Function at 0x1000048b8
Capabilities:
Create new key via cryptacquirecontext
Delete file

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe0
mov rax, qword [0x10000a100]
xor rax, rsp
mov qword [rsp + 0xd0], rax
xor r12d, r12d
mov rbp, rcx
mov rcx, qword [0x10000ba10]
mov edx, r12d
lea r14d, [r12 + 2]
lea r15d, [r12 + 0x28]
cmp dword [0x10000b998], r14d
lea r8, [r11 - 0x88]
mov r9d, r15d
setne dl
mov qword [rsp + 0x50], r12
mov rsi, r12
add edx, 0x1b89
mov qword [rsp + 0x58], r12
call qword [sym.imp.USER32.dll_LoadStringW]
cmp eax, r12d
je 0x100004e02
cmp dword [0x10000b8e0], r12d
mov r9d, dword [0x10000a420]
mov r8, qword [0x10000b9c8]
lea rcx, [0x10000b998]
mov edi, 0x20000
lea r13d, [r12 + 1]
je 0x1000049a3
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov rax, qword [0x10000b900]
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rcx
xor ecx, ecx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
call sub.MSSIGN32.dll_PvkGetCryptProv
cmp eax, r12d
je 0x100004aaa
jmp 0x100004a5e
cmp dword [0x10000a414], edi
jne 0x100004a65
mov rdx, qword [0x10000b900]
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x20], 0x20
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
cmp eax, r12d
jne 0x1000049d8
mov qword [rsp + 0x50], r12
jmp 0x100004ab5
mov ebx, dword [0x10000b998]
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x60]
cmp ebx, r12d
cmove ebx, r14d
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGetUserKey]
cmp eax, r12d
je 0x100004a12
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov dword [0x10000b998], ebx
jmp 0x100004aaa
cmp dword [0x10000b998], r12d
mov rcx, qword [rsp + 0x50]
je 0x100004a2a
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x1000049ce
lea r8, [rsp + 0x60]
mov edx, r13d
call qword [sym.imp.ADVAPI32.dll_CryptGetUserKey]
cmp eax, r12d
je 0x100004a51
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov dword [0x10000b998], r13d
jmp 0x100004aaa
mov rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov qword [rsp + 0x50], r12
jmp 0x100004aaa
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov rax, qword [0x10000b900]
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov qword [rsp + 0x20], r12
call sub.MSSIGN32.dll_PvkGetCryptProv
mov rcx, qword [rsp + 0x50]
cmp eax, r12d
cmovne rcx, r12
mov qword [rsp + 0x50], rcx
cmp qword [rsp + 0x50], r12
jne 0x100004e3e
mov eax, dword [0x10000b998]
cmp eax, r12d
cmove eax, r14d
cmp dword [0x10000b8e0], r12d
mov dword [0x10000b998], eax
je 0x100004d15
lea rcx, [rsp + 0x68]
call qword [sym.imp.ole32.dll_CoCreateGuid]
cmp eax, r12d
jne 0x100004e02
mov rdx, qword [0x10000ba10]
mov r8d, 0x1b6c
mov ecx, 0x42
call fcn.1000070e4
cmp rax, r12
mov rsi, rax
je 0x100004e02
mov r15d, 0x10
lea rdx, [rsp + 0x68]
mov r8, rax
mov ecx, r15d
call fcn.100005ddc
mov r9d, dword [0x10000a420]
mov r8, qword [0x10000b9c8]
lea r10d, [r15 - 8]
lea rcx, [rsp + 0x50]
mov rdx, rsi
mov dword [rsp + 0x20], r10d
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
cmp eax, r12d
je 0x100004e02
mov edx, dword [0x10000b998]
cmp edx, r13d
jne 0x100004b7c
cmp dword [0x10000a420], 0xd
jne 0x100004b7c
mov rcx, qword [rsp + 0x50]
mov edx, r13d
call fcn.100006b58
cmp eax, r12d
je 0x100004e1a
jmp 0x100004bae
mov r8d, dword [0x10000b9dc]
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x58]
shl r8d, 0x10
or r8d, r13d
call qword [sym.imp.ADVAPI32.dll_CryptGenKey]
cmp eax, r12d
je 0x100004e02
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [0x10000b900]
mov qword [rsp + 0x30], r12
mov r14d, 0x80
xor r9d, r9d
mov r8d, r13d
mov edx, 0xc0000000
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rdi, rax
jne 0x100004c11
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [0x10000b900]
mov rcx, qword [0x10000ba10]
cmp eax, 0x50
mov edx, 0x1b66
je 0x100004c07
mov edx, 0x1b67
call fcn.100007180
mov ebx, r12d
jmp 0x100004c5f
mov r8d, dword [0x10000b998]
mov ebx, r12d
cmp r8d, r13d
jne 0x100004c3c
cmp dword [0x10000a420], 0xd
jne 0x100004c3c
call fcn.10000692c
mov r8d, dword [0x10000b998]
cmp eax, r12d
cmovne ebx, r14d
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x80]
xor r9d, r9d
mov rdx, rdi
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call sub.MSSIGN32.dll_PvkPrivateKeySave
mov ebx, eax
mov rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov r9d, dword [0x10000a420]
mov r8, qword [0x10000b9c8]
lea rcx, [rsp + 0x50]
mov rdx, rsi
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov qword [rsp + 0x50], r12
and ebx, eax
cmp rdi, 0xffffffffffffffff
je 0x100004cb5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, r12d
jne 0x100004cbe
mov rcx, qword [0x10000b900]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp ebx, r12d
je 0x100004e02
mov r9d, dword [0x10000a420]
mov r8, qword [0x10000b9c8]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbp
lea rax, [0x10000b998]
mov qword [rsp + 0x30], rax
mov rax, qword [0x10000b900]
lea rdx, [rsp + 0x80]
xor ecx, ecx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
call sub.MSSIGN32.dll_PvkGetCryptProv
cmp eax, r12d
je 0x100004df4
jmp 0x100004def
cmp dword [0x10000a414], edi
mov r9d, dword [0x10000a420]
mov r8, qword [0x10000b9c8]
mov rdx, qword [0x10000b900]
mov r10d, 8
lea rcx, [rsp + 0x50]
cmove r10d, r15d
mov dword [rsp + 0x20], r10d
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
cmp eax, r12d
je 0x100004e02
cmp dword [0x10000b8f0], r12d
mov edx, dword [0x10000b998]
mov eax, r12d
cmovne eax, r13d
cmp edx, r13d
jne 0x100004d8c
cmp dword [0x10000a420], 0xd
jne 0x100004d8c
mov rcx, qword [rsp + 0x50]
mov edx, eax
call fcn.100006b58
cmp eax, r12d
je 0x100004e1a
jmp 0x100004dba
mov r8d, dword [0x10000b9dc]
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x58]
shl r8d, 0x10
or r8d, eax
call qword [sym.imp.ADVAPI32.dll_CryptGenKey]
cmp eax, r12d
je 0x100004e02
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov edx, dword [0x10000b998]
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptGetUserKey]
cmp eax, r12d
je 0x100004de2
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
jmp 0x100004df4
mov rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov qword [rsp + 0x50], r12
cmp qword [rsp + 0x50], r12
jne 0x100004e31
mov edx, 0x1b68
jmp 0x100004e07
mov edx, 0x1b69
mov r8, qword [0x10000b900]
mov rcx, qword [0x10000ba10]
call fcn.100007180
mov rcx, qword [rsp + 0x50]
cmp rcx, r12
je 0x100004e31
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov qword [rsp + 0x50], r12
cmp rsi, r12
je 0x100004e3e
mov rcx, rsi
call sub.msvcrt.dll_free
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.100007b10
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret