Function at 0x14000bf00
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Import public key
Initialize hashing via wincrypt
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x11a8
call fcn.1400297c0
sub rsp, rax
movaps xmmword [rsp + 0x1190], xmm6
mov ebx, r9d
mov rax, qword [0x140045010]
xor rax, rsp
mov qword [rsp + 0x1188], rax
mov qword [rsp + 0x70], 0
xorps xmm0, xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
mov edi, r9d
test rcx, rcx
je 0x14000c18a
mov rbp, rdx
test rdx, rdx
je 0x14000c18a
mov r13, r8
test r8, r8
je 0x14000c18a
test ebx, ebx
je 0x14000c18a
mov rsi, rcx
cmp qword [rcx], 0
je 0x14000c1d2
mov dword [rsp + 0x20], 0xf0000000
lea r8, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
lea rcx, [rsp + 0x70]
xor edx, edx
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x14000c02f
mov dword [rsp + 0x20], 0xf0000008
lea r8, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
lea rcx, [rsp + 0x70]
xor edx, edx
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x14000c02f
mov dword [rsp + 0x20], 0xf0000000
lea rcx, [rsp + 0x70]
xor edx, edx
xor r8d, r8d
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x14000c02f
mov dword [rsp + 0x20], 0xf0000008
lea rcx, [rsp + 0x70]
xor edx, edx
xor r8d, r8d
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x14000c2a4
mov qword [rsp + 0x68], rsi
mov dword [rsp + 0x58], ebx
lea rsi, [rsp + 0x80]
xor r12d, r12d
xorps xmm6, xmm6
mov r14, qword [sym.imp.CRYPT32.dll_CryptQueryObject]
mov r15, qword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
mov rax, qword [rbp + r12*8]
test rax, rax
je 0x14000c1aa
mov rbx, qword [rsp + 0x70]
test rbx, rbx
je 0x14000c1aa
mov ecx, dword [r13 + r12*4]
mov dword [rsp + 0x140], ecx
mov qword [rsp + 0x148], rax
lea rax, [rsp + 0x1140]
mov qword [rsp + 0x50], rax
movups xmmword [rsp + 0x38], xmm6
movups xmmword [rsp + 0x28], xmm6
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x20], 0
mov ecx, 2
lea rdx, [rsp + 0x140]
mov r8d, 2
mov r9d, 2
call r14
test eax, eax
je 0x14000c1aa
mov rax, qword [rsp + 0x1140]
mov r8, qword [rax + 0x18]
add r8, 0x60
mov rcx, rbx
mov edx, 0x10001
mov r9, rsi
call qword [sym.imp.CRYPT32.dll_CryptImportPublicKeyInfo]
mov ebx, eax
mov rcx, qword [rsp + 0x1140]
call r15
test ebx, ebx
je 0x14000c1aa
inc r12
add rsi, 8
cmp rdi, r12
jne 0x14000c054
mov rsi, qword [rsp + 0x70]
mov rax, qword [rsp + 0x68]
mov rbx, qword [rax]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x100], xmm0
movaps xmmword [rsp + 0x110], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xf0], xmm0
test rbx, rbx
je 0x14000c23e
mov rcx, rbx
xor edx, edx
mov r8d, 2
call fcn.14001b4f0
test eax, eax
je 0x14000c254
mov ecx, 2
call fcn.1400135c8
lea rdx, str.ERROR:_Could_not_seek_to_the_end_of_the_MAR_file._n
jmp 0x14000c1bb
mov ecx, 2
call fcn.1400135c8
lea rdx, str.ERROR:_Invalid_parameter_specified._n
mov rcx, rax
call fcn.140001260
mov ebp, 0xffffffff
jmp 0x14000c1cc
mov ecx, 2
call fcn.1400135c8
lea rdx, str.ERROR:_Could_not_load_public_key._n
mov rcx, rax
call fcn.140001260
mov ebp, 0xffffffff
mov ebx, dword [rsp + 0x58]
test ebx, ebx
jne 0x14000c1f0
jmp 0x14000c210
mov ecx, 2
call fcn.1400135c8
lea rdx, str.ERROR:_MAR_file_is_not_open._n
mov rcx, rax
call fcn.140001260
mov ebp, 0xffffffff
xor esi, esi
mov rbx, qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + rsi*8 + 0x80]
test rcx, rcx
je 0x14000c208
call rbx
inc rsi
cmp rdi, rsi
jne 0x14000c1f9
mov rcx, qword [rsp + 0x1188]
xor rcx, rsp
call fcn.140023680
mov eax, ebp
movaps xmm6, xmmword [rsp + 0x1190]
add rsp, 0x11a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 2
call fcn.1400135c8
lea rdx, str.ERROR:_Invalid_file_pointer_passed._n
jmp 0x14000c1bb
mov rcx, rbx
call fcn.14001c020
cmp rax, 0x1f400001
jl 0x14000c27a
mov ecx, 2
call fcn.1400135c8
lea rdx, str.ERROR:_MAR_file_is_too_large_to_be_verified._n
jmp 0x14000c1bb
mov edx, 0x10
mov rcx, rbx
xor r8d, r8d
call fcn.14001b4f0
test eax, eax
je 0x14000c2c3
mov ecx, 2
call fcn.1400135c8
lea rdx, str.ERROR:_Could_not_seek_to_the_signature_block._n
jmp 0x14000c1bb
mov qword [rsp + 0x70], 0
mov ecx, 2
call fcn.1400135c8
lea rdx, str.ERROR:_Could_not_init_crytpo_library._n
jmp 0x14000c1e3
lea rcx, [rsp + 0x7c]
mov edx, 4
mov r8d, 1
mov r9, rbx
call fcn.1400206ec
cmp rax, 1
jne 0x14000c318
mov ecx, dword [rsp + 0x7c]
call qword [sym.imp.WSOCK32.dll_ntohl]
mov dword [rsp + 0x7c], eax
cmp eax, 8
jbe 0x14000c32e
mov ecx, 2
call fcn.1400135c8
lea rdx, str.ERROR:_At_most__d_signatures_can_be_specified._n
mov rcx, rax
mov r8d, 8
call fcn.140001260
jmp 0x14000c1c3
mov ecx, 2
call fcn.1400135c8
lea rdx, str.ERROR:_Could_not_read_number_of_signatures._n
jmp 0x14000c1bb
mov dword [rsp + 0x5c], eax
test eax, eax
je 0x14000c421
mov eax, dword [rsp + 0x5c]
mov qword [rsp + 0x60], rax
lea rax, [rax*4]
mov qword [rsp + 0x68], rax
xor r14d, r14d
mov r15, qword [sym.imp.WSOCK32.dll_ntohl]
lea rbp, [rsp + r14]
add rbp, 0x100
mov edx, 4
mov r8d, 1
mov rcx, rbp
mov r9, rbx
call fcn.1400206ec
cmp rax, 1
jne 0x14000c514
mov ecx, dword [rbp]
call r15
mov r13d, eax
mov dword [rbp], eax
mov edx, 4
mov r8d, 1
lea rcx, [rsp + 0x78]
mov r9, rbx
call fcn.1400206ec
cmp rax, 1
jne 0x14000c52a
mov ecx, dword [rsp + 0x78]
mov r12, r15
call r15
mov dword [rsp + 0x78], eax
cmp eax, 0x801
jae 0x14000c540
mov ebp, eax
mov rcx, rbp
call fcn.140020e74
mov qword [rsp + r14*2 + 0xc0], rax
test rax, rax
je 0x14000c556
mov r8d, 1
mov rcx, rax
mov rdx, rbp
mov r9, rbx
call fcn.1400206ec
cmp rax, 1
jne 0x14000c56c
cmp r13d, 2
jne 0x14000c5af
add r14, 4
cmp qword [rsp + 0x68], r14
mov r15, r12
jne 0x14000c35a
mov rcx, rbx
call fcn.14001c020
mov ebp, 0xffffffff
cmp rax, 0xffffffffffffffff
je 0x14000c1c8
xorps xmm0, xmm0
movaps xmmword [rsp + 0x1140], xmm0
movaps xmmword [rsp + 0x1150], xmm0
movaps xmmword [rsp + 0x1160], xmm0
movaps xmmword [rsp + 0x1170], xmm0
movaps xmmword [rsp + 0x120], xmm0
movaps xmmword [rsp + 0x130], xmm0
cmp dword [rsp + 0x5c], 0
je 0x14000c4fe
test rsi, rsi
lea r14, [rsp + 0x1140]
je 0x14000c4e8
mov ebp, dword [rsp + 0x5c]
mov r15, qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov qword [rsp + 0x68], rbp
mov qword [r14], 0
mov qword [rsp + 0x20], r14
mov rcx, rsi
mov edx, 0x800d
xor r8d, r8d
xor r9d, r9d
call r15
test eax, eax
je 0x14000c4e8
add r14, 8
dec rbp
jne 0x14000c493
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call fcn.14001b4f0
test eax, eax
je 0x14000c5f2
mov ecx, 2
call fcn.1400135c8
lea rdx, str.ERROR:_Could_not_seek_to_start_of_the_file_n
jmp 0x14000c1bb
mov ecx, 2
call fcn.1400135c8
lea rdx, str.ERROR:_Could_not_initialize_signature_handle._n
jmp 0x14000c1bb
mov ecx, 2
call fcn.1400135c8
lea rdx, str.ERROR:_There_must_be_at_least_one_signature._n
jmp 0x14000c1bb
mov ecx, 2
call fcn.1400135c8
lea rdx, str.ERROR:_Could_not_read_signatures_algorithm_ID._n
jmp 0x14000c1bb
mov ecx, 2
call fcn.1400135c8
lea rdx, str.ERROR:_Could_not_read_signatures_length._n
jmp 0x14000c1bb
mov ecx, 2
call fcn.1400135c8
lea rdx, str.ERROR:_Signature_length_is_too_large_to_verify._n
jmp 0x14000c1bb
mov ecx, 2
call fcn.1400135c8
lea rdx, str.ERROR:_Could_allocate_buffer_for_signature._n
jmp 0x14000c1bb
mov ecx, 2
call fcn.1400135c8
lea rdx, str.ERROR:_Could_not_read_extracted_signature._n
mov rcx, rax
call fcn.140001260
xor esi, esi
mov ebx, dword [rsp + 0x58]
mov r14, qword [rsp + 0x60]
mov ebp, 0xffffffff
mov rcx, qword [rsp + rsi*8 + 0xc0]
call fcn.14002099c
inc rsi
cmp r14, rsi
jne 0x14000c595
jmp 0x14000c1cc
mov ecx, 2
call fcn.1400135c8
lea rdx, str.ERROR:_Unknown_signature_algorithm_ID._n
mov rcx, rax
call fcn.140001260
xor esi, esi
mov ebx, dword [rsp + 0x58]
mov r14, qword [rsp + 0x60]
mov ebp, 0xffffffff
mov rcx, qword [rsp + rsi*8 + 0xc0]
call fcn.14002099c
inc rsi
cmp r14, rsi
jne 0x14000c5d8
jmp 0x14000c1cc
lea rax, str.signature_block
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x20], eax
lea rdx, [rsp + 0x140]
lea r9, [rsp + 0x1140]
mov rcx, rbx
mov r8d, 0x14
call fcn.14000be10
test eax, eax
jne 0x14000c1c3
mov ecx, dword [rsp + 0x5c]
test ecx, ecx
mov eax, 1
mov r15d, ecx
cmove r15d, eax
lea rsi, [rsp + 0x120]
lea r14, str.signature_algorithm_ID
lea r13, [rsp + 0x140]
lea rbp, [rsp + 0x1140]
lea r12, str.signature_length
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x28], r14
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x20], eax
mov rcx, rbx
mov rdx, r13
mov r8d, 4
mov r9, rbp
call fcn.14000be10
test eax, eax
jne 0x14000c1c3
mov qword [rsp + 0x28], r12
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x20], eax
mov rcx, rbx
mov rdx, rsi
mov r8d, 4
mov r9, rbp
call fcn.14000be10
test eax, eax
jne 0x14000c1c3
mov ecx, dword [rsi]
call qword [sym.imp.WSOCK32.dll_ntohl]
mov dword [rsi], eax
cmp eax, 0x801
jae 0x14000c803
mov edx, eax
mov rcx, rbx
mov r8d, 1
call fcn.14001b4f0
test eax, eax
jne 0x14000c819
add rsi, 4
dec r15
jne 0x14000c669
mov rcx, rbx
call fcn.140020340
test eax, eax
je 0x14000c845
xor r13d, r13d
mov r13d, r13d
mov r12d, dword [rsp + r13*4 + 0x120]
test r12, r12
je 0x14000c82f
mov r14, qword [rsp + r13*8 + 0xc0]
test r14, r14
je 0x14000c82f
mov rcx, r12
call fcn.140020e74
test rax, rax
je 0x14000c82f
mov r15, rax
mov rsi, r12
neg rsi
lea ecx, [r12 - 1]
xor edx, edx
mov ebp, ecx
mov bl, byte [r14 + rbp]
mov byte [r15 + rdx], bl
inc rdx
dec ecx
mov rax, rsi
add rax, rdx
jne 0x14000c74e
mov r9, qword [rsp + r13*8 + 0x80]
mov rcx, qword [rsp + r13*8 + 0x1140]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rdx, r15
mov r8d, r12d
call qword [sym.imp.ADVAPI32.dll_CryptVerifySignatureA]
mov esi, eax
mov rcx, r15
call fcn.14002099c
test esi, esi
je 0x14000c82f
inc r13d
cmp r13d, dword [rsp + 0x60]
jne 0x14000c708
xor esi, esi
mov rcx, qword [rsp + rsi*8 + 0xc0]
call fcn.14002099c
inc rsi
cmp qword [rsp + 0x68], rsi
jne 0x14000c7b4
xor ebp, ebp
mov ebx, dword [rsp + 0x58]
cmp dword [rsp + 0x60], ebx
je 0x14000c1cc
mov ecx, 2
call fcn.1400135c8
lea rdx, str.ERROR:_Only__d_of__d_signatures_were_verified._n
mov rcx, rax
mov r8, qword [rsp + 0x60]
mov r9d, dword [rsp + 0x5c]
call fcn.140001260
jmp 0x14000c1a3
mov ecx, 2
call fcn.1400135c8
lea rdx, str.ERROR:_Embedded_signature_length_is_too_large._n
jmp 0x14000c1bb
mov ecx, 2
call fcn.1400135c8
lea rdx, str.ERROR:_Could_not_seek_past_signature._n
jmp 0x14000c1bb
mov ecx, 2
call fcn.1400135c8
lea rdx, str.ERROR:_Error_verifying_signature._n
jmp 0x14000c1bb
lea r12, [rsp + 0x140]
mov r15, qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov edx, 1
mov r8d, 0x1000
mov rcx, r12
mov r9, rbx
call fcn.1400206ec
mov rbp, rax
mov rcx, rbx
call fcn.14002036c
test eax, eax
jne 0x14000c8c4
xor esi, esi
mov rcx, qword [rsp + rsi*8 + 0x1140]
mov rdx, r12
mov r8d, ebp
xor r9d, r9d
call r15
test eax, eax
je 0x14000c8ae
inc rsi
cmp qword [rsp + 0x60], rsi
jne 0x14000c87b
mov rcx, rbx
call fcn.140020340
test eax, eax
je 0x14000c854
jmp 0x14000c705
mov ecx, 2
call fcn.1400135c8
lea rdx, str.ERROR:_Error_updating_verify_context_with_data_block._n
jmp 0x14000c1bb
mov ecx, 2
call fcn.1400135c8
lea rdx, str.ERROR:_Error_reading_data_block._n
jmp 0x14000c1bb