Function at 0x1400a426e
Capabilities:
Create new key via cryptacquirecontext
Encrypt or decrypt via wincrypt

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
mov r15d, r9d
mov r12, r8
mov rsi, rdx
mov edi, ecx
xor ebx, ebx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbx
lea rbp, [rsp + 0x38]
mov qword [rbp], rbx
mov qword [rsp + 0x20], rbx
lea r8, [0x14015c67a]
xor r9d, r9d
call fcn.14002406b
mov r14d, eax
mov qword [rsp + 0x20], rbx
mov ecx, edi
mov rdx, rsi
mov r8, r12
mov r9, rbp
call fcn.14002406b
test eax, eax
jne 0x1400a42eb
mov qword [rsp + 0x20], 0
lea r8, [0x14015c684]
lea r9, [rsp + 0x38]
mov ecx, edi
mov rdx, rsi
call fcn.14002406b
test r14d, r14d
jne 0x1400a42fc
cmp qword [rsp + 0x38], 0
je 0x1400a454c
mov ebp, dword [rsp + 0xe8]
mov edi, ebp
mov ecx, 0x40
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
je 0x1400a454c
mov rsi, rax
mov rdx, qword [rsp + 0xe0]
mov rcx, rax
mov r8, rdi
call fcn.1400eeb30
xor edi, edi
mov dword [rsp + 0x5c], ebp
test r14d, r14d
je 0x1400a4366
test r15d, r15d
lea rax, [0x14015c6a0]
lea r8, [0x14015c690]
cmove r8, rax
lea rcx, [0x14015c6b0]
mov rdx, r12
call fcn.140016430
mov rdx, r12
jmp 0x1400a436d
mov edi, 0xf0000000
xor edx, edx
xor eax, eax
test r15d, r15d
setne al
shl eax, 5
or eax, edi
cmp dword [0x140177fe0], 0xa29
lea rcx, [0x14015c6f0]
lea r8, [0x14015c780]
cmovb r8, rcx
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x50]
mov r9d, Ordinal_26
call qword [sym.imp.advapi32.dll_CryptAcquireContextW]
test eax, eax
je 0x1400a43ca
test r14d, r14d
je 0x1400a43e3
lea rcx, [0x14015c7ec]
call fcn.140016430
mov r9, qword [rsp + 0x40]
jmp 0x1400a4470
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x14015c960]
mov edx, eax
call fcn.140016430
jmp 0x1400a4543
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x48]
lea r8, [rsp + 0x6c]
call fcn.1400127a5
test eax, eax
je 0x1400a4462
mov r8, qword [rsp + 0x38]
lea rcx, str.cCcC_CcC
mov rdx, r12
call fcn.140016430
mov rdx, qword [rsp + 0x48]
mov r8d, dword [rdx + 0x14]
add rdx, 0x18
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
call qword [sym.imp.advapi32.dll_CryptImportKey]
test eax, eax
je 0x1400a444e
lea rcx, [0x14015c7ec]
call fcn.140016430
jmp 0x1400a4462
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x14015c840]
mov edx, eax
call fcn.140016430
mov r9, qword [rsp + 0x40]
test r9, r9
je 0x1400a4526
mov r8d, dword [rsp + 0xd8]
mov rdx, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
call qword [sym.imp.advapi32.dll_CryptImportKey]
test eax, eax
je 0x1400a44dc
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.advapi32.dll_CryptDecrypt]
test eax, eax
je 0x1400a44f2
mov rdx, rsi
add rdx, 4
lea rcx, [0x14015c890]
call fcn.140016430
jmp 0x1400a4506
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str._a3a3a.a3aAaAaZaAa_a
mov edx, eax
call fcn.140016430
jmp 0x1400a4511
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x14015c8c0]
mov edx, eax
call fcn.140016430
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.advapi32.dll_CryptDestroyKey]
test r14d, r14d
jne 0x1400a4536
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400a4526
call qword [sym.imp.advapi32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400a4536
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.advapi32.dll_CryptReleaseContext]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
add rsp, 0x70
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret