Function at 0x14001f460
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x5a0
lea rdi, [rsp + 0x40]
mov ecx, 0x158
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x5b0]
mov rax, qword [0x140575740]
xor rax, rsp
mov qword [rsp + 0x598], rax
mov dword [rsp + 0x44], 0xc00
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov dword [rsp + 0x88], 0
mov dword [rsp + 0x94], 0
mov dword [rsp + 0xb4], 0
mov dword [rsp + 0xc4], 0
mov qword [rsp + 0xc8], 0
mov dword [rsp + 0xd4], 0
mov dword [rsp + 0x134], 0
mov qword [rsp + 0x288], 0
mov qword [rsp + 0x2b8], 0
mov dword [rsp + 0x2f4], 0
cmp qword [rsp + 0x5b8], 0
je 0x14001f555
mov edx, 0xff
mov rcx, qword [rsp + 0x5b8]
call fcn.14001ee40
cmp rax, 0x40
jbe 0x14001f55c
xor eax, eax
jmp 0x14001ffe7
mov r9, qword [rsp + 0x5b8]
lea r8, str._s_privatekey
mov edx, 0xff
lea rcx, [rsp + 0x440]
call fcn.140015f80
mov dword [rsp + 0x544], eax
mov qword [rsp + 0x20], 0x40
lea r9, [rsp + 0x440]
mov r8d, 0x7f
lea rdx, [rsp + 0x320]
lea rcx, [rsp + 0x558]
call fcn.1403c59a0
test eax, eax
je 0x14001f5bb
xor eax, eax
jmp 0x14001ffe7
mov r8d, reloc.WS2_32.dll_recv
xor edx, edx
lea rcx, [rsp + 0x1a8]
call fcn.140410c60
xor eax, eax
cmp eax, 1
je 0x14001f5eb
mov ecx, 0x30
call fcn.1403c4e30
mov qword [rsp + 0x590], rax
jmp 0x14001f5f7
mov qword [rsp + 0x590], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x18
mov rcx, qword [rsp + 0x590]
call fcn.1401375b0
mov qword [rsp + 0x568], rax
cmp qword [rsp + 0x78], 0
jne 0x14001f68d
mov eax, dword [rsp + 0x88]
lea rcx, str._yA_
cmp qword [rcx + rax*8], 0
je 0x14001f68d
mov eax, dword [rsp + 0x88]
lea rcx, str._yA_
mov rax, qword [rcx + rax*8]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x568]
xor r8d, r8d
mov rdx, qword [rsp + 0x78]
mov rcx, rax
call sub.ncrypt.dll_NCryptOpenStorageProvider
nop
mov rax, qword [rsp + 0x568]
cmp qword [rax], 0
jne 0x14001f67b
mov qword [rsp + 0x78], 0
mov eax, dword [rsp + 0x88]
inc eax
mov dword [rsp + 0x88], eax
jmp 0x14001f617
mov rax, qword [rsp + 0x568]
cmp qword [rax], 0
jne 0x14001f6b2
lea rcx, str.Could_not_find_suitable_CngProvider
call fcn.14014d820
nop
jmp 0x14001ffa2
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0xd4]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 3
mov rdx, qword [rsp + 0x5b8]
mov ecx, 1
call qword [sym.imp.CRYPT32.dll_CertStrToNameA]
test eax, eax
jne 0x14001f6fb
jmp 0x14001ffa2
mov eax, dword [rsp + 0xd4]
mov ecx, eax
call fcn.1403c4e30
mov qword [rsp + 0xc8], rax
cmp qword [rsp + 0xc8], 0
jne 0x14001f764
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, 0xfe
mov r8d, 0xc9
lea rdx, [0x140417d20]
xor ecx, ecx
call fcn.14014da80
mov r8d, 0xc9
lea rdx, [0x140417d70]
lea rcx, [0x140417db8]
call fcn.140015e70
mov ecx, 0xfe
call fcn.14038e600
nop
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0xd4]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 3
mov rdx, qword [rsp + 0x5b8]
mov ecx, 1
call qword [sym.imp.CRYPT32.dll_CertStrToNameA]
test eax, eax
jne 0x14001f7b1
jmp 0x14001ffa2
mov eax, dword [rsp + 0xd4]
mov dword [rsp + 0x1d8], eax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x1e0], rax
lea rax, [0x140417ddc]
mov qword [rsp + 0x20], rax
mov r9d, 0x14000
xor r8d, r8d
mov edx, 0x10001
mov ecx, 0xa
call qword [sym.imp.CRYPT32.dll_CertOpenStore]
mov rcx, qword [rsp + 0x568]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x568]
cmp qword [rax + 8], 0
jne 0x14001f826
lea rcx, str.Failed_to_open_Windows_Cert_Store
call fcn.14014d820
nop
jmp 0x14001ffa2
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x1d8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20007
xor r8d, r8d
mov edx, 0x10001
mov rax, qword [rsp + 0x568]
mov rcx, qword [rax + 8]
call qword [sym.imp.CRYPT32.dll_CertFindCertificateInStore]
mov rcx, qword [rsp + 0x568]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x568]
cmp qword [rax + 0x10], 0
je 0x14001f929
lea rax, [rsp + 0xb4]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x94]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
xor r8d, r8d
mov edx, 0x10040
mov rax, qword [rsp + 0x568]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.CRYPT32.dll_CryptAcquireCertificatePrivateKey]
test eax, eax
jne 0x14001f8d0
mov dword [rsp + 0x5b0], 1
lea rcx, str.CryptAcquireCertificatePrivateKey___Failed
call fcn.14014d820
nop
cmp dword [rsp + 0x94], 0xffffffff
je 0x14001f8f2
mov dword [rsp + 0x5b0], 1
lea rcx, str.hKeyNodeSpec___CERT_NCRYPT_KEY_SPEC
call fcn.14014d820
nop
cmp dword [rsp + 0xb4], 0
je 0x14001f929
cmp qword [rsp + 0x68], 0
je 0x14001f929
cmp dword [rsp + 0x94], 0xffffffff
jne 0x14001f91b
mov rcx, qword [rsp + 0x68]
call sub.ncrypt.dll_NCryptFreeObject
nop
jmp 0x14001f929
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
nop
mov rax, qword [rsp + 0x568]
cmp qword [rax + 0x10], 0
je 0x14001f94c
cmp dword [rsp + 0x5b0], 0
jne 0x14001f94c
jmp 0x14001ffc6
mov rax, qword [rsp + 0x568]
cmp qword [rax + 0x10], 0
je 0x14001f9a5
mov rax, qword [rsp + 0x568]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.CRYPT32.dll_CertDeleteCertificateFromStore]
mov dword [rsp + 0xc4], eax
cmp dword [rsp + 0xc4], 0
jne 0x14001f995
lea rcx, str.CertDeleteCertificateFromStore___Failed
call fcn.14014d820
nop
jmp 0x14001ffa2
mov rax, qword [rsp + 0x568]
mov qword [rax + 0x10], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x320]
lea r8, [0x140417e90]
lea rdx, [rsp + 0x68]
mov rax, qword [rsp + 0x568]
mov rcx, qword [rax]
call sub.ncrypt.dll_NCryptCreatePersistedKey
mov dword [rsp + 0xc4], eax
cmp dword [rsp + 0xc4], 0
jge 0x14001fa19
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x78]
call fcn.140137020
mov rdx, rax
lea rcx, str.NCryptCreatePersistedKey__s__failed
call fcn.14014d820
nop
jmp 0x14001ffa2
mov dword [rsp + 0x20], 0x80000040
mov r9d, 4
lea r8, [rsp + 0x44]
lea rdx, [0x140417ec0]
mov rcx, qword [rsp + 0x68]
call sub.ncrypt.dll_NCryptSetProperty
mov dword [rsp + 0xc4], eax
cmp dword [rsp + 0xc4], 0
jge 0x14001faa6
mov dword [rsp + 0x44], 0x800
mov dword [rsp + 0x20], 0x80000040
mov r9d, 4
lea r8, [rsp + 0x44]
lea rdx, [0x140417ed0]
mov rcx, qword [rsp + 0x68]
call sub.ncrypt.dll_NCryptSetProperty
mov dword [rsp + 0xc4], eax
cmp dword [rsp + 0xc4], 0
jge 0x14001faa6
mov edx, dword [rsp + 0x44]
lea rcx, str.NCryptSetProperty__u__failed
call fcn.14014d820
nop
jmp 0x14001ffa2
mov edx, 0x40
mov rcx, qword [rsp + 0x68]
call sub.ncrypt.dll_NCryptFinalizeKey
mov dword [rsp + 0xc4], eax
cmp dword [rsp + 0xc4], 0
jge 0x14001fadd
lea rcx, str.NCryptFinalizeKey___failed
call fcn.14014d820
nop
jmp 0x14001ffa2
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0xf8]
call fcn.140410c60
lea rax, [rsp + 0x320]
mov qword [rsp + 0xf8], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x100], rax
mov dword [rsp + 0x108], 0
mov dword [rsp + 0x10c], 0
mov dword [rsp + 0x120], 0
mov r8d, 0x40
xor edx, edx
lea rcx, [rsp + 0x240]
call fcn.140410c60
mov byte [rsp + 0x574], 6
mov r8d, 0x18
xor edx, edx
lea rcx, [rsp + 0x2c8]
call fcn.140410c60
mov dword [rsp + 0x2c8], 1
lea rax, [rsp + 0x574]
mov qword [rsp + 0x2d0], rax
lea rax, [rsp + 0x2f4]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x2c8]
mov edx, reloc.WS2_32.dll_ntohl
mov ecx, 1
call qword [sym.imp.CRYPT32.dll_CryptEncodeObject]
test eax, eax
jne 0x14001fbb3
jmp 0x14001ffc6
mov eax, dword [rsp + 0x2f4]
mov ecx, eax
call fcn.1403c4e30
mov qword [rsp + 0x288], rax
cmp qword [rsp + 0x288], 0
jne 0x14001fc1c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, 0xfe
mov r8d, 0x11c
lea rdx, [0x140417f20]
xor ecx, ecx
call fcn.14014da80
mov r8d, 0x11c
lea rdx, [0x140417f70]
lea rcx, [0x140417fb8]
call fcn.140015e70
mov ecx, 0xfe
call fcn.14038e600
nop
lea rax, [rsp + 0x2f4]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x288]
lea r8, [rsp + 0x2c8]
mov edx, reloc.WS2_32.dll_ntohl
mov ecx, 1
call qword [sym.imp.CRYPT32.dll_CryptEncodeObject]
test eax, eax
jne 0x14001fc57
jmp 0x14001ffc6
mov eax, 0x20
imul rax, rax, 0
lea rcx, [0x140417fe0]
mov qword [rsp + rax + 0x240], rcx
mov eax, 0x20
imul rax, rax, 0
mov dword [rsp + rax + 0x248], 0
mov eax, 0x20
imul rax, rax, 0
mov ecx, dword [rsp + 0x2f4]
mov dword [rsp + rax + 0x250], ecx
mov eax, 0x20
imul rax, rax, 0
mov rcx, qword [rsp + 0x288]
mov qword [rsp + rax + 0x258], rcx
mov r8d, ntohs
xor edx, edx
lea rcx, [rsp + 0x298]
call fcn.140410c60
mov dword [rsp + 0x298], 1
mov dword [rsp + 0x29c], 0
mov dword [rsp + 0x2a0], 0
lea rax, [rsp + 0x2f4]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x298]
mov edx, reloc.WS2_32.dll_ntohs
mov ecx, 1
call qword [sym.imp.CRYPT32.dll_CryptEncodeObject]
test eax, eax
jne 0x14001fd1f
jmp 0x14001ffc6
mov eax, dword [rsp + 0x2f4]
mov ecx, eax
call fcn.1403c4e30
mov qword [rsp + 0x2b8], rax
cmp qword [rsp + 0x2b8], 0
jne 0x14001fd88
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, 0xfe
mov r8d, 0x12e
lea rdx, [0x140417ff0]
xor ecx, ecx
call fcn.14014da80
mov r8d, 0x12e
lea rdx, [0x140418040]
lea rcx, [0x140418088]
call fcn.140015e70
mov ecx, 0xfe
call fcn.14038e600
nop
lea rax, [rsp + 0x2f4]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x2b8]
lea r8, [rsp + 0x298]
mov edx, reloc.WS2_32.dll_ntohs
mov ecx, 1
call qword [sym.imp.CRYPT32.dll_CryptEncodeObject]
test eax, eax
jne 0x14001fdc3
jmp 0x14001ffc6
mov eax, 0x20
imul rax, rax, 1
lea rcx, str.2.5.29.19
mov qword [rsp + rax + 0x240], rcx
mov eax, 0x20
imul rax, rax, 1
mov dword [rsp + rax + 0x248], 0
mov eax, 0x20
imul rax, rax, 1
mov ecx, dword [rsp + 0x2f4]
mov dword [rsp + rax + 0x250], ecx
mov eax, 0x20
imul rax, rax, 1
mov rcx, qword [rsp + 0x2b8]
mov qword [rsp + rax + 0x258], rcx
mov dword [rsp + 0x1a8], 2
lea rax, [rsp + 0x240]
mov qword [rsp + 0x1b0], rax
lea rcx, [rsp + 0x148]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsp + 0x178]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [rsp + 0x148]
dec eax
mov word [rsp + 0x148], ax
movzx eax, word [rsp + 0x178]
add eax, 0x1e
mov word [rsp + 0x178], ax
mov r8d, 0x18
xor edx, edx
lea rcx, [rsp + 0x208]
call fcn.140410c60
lea rax, [0x1404180c0]
mov qword [rsp + 0x208], rax
lea rax, [rsp + 0x1a8]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x178]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x148]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x208]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xf8]
xor r8d, r8d
lea rdx, [rsp + 0x1d8]
xor ecx, ecx
call qword [sym.imp.CRYPT32.dll_CertCreateSelfSignCertificate]
mov rcx, qword [rsp + 0x568]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x568]
cmp qword [rax + 0x10], 0
jne 0x14001ff20
lea rcx, str.CertCreateSelfSignCertificate___failed
call fcn.14014d820
nop
jmp 0x14001ffa2
mov rax, qword [rsp + 0x568]
add rax, 0x10
mov r9, rax
mov r8d, 3
mov rax, qword [rsp + 0x568]
mov rdx, qword [rax + 0x10]
mov rax, qword [rsp + 0x568]
mov rcx, qword [rax + 8]
call qword [sym.imp.CRYPT32.dll_CertAddCertificateContextToStore]
mov dword [rsp + 0xc4], eax
cmp dword [rsp + 0xc4], 0
je 0x14001ff73
mov rax, qword [rsp + 0x568]
cmp qword [rax + 0x10], 0
jne 0x14001ff84
lea rcx, str.CertAddCertificateContextToStore___failed
call fcn.14014d820
nop
jmp 0x14001ffa2
cmp qword [rsp + 0x78], 0
je 0x14001ff9e
mov rdx, qword [rsp + 0x78]
lea rcx, [0x140418130]
call fcn.14001ee90
nop
jmp 0x14001ffc6
cmp qword [rsp + 0x68], 0
je 0x14001ffb5
mov rcx, qword [rsp + 0x68]
call sub.ncrypt.dll_NCryptFreeObject
nop
mov rcx, qword [rsp + 0x568]
call fcn.14001f3e0
xor eax, eax
jmp 0x14001ffe7
cmp qword [rsp + 0xc8], 0
je 0x14001ffdf
mov rcx, qword [rsp + 0xc8]
call fcn.1403c4e00
nop
mov rax, qword [rsp + 0x568]
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_send
call fcn.14037c300
mov rax, rdi
mov rcx, qword [rsp + 0x598]
xor rcx, rsp
call fcn.14037c650
add rsp, 0x5a0
pop rdi
ret