Function at 0x1400e5440
Capabilities:
Encrypt data using rc4 via systemfunction033

Disassembly:
mov dword [rsp + 0x20], r9d
push rbp
push rbx
push rsi
push r12
push r14
lea rbp, [rsp - 0x27]
sub rsp, 0xc0
mov eax, dword [rcx]
xor ebx, ebx
mov dword [rbp - 0x59], 0x10
mov r14, rcx
mov dword [rbp - 0x55], 0x10
lea rcx, [rbp + 0xf]
mov qword [rbp - 0x51], rcx
mov r12, r8
mov qword [rbp - 0x69], rbx
lea rsi, [rdx + rax]
mov qword [rbp - 0x61], rbx
test eax, eax
je 0x1400e5696
mov r8d, dword [r14 + 4]
test r8d, r8d
je 0x1400e5696
movzx edx, word [rsi + 2]
mov ecx, edx
mov qword [rsp + 0x100], rdi
mov edi, dword [rbp + 0x7f]
sub ecx, 1
je 0x1400e5546
cmp ecx, 1
je 0x1400e54c9
lea rcx, str.ERROR_kuhl_m_lsadump_getHash___Unknow_SAM_HASH_revision___hu__n
call fcn.14000afb0
jmp 0x1400e566e
cmp dword [rsi + 4], 0x10
jb 0x1400e567d
lea rax, [rbp + 0x57]
mov rcx, r12
mov qword [rsp + 0x28], rax
lea r9d, [r8 - 0x18]
lea rax, [rbp + 0x5f]
lea r8, [rsi + 0x18]
mov qword [rsp + 0x20], rax
lea rdx, [rsi + 8]
call fcn.1400045c0
test eax, eax
je 0x1400e566e
mov eax, dword [rbp + 0x57]
mov ecx, 0x40
mov edx, eax
mov dword [rbp - 0x65], eax
mov dword [rbp - 0x69], eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, qword [rbp + 0x5f]
mov qword [rbp - 0x61], rax
test rax, rax
je 0x1400e5538
mov r8d, dword [rbp + 0x57]
mov rdx, rsi
mov rcx, rax
call fcn.14011b4a0
mov ebx, 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1400e562c
cmp r8d, 6
jb 0x1400e567d
lea rcx, [rbp - 0x49]
call qword [sym.imp.cryptdll.dll_MD5Init]
mov r8d, 0x10
lea rcx, [rbp - 0x49]
mov rdx, r12
call qword [sym.imp.cryptdll.dll_MD5Update]
mov r8d, 4
lea rdx, [rbp + 0x6f]
lea rcx, [rbp - 0x49]
call qword [sym.imp.cryptdll.dll_MD5Update]
mov eax, reloc.Cabinet.dll_FCIAddFile
lea ecx, [rax + 7]
cmp dword [rbp + 0x77], ebx
je 0x1400e55a3
test edi, edi
lea rdx, str.NTPASSWORD
cmovne eax, ecx
lea rcx, str.NTPASSWORDHISTORY
jmp 0x1400e55b7
test edi, edi
lea rdx, str.LMPASSWORD
cmovne rax, rcx
lea rcx, str.LMPASSWORDHISTORY
cmovne rdx, rcx
mov r8d, eax
lea rcx, [rbp - 0x49]
call qword [sym.imp.cryptdll.dll_MD5Update]
lea rcx, [rbp - 0x49]
call qword [sym.imp.cryptdll.dll_MD5Final]
mov eax, dword [r14 + 4]
mov ecx, 0x40
add eax, 0xfffffffc
mov edx, eax
mov dword [rbp - 0x65], eax
mov dword [rbp - 0x69], eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp - 0x61], rax
test rax, rax
je 0x1400e567d
mov r8d, dword [rbp - 0x69]
lea rdx, [rsi + 4]
mov rcx, rax
call fcn.14011b4a0
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x69]
call qword [sym.imp.ADVAPI32.dll_SystemFunction033]
test eax, eax
setns bl
test eax, eax
jns 0x1400e562c
lea rcx, str.ERROR_kuhl_m_lsadump_getHash___RtlDecryptData2_n
call fcn.14000afb0
test ebx, ebx
je 0x1400e566e
cmp dword [rbp + 0x77], 0
je 0x1400e5646
lea rax, str.ntlm
lea r9, str.NTLM
jmp 0x1400e5654
lea rax, str.lm
lea r9, str.LM
mov r8d, dword [rbp + 0x6f]
test edi, edi
mov edx, dword [rbp - 0x69]
mov rcx, qword [rbp - 0x61]
cmovne r9, rax
mov dword [rsp + 0x20], edi
call fcn.1401095a0
mov rcx, qword [rbp - 0x61]
test rcx, rcx
je 0x1400e567d
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdi, qword [rsp + 0x100]
mov eax, ebx
add rsp, 0xc0
pop r14
pop r12
pop rsi
pop rbx
pop rbp
ret
mov eax, ebx
add rsp, 0xc0
pop r14
pop r12
pop rsi
pop rbx
pop rbp
ret