Function at 0x1400a9d40
Capabilities:
Access peb ldr_data
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x860
mov rdi, r8
mov rsi, rcx
mov r8d, 0x800
lea rcx, [rsp + 0x60]
xor edx, edx
movzx ebp, r9b
call fcn.1400c7510
mov rax, qword gs:[0x58]
mov ebx, 4
add rbx, qword [rax]
mov eax, dword [rbx]
cmp dword [0x14013b380], eax
jle 0x1400a9dc7
lea rcx, [0x14013b380]
call fcn.1400c4364
cmp dword [0x14013b380], 0xffffffff
jne 0x1400a9dc7
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, [0x14013b380]
mov qword [0x14013b388], rax
call fcn.1400c4304
mov eax, dword [rbx]
cmp dword [0x14013b390], eax
jle 0x1400a9e0d
lea rcx, [0x14013b390]
call fcn.1400c4364
cmp dword [0x14013b390], 0xffffffff
jne 0x1400a9e0d
mov rcx, qword [0x14013b388]
lea rdx, str.CryptEncrypt
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x14013b390]
mov qword [0x14013b398], rax
call fcn.1400c4304
mov eax, dword [rbx]
cmp dword [0x14013b3a0], eax
jle 0x1400a9e53
lea rcx, [0x14013b3a0]
call fcn.1400c4364
cmp dword [0x14013b3a0], 0xffffffff
jne 0x1400a9e53
mov rcx, qword [0x14013b388]
lea rdx, str.CryptDecrypt
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x14013b3a0]
mov qword [0x14013b3a8], rax
call fcn.1400c4304
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
lea rcx, [rsp + 0x50]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1400a9fef
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x8004
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1400a9fef
xor ebx, ebx
test rdi, rdi
je 0x1400a9ed5
mov rax, qword [rdi]
test rax, rax
je 0x1400a9ed5
mov ecx, ebx
mov edx, ebx
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [rax]
inc ecx
mov word [rsp + rdx*2 + 0x60], ax
mov edx, ecx
mov rax, qword [rdi + rcx*8]
test rax, rax
jne 0x1400a9ec0
lea rcx, [rsp + 0x60]
or rax, 0xffffffffffffffff
nop
cmp word [rcx + rax*2 + 2], bx
lea rax, [rax + 1]
jne 0x1400a9ee0
mov rcx, qword [rsp + 0x40]
lea r8d, [rax + rax]
xor r9d, r9d
lea rdx, [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1400a9fef
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x800
call fcn.1400c7510
mov r9d, dword [rsp + 0x890]
cmp r9d, 0x80
jne 0x1400a9f34
mov ebx, 0x660e
jmp 0x1400a9f44
cmp r9d, 0xc0
setne bl
add ebx, 0x660f
mov r8, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
mov edx, ebx
shl r9d, 0x10
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x1400a9fef
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
test eax, eax
je 0x1400a9fef
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 1]
test bpl, bpl
je 0x1400a9fb6
mov eax, dword [rsp + 0x878]
add eax, 0x10
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x878]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
call qword [0x14013b398]
jmp 0x1400a9fce
lea rax, [rsp + 0x878]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
call qword [0x14013b3a8]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [rsp + 0x878]
jmp 0x1400a9ff1
xor eax, eax
lea r11, [rsp + 0x860]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret