Function at 0x14009fbd4
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using rc4 via systemfunction033

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0xe0
mov rdi, rcx
lea rax, [rax - 0x30]
xor esi, esi
lea r13d, [rsi + 0x10]
lea rcx, str._nSAMKey_:
mov rbp, r9
mov r12, r8
mov rbx, rdx
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r13d
mov dword [rsp + 0x4c], r13d
mov dword [rsp + 0x58], r13d
mov dword [rsp + 0x5c], r13d
mov qword [rsp + 0x60], r9
call fcn.14000c020
and qword [rsp + 0x30], rsi
lea rax, [rsp + 0x40]
lea r9, [0x14010b890]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], rsi
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call fcn.14000f340
test eax, eax
je 0x14009fde6
mov rbx, qword [rsp + 0x40]
movzx edx, word [rbx]
lea eax, [rdx - 2]
cmp eax, 1
ja 0x14009fdcf
mov edx, dword [rbx + 0x68]
mov eax, edx
sub eax, 1
je 0x14009fd38
cmp eax, 1
je 0x14009fc93
lea rcx, str.ERROR_kuhl_m_lsadump_getSamKey___Unknow_Struct_Key_revision___u_
jmp 0x14009fdd6
mov edi, dword [rbx + 0x74]
lea rcx, [rsp + 0x40]
mov r9d, reloc.ODBC32.dll_SQLAllocHandle
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x14009fcf1
lea rax, [rsp + 0x40]
lea r8, [rbx + 0x88]
lea rdx, [rbx + 0x78]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x118]
mov r9d, edi
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov rcx, r12
mov qword [rsp + 0x20], rax
call fcn.140004c90
jmp 0x14009fd07
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kull_m_crypto_genericAES128Decrypt___CryptAcquireContext__0x_08x__n
mov edx, eax
call fcn.14000c020
xor eax, eax
test eax, eax
je 0x14009fddb
cmp dword [rsp + 0x118], r13d
mov rcx, qword [rsp + 0x68]
sete sil
test esi, esi
je 0x14009fd2d
movdqu xmm0, xmmword [rcx]
movdqu xmmword [rbp], xmm0
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14009fddb
lea rcx, [rsp + 0x70]
call sub.cryptdll.dll_MD5Init
lea rdx, [rbx + 0x70]
lea rcx, [rsp + 0x70]
mov r8d, r13d
call sub.cryptdll.dll_MD5Update
lea rdx, str.______qwertyUIOPAzxcvbnmQQQQQQQQQQQQ____
lea rcx, [rsp + 0x70]
mov r8d, 0x2f
call sub.cryptdll.dll_MD5Update
lea rcx, [rsp + 0x70]
mov r8d, r13d
mov rdx, r12
call sub.cryptdll.dll_MD5Update
lea rdx, str.0123456789012345678901234567890123456789
lea rcx, [rsp + 0x70]
mov r8d, reloc.WLDAP32.dll_Ordinal_41
call sub.cryptdll.dll_MD5Update
lea rcx, [rsp + 0x70]
call sub.cryptdll.dll_MD5Final
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x58]
movdqu xmm5, xmmword [rbx + 0x80]
movdqu xmmword [rbp], xmm5
call sub.ADVAPI32.dll_SystemFunction033
test eax, eax
setns sil
test esi, esi
jne 0x14009fddb
lea rcx, str.ERROR_kuhl_m_lsadump_getSamKey___RtlDecryptData2_KO
call fcn.14000c020
jmp 0x14009fddb
lea rcx, str.ERROR_kuhl_m_lsadump_getSamKey___Unknow_F_revision___hu_
call fcn.14000c020
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14009fdf2
lea rcx, str.ERROR_kuhl_m_lsadump_getSamKey___kull_m_registry_OpenAndQueryWithAlloc_KO
call fcn.14000c020
test esi, esi
je 0x14009fe04
xor r8d, r8d
mov edx, r13d
mov rcx, rbp
call fcn.140012c94
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.14000c020
lea r11, [rsp + 0xe0]
mov eax, esi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret