Function at 0x140006dde
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov r13d, r9d
mov ebp, r8d
mov r15, rdx
mov ebx, ecx
call fcn.140023fc0
test rax, rax
je 0x140007032
mov rsi, rax
mov r12, qword [rsp + 0xc8]
mov dword [rsp + 0x20], 8
xor edi, edi
mov rcx, r12
mov rdx, rax
xor r8d, r8d
mov r9d, Ordinal_26
call qword [sym.imp.advapi32.dll_CryptAcquireContextW]
test eax, eax
je 0x1400070e6
lea r9, [rsp + 0x38]
mov qword [r9], 0
mov rcx, qword [r12]
mov edx, 1
mov r8d, 0x4000001
call qword [sym.imp.advapi32.dll_CryptGenKey]
test eax, eax
je 0x140007039
mov rcx, qword [rsp + 0x38]
lea r14, [rsp + 0x34]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], 0
xor edi, edi
xor edx, edx
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.advapi32.dll_CryptExportKey]
test eax, eax
je 0x1400070c7
mov edx, dword [rsp + 0x34]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
je 0x1400070c7
mov dword [rsp + 0x44], ebx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
xor edi, edi
xor edx, edx
mov r8d, 7
xor r9d, r9d
mov r14, rax
call qword [sym.imp.advapi32.dll_CryptExportKey]
test eax, eax
je 0x1400070be
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x40], r13d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.advapi32.dll_CryptDestroyKey]
mov qword [rsp + 0x38], 0
mov r12d, dword [r14 + 0xc]
mov r13, r12
shr r13, 3
mov dword [r14 + 0x10], 1
lea rbx, [r14 + r13*2]
mov al, 1
mov byte [r14 + r13*2 + 0x14], al
lea rcx, [r14 + r13*2]
add rcx, 0x15
shr r12, 4
lea ebp, [r12 - 1]
xor edi, edi
xor edx, edx
mov r8, rbp
call fcn.1400ef1e0
lea rcx, [r12 + rbx]
add rcx, 0x14
mov qword [rsp + 0x50], rcx
lea rcx, [r12 + rbx + 0x15]
mov r12, qword [rsp + 0xc8]
mov al, 1
mov byte [rcx - 1], al
mov bl, 1
xor edx, edx
mov r8, rbp
call fcn.1400ef1e0
mov rax, qword [rsp + 0x50]
lea rcx, [rax + r13]
inc rcx
mov byte [rcx - 1], bl
xor edx, edx
mov r8, rbp
call fcn.1400ef1e0
mov r8d, dword [rsp + 0x34]
mov rcx, qword [r12]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r13, r14
mov rdx, r14
xor r9d, r9d
call qword [sym.imp.advapi32.dll_CryptImportKey]
test eax, eax
je 0x1400070bb
mov dword [rsp + 0x34], reloc.WLDAP32.dll_Ordinal_140
mov edx, reloc.WLDAP32.dll_Ordinal_140
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
mov r11d, dword [rsp + 0x40]
mov r9, qword [rsp + 0x48]
mov r14, r13
je 0x1400070be
mov rcx, rax
mov dword [rax], 0x201
mov eax, dword [rsp + 0x44]
mov dword [rcx + 4], eax
mov dword [rcx + 8], 0xa400
mov r14, rcx
mov rax, rcx
add rax, 0xc
test r9d, r9d
je 0x140007040
mov r8d, r9d
mov rcx, r8
neg rcx
lea ebx, [r9 - 1]
xor edi, edi
mov edx, ebx
mov dl, byte [r15 + rdx]
mov byte [rax + rdi], dl
inc rdi
dec ebx
mov rdx, rcx
add rdx, rdi
jne 0x140007010
mov rcx, 0xfffffffffffffff1
sub rcx, r8
jmp 0x140007047
xor edi, edi
jmp 0x1400070ef
xor edi, edi
jmp 0x1400070c7
mov rcx, 0xfffffffffffffff1
mov r10, qword [rsp + 0xc0]
mov edx, dword [rsp + 0x34]
mov rbp, rdx
add rbp, rcx
je 0x140007084
inc r9d
add rax, r9
mov ebx, 1
xor edi, edi
cmp byte [rax + rdi], 0
jne 0x140007076
mov byte [rax + rdi], Ordinal_69
mov edx, dword [rsp + 0x34]
mov edi, ebx
mov ebp, edx
add rbp, rcx
inc ebx
cmp rbp, rdi
ja 0x140007068
add edx, 0xfffffffe
mov rbx, r14
mov byte [r14 + rdx], 2
mov r9, qword [rsp + 0x38]
mov r8d, dword [rsp + 0x34]
mov rcx, qword [r12]
mov qword [rsp + 0x28], r10
mov dword [rsp + 0x20], r11d
mov rdx, r14
call qword [sym.imp.advapi32.dll_CryptImportKey]
mov edi, eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r14, r13
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400070d7
call qword [sym.imp.advapi32.dll_CryptDestroyKey]
test edi, edi
jne 0x1400070e6
mov rcx, qword [r12]
call fcn.14000723a
xor edi, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret