Function at 0x21f10
Capabilities:
Hash data via bcrypt
Print debug messages

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov dword [rsp + 0x40], 0xc0000001
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x00027270]
lea rcx, [rsp + 0x48]
call sub.ksecdd.sys_BCryptOpenAlgorithmProvider
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x22271
lea rcx, [0x00027280]
call sub.ntoskrnl.exe_DbgPrint
cmp dword [rsp + 0x40], 0
jne 0x22263
mov dword [rsp + 0x28], 0
lea rax, [rsp + 0x54]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rsp + 0x50]
lea rdx, [0x000272a0]
mov rcx, qword [rsp + 0x48]
call sub.ksecdd.sys_BCryptGetProperty
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x22257
mov edx, dword [rsp + 0x50]
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
je 0x22249
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
lea rdx, [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
call sub.ksecdd.sys_BCryptCreateHash
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x2222e
xor r9d, r9d
mov r8d, dword [rsp + 0xa8]
mov rdx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x58]
call sub.ksecdd.sys_BCryptHashData
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x22216
mov dword [rsp + 0x28], 0
lea rax, [rsp + 0x54]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rsp + 0x68]
lea rdx, [0x000272c0]
mov rcx, qword [rsp + 0x48]
call sub.ksecdd.sys_BCryptGetProperty
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x22208
mov edx, dword [rsp + 0x68]
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0
je 0x221fa
xor r9d, r9d
mov r8d, dword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
call sub.ksecdd.sys_BCryptFinishHash
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x221df
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x000272f0]
lea rcx, [rsp + 0x78]
call sub.ksecdd.sys_BCryptOpenAlgorithmProvider
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x221d1
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8c
lea rax, str.ECS5B
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x80]
lea r8, [0x00027310]
xor edx, edx
mov rcx, qword [rsp + 0x78]
call sub.ksecdd.sys_BCryptImportKeyPair
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x221b7
mov dword [rsp + 0x30], 0
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x70]
xor edx, edx
mov rcx, qword [rsp + 0x80]
call sub.ksecdd.sys_BCryptVerifySignature
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x2217a
lea rcx, [0x00027330]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x221a8
mov qword [rsp + 0x88], 0xfffffffffeced300
lea r8, [rsp + 0x88]
xor edx, edx
mov cl, 1
call qword [sym.imp.ntoskrnl.exe_KeDelayExecutionThread]
mov edx, dword [rsp + 0x40]
lea rcx, [0x00027340]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rsp + 0x80]
call sub.ksecdd.sys_BCryptDestroyKey
jmp 0x221c3
lea rcx, [0x00027360]
call sub.ntoskrnl.exe_DbgPrint
xor edx, edx
mov rcx, qword [rsp + 0x78]
call sub.ksecdd.sys_BCryptCloseAlgorithmProvider
jmp 0x221dd
lea rcx, [0x00027380]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x221eb
lea rcx, [0x000273a0]
call sub.ntoskrnl.exe_DbgPrint
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x22206
lea rcx, [0x000273c0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x22214
lea rcx, [0x000273e0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x22222
lea rcx, [0x00027410]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rsp + 0x58]
call sub.ksecdd.sys_BCryptDestroyHash
jmp 0x2223a
lea rcx, [0x00027430]
call sub.ntoskrnl.exe_DbgPrint
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x22255
lea rcx, [0x00027450]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x22263
lea rcx, [0x00027480]
call sub.ntoskrnl.exe_DbgPrint
xor edx, edx
mov rcx, qword [rsp + 0x48]
call sub.ksecdd.sys_BCryptCloseAlgorithmProvider
jmp 0x2227d
lea rcx, [0x000274b0]
call sub.ntoskrnl.exe_DbgPrint
mov eax, dword [rsp + 0x40]
add rsp, 0x98
ret