Function at 0x14000e8f0
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Import public key
Initialize hashing via wincrypt
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x1168
call fcn.140028630
sub rsp, rax
mov rax, qword [0x140048030]
xor rax, rsp
mov qword [rsp + 0x1160], rax
mov qword [rsp + 0x70], 0
xorps xmm0, xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
test rcx, rcx
je 0x14000eafb
mov rbx, rdx
test rdx, rdx
je 0x14000eafb
mov rdi, r8
test r8, r8
je 0x14000eafb
mov rsi, rcx
mov dword [rsp + 0x20], 0xf0000000
lea r8, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
lea rcx, [rsp + 0x70]
xor edx, edx
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x14000e9ff
mov dword [rsp + 0x20], 0xf0000008
lea r8, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
lea rcx, [rsp + 0x70]
xor edx, edx
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x14000e9ff
mov dword [rsp + 0x20], 0xf0000000
lea rcx, [rsp + 0x70]
xor edx, edx
xor r8d, r8d
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x14000e9ff
mov dword [rsp + 0x20], 0xf0000008
lea rcx, [rsp + 0x70]
xor edx, edx
xor r8d, r8d
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x14000efa9
mov rax, qword [rbx]
test rax, rax
je 0x14000eb13
mov rbx, qword [rsp + 0x70]
test rbx, rbx
je 0x14000eb13
mov ecx, dword [rdi]
lea rdx, [rsp + 0x120]
mov dword [rdx], ecx
mov qword [rdx + 8], rax
lea r15, [rsp + 0x1120]
mov qword [rsp + 0x50], r15
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x20], 0
mov ecx, 2
mov r8d, 2
mov r9d, 2
call qword [sym.imp.CRYPT32.dll_CryptQueryObject]
test eax, eax
je 0x14000eb13
mov rax, qword [rsp + 0x1120]
mov r8, qword [rax + 0x18]
add r8, 0x60
lea r9, [rsp + 0x80]
mov rcx, rbx
mov edx, 0x10001
call qword [sym.imp.CRYPT32.dll_CryptImportPublicKeyInfo]
mov edi, eax
mov rcx, qword [rsp + 0x1120]
call qword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
test edi, edi
je 0x14000eb13
mov rdi, qword [rsp + 0x70]
xorps xmm0, xmm0
movaps xmmword [rsp + 0xf0], xmm0
movaps xmmword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xc0], xmm0
mov rax, qword [rsi + 8]
cmp rax, 0xf
ja 0x14000eb75
mov ecx, 2
call fcn.140015808
lea rcx, str.ERROR:_Could_not_seek_to_the_signature_block._n
mov edx, 0x2e
jmp 0x14000eb29
mov ecx, 2
call fcn.140015808
lea rcx, str.ERROR:_Invalid_parameter_specified._n
mov edx, 0x24
jmp 0x14000eb29
mov ecx, 2
call fcn.140015808
lea rcx, str.ERROR:_Could_not_load_public_key._n
mov edx, 0x22
mov r8d, 1
mov r9, rax
call fcn.140020bb8
mov esi, 0xffffffff
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x14000eb4f
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x1160]
xor rcx, rsp
call fcn.140025ef0
mov eax, esi
add rsp, 0x1168
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
add rax, 0xfffffffffffffffc
cmp rax, 0xf
ja 0x14000eb97
mov ecx, 2
call fcn.140015808
lea rcx, str.ERROR:_Could_not_read_number_of_signatures._n
mov edx, 0x2c
jmp 0x14000eb29
mov rax, qword [rsi]
mov ecx, dword [rax + 0x10]
call qword [sym.imp.WS2_32.dll_ntohl]
cmp eax, 8
ja 0x14000f11f
test eax, eax
je 0x14000efcd
mov qword [rsp + 0x68], rdi
mov dword [rsp + 0x64], eax
mov r14d, eax
mov r12, qword [rsi + 8]
mov edi, 0x14
xor r13d, r13d
sub r12, 4
jb 0x14000f024
cmp rdi, r12
ja 0x14000f024
mov rax, qword [rsi]
mov ecx, dword [rax + rdi]
mov rbx, qword [sym.imp.WS2_32.dll_ntohl]
call rbx
mov ebp, eax
mov rax, qword [rsi + 8]
sub rax, 4
jb 0x14000f03f
lea rcx, [rdi + 4]
cmp rcx, rax
ja 0x14000f03f
mov rax, qword [rsi]
mov ecx, dword [rax + rdi + 4]
call rbx
cmp eax, 0x801
jae 0x14000f05a
mov rbx, r14
mov r14d, eax
mov rcx, r14
call fcn.140021118
mov qword [rsp + r13*8 + 0xc0], rax
test rax, rax
je 0x14000f06d
mov r12, qword [rsi + 8]
mov rcx, r12
sub rcx, r14
jb 0x14000f088
add rdi, 8
cmp rdi, rcx
ja 0x14000f088
mov rdx, qword [rsi]
add rdx, rdi
mov rcx, rax
mov r8, r14
call fcn.140025f40
cmp ebp, 2
jne 0x14000f0da
add rdi, r14
inc r13
mov r14, rbx
cmp rbx, r13
jne 0x14000ebcc
mov qword [rsp + 0x78], 0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x1120], xmm0
movaps xmmword [rsp + 0x1130], xmm0
movaps xmmword [rsp + 0x1140], xmm0
movaps xmmword [rsp + 0x1150], xmm0
movaps xmmword [rsp + 0x100], xmm0
movaps xmmword [rsp + 0x110], xmm0
mov ebp, dword [rsp + 0x64]
test ebp, ebp
je 0x14000f009
mov r13, qword [rsp + 0x68]
test r13, r13
je 0x14000f143
lea rdi, [rbx*8]
xor r14d, r14d
mov r12, qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
lea rax, [rsp + r14]
add rax, 0x1120
mov qword [rax], 0
mov qword [rsp + 0x20], rax
mov rcx, r13
mov edx, 0x800d
xor r8d, r8d
xor r9d, r9d
call r12
test eax, eax
je 0x14000f143
add r14, 8
cmp rdi, r14
jne 0x14000ecef
lea rax, str.signature_block
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], r15
lea rdx, [rsp + 0x78]
lea r8, [rsp + 0x120]
mov rcx, rsi
mov r9d, 0x14
call fcn.14000e7b0
test eax, eax
jne 0x14000eb37
cmp ebp, 2
mov eax, 1
cmovae eax, ebp
mov qword [rsp + 0x68], rax
lea rdi, [rax*4]
xor r13d, r13d
lea r14, [rsp + 0x78]
lea rax, str.signature_algorithm_ID
mov qword [rsp + 0x30], rax
mov ebp, dword [rsp + 0x64]
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov rdx, r14
lea r8, [rsp + 0x120]
mov r9d, 4
call fcn.14000e7b0
test eax, eax
jne 0x14000eb37
lea r12, [rsp + r13]
add r12, 0x100
lea rax, str.signature_length
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov rdx, r14
mov r8, r12
mov r9d, 4
call fcn.14000e7b0
test eax, eax
jne 0x14000eb37
mov ecx, dword [r12]
call qword [sym.imp.WS2_32.dll_ntohl]
mov dword [r12], eax
cmp eax, 0x801
jae 0x14000f16f
mov eax, eax
mov r12, qword [rsi + 8]
mov rcx, r12
sub rcx, rax
jb 0x14000f159
mov rbp, qword [rsp + 0x78]
cmp rbp, rcx
ja 0x14000f159
add rbp, rax
mov qword [rsp + 0x78], rbp
add r13, 4
cmp rdi, r13
jne 0x14000ed7f
cmp rbp, r12
jae 0x14000eec4
mov edi, 0x1000
lea r14, [rsp + 0x120]
mov r15, qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov r13d, 0
sub r12, rbp
jbe 0x14000ee8a
cmp r12, rdi
cmovae r12, rdi
mov rdx, qword [rsi]
add rdx, rbp
mov rcx, r14
mov r8, r12
call fcn.140025f40
add rbp, r12
mov qword [rsp + 0x78], rbp
mov r13d, r12d
xor r12d, r12d
mov rbp, qword [rsp + 0x68]
mov rcx, qword [rsp + r12*8 + 0x1120]
mov rdx, r14
mov r8d, r13d
xor r9d, r9d
call r15
test eax, eax
je 0x14000f185
inc r12
cmp rbp, r12
jne 0x14000ee92
mov rbp, qword [rsp + 0x78]
mov r12, qword [rsi + 8]
cmp rbp, r12
jb 0x14000ee5c
xor edi, edi
mov r12, qword [sym.imp.ADVAPI32.dll_CryptVerifySignatureA]
mov esi, dword [rsp + rdi*4 + 0x100]
test rsi, rsi
je 0x14000f1a0
mov r15, qword [rsp + rdi*8 + 0xc0]
test r15, r15
je 0x14000f1a0
mov rcx, rsi
call fcn.140021118
test rax, rax
je 0x14000f1a0
mov r14, rax
mov rax, rsi
neg rax
lea ecx, [rsi - 1]
xor edx, edx
mov r8d, ecx
mov r8b, byte [r15 + r8]
mov byte [r14 + rdx], r8b
inc rdx
dec ecx
mov r8, rax
add r8, rdx
jne 0x14000ef0d
mov r9, qword [rsp + rdi*8 + 0x80]
mov rcx, qword [rsp + rdi*8 + 0x1120]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rdx, r14
mov r8d, esi
call r12
mov esi, eax
mov rcx, r14
call fcn.140020ba4
test esi, esi
je 0x14000f1a0
inc rdi
cmp rdi, qword [rsp + 0x68]
jne 0x14000eecd
cmp dword [rsp + 0x64], 0
je 0x14000f1b6
xor esi, esi
mov rcx, qword [rsp + rsi*8 + 0xc0]
call fcn.140020ba4
inc rsi
cmp rbx, rsi
jne 0x14000ef7c
xor esi, esi
cmp dword [rsp + 0x64], 1
ja 0x14000f1be
je 0x14000eb3c
jmp 0x14000f1be
mov qword [rsp + 0x70], 0
mov ecx, 2
call fcn.140015808
lea rcx, str.ERROR:_Could_not_init_crytpo_library._n
mov edx, 0x26
jmp 0x14000eb29
mov qword [rsp + 0x78], 0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x1120], xmm0
movaps xmmword [rsp + 0x1130], xmm0
movaps xmmword [rsp + 0x1140], xmm0
movaps xmmword [rsp + 0x1150], xmm0
movaps xmmword [rsp + 0x100], xmm0
movaps xmmword [rsp + 0x110], xmm0
mov ecx, 2
call fcn.140015808
lea rcx, str.ERROR:_There_must_be_at_least_one_signature._n
mov edx, 0x2d
jmp 0x14000eb29
mov ecx, 2
call fcn.140015808
lea rcx, str.ERROR:_Could_not_read_signatures_algorithm_ID._n
mov edx, 0x2f
jmp 0x14000eb29
mov ecx, 2
call fcn.140015808
lea rcx, str.ERROR:_Could_not_read_signatures_length._n
mov edx, 0x29
jmp 0x14000eb29
mov ecx, 2
call fcn.140015808
lea rcx, str.ERROR:_Signature_length_is_too_large_to_verify._n
jmp 0x14000f07e
mov ecx, 2
call fcn.140015808
lea rcx, str.ERROR:_Could_not_allocate_buffer_for_signature._n
mov edx, 0x30
jmp 0x14000eb29
mov ecx, 2
call fcn.140015808
lea rcx, str.ERROR:_Could_not_read_extracted_signature._n
mov edi, 1
mov edx, 0x2b
mov r8d, 1
mov r9, rax
call fcn.140020bb8
cmp rbx, 2
cmovae rdi, rbx
xor ebx, ebx
mov esi, 0xffffffff
mov rcx, qword [rsp + rbx*8 + 0xc0]
call fcn.140020ba4
inc rbx
cmp rdi, rbx
jne 0x14000f0c0
jmp 0x14000eb3c
mov ecx, 2
call fcn.140015808
lea rcx, str.ERROR:_Unknown_signature_algorithm_ID._n
mov edx, 0x27
mov r8d, 1
mov r9, rax
call fcn.140020bb8
xor edi, edi
mov esi, 0xffffffff
mov rcx, qword [rsp + rdi*8 + 0xc0]
call fcn.140020ba4
inc rdi
cmp rbx, rdi
jne 0x14000f105
jmp 0x14000eb3c
mov ecx, 2
call fcn.140015808
lea rdx, str.ERROR:_At_most__d_signatures_can_be_specified._n
mov rcx, rax
mov r8d, 8
call fcn.140035130
jmp 0x14000eb37
mov ecx, 2
call fcn.140015808
lea rcx, str.ERROR:_Could_not_initialize_signature_handle._n
jmp 0x14000eaf4
mov ecx, 2
call fcn.140015808
lea rcx, str.ERROR:_Could_not_seek_past_signature._n
jmp 0x14000efc3
mov ecx, 2
call fcn.140015808
lea rcx, str.ERROR:_Embedded_signature_length_is_too_large._n
jmp 0x14000f035
mov ecx, 2
call fcn.140015808
lea rcx, str.ERROR:_Error_updating_verify_context_with_data_block._n
mov edx, 0x36
jmp 0x14000eb29
mov ecx, 2
call fcn.140015808
lea rcx, str.ERROR:_Error_verifying_signature._n
jmp 0x14000eb24
mov dword [rsp + 0x64], 0
mov ecx, 2
call fcn.140015808
lea rdx, str.ERROR:_Only__d_of__d_signatures_were_verified._n
mov rcx, rax
mov r8, qword [rsp + 0x68]
mov r9d, dword [rsp + 0x64]
call fcn.140035130
jmp 0x14000eb37