uses JwaWinCrypt;

type
  TSessionQuery = record
	Data: string;           // Исходные данные
    Data64: string;         // Исходные данные в Base64
    SignSize: Cardinal;
    Sign: PChar;            // Подпись в двоичном формате
    Sign64: string;         // подпись в Base64
  end;

  TProperCertificate = record
    pCert: PCERT_CONTEXT;
    hProv: HCRYPTPROV;
  end;

procedure SignData(Cert: TProperCertificate; var SessionQuery: TSessionQuery);
var
  SignPara: CRYPT_SIGN_MESSAGE_PARA;
  Error, DataSize: DWORD;
  pbArray, cbArray, pbCert: Pointer;
  pData: array[0..0] of Pointer;
  pSize: array[0..0] of DWORD;
  pCert: array[0..0] of PCERT_CONTEXT;
  S: string;
begin
  DataSize := Length(SessionQuery.Data);
  pData[0] := @SessionQuery.Data;
  pSize[0] := DataSize;
  pCert[0] := Cert.pCert;

  pbArray   := @pData[0];
  cbArray   := @pSize[0];
  pbCert    := @pCert[0];

  ZeroMemory(@SignPara, SizeOf(CRYPT_SIGN_MESSAGE_PARA));
  with SignPara do
  begin
    cbSize := SizeOf(CRYPT_SIGN_MESSAGE_PARA);
    dwMsgEncodingType := X509_ASN_ENCODING or PKCS_7_ASN_ENCODING;
    pSigningCert := Cert.pCert;
    HashAlgorithm.pszObjId := '1.2.643.2.2.9';  //  GOST R 34.11-94
    HashAlgorithm.Parameters.cbData := 0;
    pvHashAuxInfo := nil;
    cMsgCert := 1;
    rgpMsgCert := pbCert;
    cMsgCrl := 0;
    rgpMsgCrl := nil;
    cAuthAttr := 0;
    rgAuthAttr := nil;
    cUnauthAttr := 0;
    rgUnauthAttr := nil;
    dwFlags := 0;
    dwInnerContentType := 0;
  end;

  if not CryptSignMessage(@SignPara, False, 1, pbArray, cbArray, nil, SessionQuery.SignSize) then {...} ;
  
  GetMem(SessionQuery.Sign, SessionQuery.SignSize);

  if not CryptSignMessage(@SignPara, False, 1, pbArray, cbArray, PByte(SessionQuery.Sign), SessionQuery.SignSize) then {...} ;

  SetLength(S, SessionQuery.SignSize);
  Move(SessionQuery.Sign^, S[1], SessionQuery.SignSize);
  SessionQuery.Sign64 := EncodeString(S);
end;