Function at 0x1400044fc
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov dword [rax + 0x20], r9d
mov qword [rax + 0x10], rdx
mov dword [rax + 8], ecx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
xor edi, edi
mov r14d, r8d
mov r12d, edi
call fcn.140012d04
mov qword [rbp - 0x10], rax
mov rbx, rax
test rax, rax
je 0x140004791
mov r15, qword [rbp + 0x68]
lea r9d, [rdi + 0x18]
mov rcx, r15
mov dword [rsp + 0x20], 8
xor r8d, r8d
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140004788
mov rcx, qword [r15]
lea r9, [rbp - 0x18]
lea edx, [rdi + 1]
mov qword [rbp - 0x18], rdi
mov r8d, 0x2000001
call qword [sym.imp.ADVAPI32.dll_CryptGenKey]
test eax, eax
je 0x14000476c
mov rcx, qword [rbp - 0x18]
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
lea esi, [rdi + 7]
mov r8d, esi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptExportKey]
test eax, eax
je 0x14000476c
mov edx, dword [rbp - 0x20]
lea ecx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r13, rax
test rax, rax
je 0x14000476c
mov rcx, qword [rbp - 0x18]
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov r8d, esi
mov qword [rsp + 0x20], r13
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptExportKey]
test eax, eax
je 0x140004763
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov qword [rbp - 0x18], rdi
xor edx, edx
mov ebx, dword [r13 + 0xc]
shr ebx, 3
mov eax, ebx
mov dword [r13 + 0x10], 1
shr eax, 1
dec eax
lea esi, [rbx + rbx]
mov r8d, eax
add rsi, 0x14
mov edi, eax
add rsi, r13
lea rcx, [rsi + 1]
mov byte [rsi], 1
call sub.VCRUNTIME140.dll_memset
mov eax, ebx
mov r8d, edi
shr rax, 1
xor edx, edx
add rsi, rax
lea rcx, [rsi + 1]
mov byte [rsi], 1
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbx + 1]
mov byte [rsi + rbx], 1
add rcx, rsi
mov r8d, edi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov r8d, dword [rbp - 0x20]
lea rax, [rbp - 0x18]
mov rcx, qword [r15]
xor edi, edi
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov rdx, r13
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x14000475f
lea edx, [rdi + 0x4c]
lea ecx, [rdi + 0x40]
mov dword [rbp - 0x20], edx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x14000475f
lea rdx, [rbx + 8]
mov dword [rax], 0x201
mov eax, dword [rbp + 0x40]
mov r8d, edi
mov dword [rdx], 0xa400
add rdx, 4
mov dword [rbx + 4], eax
test r14d, r14d
je 0x1400046e7
mov r10, qword [rbp + 0x48]
mov r9, rdx
mov eax, r14d
sub eax, r8d
inc r8d
dec eax
mov cl, byte [rax + r10]
mov byte [r9], cl
inc r9
cmp r8d, r14d
jb 0x1400046cd
mov r8d, dword [rbp - 0x20]
lea ecx, [r14 + 1]
mov eax, r8d
add rdx, rcx
sub rax, r14
mov r9d, edi
cmp rax, 0xf
je 0x140004727
mov rcx, rdi
cmp byte [rcx + rdx], dil
jne 0x140004712
mov byte [rcx + rdx], Ordinal_69
mov r8d, dword [rbp - 0x20]
inc r9d
mov eax, r8d
sub rax, r14
mov ecx, r9d
sub rax, 0xf
cmp rcx, rax
jb 0x140004704
lea eax, [r8 - 2]
mov rdx, rbx
mov byte [rax + rbx], 2
mov rax, qword [rbp + 0x60]
mov r9, qword [rbp - 0x18]
mov r8d, dword [rbp - 0x20]
mov rcx, qword [r15]
mov qword [rsp + 0x28], rax
mov eax, dword [rbp + 0x58]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov rcx, rbx
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbx, qword [rbp - 0x10]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x14000477b
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
test r12d, r12d
jne 0x140004788
mov rcx, qword [r15]
call fcn.140003c00
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbx, qword [rsp + 0xa0]
mov eax, r12d
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret