Function at 0x140023144
Capabilities:
Hash data via bcrypt

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xa8
xor esi, esi
lea rcx, [rbp - 0x11]
mov qword [rbp - 0x31], rsi
mov r13d, esi
mov qword [rbp - 0x21], rsi
mov r15d, esi
mov dword [rbp + 0x6f], esi
mov r14d, esi
mov edi, esi
mov qword [rbp - 0x39], rsi
mov qword [0x1400522f8], rsi
call fcn.140023ff0
mov ebx, eax
test eax, eax
js 0x1400232ae
mov rcx, qword [0x140052058]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], si
jne 0x14002319e
mov rcx, qword [0x140052050]
lea eax, [rax*2 + 0x40]
mov edx, eax
mov dword [rbp + 0x77], eax
xor r8d, r8d
call fcn.140014c70
mov rcx, qword [0x140052050]
mov r12d, 0x800
mov edx, r12d
mov qword [rbp - 0x49], rax
xor r8d, r8d
mov rbx, rax
call fcn.140014c70
mov rcx, qword [0x140052050]
xor r8d, r8d
mov edx, r12d
mov rsi, rax
call fcn.140014c70
mov r12, rax
xor eax, eax
test rbx, rbx
je 0x140023c39
test rsi, rsi
je 0x140023c39
test r12, r12
je 0x140023c39
mov edx, dword [rbp + 0x77]
mov rcx, rbx
mov r9, qword [0x140052058]
mov r8, qword [0x140051ee8]
call fcn.1400038d4
xor eax, eax
lea rcx, [rbp - 0x31]
mov dword [rsp + 0x30], eax
xor r9d, r9d
mov eax, 1
mov r8d, 0x120089
mov dword [rsp + 0x28], eax
mov rdx, rbx
mov dword [rsp + 0x20], eax
call fcn.14000edac
test eax, eax
jns 0x1400232f1
mov ebx, 0xc0000225
mov rcx, qword [rbp - 0x49]
mov edx, dword [rbp + 0x77]
call fcn.14000e2f4
test rsi, rsi
je 0x140023282
mov edx, 0x800
mov rcx, rsi
call fcn.14000e2f4
test r12, r12
je 0x140023294
mov edx, 0x800
mov rcx, r12
call fcn.14000e2f4
test r14, r14
je 0x1400232a1
mov rcx, r14
call fcn.140014d0c
test rdi, rdi
je 0x1400232ae
mov rcx, rdi
call fcn.140014d0c
lea rcx, [rbp - 0x11]
call fcn.140023fa4
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x1400232cb
mov edx, 0x7668704b
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
test r15, r15
je 0x1400232db
mov edx, r13d
mov rcx, r15
call fcn.14000e2f4
mov eax, ebx
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rcx, qword [rbp - 0x31]
xor edx, edx
call fcn.14000efa0
mov ebx, eax
test eax, eax
js 0x140023264
mov rcx, qword [rbp - 0x31]
lea r8, [rbp + 0x6f]
mov rdx, rsi
call fcn.140004bd4
test eax, eax
js 0x140023580
lfence
mov edx, 0x3a
mov rcx, rsi
call sub.ntoskrnl.exe_wcschr
xor edx, edx
test rax, rax
je 0x140023580
cmp rax, rsi
je 0x140023580
lea rbx, [rax + 2]
lea r8d, [rdx + 0x20]
jbe 0x140023363
mov rcx, rax
sub rax, 2
cmp word [rax], r8w
ja 0x140023360
cmp rax, rsi
ja 0x14002334c
jmp 0x140023363
mov rax, rcx
mov word [rax], dx
jmp 0x140023375
test ax, ax
je 0x140023580
add rbx, 2
movzx eax, word [rbx]
cmp ax, r8w
jbe 0x140023368
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], dx
jne 0x140023382
lea rax, [rbx + rax*2]
jmp 0x14002339e
mov rcx, rax
sub rax, 2
cmp word [rax], r8w
ja 0x1400233a5
cmp rax, rbx
ja 0x140023391
jmp 0x1400233a8
mov rax, rcx
mov word [rax], dx
lea rcx, [0x14002df50]
mov rdx, rsi
call sub.ntoskrnl.exe__wcsicmp
xor ecx, ecx
test eax, eax
jne 0x140023400
test r15, r15
jne 0x140023400
mov rcx, rbx
call fcn.140024204
mov rcx, qword [0x140052050]
xor r8d, r8d
mov edx, eax
mov r13, rax
call fcn.140014c70
mov r15, rax
test rax, rax
je 0x1400235b3
mov r8d, r13d
mov rdx, rax
mov rcx, rbx
call fcn.1400240a0
jmp 0x140023568
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], cx
jne 0x140023404
add eax, eax
lea r8, [rbp + 0x67]
mov r9, rsi
mov dword [rsp + 0x20], eax
mov edx, 0x800
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_RtlUnicodeToUTF8N]
xor ecx, ecx
test eax, eax
js 0x140023446
lfence
mov r8d, dword [rbp + 0x67]
xor r9d, r9d
mov rcx, qword [rbp - 9]
mov rdx, r12
call sub.ksecdd.sys_BCryptHashData
xor ecx, ecx
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], cx
jne 0x14002344a
add eax, eax
lea r8, [rbp + 0x67]
mov r9, rbx
mov dword [rsp + 0x20], eax
mov edx, 0x800
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_RtlUnicodeToUTF8N]
test eax, eax
js 0x140023488
lfence
mov r8d, dword [rbp + 0x67]
xor r9d, r9d
mov rcx, qword [rbp - 9]
mov rdx, r12
call sub.ksecdd.sys_BCryptHashData
mov rdx, rsi
lea rcx, [0x14002df70]
call sub.ntoskrnl.exe__wcsicmp
xor ecx, ecx
test eax, eax
jne 0x1400234b4
cmp qword [rbp - 0x39], rcx
jne 0x1400234b4
lea rdx, [rbp - 0x39]
mov rcx, rbx
call fcn.140022f58
jmp 0x140023568
mov rdx, rsi
lea rcx, [0x14002df80]
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
jne 0x140023513
test r14, r14
jne 0x140023513
lea edx, [rax + 0x2d]
mov rcx, rbx
call sub.ntoskrnl.exe_wcschr
xor ecx, ecx
test rax, rax
je 0x1400234fc
mov word [rax], cx
test rdi, rdi
jne 0x1400234fc
mov rcx, qword [0x140052050]
lea rdx, [rax + 2]
xor r8d, r8d
call fcn.140014c78
mov rdi, rax
mov rcx, qword [0x140052050]
xor r8d, r8d
mov rdx, rbx
call fcn.140014c78
mov r14, rax
jmp 0x140023568
mov rdx, rsi
lea rcx, [0x14002df90]
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
jne 0x140023542
test rdi, rdi
jne 0x140023542
mov rcx, qword [0x140052050]
xor r8d, r8d
mov rdx, rbx
call fcn.140014c78
mov rdi, rax
jmp 0x140023568
mov rdx, rsi
lea rcx, [0x14002dfa0]
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
jne 0x140023568
lea rdx, [0x14002dfc0]
mov rcx, rbx
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
jne 0x1400235bd
mov rcx, qword [rbp - 0x31]
lea r8, [rbp + 0x6f]
mov rdx, rsi
call fcn.140004bd4
test eax, eax
jns 0x140023321
mov rcx, qword [rbp - 0x31]
call fcn.14000ed04
lea r8, [rbp + 0x7f]
lea rdx, [rbp - 0x21]
lea rcx, [rbp - 0x11]
call fcn.140023eec
mov ebx, eax
test eax, eax
js 0x140023264
test r15, r15
jne 0x1400235c7
mov ebx, 0xc0000079
jmp 0x140023264
mov ebx, 0xc000009a
jmp 0x140023264
mov ebx, 0xc0000024
jmp 0x140023264
mov edx, dword [rbp + 0x7f]
mov r9d, r13d
mov rcx, qword [rbp - 0x21]
mov r8, r15
call fcn.140023e0c
mov ebx, eax
xor eax, eax
test ebx, ebx
js 0x140023264
or dword [0x1400522f8], 1
lea rcx, [rbp - 0x29]
xorps xmm0, xmm0
mov qword [rbp - 0x29], rax
movups xmmword [rbp + 7], xmm0
call fcn.140022cdc
movabs rax, 0xfffff78000000014
lea rdx, [rbp - 0x41]
lea rcx, [rbp - 0x19]
mov rax, qword [rax]
mov qword [rbp - 0x19], rax
call qword [sym.imp.ntoskrnl.exe_ExSystemTimeToLocalTime]
xor eax, eax
test r14, r14
jne 0x140023634
test rdi, rdi
je 0x140023bd6
mov r14, rdi
mov edi, eax
lfence
lea rdx, [0x14002dfe0]
mov rcx, r14
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
je 0x140023264
test r14, r14
je 0x140023933
lfence
lea rdx, [0x14002e000]
mov rcx, r14
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
jne 0x140023805
mov r10d, dword [0x1400522f8]
or r10d, 8
mov dword [0x1400522f8], r10d
test rdi, rdi
je 0x140023771
lfence
mov rcx, rdi
call sub.ntoskrnl.exe__wtoi
movsx rcx, ax
movabs rax, 0x1792f8648000
imul rcx, rax
add rcx, qword [rbp - 0x39]
cmp rcx, qword [rbp - 0x41]
jge 0x1400236ba
or dword [0x1400522f8], 2
mov rcx, rdi
call sub.ntoskrnl.exe__wtoi
movsx rcx, ax
movabs rax, 0x1792f8648000
imul rcx, rax
movabs rax, 0xd6bf94d5e57a42bd
sub rcx, qword [rbp - 0x41]
add rcx, qword [rbp - 0x39]
imul rcx
add rdx, rcx
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov eax, dword [0x1400522f8]
mov dword [0x1400522fc], edx
test al, 2
je 0x140023264
lfence
mov rcx, rdi
call sub.ntoskrnl.exe__wtoi
cmp ax, 3
jl 0x140023750
lfence
mov rcx, rdi
call sub.ntoskrnl.exe__wtoi
inc ax
movsx rcx, ax
movabs rax, 0x1792f8648000
imul rcx, rax
add rcx, qword [rbp - 0x39]
cmp rcx, qword [rbp - 0x41]
jl 0x140023750
or dword [0x1400522f8], 0x20
mov eax, dword [0x1400522f8]
test al, 0x20
jne 0x140023264
and eax, 0xfffffffe
mov dword [0x1400522f8], eax
mov ebx, 0xc0000193
jmp 0x140023264
mov rcx, qword [rbp - 0x39]
movabs rdx, 0x11ed178c6c000
mov r8, qword [rbp - 0x41]
lea rax, [rcx + rdx]
cmp rax, r8
jge 0x140023797
or r10d, 2
mov dword [0x1400522f8], r10d
mov r9, rcx
movabs rax, 0xd6bf94d5e57a42bd
sub r9, r8
add r9, rdx
imul r9
add rdx, r9
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov dword [0x1400522fc], edx
test r10b, 2
je 0x140023264
movabs rax, 0x13664712b4000
add rax, rcx
cmp rax, r8
jl 0x1400237eb
or r10d, 0x20
mov dword [0x1400522f8], r10d
test r10b, 0x20
jne 0x140023264
and r10d, 0xfffffffe
mov dword [0x1400522f8], r10d
jmp 0x140023767
lfence
lea rdx, [0x14002e020]
mov rcx, r14
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
jne 0x140023933
mov r8d, dword [0x1400522f8]
or r8d, 0x10
mov dword [0x1400522f8], r8d
test rdi, rdi
je 0x1400238c1
lfence
mov rcx, rdi
call sub.ntoskrnl.exe__wtoi
movsx rcx, ax
movabs rax, 0xc92a69c000
imul rcx, rax
add rcx, qword [rbp - 0x39]
cmp rcx, qword [rbp - 0x41]
jge 0x140023868
or dword [0x1400522f8], 2
mov rcx, rdi
call sub.ntoskrnl.exe__wtoi
movsx rcx, ax
movabs rax, 0xc92a69c000
imul rcx, rax
sub rcx, qword [rbp - 0x41]
add rcx, qword [rbp - 0x39]
movabs rax, 0xd6bf94d5e57a42bd
imul rcx
add rdx, rcx
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov eax, dword [0x1400522f8]
mov dword [0x1400522fc], edx
test al, 2
je 0x140023264
jmp 0x140023756
mov rcx, qword [rbp - 0x39]
movabs rdx, 0x3edd410c000
lea rax, [rcx + rdx]
cmp rax, qword [rbp - 0x41]
jge 0x1400238e4
or r8d, 2
mov dword [0x1400522f8], r8d
sub rcx, qword [rbp - 0x41]
movabs rax, 0xd6bf94d5e57a42bd
add rcx, rdx
imul rcx
add rdx, rcx
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov dword [0x1400522fc], edx
test r8b, 2
je 0x140023264
test r8b, 0x20
jne 0x140023264
and r8d, 0xfffffffe
mov dword [0x1400522f8], r8d
jmp 0x140023767
test rdi, rdi
je 0x140023bd6
lfence
lea rdx, [0x14002e040]
mov rcx, rdi
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
je 0x140023264
lfence
lea rdx, [0x14002e050]
mov rcx, rdi
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
jne 0x1400239d1
lea edx, [rax + 4]
mov r8d, 0x7e6
lea ecx, [rax + 1]
call fcn.140022d10
mov rcx, qword [rbp - 0x39]
cmp rcx, rax
jge 0x1400239d1
movabs rdx, 0x23da2f18d8000
lea rax, [rcx + rdx]
cmp rax, qword [rbp - 0x41]
jge 0x1400239a1
or dword [0x1400522f8], 2
sub rcx, qword [rbp - 0x41]
movabs rax, 0xd6bf94d5e57a42bd
add rcx, rdx
imul rcx
add rdx, rcx
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov dword [0x1400522fc], edx
jmp 0x140023264
lfence
lea rdx, [0x14002e050]
mov rcx, rdi
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
jne 0x140023a85
mov rcx, qword [rbp - 0x39]
movabs rdx, 0x23da2f18d8000
mov r8, qword [rbp - 0x41]
lea r10, [rcx + rdx]
cmp r10, r8
jge 0x140023a0d
or dword [0x1400522f8], 2
mov r9, rcx
movabs rax, 0xd6bf94d5e57a42bd
sub r9, r8
add r9, rdx
imul r9
add rdx, r9
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov dword [0x1400522fc], edx
cmp r10, qword [rbp - 0x29]
jge 0x140023264
mov edx, dword [0x1400522f8]
movabs rax, 0x25535e9f20000
or edx, 4
mov dword [0x1400522f8], edx
add rax, rcx
cmp rax, r8
jl 0x140023a6e
or edx, 0x20
mov dword [0x1400522f8], edx
test dl, 0x20
jne 0x140023264
and edx, 0xfffffffe
mov dword [0x1400522f8], edx
jmp 0x140023767
lfence
lea rdx, [0x14002e060]
mov rcx, rdi
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
jne 0x140023b12
mov rcx, qword [rbp - 0x39]
movabs rdx, 0x11ed178c6c000
mov r8, qword [rbp - 0x41]
lea r10, [rcx + rdx]
cmp r10, r8
jge 0x140023abd
or dword [0x1400522f8], 2
mov r9, rcx
movabs rax, 0xd6bf94d5e57a42bd
sub r9, r8
add r9, rdx
imul r9
add rdx, r9
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov dword [0x1400522fc], edx
cmp r10, qword [rbp - 0x29]
jge 0x140023264
mov edx, dword [0x1400522f8]
or edx, 4
mov dword [0x1400522f8], edx
movabs rax, 0x13664712b4000
jmp 0x140023a5d
lfence
lea rdx, [0x14002e070]
mov rcx, rdi
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
jne 0x140023b53
mov rcx, qword [rbp - 0x39]
movabs rdx, 0x3edd410c000
lea rax, [rcx + rdx]
cmp rax, qword [rbp - 0x41]
jge 0x140023b47
or dword [0x1400522f8], 2
sub rcx, qword [rbp - 0x41]
add rcx, rdx
jmp 0x14002388a
lfence
lea rdx, [0x14002e080]
mov rcx, rdi
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
jne 0x140023bd6
mov rcx, qword [rbp - 0x39]
movabs rdx, 0x46b8e92d8000
mov r8, qword [rbp - 0x41]
lea rax, [rcx + rdx]
cmp rax, r8
jge 0x140023b8b
or dword [0x1400522f8], 2
mov r9, rcx
movabs rax, 0xd6bf94d5e57a42bd
sub r9, r8
add r9, rdx
imul r9
add rdx, r9
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov dword [0x1400522fc], edx
mov edx, dword [0x1400522f8]
test dl, 2
je 0x140023264
movabs rax, 0x5e4be1920000
jmp 0x140023a5d
mov rcx, qword [rbp - 0x39]
movabs rdx, 0x11ed178c6c000
mov r8, qword [rbp - 0x41]
lea rax, [rcx + rdx]
cmp rax, r8
jge 0x140023bf8
or dword [0x1400522f8], 2
mov r9, rcx
movabs rax, 0xd6bf94d5e57a42bd
sub r9, r8
add r9, rdx
imul r9
add rdx, r9
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov dword [0x1400522fc], edx
mov edx, dword [0x1400522f8]
test dl, 2
je 0x140023264
jmp 0x140023b03
mov rcx, qword [rbp - 0x49]
mov ebx, 0xc000009a
test rcx, rcx
je 0x140023270
jmp 0x140023268