Function at 0x180027310
Capabilities:
Create thread
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
lea eax, [rcx + 0x9c9]
mov r10, r9
mov dword [rsp + 0x50], eax
mov r14, r8
mov r9, rdx
mov ebp, ecx
cmp ecx, eax
jae 0x1800278ee
mov r13d, dword [rsp + 0xd0]
xor edi, edi
mov ebx, dword [rsp + 0xd0]
lea rdx, [0x180000000]
cmp ebp, 0x19a
ja 0x1800274dc
je 0x180027497
cmp ebp, 0xf3
ja 0x180027416
je 0x1800273c3
mov eax, ebp
sub eax, 0x4d
je 0x1800273b7
sub eax, 1
je 0x180027822
cmp eax, 0x5d
jne 0x180027878
mov rax, qword [r14]
add rax, 0x368
mov qword [rsp + 0x60], rax
jmp 0x180027878
mov qword [0x18007d6b8], r14
jmp 0x180027878
xor r8d, r8d
xor edx, edx
mov ecx, 0xaa
call fcn.180007200
test al, al
jne 0x180027878
mov esi, 0x7c
nop
mov eax, esi
sub eax, 0x7c
je 0x1800273f2
cmp eax, 0x52
je 0x1800278ee
jmp 0x180027406
xor edx, edx
xor r9d, r9d
mov r8, r14
lea ecx, [rdx + 0x20]
call fcn.1800234e0
mov byte [rsp + 0x38], al
add esi, 0x52
cmp esi, 0x120
jb 0x1800273e0
jmp 0x180027878
mov eax, ebp
sub eax, 0xf4
je 0x18002748b
sub eax, 1
je 0x180027862
cmp eax, 0x5d
jne 0x180027878
mov edx, 0xa2
nop word [rax + rax]
cmp edx, 0xa2
jne 0x1800278c1
mov r8, qword [rsp + 0x60]
mov rcx, qword [r8]
cmp r9, rcx
jb 0x1800278b3
add rcx, qword [r8 + 8]
cmp r9, rcx
jae 0x1800278b3
mov ecx, 0x92
nop
mov eax, ecx
sub eax, 0x92
je 0x1800278a0
cmp eax, 1
je 0x1800278ee
jmp 0x1800278a5
mov qword [r14 + 0x80], r9
jmp 0x180027878
mov eax, 0xf
nop dword [rax]
cmp eax, 0xf
je 0x1800278da
add eax, 0x573
cmp eax, 0x573
jbe 0x1800274a0
mov qword [rsp + 0x28], rdi
lea r8, [0x180027a50]
mov r9, r14
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x68], rax
jmp 0x180027878
cmp ebp, 0x243
ja 0x1800277da
je 0x180027750
mov eax, ebp
sub eax, 0x19b
je 0x1800274b5
sub eax, 1
je 0x18002754a
cmp eax, 0xa6
jne 0x180027878
mov rcx, qword [rsp + 0x68]
test rcx, rcx
jne 0x18002753b
mov eax, 0x81
cmp eax, 0x81
je 0x18002752a
cmp eax, 0x109
je 0x1800278ee
jmp 0x18002752f
mov byte [rsp + 0x38], dil
add eax, 0x88
cmp eax, 0x191
jb 0x180027516
mov rax, rcx
xchg qword [0x18007d6c0], rax
jmp 0x180027878
cmp dword [r9], 0x10
jne 0x180027878
mov r15, r14
lea rsi, [0x180061bb8]
mov r14d, 0x46
mov r12d, 2
nop word [rax + rax]
lea eax, [r14 - 0x40]
cmp eax, 8
ja case.0x180027587.67
mov ecx, dword [rdx + rax*4 + 0x27908]
add rcx, rdx
jmp rcx
mov rcx, qword [r15 + 8]
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov dword [rsp + 0x30], eax
jmp case.0x180027587.67
test r12, r12
je 0x180027710
movzx eax, byte [rsi]
movzx ebx, byte [r15]
sub ebx, eax
jmp case.0x180027587.67
mov ecx, dword [rsp + 0x30]
test ecx, ecx
je 0x18002769b
mov ebp, 0x34
nop dword [rax]
mov eax, ebp
sub eax, 0x34
je 0x180027604
cmp eax, 1
jne 0x180027690
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov ecx, dword [rsp + 0x30]
jmp 0x180027690
movzx r8d, word [rsi]
lea rdx, [rsi + 4]
mov rcx, qword [rsp + 0x58]
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov dword [rsp + 0x30], eax
mov ecx, eax
test eax, eax
je 0x180027690
mov ebx, 0x50
nop dword [rax]
mov eax, ebx
sub eax, 0x50
je 0x18002767d
sub eax, 1
je 0x18002764b
cmp eax, 1
jne 0x180027685
movzx eax, word [rsp + 0x40]
add word [rsi], ax
jmp 0x180027685
movzx ecx, word [rsi]
lea rax, [rsp + 0x40]
add rcx, 4
mov qword [rsp + 0x28], rax
add rcx, rsi
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, qword [rsp + 0x58]
lea edx, [r9 + 2]
call qword [sym.imp.ADVAPI32.dll_CryptSignHashW]
mov ecx, eax
jmp 0x180027685
mov dword [rsp + 0x40], 0x100
inc ebx
cmp ebx, 0x53
jb 0x180027630
mov dword [rsp + 0x30], ecx
inc ebp
cmp ebp, 0x36
jb 0x1800275e0
mov ebx, ecx
jmp case.0x180027587.67
cmp byte [r15], dil
je 0x1800276ea
cmp byte [rsi], dil
je 0x1800276ea
test r12, r12
je 0x1800276ea
mov ecx, 0xe0
mov eax, ecx
sub eax, 0xde
je 0x1800276d8
sub eax, 1
je 0x1800276d0
cmp eax, 1
jne 0x1800276db
movzx eax, byte [rsi]
cmp byte [r15], al
jne 0x1800276ea
jmp 0x1800276db
inc r15
inc rsi
jmp 0x1800276db
dec r12
dec ecx
cmp ecx, 0xdd
ja 0x1800276b3
cmp byte [r15], dil
jne 0x1800276a4
mov r14d, 0x46
inc r14d
cmp r14d, 0x4c
jae case.0x180027587.66
lea rdx, [0x180000000]
jmp 0x180027570
mov r14, qword [rsp + 0xe0]
mov ebx, edi
add r14, 2
mov qword [rsp + 0xe0], r14
jmp 0x180027871
test ebx, ebx
jne 0x180027869
mov r14, qword [rsp + 0xe0]
add r14, 2
mov qword [rsp + 0xe0], r14
jmp 0x180027871
mov r8d, 0x2a
cmp r8d, 0x2a
je 0x18002777a
cmp r8d, 0xd1
jne 0x1800277c5
movsxd rax, r13d
add qword [rsp + 0x48], rax
inc r14
mov qword [rsp + 0xe0], r14
jmp 0x1800277c5
movsx ecx, byte [r14]
mov edx, dword [r9]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x18002778e
lea r13d, [rcx - 0x30]
jmp 0x1800277b4
cmp edx, 0x10
jne 0x180027829
lea eax, [rcx - 0x41]
cmp al, 5
ja 0x1800277a4
lea r13d, [rcx - 0x37]
jmp 0x1800277af
lea eax, [rcx - 0x61]
cmp al, 5
ja 0x180027829
lea r13d, [rcx - 0x57]
mov edx, 0x10
mov rcx, qword [rsp + 0x48]
movsxd rax, edx
imul rcx, rax
mov qword [rsp + 0x48], rcx
add r8d, 0xa7
cmp r8d, 0x178
jb 0x180027756
jmp 0x180027750
mov eax, ebp
sub eax, 0x2e9
je 0x18002783d
sub eax, 1
je 0x180027829
cmp eax, 0xa7
jne 0x180027878
mov rdx, qword [rsp + 0x70]
mov ecx, 0x78
nop dword [rax]
mov eax, ecx
sub eax, 0x77
je 0x1800278ee
cmp eax, 1
jne 0x18002781b
mov rax, r14
sub rax, rdx
mov qword [rsp + 0x38], rax
dec ecx
cmp ecx, 0x76
ja 0x180027800
mov qword [rsp + 0x70], r14
jmp 0x180027878
mov ebp, 0x2ea
test r10, r10
je 0x180027878
mov rax, qword [rsp + 0x48]
mov qword [r10], rax
jmp 0x180027878
mov ecx, 0x91
mov eax, ecx
sub eax, 0x90
je 0x1800278ee
cmp eax, 1
jne 0x180027858
mov byte [rsp + 0x38], al
dec ecx
cmp ecx, 0x8f
ja 0x180027842
mov qword [rsp + 0x48], rdi
jmp 0x180027878
mov r14, qword [rsp + 0xe0]
mov ebp, dword [rsp + 0xd0]
add ebp, 0xa7
mov dword [rsp + 0xd0], ebp
cmp ebp, dword [rsp + 0x50]
jae 0x1800278ee
mov r9, qword [rsp + 0xd8]
mov r10, qword [rsp + 0xe8]
jmp 0x180027364
mov qword [rsp + 0x38], r8
inc ecx
cmp ecx, 0x94
jb 0x180027470
mov r8, qword [r8 + 0x10]
mov qword [rsp + 0x60], r8
test r8, r8
je 0x1800278d5
add edx, 0x73
cmp edx, 0x115
jb 0x180027440
jmp 0x180027431
mov rax, rdi
jmp 0x1800278f3
xor r8d, r8d
mov rdx, r14
mov ecx, 0xf6
call fcn.180009770
mov byte [rsp + 0x38], al
mov rax, qword [rsp + 0x38]
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret