Function at 0x140006650
Capabilities:
Contain obfuscated stackstrings
Create new key via cryptacquirecontext
Encode data using xor

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1b0
mov qword [r11 - 0xf0], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x14004d008]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov rbx, rdx
xor esi, esi
mov qword [r11 - 0x78], rsi
mov qword [r11 - 0x60], rsi
lea rcx, str.CryptAcquireContext_of_existing_key_container...
call fcn.14000d7a0
mov dword [rsp + 0x20], esi
lea r9d, [rsi + 1]
xor r8d, r8d
lea r14, str.SSLTestKeyContainer
mov rdx, r14
lea rcx, [rsp + 0x160]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x140006774
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x1400066e7
lea rcx, str._CryptAcquireContext_failed_with_bad_keyset
call fcn.14000d7a0
jmp 0x1400066f5
mov edx, eax
lea rcx, [0x140040f08]
call fcn.14000d7a0
lea rcx, str.CryptAcquireContext_create_new_container...
call fcn.14000d7a0
mov dword [rsp + 0x20], 8
mov r9d, 1
xor r8d, r8d
mov rdx, r14
lea rcx, [rsp + 0x160]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x14000676b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x8009000f
jne 0x140006742
lea rcx, str._CryptAcquireContext_failed_with_already_exists__are_you_running_as_administrator
call fcn.14000d7a0
jmp 0x140006750
mov edx, eax
lea rcx, str._Error_0x_x_returned_by_CryptAcquireContext
call fcn.14000d7a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x140040ff8]
call fcn.14000d7a0
xor eax, eax
jmp 0x14000728a
lea rcx, str.Success___new_container_created
jmp 0x14000677b
lea rcx, str.Success___container_found
call fcn.14000d7a0
lea rcx, str.CryptGenKey...
call fcn.14000d7a0
lea r9, [rsp + 0x178]
mov edx, 2
mov r8d, 0x8000000
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.ADVAPI32.dll_CryptGenKey]
test eax, eax
jne 0x1400067cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x140041058]
call fcn.14000d7a0
xor eax, eax
jmp 0x14000728a
lea rcx, [0x140040f98]
call fcn.14000d7a0
cmp qword [rsp + 0x178], rsi
je 0x140006808
lea rcx, str.CryptDestroyKey...
call fcn.14000d7a0
mov rcx, qword [rsp + 0x178]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
lea rcx, [0x140041080]
call fcn.14000d7a0
cmp qword [rsp + 0x160], rsi
je 0x14000683a
lea rcx, [0x140041088]
call fcn.14000d7a0
xor edx, edx
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea rcx, [0x1400410a0]
call fcn.14000d7a0
mov qword [rsp + 0xd0], rsi
mov qword [rsp + 0xd8], rsi
mov qword [rsp + 0xe0], rsi
mov qword [rsp + 0x180], rsi
mov dword [rsp + 0x170], esi
call fcn.1400013a0
mov rcx, rax
test rax, rax
jne 0x140006878
mov ecx, 0x80004005
call fcn.1400064e0
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x168], rax
lea rdx, [0x1400410a8]
test rdx, 0xffffffffffff0000
jne 0x1400068c2
movzx edi, dx
mov ecx, edi
call fcn.1400065a0
test rax, rax
je 0x1400068bc
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x168]
call fcn.1400072e0
or rdi, 0xffffffffffffffff
jmp 0x1400068eb
or rdi, 0xffffffffffffffff
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400068d0
mov r8d, eax
lea rcx, [rsp + 0x168]
call fcn.140007510
nop
mov rax, rdi
test rbx, rbx
je 0x140006912
inc rax
cmp word [rbx + rax*2], 0
jne 0x1400068f3
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x168]
call fcn.1400073f0
jmp 0x14000693a
lea rdx, str.localuser
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140006920
mov r8d, eax
lea rcx, [rsp + 0x168]
call fcn.1400073f0
mov dword [rsp + 0xf0], esi
lea rcx, [0x1400410c8]
call fcn.14000d7a0
mov qword [rsp + 0x30], rsi
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8d, [r9 + 3]
mov rbx, qword [rsp + 0x168]
mov rdx, rbx
lea ecx, [r9 + 1]
call qword [sym.imp.CRYPT32.dll_CertStrToNameW]
test eax, eax
jne 0x1400069b7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x1400410e0]
call fcn.14000d7a0
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400069b0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
xor eax, eax
jmp 0x14000728a
lea rcx, [0x1400410f0]
call fcn.14000d7a0
lea rcx, str.malloc...
call fcn.14000d7a0
mov ecx, dword [rsp + 0xf0]
call fcn.1400185d0
mov r15, rax
mov qword [rsp + 0xd8], rax
test rax, rax
jne 0x140006a1e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x140041108]
call fcn.14000d7a0
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140006a17
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
xor eax, eax
jmp 0x14000728a
lea rcx, [0x140041118]
call fcn.14000d7a0
lea rcx, str.CertStrToName...
call fcn.14000d7a0
mov qword [rsp + 0x30], rsi
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea r8d, [r9 + 3]
mov rdx, rbx
lea ecx, [r9 + 1]
call qword [sym.imp.CRYPT32.dll_CertStrToNameW]
test eax, eax
jne 0x140006a98
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x140041138]
call fcn.14000d7a0
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140006a91
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
xor eax, eax
jmp 0x14000728a
lea rcx, [0x140041148]
call fcn.14000d7a0
xor eax, eax
mov qword [rsp + 0x108], rax
mov eax, dword [rsp + 0xf0]
mov dword [rsp + 0x108], eax
mov qword [rsp + 0x110], r15
xor eax, eax
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x118], r14
mov qword [rsp + 0x120], rsi
mov qword [rsp + 0x128], 1
mov dword [rsp + 0x130], esi
mov qword [rsp + 0x138], rsi
mov dword [rsp + 0x140], 2
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x158], rax
lea rax, str.1.2.840.113549.1.1.5
mov qword [rsp + 0x148], rax
lea rcx, [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
add word [rsp + 0x190], 5
lea rcx, str.CertCreateSelfSignCertificate...
call fcn.14000d7a0
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x190]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
lea rax, [rsp + 0x148]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x118]
xor r8d, r8d
lea rdx, [rsp + 0x108]
xor ecx, ecx
call qword [sym.imp.CRYPT32.dll_CertCreateSelfSignCertificate]
mov r14, rax
mov qword [rsp + 0xd0], rax
test rax, rax
jne 0x140006bd0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x140041190]
call fcn.14000d7a0
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140006bc9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
xor eax, eax
jmp 0x14000728a
lea rcx, [0x1400411a0]
call fcn.14000d7a0
lea rcx, str.CertAddEnhancedKeyUsageIdentifier
call fcn.14000d7a0
lea rdx, [0x1400411e8]
mov rcx, r14
call qword [sym.imp.CRYPT32.dll_CertAddEnhancedKeyUsageIdentifier]
test eax, eax
je 0x1400071bc
lea rcx, [0x140041200]
call fcn.14000d7a0
mov dword [rsp + 0x40], 0x440045
mov dword [rsp + 0x44], 0x4a0054
mov dword [rsp + 0x48], 0x69006e
mov dword [rsp + 0x4c], 0x7c0079
mov dword [rsp + 0x50], 0x1f0073
movzx eax, word [0x14004122c]
xor ax, 0x20
mov word [rsp + 0x54], ax
movzx eax, word [0x14004122e]
xor ax, 0x21
mov word [rsp + 0x56], ax
movzx eax, word [str.CertSetCertificateContextProperty_CERT_FRIENDLY_NAME_PROP_ID]
xor ax, 0x22
mov word [rsp + 0x58], ax
movzx eax, word [0x140041232]
xor ax, 0x23
mov word [rsp + 0x5a], ax
movzx eax, word [0x140041234]
xor ax, 0x24
mov word [rsp + 0x5c], ax
movzx eax, word [0x140041236]
xor ax, 0x25
mov word [rsp + 0x5e], ax
movzx eax, word [0x140041238]
xor ax, 0x26
mov word [rsp + 0x60], ax
movzx eax, word [0x14004123a]
xor ax, 0x27
mov word [rsp + 0x62], ax
movzx eax, word [0x14004123c]
xor ax, 0x28
mov word [rsp + 0x64], ax
xor eax, eax
mov word [rsp + 0x66], ax
mov ecx, esi
mov rdx, rsi
lea eax, [rcx + 0x16]
xor word [rsp + rdx*2 + 0x40], ax
inc ecx
movsxd rdx, ecx
cmp rdx, 0x13
jb 0x140006cd0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x100], rax
lea rcx, [rsp + 0x40]
mov rax, rdi
nop dword [rax + rax]
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x140006d00
lea eax, [rax*2 + 2]
mov dword [rsp + 0xf8], eax
lea rcx, str.CertSetCertificateContextProperty_CERT_FRIENDLY_NAME_PROP_ID
call fcn.14000d7a0
lea r9, [rsp + 0xf8]
xor r8d, r8d
lea edx, [r8 + 0xb]
mov rcx, r14
call qword [sym.imp.CRYPT32.dll_CertSetCertificateContextProperty]
test eax, eax
je 0x140007189
lea rcx, [0x140041270]
call fcn.14000d7a0
mov dword [rsp + 0x70], 0x440045
mov dword [rsp + 0x74], 0x4a0054
mov dword [rsp + 0x78], 0x69006e
mov dword [rsp + 0x7c], 0x7c0079
mov dword [rsp + 0x80], 0x3f0073
mov dword [rsp + 0x84], 0x4d0063
mov dword [rsp + 0x88], 0x46004b
mov dword [rsp + 0x8c], 0x51004a
mov dword [rsp + 0x90], 0x730006
mov dword [rsp + 0x94], 0x5a004d
mov dword [rsp + 0x98], 0x2b005e
movzx eax, word [0x1400412e4]
xor ax, 0x2c
mov word [rsp + 0x9c], ax
movzx eax, word [0x1400412e6]
xor ax, 0x2d
mov word [rsp + 0x9e], ax
movzx eax, word [0x1400412e8]
xor ax, 0x2e
mov word [rsp + 0xa0], ax
movzx eax, word [0x1400412ea]
xor ax, 0x2f
mov word [rsp + 0xa2], ax
movzx eax, word [0x1400412ec]
xor ax, 0x30
mov word [rsp + 0xa4], ax
movzx eax, word [reloc.WS2_32.dll_WSAStartup]
xor ax, 0x31
mov word [rsp + 0xa6], ax
movzx eax, word [0x1400412f0]
xor ax, 0x32
mov word [rsp + 0xa8], ax
movzx eax, word [0x1400412f2]
xor ax, 0x33
mov word [rsp + 0xaa], ax
movzx eax, word [0x1400412f4]
xor ax, 0x34
mov word [rsp + 0xac], ax
movzx eax, word [0x1400412f6]
xor ax, 0x35
mov word [rsp + 0xae], ax
movzx eax, word [0x1400412f8]
xor ax, 0x36
mov word [rsp + 0xb0], ax
movzx eax, word [0x1400412fa]
xor ax, 0x37
mov word [rsp + 0xb2], ax
movzx eax, word [0x1400412fc]
xor ax, 0x38
mov word [rsp + 0xb4], ax
movzx eax, word [0x1400412fe]
xor ax, 0x39
mov word [rsp + 0xb6], ax
movzx eax, word [str._CertOpenStore_failed_with_access_denied_are__you_running_as_administrator_]
xor ax, 0x3a
mov word [rsp + 0xb8], ax
movzx eax, word [0x140041302]
xor ax, 0x3b
mov word [rsp + 0xba], ax
movzx eax, word [0x140041304]
xor ax, 0x3c
mov word [rsp + 0xbc], ax
movzx eax, word [0x140041306]
xor ax, 0x3d
mov word [rsp + 0xbe], ax
movzx eax, word [0x140041308]
xor ax, 0x3e
mov word [rsp + 0xc0], ax
movzx eax, word [0x14004130a]
xor ax, 0x3f
mov word [rsp + 0xc2], ax
movzx eax, word [0x14004130c]
xor ax, 0x40
mov word [rsp + 0xc4], ax
xor eax, eax
mov word [rsp + 0xc6], ax
mov rcx, rsi
nop word [rax + rax]
lea eax, [rsi + 0x16]
xor word [rsp + rcx*2 + 0x70], ax
inc esi
movsxd rcx, esi
cmp rcx, 0x2b
jb 0x140006f60
lea rax, [rsp + 0x70]
mov qword [rsp + 0x100], rax
lea rcx, [rsp + 0x70]
mov rax, rdi
nop dword [rax + rax]
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x140006f90
lea eax, [rax*2 + 2]
mov dword [rsp + 0xf8], eax
lea r9, [rsp + 0xf8]
xor r8d, r8d
lea edx, [r8 + 0xd]
mov rcx, r14
call qword [sym.imp.CRYPT32.dll_CertSetCertificateContextProperty]
test eax, eax
je 0x140007156
lea rcx, [0x1400412e8]
call fcn.14000d7a0
lea rax, [0x140040894]
mov qword [rsp + 0x20], rax
mov r9d, 0x10000
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xa]
call qword [sym.imp.CRYPT32.dll_CertOpenStore]
mov rsi, rax
mov qword [rsp + 0xe0], rax
test rax, rax
jne 0x14000704b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x14000701e
lea rcx, str._CertOpenStore_failed_with_access_denied_are__you_running_as_administrator_
call fcn.14000d7a0
jmp 0x14000702d
mov edx, eax
lea rcx, str._Error_0x_x_returned_by_CertOpenStore
call fcn.14000d7a0
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140007044
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
xor eax, eax
jmp 0x14000728a
lea rcx, [0x140041388]
call fcn.14000d7a0
lea rcx, str.CertAddCertificateContextToStore...
call fcn.14000d7a0
xor r9d, r9d
lea r8d, [r9 + 3]
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.CRYPT32.dll_CertAddCertificateContextToStore]
test eax, eax
jne 0x1400070ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x1400413b8]
call fcn.14000d7a0
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400070a6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
xor eax, eax
jmp 0x14000728a
lea rcx, [0x1400413c8]
call fcn.14000d7a0
lea rcx, str.CryptAcquireCertificatePrivateKey...
call fcn.14000d7a0
lea rax, [rsp + 0x170]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x188]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x180]
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.CRYPT32.dll_CryptAcquireCertificatePrivateKey]
test eax, eax
jne 0x14000712c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Error_0x_x
call fcn.14000d7a0
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140007125
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
xor eax, eax
jmp 0x14000728a
lea rcx, str.Success__private_key_acquired
call fcn.14000d7a0
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140007151
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
jmp 0x140007207
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x1400412f0]
call fcn.14000d7a0
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140007182
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
xor eax, eax
jmp 0x14000728a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x140041278]
call fcn.14000d7a0
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400071b5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
xor eax, eax
jmp 0x14000728a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x140041208]
call fcn.14000d7a0
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400071e8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
xor eax, eax
jmp 0x14000728a
test r15, r15
je 0x14000722c
lea rcx, str.free...
call fcn.14000d7a0
mov rcx, r15
call fcn.1400165a4
lea rcx, [0x140041438]
call fcn.14000d7a0
cmp qword [rsp + 0x180], 0
je 0x14000725f
lea rcx, str.CryptReleaseContext...
call fcn.14000d7a0
xor edx, edx
mov rcx, qword [rsp + 0x180]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea rcx, [0x140041458]
call fcn.14000d7a0
test rsi, rsi
je 0x140007287
lea rcx, str.CertCloseStore...
call fcn.14000d7a0
xor edx, edx
mov rcx, rsi
call qword [sym.imp.CRYPT32.dll_CertCloseStore]
lea rcx, str.Success
call fcn.14000d7a0
mov rax, r14
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.14000da40
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret