor word [rcx + 4], r14w
xor word [rcx + 6], 0x43
xor word [rcx + 8], 0x69
xor word [rcx + 0xa], 0x57
mov eax, 0xe3
xor word [rcx + 0xc], ax
xor word [rcx + 0xe], 0x53
xor word [rcx + 0x10], si
xor word [rcx + 0x12], dx
xor word [rcx + 0x14], r14w
mov byte [rcx + 0x16], 0
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x140022c20
test rbp, rbp
je 0x140022c20
movdqa xmm0, xmmword [0x14001a7d0]
mov eax, 0x19c
mov ecx, dword [rax + rbx]
mov edi, 0x150
test cl, 1
jne 0x140022a7c
or ecx, 1
mov dword [rax + rbx], ecx
lea rax, [rbx + rdi]
mov byte [rax + 0x10], 1
lea rcx, [rax + 0xf]
lea rdx, [rsp + 0x3f]
cmp rax, rdx
ja 0x140022a6c
lea rdx, [rsp + 0x30]
cmp rcx, rdx
jb 0x140022a6c
movups xmmword [rax], xmm0
jmp 0x140022a6f
movups xmmword [rax], xmm0
lea rcx, [0x140067b20]
call fcn.140048870
nop
lea rdx, [rdi + rbx]
cmp byte [rdx + 0x10], 0
je 0x140022ac9
xor byte [rdx], 0xa3
xor byte [rdx + 1], 0xc5
xor byte [rdx + 2], 0x8d
xor byte [rdx + 3], 0x79
xor byte [rdx + 4], 0xfd
xor byte [rdx + 5], 0x5d
xor byte [rdx + 6], 0x35
xor byte [rdx + 7], 0x95
xor byte [rdx + 8], 0xa3
xor byte [rdx + 9], 0xc5
xor byte [rdx + 0xa], 0x8d
xor byte [rdx + 0xb], 0x79
xor byte [rdx + 0xc], 0xfd
xor byte [rdx + 0xd], 0x5d
xor byte [rdx + 0xe], 0x35
xor byte [rdx + 0xf], 0x95
mov byte [rdx + 0x10], 0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140076d68], rax
mov ecx, 0x198
mov eax, dword [rcx + rbx]
mov edi, 0x168
test al, 1
jne 0x140022b1c
or eax, 1
mov dword [rcx + rbx], eax
mov dword [rbx + rdi + 0xc], 0x17b28c8
mov dword [rbx + rdi], 0x3827b02
mov dword [rbx + rdi + 4], 0x471e02d3
mov dword [rbx + rdi + 8], 0x17956813
lea rcx, [0x140067af0]
call fcn.140048870
nop
lea rdx, [rdi + rbx]
cmp byte [rdx + 0xf], 0
je 0x140022b65
xor byte [rdx], 0x41
xor byte [rdx + 1], 9
xor byte [rdx + 2], 0xfb
xor byte [rdx + 3], 0x73
xor byte [rdx + 4], 0xa7
xor byte [rdx + 5], 0x45
xor byte [rdx + 6], 0x7b
xor byte [rdx + 7], 0x29
xor byte [rdx + 8], 0x41
xor byte [rdx + 9], 9
xor byte [rdx + 0xa], 0xfb
xor byte [rdx + 0xb], 0x73
xor byte [rdx + 0xc], 0xa7
xor byte [rdx + 0xd], 0x45
xor byte [rdx + 0xe], 0x7b
mov byte [rdx + 0xf], 0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140076d60], rax
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 0x18
xor r8d, r8d
xor edx, edx
lea rcx, [0x140076d78]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x140022bc8
mov dword [rsp + 0x20], 0xf0000008
lea r9d, [rax + 0x18]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140076d78]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x140022bc8
mov qword [0x140076d78], 0
jmp 0x140022bd2
cmp qword [0x140076d78], 0
jne 0x140022bdc
cmp qword [0x140076d68], 0
je 0x140022c20
cmp qword [0x140076d60], 0
je 0x140022c20
mov ecx, 0xd
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [0x140076d70], eax
mov ecx, 0x28
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [0x140076d74], eax
mov ecx, 0x29
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [0x140076d80], eax
mov eax, 1
jmp 0x140022c22
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140048740
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret