Function at 0x14000bdf0
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Import public key
Initialize hashing via wincrypt
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x11c8
call fcn.14002aee0
sub rsp, rax
movaps xmmword [rsp + 0x11b0], xmm6
mov edi, r9d
mov rax, qword [0x140048010]
xor rax, rsp
mov qword [rsp + 0x11a8], rax
mov qword [rsp + 0x80], 0
xorps xmm0, xmm0
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
mov ebp, r9d
test rcx, rcx
je 0x14000c094
mov rsi, rdx
test rdx, rdx
je 0x14000c094
mov rbx, r8
test r8, r8
je 0x14000c094
test edi, edi
je 0x14000c094
mov r14, rcx
mov dword [rsp + 0x20], 0xf0000000
lea r8, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
lea rcx, [rsp + 0x80]
xor edx, edx
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x14000bf24
mov dword [rsp + 0x20], 0xf0000008
lea r8, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
lea rcx, [rsp + 0x80]
xor edx, edx
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x14000bf24
mov dword [rsp + 0x20], 0xf0000000
lea rcx, [rsp + 0x80]
xor edx, edx
xor r8d, r8d
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x14000bf24
mov dword [rsp + 0x20], 0xf0000008
lea rcx, [rsp + 0x80]
xor edx, edx
xor r8d, r8d
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x14000c1d2
mov qword [rsp + 0x70], r14
mov dword [rsp + 0x6c], edi
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0xa0]
xor r12d, r12d
xorps xmm6, xmm6
mov r15, qword [sym.imp.CRYPT32.dll_CryptQueryObject]
mov r13, qword [sym.imp.CRYPT32.dll_CryptImportPublicKeyInfo]
mov r14, qword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
mov rax, qword [rsi + r12*8]
test rax, rax
je 0x14000c0bf
mov rdi, qword [rsp + 0x80]
test rdi, rdi
je 0x14000c0bf
mov ecx, dword [rbx + r12*4]
mov dword [rsp + 0x160], ecx
mov qword [rsp + 0x168], rax
lea rax, [rsp + 0x1160]
mov qword [rsp + 0x50], rax
movups xmmword [rsp + 0x38], xmm6
movups xmmword [rsp + 0x28], xmm6
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x20], 0
mov ecx, 2
lea rdx, [rsp + 0x160]
mov r8d, 2
mov r9d, 2
call r15
test eax, eax
je 0x14000c0bf
mov rax, qword [rsp + 0x1160]
mov r8, qword [rax + 0x18]
add r8, 0x60
mov rcx, rdi
mov edx, 0x10001
mov r9, rbp
call r13
mov edi, eax
mov rcx, qword [rsp + 0x1160]
call r14
test edi, edi
je 0x14000c0bf
inc r12
add rbp, 8
cmp qword [rsp + 0x60], r12
jne 0x14000bf55
mov r12, qword [rsp + 0x80]
lea rdx, [rsp + 0x88]
mov qword [rdx], 0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x120], xmm0
movaps xmmword [rsp + 0x130], xmm0
movaps xmmword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xf0], xmm0
movaps xmmword [rsp + 0x100], xmm0
movaps xmmword [rsp + 0x110], xmm0
mov r8d, 0x10
mov rbx, qword [rsp + 0x70]
mov rcx, rbx
call fcn.14000ceb0
test eax, eax
je 0x14000c143
mov ecx, 2
call fcn.140016598
lea rcx, str.ERROR:_Could_not_seek_to_the_signature_block._n
mov edx, 0x2e
jmp 0x14000c0d5
mov ecx, 2
call fcn.140016598
lea rcx, str.ERROR:_Invalid_parameter_specified._n
mov edx, 0x24
mov r8d, 1
mov r9, rax
call fcn.140021a1c
mov esi, 0xffffffff
jmp 0x14000c0f1
mov ecx, 2
call fcn.140016598
lea rcx, str.ERROR:_Could_not_load_public_key._n
mov edx, 0x22
mov r8d, 1
mov r9, rax
call fcn.140021a1c
mov esi, 0xffffffff
mov rbp, qword [rsp + 0x60]
mov edi, dword [rsp + 0x6c]
test edi, edi
je 0x14000c115
xor edi, edi
mov rbx, qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + rdi*8 + 0xa0]
test rcx, rcx
je 0x14000c10d
call rbx
inc rdi
cmp rbp, rdi
jne 0x14000c0fe
mov rcx, qword [rsp + 0x11a8]
xor rcx, rsp
call fcn.140024a50
mov eax, esi
movaps xmm6, xmmword [rsp + 0x11b0]
add rsp, 0x11c8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rdx, [rsp + 0x94]
lea r8, [rsp + 0x88]
mov r9d, 4
mov rcx, rbx
call fcn.14000ce10
test eax, eax
mov rbp, qword [rsp + 0x60]
je 0x14000c198
mov ecx, 2
call fcn.140016598
lea rcx, str.ERROR:_Could_not_read_number_of_signatures._n
mov edx, 0x2c
mov r8d, 1
mov r9, rax
call fcn.140021a1c
mov esi, 0xffffffff
jmp 0x14000c0ed
mov ecx, dword [rsp + 0x94]
call qword [sym.imp.WS2_32.dll_ntohl]
mov dword [rsp + 0x94], eax
cmp eax, 8
jbe 0x14000c20c
mov ecx, 2
call fcn.140016598
lea rdx, str.ERROR:_At_most__d_signatures_can_be_specified._n
mov rcx, rax
mov r8d, 8
call fcn.140001260
jmp 0x14000c18e
mov qword [rsp + 0x80], 0
mov ecx, 2
call fcn.140016598
lea rcx, str.ERROR:_Could_not_init_crytpo_library._n
mov edx, 0x26
mov r8d, 1
mov r9, rax
call fcn.140021a1c
mov esi, 0xffffffff
jmp 0x14000c0f5
test eax, eax
je 0x14000c633
xor esi, esi
lea r15, [rsp + 0x88]
mov r13, qword [sym.imp.WS2_32.dll_ntohl]
xor r14d, r14d
lea rdx, [rsp + rsi]
add rdx, 0x120
mov r9d, 4
mov rcx, rbx
mov r8, r15
call fcn.14000ce10
test eax, eax
jne 0x14000c64e
mov ecx, dword [rsp + r14*4 + 0x120]
call r13
mov dword [rsp + r14*4 + 0x120], eax
mov r9d, 4
mov rcx, rbx
lea rdx, [rsp + 0x90]
mov r8, r15
call fcn.14000ce10
test eax, eax
jne 0x14000c669
mov ecx, dword [rsp + 0x90]
call r13
mov dword [rsp + 0x90], eax
cmp eax, 0x801
jae 0x14000c684
mov edi, eax
mov rcx, rdi
call fcn.140021ee0
mov qword [rsp + r14*8 + 0xe0], rax
test rax, rax
je 0x14000c697
mov rcx, rbx
mov rdx, rax
mov r8, r15
mov r9, rdi
call fcn.14000ce10
test eax, eax
jne 0x14000c6b2
cmp dword [rsp + r14*4 + 0x120], 2
jne 0x14000c70c
inc r14
mov edi, dword [rsp + 0x94]
add rsi, 4
cmp r14, rdi
jb 0x14000c228
mov qword [rsp + 0x98], 0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x1160], xmm0
movaps xmmword [rsp + 0x1170], xmm0
movaps xmmword [rsp + 0x1180], xmm0
movaps xmmword [rsp + 0x1190], xmm0
movaps xmmword [rsp + 0x140], xmm0
movaps xmmword [rsp + 0x150], xmm0
test rdi, rdi
je 0x14000c633
test r12, r12
je 0x14000c766
lea r15, [rdi*8]
xor esi, esi
mov r14, qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
lea rax, [rsp + rsi]
add rax, 0x1160
mov qword [rax], 0
mov qword [rsp + 0x20], rax
mov rcx, r12
mov edx, 0x800d
xor r8d, r8d
xor r9d, r9d
call r14
test eax, eax
je 0x14000c766
add rsi, 8
cmp r15, rsi
jne 0x14000c358
lea rax, str.signature_block
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
lea r15, [rsp + 0x1160]
mov qword [rsp + 0x20], r15
lea rdx, [rsp + 0x98]
lea r8, [rsp + 0x160]
mov rcx, rbx
mov r9d, 0x14
call fcn.14000bd00
test eax, eax
jne 0x14000c18e
cmp edi, 2
mov eax, 1
cmovae eax, edi
mov qword [rsp + 0x78], rax
lea r12, [rax*4]
xor esi, esi
lea r13, [rsp + 0x98]
mov r14, r15
mov r15, qword [rsp + 0x70]
lea rcx, str.signature_algorithm_ID
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], r14
mov rcx, r15
mov rdx, r13
lea r8, [rsp + 0x160]
mov r9d, 4
call fcn.14000bd00
test eax, eax
jne 0x14000c18e
lea rbx, [rsp + rsi]
add rbx, 0x140
lea rax, str.signature_length
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], r14
mov rcx, r15
mov rdx, r13
mov r8, rbx
mov r9d, 4
call fcn.14000bd00
test eax, eax
jne 0x14000c18e
mov ecx, dword [rbx]
call qword [sym.imp.WS2_32.dll_ntohl]
mov dword [rbx], eax
cmp eax, 0x801
jae 0x14000c781
mov r8d, eax
mov rcx, qword [rsp + 0x70]
mov rdx, r13
call fcn.14000ceb0
test eax, eax
jne 0x14000c797
add rsi, 4
cmp r12, rsi
lea r14, [rsp + 0x1160]
jne 0x14000c3fd
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x70]
cmp rax, qword [rcx + 8]
jae 0x14000c531
lea rsi, [rsp + 0x160]
lea r14, [rsp + 0x98]
mov r15, qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rbx, qword [rsp + 0x78]
mov r9d, 0x1000
mov rcx, qword [rsp + 0x70]
mov rdx, rsi
mov r8, r14
call fcn.14000ce60
mov ebp, eax
xor edi, edi
mov rcx, qword [rsp + rdi*8 + 0x1160]
mov rdx, rsi
mov r8d, ebp
xor r9d, r9d
call r15
test eax, eax
je 0x14000c7b2
inc rdi
cmp rbx, rdi
jne 0x14000c4fa
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x70]
cmp rax, qword [rcx + 8]
jb 0x14000c4e0
xor r12d, r12d
mov r14, qword [sym.imp.ADVAPI32.dll_CryptVerifySignatureA]
mov r12d, r12d
mov r15d, dword [rsp + r12*4 + 0x140]
test r15, r15
je 0x14000c7ca
mov rbp, qword [rsp + r12*8 + 0xe0]
test rbp, rbp
je 0x14000c7ca
mov rcx, r15
call fcn.140021ee0
test rax, rax
je 0x14000c7ca
mov r13, rax
mov rdi, r15
neg rdi
lea ecx, [r15 - 1]
xor edx, edx
mov esi, ecx
mov bl, byte [rbp + rsi]
mov byte [r13 + rdx], bl
inc rdx
dec ecx
mov rax, rdi
add rax, rdx
jne 0x14000c580
mov r9, qword [rsp + r12*8 + 0xa0]
mov rcx, qword [rsp + r12*8 + 0x1160]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rdx, r13
mov r8d, r15d
call r14
mov esi, eax
mov rcx, r13
call fcn.140021a08
test esi, esi
je 0x14000c7ca
inc r12d
cmp r12d, dword [rsp + 0x78]
jne 0x14000c53b
cmp dword [rsp + 0x94], 0
je 0x14000c7f8
xor esi, esi
mov rcx, qword [rsp + rsi*8 + 0xe0]
call fcn.140021a08
inc rsi
mov edi, dword [rsp + 0x94]
cmp rsi, rdi
jb 0x14000c5f2
mov rax, qword [rsp + 0x78]
cmp eax, dword [rsp + 0x6c]
jne 0x14000c7fa
xor esi, esi
cmp dword [rsp + 0x78], edi
mov rbp, qword [rsp + 0x60]
je 0x14000c0ed
jmp 0x14000c7ff
mov ecx, 2
call fcn.140016598
lea rcx, str.ERROR:_There_must_be_at_least_one_signature._n
mov edx, 0x2d
jmp 0x14000c180
mov ecx, 2
call fcn.140016598
lea rcx, str.ERROR:_Could_not_read_signatures_algorithm_ID._n
mov edx, 0x2f
jmp 0x14000c180
mov ecx, 2
call fcn.140016598
lea rcx, str.ERROR:_Could_not_read_signatures_length._n
mov edx, 0x29
jmp 0x14000c180
mov ecx, 2
call fcn.140016598
lea rcx, str.ERROR:_Signature_length_is_too_large_to_verify._n
jmp 0x14000c6a8
mov ecx, 2
call fcn.140016598
lea rcx, str.ERROR:_Could_not_allocate_buffer_for_signature._n
mov edx, 0x30
jmp 0x14000c180
mov ecx, 2
call fcn.140016598
lea rcx, str.ERROR:_Could_not_read_extracted_signature._n
mov edx, 0x2b
mov r8d, 1
mov r9, rax
call fcn.140021a1c
mov esi, 0xffffffff
cmp dword [rsp + 0x94], 0
je 0x14000c0ed
xor edi, edi
mov rcx, qword [rsp + rdi*8 + 0xe0]
call fcn.140021a08
inc rdi
mov eax, dword [rsp + 0x94]
cmp rdi, rax
jb 0x14000c6eb
jmp 0x14000c0ed
mov ecx, 2
call fcn.140016598
lea rcx, str.ERROR:_Unknown_signature_algorithm_ID._n
mov edx, 0x27
mov r8d, 1
mov r9, rax
call fcn.140021a1c
mov esi, 0xffffffff
cmp dword [rsp + 0x94], 0
je 0x14000c0ed
xor edi, edi
mov rcx, qword [rsp + rdi*8 + 0xe0]
call fcn.140021a08
inc rdi
mov eax, dword [rsp + 0x94]
cmp rdi, rax
jb 0x14000c745
jmp 0x14000c0ed
mov ecx, 2
call fcn.140016598
lea rcx, str.ERROR:_Could_not_initialize_signature_handle._n
mov edx, 0x2e
jmp 0x14000c180
mov ecx, 2
call fcn.140016598
lea rcx, str.ERROR:_Embedded_signature_length_is_too_large._n
jmp 0x14000c65f
mov ecx, 2
call fcn.140016598
lea rcx, str.ERROR:_Could_not_seek_past_signature._n
mov edx, 0x26
jmp 0x14000c180
mov ecx, 2
call fcn.140016598
lea rcx, str.ERROR:_Error_updating_verify_context_with_data_block._n
mov edx, 0x36
jmp 0x14000c7e0
mov ecx, 2
call fcn.140016598
lea rcx, str.ERROR:_Error_verifying_signature._n
mov edx, 0x22
mov r8d, 1
mov r9, rax
call fcn.140021a1c
mov rbp, qword [rsp + 0x60]
jmp 0x14000c18e
xor edi, edi
mov rbp, qword [rsp + 0x60]
mov ecx, 2
call fcn.140016598
lea rdx, str.ERROR:_Only__d_of__d_signatures_were_verified._n
mov rcx, rax
mov r8, qword [rsp + 0x78]
mov r9d, edi
call fcn.140001260
jmp 0x14000c18e