Function at 0x1400e2abc
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
xor eax, eax
xor r14d, r14d
or ebx, 0xffffffff
mov byte [r11 - 0x58], r14b
mov qword [r11 - 0x57], rax
lea ebp, [rax + 1]
mov edi, edx
mov dword [rsp + 0x59], eax
mov word [rsp + 0x5d], ax
mov dword [r11 + 0x10], ebp
mov byte [rsp + 0x5f], al
mov dword [r11 - 0x70], r14d
mov dword [r11 + 8], ecx
mov byte [r11 + 0x18], r14b
mov word [r11 + 0x19], ax
mov byte [r11 + 0x1b], al
mov dword [r11 - 0x78], r14d
mov dword [r11 - 0x74], r14d
mov dword [r11 + 0x20], r14d
lea esi, [rax + 4]
mov r12, 0xffffffff80000002
test dl, 0x10
je 0x1400e2b2d
mov ebx, r14d
jmp 0x1400e2fe9
lea rax, [rsp + 0xb8]
lea r9, [rsp + 0x30]
lea r8, str.DEVIAutoDisverify
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc8]
lea rdx, str.SOFTWAREPELOGON
mov rcx, r12
and edi, 0xffffffef
mov dword [rsp + 0xb8], esi
mov qword [rsp + 0x20], rax
call qword [0x14013cd48]
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
lea r8, str.Policy
lea rdx, str.SOFTWAREMicrosoftDriver_Signing
mov rcx, r12
mov qword [rsp + 0x20], rax
mov dword [rsp + 0xb8], esi
call qword [0x14013cd48]
lea r15, [0x14013d130]
cmp eax, r14d
jne 0x1400e2c10
mov ebx, dword [rsp + 0x34]
cmp ebx, dword [rsp + 0xb0]
jne 0x1400e2bf6
mov eax, dword [rsp + 0xc8]
lea r8, [0x14012ae38]
lea rdx, [0x14012ae08]
mov r9d, edi
mov rcx, r15
mov dword [rsp + 0x20], eax
call fcn.140018dd8
cmp edi, r14d
jne 0x1400e2bf6
cmp dword [rsp + 0xc8], ebp
je 0x1400e3024
mov r12d, dword [rsp + 0x30]
cmp r12d, esi
je 0x1400e2c06
cmp r12d, 3
jne 0x1400e2c10
mov r13d, dword [rsp + 0xb8]
jmp 0x1400e2c1e
mov r12d, 3
mov r13d, ebp
mov dword [rsp + 0x30], r12d
lea rax, [rsp + 0xb8]
lea r9, [rsp + 0x30]
lea r8, str.seed
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
lea rdx, str.SystemWPAPnP
mov rcx, 0xffffffff80000002
mov dword [rsp + 0xb8], esi
mov qword [rsp + 0x20], rax
call qword [0x14013cd48]
lea rcx, [rsp + 0x40]
mov r9d, ebp
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], r14
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov edi, eax
cmp eax, r14d
jne 0x1400e2cf5
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Err_1
xor r9d, r9d
mov rcx, r15
mov r8d, eax
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call fcn.140025f80
cmp dword [rsp + 0xb0], r14d
je 0x1400e2ce8
mov rcx, qword [rsp + 0x40]
bts ebx, 0xc
cmp rcx, r14
je 0x1400e2cca
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x40], r14
cmp rcx, r14
je 0x1400e3024
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x1400e3024
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1400e2e8e
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8003
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov ebp, 2
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp edi, r14d
jne 0x1400e2d66
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Err_2
xor r9d, r9d
mov r8d, eax
mov rcx, r15
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call fcn.140025f80
mov rcx, qword [rsp + 0x40]
cmp dword [rsp + 0xb0], r14d
je 0x1400e2e93
jmp 0x1400e2cb9
mov al, byte [rsp + 0xb0]
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
lea r8d, [r9 + 4]
lea rdx, [rsp + 0xc0]
mov byte [rsp + 0xc0], r14b
mov byte [rsp + 0xc1], al
mov byte [rsp + 0xc2], r14b
mov byte [rsp + 0xc3], r14b
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov ebp, 3
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp edi, r14d
jne 0x1400e2dcc
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Err_3
jmp 0x1400e2d36
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
lea rdx, [rsp + 0x38]
lea esi, [r9 + 4]
mov r8d, esi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov ebp, esi
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp edi, r14d
jne 0x1400e2e09
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Err_4
jmp 0x1400e2d36
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0xb8]
lea r8, [rsp + 0x50]
mov edx, 2
mov dword [rsp + 0xb8], 0x10
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov ebp, 5
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp edi, r14d
jne 0x1400e2e5c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Err_5
jmp 0x1400e2d36
lea rax, [rsp + 0x50]
lea r8, str.PrivateHash
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionSetup
mov r9d, 3
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x10
mov qword [rsp + 0x20], rax
call fcn.14005c2f4
mov rcx, qword [rsp + 0x40]
cmp rcx, r14
je 0x1400e2ea0
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x40], r14
cmp rcx, r14
je 0x1400e2eb5
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
lea rax, [rsp + 0xb0]
lea r8, str.Policy
lea rdx, str.SoftwareMicrosoftDriver_Signing
mov r9d, r12d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call fcn.14005c2f4
lea rax, [rsp + 0xb0]
lea r8, str.Policy
lea rdx, str.SoftwareMicrosoftNon_Driver_Signing
mov r9d, r12d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call fcn.14005c2f4
lea rax, [rsp + 0xb0]
lea r8, str.Policy
lea rdx, str.SoftwareMicrosoftDriver_Signing
mov r9d, r12d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call fcn.14005c2f4
mov r13d, 7
mov r12d, eax
cmp edi, r14d
je 0x1400e2f5b
mov ebp, r13d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp r12d, r14d
jne 0x1400e2f9a
cmp edi, r14d
je 0x1400e2f87
cmp dword [rsp + 0xb0], r14d
jne 0x1400e2fd1
lea r8, [0x14012ac60]
lea rdx, [0x14012ac40]
mov rcx, r15
call fcn.140018dd8
jmp 0x1400e2fd1
cmp dword [rsp + 0xb0], r14d
jne 0x1400e2fd1
lea r8, [0x14012ac30]
jmp 0x1400e2fbb
cmp edi, r14d
je 0x1400e2faa
mov ebp, r13d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp dword [rsp + 0xb0], r14d
jne 0x1400e2fd1
lea r8, str.Err_
lea rdx, [0x14012abf0]
mov r9d, ebp
mov rcx, r15
mov dword [rsp + 0x20], esi
call fcn.140018dd8
mov ebp, 1
cmp dword [rsp + 0xc8], ebp
je 0x1400e3024
lea esi, [rbp + 3]
mov r12, 0xffffffff80000002
cmp dword [rsp + 0xb0], r14d
jne 0x1400e3024
lea rax, [rsp + 0xc8]
lea r8, str.DEVIAutoDisverify
lea rdx, str.SoftwarePELOGON
mov r9d, esi
mov rcx, r12
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0xc8], ebp
call fcn.14005c2f4
mov eax, ebx
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret