Function at 0x1400c9858
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
xor edi, edi
mov rbp, r9
mov ebx, r8d
mov r12, rdx
mov r13, rcx
mov qword [rax - 0x70], rdi
cmp r8d, 0xffffcfc7
jne 0x1400c9a87
lea rdx, [0x140109cac]
or r8, 0xffffffffffffffff
mov rcx, r9
call fcn.14005bdb8
lea esi, [rdi + 1]
lea rcx, [rsp + 0x60]
mov edx, 0x1c00
mov r14d, esi
mov r12d, esi
mov ebx, edi
mov dword [rsp + 0x6c], 0x400
call fcn.14005bc8c
mov r11, qword [rsp + 0x60]
lea rcx, [rsp + 0x58]
lea r15, [r11 + 0x1400]
lea rax, [r11 + 0x1800]
mov qword [rsp + 0x28], rcx
lea r13, [r11 + 0x1000]
xor ecx, ecx
mov qword [rsp + 0x88], r15
mov qword [rsp + 0x70], rax
jmp 0x1400c992d
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov ecx, ebx
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_CryptEnumProviderTypesW]
lea rax, [rsp + 0x58]
add ebx, esi
mov qword [rsp + 0x28], rax
mov ecx, ebx
lea r9, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_CryptEnumProviderTypesW]
xor edx, edx
cmp eax, edi
jne 0x1400c9900
lea rcx, [rsp + 0x80]
mov r9d, esi
xor r8d, r8d
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
cmp eax, edi
je 0x1400c9a76
mov rcx, qword [rsp + 0x80]
lea r9, [rsp + 0x6c]
mov r8, r15
mov edx, esi
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_CryptGetProvParam]
cmp eax, edi
je 0x1400c9a58
mov r14d, dword [r15]
mov rcx, qword [rsp + 0x70]
lea rdx, [r15 + 4]
mov r13d, dword [rdx + 4]
mov r15d, dword [rdx]
mov eax, 0x63
cmp r13d, eax
cmovb eax, r13d
add rdx, 8
mov r8d, eax
mov ebx, eax
call fcn.1400e4d20
mov rdx, qword [rsp + 0x70]
mov ecx, r14d
and ecx, 0xe000
mov byte [rbx + rdx], dil
cmp ecx, 0x2000
je 0x1400c9a10
cmp ecx, 0x6000
je 0x1400c9a07
cmp ecx, 0x8000
je 0x1400c99fe
lea rax, [0x140109ca4]
lea r8, [0x140109c9c]
cmp ecx, 0xa000
cmove rax, r8
jmp 0x1400c9a17
lea rax, [0x140109c94]
jmp 0x1400c9a17
lea rax, [0x140109c8c]
jmp 0x1400c9a17
lea rax, [0x140109c84]
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rdx
lea rdx, str._8.8xh___4d___4s___4d___s_r_n
mov r9d, r15d
mov r8d, r14d
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov rdx, qword [rsp + 0x60]
mov rcx, rbp
call fcn.14005bd40
mov r15, qword [rsp + 0x88]
mov r14d, edi
jmp 0x1400c9a5b
mov r12d, edi
cmp r12d, edi
jne 0x1400c9968
mov rcx, qword [rsp + 0x80]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov esi, edi
lea rcx, [rsp + 0x60]
call fcn.140054110
mov eax, esi
jmp 0x1400c9bfb
mov esi, 1
lea r8, str.Microsoft_Base_Cryptographic_Provider_v1.0
lea rcx, [rsp + 0x48]
xor edx, edx
mov r9d, esi
mov dword [rsp + 0xd0], 4
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
cmp eax, edi
jne 0x1400c9ac5
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400c9bfb
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
cmp eax, edi
jne 0x1400c9b02
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, ebx
jmp 0x1400c9bfb
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov r8d, r12d
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
cmp eax, edi
jne 0x1400c9b2f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x40]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x1400c9aee
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0xd0]
lea r8, [rsp + 0x54]
mov edx, 4
mov dword [rsp + 0xd0], 4
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov edx, dword [rsp + 0x54]
lea rcx, [rsp + 0x78]
call fcn.14005bc8c
mov rbx, qword [rsp + 0x78]
mov eax, dword [rsp + 0x54]
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0xd0]
mov r8, rbx
mov edx, 2
mov dword [rsp + 0xd0], eax
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
lea rdx, [0x1400fcf30]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [rsp + 0xd0], edi
jbe 0x1400c9bd7
movzx r8d, byte [rbx]
lea rdx, str._02X
mov rcx, rbp
call qword [sym.imp.USER32.dll_wsprintfA]
add edi, esi
add rbp, 2
add rbx, rsi
cmp edi, dword [rsp + 0xd0]
jb 0x1400c9bb1
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea rcx, [rsp + 0x78]
call fcn.140054110
xor eax, eax
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret