Function at 0x100056400
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd8
mov rax, qword [0x10010f190]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov r15, qword [rsp + 0x148]
mov esi, ecx
xor ecx, ecx
mov rdi, r9
mov rax, r8
mov rbx, rdx
mov r13, rcx
mov qword [rsp + 0x60], rcx
mov rbp, rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], rcx
mov r14, rcx
mov r12, rcx
mov dword [rsp + 0x5c], ecx
mov qword [rsp + 0x78], rdx
cmp esi, 0x10
je 0x100056482
cmp esi, 0x20
je 0x100056482
cmp esi, 0x40
je 0x100056482
mov ebx, 0x8000ffff
mov edx, 0xe2013e
jmp 0x100056a74
cmp rax, rcx
je 0x100056a6a
cmp r9, rcx
je 0x100056a6a
or r13, 0xffffffffffffffff
lea rcx, [rsp + 0x60]
mov rdx, rax
mov r8d, r13d
call fcn.1000b9064
test eax, eax
jne 0x1000564ce
mov r8d, 0x8007000e
xor r9d, r9d
mov edx, 0xec013e
xor ecx, ecx
mov ebx, r8d
call fcn.1000b51b8
mov r13, qword [rsp + 0x60]
jmp 0x100056a7f
lea rcx, [rsp + 0x50]
mov r8d, r13d
mov rdx, rdi
call fcn.1000b9064
test eax, eax
jne 0x100056504
mov r8d, 0x8007000e
xor r9d, r9d
mov edx, 0xf1013e
xor ecx, ecx
mov ebx, r8d
call fcn.1000b51b8
mov r13, qword [rsp + 0x60]
jmp 0x100056a63
mov rbp, qword [rsp + 0x50]
xor eax, eax
mov rcx, r13
mov rdi, rbp
repne scasb al, byte [rdi]
not rcx
lea r14, [rcx - 1]
mov rcx, r13
mov r13, qword [rsp + 0x60]
mov rdi, r13
repne scasb al, byte [rdi]
not rcx
add r14, rcx
cmp r14, 0x10000
jb 0x100056547
mov ebx, 0x80070216
mov edx, 0xf9013e
xor ecx, ecx
jmp 0x100056a74
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
xor edi, edi
mov r12, rax
cmp rax, rdi
jne 0x100056571
mov r8d, 0x8007000e
mov edx, 0xff013e
mov ebx, r8d
xor ecx, ecx
jmp 0x100056a77
cmp r14, rdi
je 0x1000565bc
cmp r14, 0x7fffffff
ja 0x1000565bc
mov edi, 0x7ffffffe
mov r8, r13
mov rdx, r14
sub rdi, r14
sub r8, rax
mov rcx, rax
lea rax, [rdi + rdx]
test rax, rax
je 0x1000565af
mov al, byte [r8 + rcx]
test al, al
je 0x1000565af
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x100056593
xor edi, edi
cmp rdx, rdi
jne 0x1000565b9
dec rcx
mov byte [rcx], dil
mov r8, rbp
mov rdx, r14
mov rcx, r12
call fcn.10005f408
mov edx, edi
lea rax, [rsp + 0x70]
cmp esi, 0x10
mov rcx, rbx
mov qword [rsp + 0x20], rax
setne dl
xor r9d, r9d
xor r8d, r8d
add edx, 0x8003
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
cmp eax, edi
jne 0x100056610
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x10c013e
mov ebx, eax
mov r8d, eax
jmp 0x10005656a
mov rcx, qword [rsp + 0x70]
lea r8d, [r14 - 1]
xor r9d, r9d
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
cmp eax, edi
jne 0x100056641
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x114013e
mov ebx, eax
jmp 0x100056a52
mov rcx, qword [rsp + 0x70]
lea r9, [rsp + 0x5c]
lea r8, [rsp + 0x80]
mov edx, 2
mov dword [rsp + 0x5c], reloc.Cabinet.dll_FDICreate
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp eax, edi
jne 0x100056686
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x11d013e
mov ebx, eax
jmp 0x100056a52
mov eax, dword [rsp + 0x5c]
lea r9, [rsp + 0x80]
mov r8d, 0x64
mov rdx, rbx
mov ecx, esi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], eax
call fcn.1000562cc
mov ebx, eax
cmp eax, edi
je 0x1000566ba
mov edx, 0x128013e
jmp 0x100056a52
mov dword [r15], esi
cmp esi, 0x20
jne 0x10005692f
movdqu xmm0, xmmword [rsp + 0x80]
mov eax, dword [rsp + 0x90]
mov rbx, qword [rsp + 0x78]
xor esi, esi
mov word [rsp + 0xa2], di
lea rdi, [r15 + 8]
movdqu xmmword [rsp + 0xac], xmm0
lea rdx, [rsp + 0xa0]
lea r8d, [rsi + 0x1c]
xor r9d, r9d
mov rcx, rbx
mov qword [rsp + 0x28], rdi
mov byte [rsp + 0xa0], 8
mov byte [rsp + 0xa1], 2
mov dword [rsp + 0xa4], 0x6602
mov dword [rsp + 0xa8], reloc.WLDAP32.dll_Ordinal_16
mov dword [rsp + 0x98], eax
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
cmp eax, esi
jne 0x10005675c
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x14f013e
mov ebx, eax
jmp 0x100056a52
mov rcx, qword [rdi]
xor r9d, r9d
lea r8, [rsp + 0x60]
lea edx, [r9 + 0x13]
mov dword [rsp + 0x60], 0x80
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
cmp eax, esi
jne 0x100056795
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x15b013e
mov ebx, eax
jmp 0x100056a52
mov rcx, qword [rdi]
xor r9d, r9d
lea r8, [rsp + 0x60]
lea edx, [r9 + 4]
mov dword [rsp + 0x60], 1
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
cmp eax, esi
jne 0x1000567ce
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x164013e
mov ebx, eax
jmp 0x100056a52
lea rax, [rsp + 0x68]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8004
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
cmp eax, esi
jne 0x100056808
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x18a013e
mov ebx, eax
jmp 0x100056a52
mov rcx, qword [rsp + 0x68]
lea r8d, [r14 - 1]
xor r9d, r9d
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
xor ebp, ebp
cmp eax, ebp
jne 0x10005683b
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x191013e
mov ebx, eax
jmp 0x100056a52
mov rcx, qword [rsp + 0x68]
xor r9d, r9d
lea rdx, [rsp + 0x58]
lea r8d, [r9 + 1]
mov byte [rsp + 0x58], 1
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
cmp eax, ebp
jne 0x100056873
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x19b013e
mov ebx, eax
jmp 0x100056a52
mov rcx, qword [rsp + 0x68]
lea r9, [rsp + 0x5c]
lea r8, [rsp + 0x80]
mov edx, 2
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp eax, ebp
jne 0x1000568b0
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x1a1013e
mov ebx, eax
jmp 0x100056a52
mov eax, dword [rsp + 0x5c]
mov r8d, 0x64
lea r9, [rsp + 0x80]
lea ecx, [r8 - 0x44]
mov rdx, rbx
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], eax
call fcn.1000562cc
xor r9d, r9d
mov ebx, eax
cmp eax, ebp
je 0x1000568e9
mov edx, 0x1a5013e
jmp 0x100056a55
mov eax, dword [rsp + 0x80]
mov rcx, qword [rdi]
lea r8, [rsp + 0x98]
mov edx, 1
mov dword [rsp + 0x9c], eax
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
xor edi, edi
cmp eax, edi
jne 0x100056a61
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x1ae013e
mov ebx, eax
jmp 0x100056a52
cmp dword [0x10011bd04], edi
je 0x10005699f
movzx ecx, byte [rsp + 0x86]
movzx eax, byte [rsp + 0x87]
movzx edi, byte [rsp + 0x85]
movzx r10d, byte [rsp + 0x84]
movzx r11d, byte [rsp + 0x83]
movzx r9d, byte [rsp + 0x82]
movzx r8d, byte [rsp + 0x81]
movzx edx, byte [rsp + 0x80]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], r10d
lea rcx, [0x100016090]
mov dword [rsp + 0x20], r11d
call fcn.1000b99b0
xor edi, edi
lea rdx, [rsp + 0x80]
lea rcx, [r15 + 0x10]
mov r8d, Ordinal_65
call fcn.1000f1a90
mov ebx, eax
cmp eax, edi
je 0x1000569c6
mov edx, 0x17a013e
jmp 0x100056a52
cmp dword [0x10011bd04], edi
je 0x100056a36
movzx ecx, byte [rsp + 0x8e]
movzx eax, byte [rsp + 0x8f]
movzx edi, byte [rsp + 0x8d]
movzx r10d, byte [rsp + 0x8c]
movzx r11d, byte [rsp + 0x8b]
movzx r9d, byte [rsp + 0x8a]
movzx r8d, byte [rsp + 0x89]
movzx edx, byte [rsp + 0x88]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], r10d
lea rcx, [0x100016120]
mov dword [rsp + 0x20], r11d
call fcn.1000b99b0
xor edi, edi
lea rdx, [rsp + 0x88]
lea rcx, [r15 + 0x10]
call fcn.1000f1a70
mov ebx, eax
cmp eax, edi
je 0x100056a61
mov edx, 0x1c6013e
xor r9d, r9d
mov r8d, eax
xor ecx, ecx
call fcn.1000b51b8
jmp 0x100056a63
mov ebx, edi
mov rbp, qword [rsp + 0x50]
jmp 0x100056a7f
mov ebx, 0x80004003
mov edx, 0xe7013e
mov r8d, ebx
xor r9d, r9d
call fcn.1000b51b8
mov ecx, dword [rsp + 0x5c]
xor eax, eax
lea rdi, [rsp + 0x80]
rep stosb byte [rdi], al
lea rdi, [rsp + 0xa0]
lea ecx, [rax + 0x1c]
rep stosb byte [rdi], al
xor edi, edi
cmp r13, rdi
je 0x100056ab4
mov rcx, r13
call fcn.1000b5624
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp rbp, rdi
je 0x100056ac2
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp r12, rdi
je 0x100056adc
xor eax, eax
mov rdi, r12
mov rcx, r14
rep stosb byte [rdi], al
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor edi, edi
mov rcx, qword [rsp + 0x70]
cmp rcx, rdi
je 0x100056aec
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x68]
cmp rcx, rdi
je 0x100056afc
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, ebx
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1000ef870
add rsp, 0xd8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret