Function at 0x140009c84
Capabilities:
Hash data via wincrypt

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov qword [rbp - 0x11], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rsi, rdx
mov r15, rcx
xor r13d, r13d
mov dword [rbp - 0x59], r13d
mov edx, 0x1fd
lea rcx, [rbp - 0x51]
call fcn.1400025c4
nop
mov rdi, qword [rsi + 0x10]
mov rbx, qword [rsi + 0x18]
sub rbx, rdi
mov rcx, qword [rbp - 0x49]
jne 0x140009e5b
mov rax, qword [rbp - 0x41]
lea rdx, [0x1400168f8]
mov qword [rbp - 0x31], rdx
lea rdx, [0x140016c68]
mov qword [rbp - 0x31], rdx
mov qword [rbp - 0x29], rcx
mov qword [rbp - 0x21], rax
mov qword [rbp - 0x19], rcx
lea rax, [rbp - 0x31]
mov qword [rbp - 0x69], rax
lea edi, [r13 + 1]
mov dword [rbp - 0x61], edi
mov al, byte [rsi + 0x30]
mov byte [rbp + 0x67], al
mov ebx, r13d
mov rax, qword [rbp - 0x31]
mov r8, rdi
sub r8, rbx
lea rdx, [rbp + 0x67]
add rdx, rbx
lea rcx, [rbp - 0x31]
call qword [rax + 0x40]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140009d48
add rbx, rax
cmp rbx, rdi
jb 0x140009d1e
mov word [rbp + 0x67], r13w
lea rdx, [rbp + 0x67]
lea rcx, [rbp - 0x69]
call fcn.1400066e8
movzx eax, word [rsi + 0x32]
mov word [rbp + 0x67], ax
lea rdx, [rbp + 0x67]
lea rcx, [rbp - 0x69]
call fcn.1400066e8
mov dword [rbp + 0x67], r13d
lea rdx, [rbp + 0x67]
lea rcx, [rbp - 0x69]
call fcn.140006768
mov rax, qword [rsi + 0x48]
sub ax, word [rsi + 0x40]
mov word [rbp + 0x67], ax
lea rdx, [rbp + 0x67]
lea rcx, [rbp - 0x69]
call fcn.1400066e8
mov r14, qword [rsi + 0x48]
mov r12, qword [rsi + 0x40]
sub r14, r12
mov rbx, r13
mov rax, qword [rbp - 0x31]
mov r8, r14
sub r8, rbx
lea rdx, [r12 + rbx]
lea rcx, [rbp - 0x31]
call qword [rax + 0x40]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140009dce
add rbx, rax
cmp rbx, r14
jb 0x140009da7
mov r8d, dword [rbp - 0x41]
mov rdx, qword [rbp - 0x49]
sub r8d, edx
xor r9d, r9d
mov rcx, qword [r15 + 0xd0]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
nop
mov qword [rbp + 0x67], r13
lea r9, [rbp + 0x67]
xor r8d, r8d
xor edx, edx
mov rcx, qword [r15 + 0xd0]
call qword [sym.imp.ADVAPI32.dll_CryptDuplicateHash]
mov dword [rbp - 0x59], edi
lea rdx, [rbp + 0x17]
lea rcx, [rbp + 0x67]
call fcn.140009410
nop
and edi, 0xfffffffe
mov dword [rbp - 0x59], edi
mov rcx, qword [rbp + 0x67]
test rcx, rcx
je 0x140009e2e
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov qword [rbp + 0x67], r13
mov rcx, qword [rbp - 0x49]
mov rax, qword [rbp + 0x1f]
mov eax, dword [rax]
mov dword [rcx + 5], eax
mov rcx, qword [rbp + 0x1f]
call qword [sym.imp.msvcrt.dll_free]
nop
lea rax, [0x1400168f8]
mov qword [rbp - 0x31], rax
mov rax, qword [rbp - 0x41]
mov rcx, qword [rbp - 0x49]
jmp 0x140009e9e
mov rdx, qword [rbp - 0x39]
sub rdx, rcx
cmp rbx, rdx
jbe 0x140009e87
lea rdx, [rdx*4 + 4]
jmp 0x140009e75
shl rdx, 2
cmp rbx, rdx
jae 0x140009e71
lea rcx, [rbp - 0x51]
call fcn.140002074
mov rcx, qword [rbp - 0x49]
mov r8, rbx
mov rdx, rdi
call sub.msvcrt.dll_memcpy
mov rcx, qword [rbp - 0x49]
lea rax, [rcx + rbx]
mov qword [rbp - 0x41], rax
mov qword [rbp - 0x69], rcx
mov qword [rbp - 0x61], rax
movaps xmm0, xmmword [rbp - 0x69]
movdqa xmmword [rbp - 0x69], xmm0
lea r8, [rbp - 0x69]
lea rdx, [rbp - 9]
mov rcx, r15
call fcn.140009ffc
nop
mov rax, qword [rbp - 1]
mov qword [rbp - 0x69], rax
mov rax, qword [rbp + 7]
mov qword [rbp - 0x61], rax
movaps xmm0, xmmword [rbp - 0x69]
movdqa xmmword [rbp - 0x69], xmm0
lea rdx, [rbp - 0x69]
mov rcx, rsi
call fcn.1400064b4
nop
mov rcx, qword [rbp - 1]
call qword [sym.imp.msvcrt.dll_free]
nop
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.msvcrt.dll_free]
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret