Function at 0x140008dbc
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov r11, rsp
push r15
sub rsp, 0x110
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rdi
mov rax, qword [0x140078790]
xor rax, rsp
mov qword [rsp + 0x100], rax
xor r8d, r8d
lea rdx, str.CDPAgentCerts::DeleteDPAgentCertificate
lea rcx, [r11 - 0x88]
call fcn.14002de00
nop
xor ebx, ebx
lea rax, [0x140051eb4]
mov qword [rsp + 0x20], rax
mov r9d, 0x20000
xor r8d, r8d
xor edx, edx
lea ecx, [rbx + 0xa]
call qword [sym.imp.CRYPT32.dll_CertOpenStore]
mov rdi, rax
test rax, rax
jne 0x140008e5e
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, 0x1fff0000
je 0x140008e47
cmp eax, 0x80000000
jb 0x140008e5e
mov ecx, eax
call fcn.140032390
test eax, eax
je 0x140008e5e
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140032390
lea r15, str.Altus_Local_client_Certificate_Authority
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r15
mov r9d, 0x80004
xor r8d, r8d
mov edx, 0x10001
mov rcx, rdi
call qword [sym.imp.CRYPT32.dll_CertFindCertificateInStore]
test rax, rax
je 0x140008e96
mov rcx, rax
call qword [sym.imp.CRYPT32.dll_CertDeleteCertificateFromStore]
jmp 0x140008e65
xor edx, edx
mov rcx, rdi
call qword [sym.imp.CRYPT32.dll_CertCloseStore]
lea r8, str.DPAgent_certificate_deleted...
xor edx, edx
lea rcx, [rsp + 0x90]
call fcn.140030824
lea rax, str.Root
mov qword [rsp + 0x20], rax
mov r9d, 0x20000
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xa]
call qword [sym.imp.CRYPT32.dll_CertOpenStore]
mov rdi, rax
test rax, rax
jne 0x140008f11
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, 0x1fff0000
je 0x140008efa
cmp eax, 0x80000000
jb 0x140008f11
mov ecx, eax
call fcn.140032390
test eax, eax
je 0x140008f11
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140032390
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r15
mov r9d, 0x80004
xor r8d, r8d
mov edx, 0x10001
mov rcx, rdi
call qword [sym.imp.CRYPT32.dll_CertFindCertificateInStore]
test rax, rax
je 0x140008f42
mov rcx, rax
call qword [sym.imp.CRYPT32.dll_CertDeleteCertificateFromStore]
jmp 0x140008f11
xor edx, edx
mov rcx, rdi
call qword [sym.imp.CRYPT32.dll_CertCloseStore]
lea r8, str.DPAgent_root_certificate_deleted...
xor edx, edx
lea rcx, [rsp + 0x90]
call fcn.140030824
mov qword [rsp + 0x48], rbx
lea rdx, [0x14004f118]
lea rcx, [rsp + 0x58]
call fcn.140003374
nop
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x20], 0x30
mov r9d, 0x18
lea r8, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
mov rdx, qword [rax + 0x10]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x140008fb0
call fcn.140007048
mov edi, eax
jmp 0x140008fb2
mov edi, ebx
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140008fc6
call fcn.140009640
mov qword [rsp + 0x68], rbx
mov r9d, edi
lea r8, str.DPAgent_keyset_deleted..._Error_0x_X
xor edx, edx
lea rcx, [rsp + 0x90]
call fcn.140030824
lea rdx, [0x14004f108]
lea rcx, [rsp + 0x70]
call fcn.140003374
nop
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x20], 0x30
mov r9d, 0x18
lea r8, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
mov rdx, qword [rax + 0x10]
lea rcx, [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x140009027
call fcn.140007048
mov edi, eax
jmp 0x140009029
mov edi, ebx
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x140009043
call fcn.140009640
mov qword [rsp + 0x80], rbx
mov r9d, edi
lea r8, str.DPAgent_root_keyset_deleted..._Error_0x_X
xor edx, edx
lea rcx, [rsp + 0x90]
call fcn.140030824
nop
jmp 0x140009063
mov r8d, ebx
lea rdx, [0x14004ee5e]
lea rcx, [rsp + 0x90]
call fcn.140030b9c
nop
lea rcx, [rsp + 0x90]
call fcn.14002e7a8
mov eax, ebx
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.140033cb0
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop r15
ret