Function at 0x140024170
Capabilities:
Hash data via bcrypt

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xf8
xor r12d, r12d
lea rcx, [rbp - 0x41]
mov ebx, r12d
mov qword [rbp - 0x71], r12
mov qword [rsp + 0x58], rbx
mov r14d, r12d
mov qword [rbp - 0x59], r12
mov esi, r12d
mov qword [rbp - 0x69], r12
mov r13d, r12d
mov dword [rbp + 0x6f], r12d
mov r15d, r12d
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r12
mov qword [rbp - 0x79], r12
mov qword [0x1400339d0], r12
call fcn.1400251c8
mov edi, eax
test eax, eax
js 0x140024d2a
mov rcx, qword [0x140033708]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r12w
jne 0x1400241e3
mov rcx, qword [0x140033700]
lea eax, [rax*2 + 0x40]
mov edx, eax
mov dword [rbp + 0x7f], eax
xor r8d, r8d
call fcn.140015224
mov rcx, qword [0x140033700]
xor r8d, r8d
mov edx, 0x800
mov qword [rsp + 0x50], rax
mov rdi, rax
call fcn.140015224
mov rcx, qword [0x140033700]
xor r8d, r8d
mov edx, 0x800
mov r12, rax
call fcn.140015224
xor edx, edx
mov qword [rbp - 0x51], rax
test rdi, rdi
je 0x140024cae
test r12, r12
je 0x140024cae
test rax, rax
je 0x140024cae
mov edx, dword [rbp + 0x7f]
mov rcx, rdi
mov r9, qword [0x140033708]
mov r8, qword [0x140033568]
call fcn.140003a30
xor eax, eax
lea rcx, [rbp - 0x71]
mov dword [rsp + 0x30], eax
xor r9d, r9d
mov dword [rsp + 0x28], 1
mov r8d, 0x120089
mov rdx, rdi
mov dword [rsp + 0x20], 1
call fcn.14000f8ec
xor ecx, ecx
test eax, eax
jns 0x1400242b4
mov edi, 0xc0000225
mov ebx, ecx
mov esi, ecx
jmp 0x140024ccc
mov rcx, qword [rbp - 0x71]
xor edx, edx
call fcn.14000fa7c
mov edi, eax
xor eax, eax
test edi, edi
js 0x140024cc6
mov rcx, qword [rbp - 0x71]
lea r8, [rbp + 0x6f]
mov rdx, r12
call fcn.140004e30
xor edi, edi
test eax, eax
js 0x1400245d4
mov edx, 0x3a
mov rcx, r12
call sub.ntoskrnl.exe_wcschr
test rax, rax
je 0x1400245cf
cmp rax, r12
je 0x1400245cf
lea rbx, [rax + 2]
mov edx, 0x20
jbe 0x140024325
mov rcx, rax
sub rax, 2
cmp word [rax], dx
ja 0x140024322
cmp rax, r12
ja 0x14002430f
jmp 0x140024325
mov rax, rcx
mov word [rax], di
jmp 0x140024337
test ax, ax
je 0x1400245cf
add rbx, 2
movzx eax, word [rbx]
cmp ax, dx
jbe 0x14002432a
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], di
jne 0x140024343
lea rax, [rbx + rax*2]
jmp 0x14002435e
mov rcx, rax
sub rax, 2
cmp word [rax], dx
ja 0x140024365
cmp rax, rbx
ja 0x140024352
jmp 0x140024368
mov rax, rcx
mov rdx, r12
mov word [rax], di
lea rcx, [0x14002c200]
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
jne 0x1400243c9
test r14, r14
jne 0x1400243c9
mov rcx, rbx
call fcn.1400253d0
mov rcx, qword [0x140033700]
xor r8d, r8d
mov edx, eax
mov qword [rsp + 0x58], rax
mov rdi, rax
call fcn.140015224
mov qword [rbp - 0x69], rax
mov r14, rax
test rax, rax
je 0x1400245f7
mov r8d, edi
mov rdx, rax
mov rcx, rbx
call fcn.140025270
xor edi, edi
jmp 0x1400245b7
or rax, 0xffffffffffffffff
inc rax
cmp word [r12 + rax*2], di
jne 0x1400243cd
mov rdi, qword [rbp - 0x51]
lea r8, [rbp + 0x67]
add eax, eax
mov rcx, rdi
mov r9, r12
mov dword [rsp + 0x20], eax
mov edx, 0x800
call qword [sym.imp.ntoskrnl.exe_RtlUnicodeToUTF8N]
xor ecx, ecx
test eax, eax
js 0x140024411
mov r8d, dword [rbp + 0x67]
xor r9d, r9d
mov rcx, qword [rbp - 0x39]
mov rdx, rdi
call sub.ksecdd.sys_BCryptHashData
xor ecx, ecx
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], cx
jne 0x140024415
add eax, eax
lea r8, [rbp + 0x67]
mov r9, rbx
mov dword [rsp + 0x20], eax
mov edx, 0x800
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlUnicodeToUTF8N]
test eax, eax
js 0x140024450
mov r8d, dword [rbp + 0x67]
xor r9d, r9d
mov rcx, qword [rbp - 0x39]
mov rdx, rdi
call sub.ksecdd.sys_BCryptHashData
mov rdx, r12
lea rcx, [0x14002c220]
call sub.ntoskrnl.exe__wcsicmp
xor edi, edi
test eax, eax
jne 0x14002447c
cmp qword [rbp - 0x79], rdi
jne 0x14002447c
lea rdx, [rbp - 0x79]
mov rcx, rbx
call fcn.140023f84
jmp 0x1400245b7
mov rdx, r12
lea rcx, [0x14002c230]
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
jne 0x1400244e1
test rsi, rsi
jne 0x1400244e1
lea edx, [rax + 0x2d]
mov rcx, rbx
call sub.ntoskrnl.exe_wcschr
test rax, rax
je 0x1400244c2
mov word [rax], di
test r13, r13
jne 0x1400244c2
mov rcx, qword [0x140033700]
lea rdx, [rax + 2]
xor r8d, r8d
call fcn.14001522c
mov r13, rax
mov rcx, qword [0x140033700]
xor r8d, r8d
mov rdx, rbx
call fcn.14001522c
mov rsi, rax
mov qword [rsp + 0x40], rax
jmp 0x1400245b7
mov rdx, r12
lea rcx, [0x14002c240]
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
jne 0x140024513
test r13, r13
jne 0x140024513
mov rcx, qword [0x140033700]
xor r8d, r8d
mov rdx, rbx
call fcn.14001522c
mov r13, rax
jmp 0x1400245b7
mov rdx, r12
lea rcx, [0x14002c250]
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
jne 0x140024547
test r15, r15
jne 0x140024547
mov rcx, qword [0x140033700]
xor r8d, r8d
mov rdx, rbx
call fcn.14001522c
mov r15, rax
mov qword [rsp + 0x48], rax
jmp 0x1400245b7
mov rdx, r12
lea rcx, [0x14002c270]
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
jne 0x140024564
mov rcx, rbx
call sub.ntoskrnl.exe__wtol
jmp 0x1400245b7
mov rdx, r12
lea rcx, [0x14002c280]
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
jne 0x140024591
lea rdx, [0x14002c2a0]
mov rcx, rbx
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
je 0x1400245b7
mov edi, 0xc0000024
jmp 0x1400245fc
mov rdx, r12
lea rcx, [0x14002c2c0]
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
jne 0x1400245b7
lea rdx, [0x1400339e0]
mov rcx, rbx
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
jne 0x14002460b
mov rcx, qword [rbp - 0x71]
lea r8, [rbp + 0x6f]
mov rdx, r12
call fcn.140004e30
test eax, eax
jns 0x1400242e5
mov rbx, qword [rsp + 0x58]
lea r8, [rbp - 0x61]
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x41]
call fcn.1400250c8
mov edi, eax
test eax, eax
js 0x1400245fc
test r14, r14
jne 0x140024612
mov edi, 0xc0000079
jmp 0x1400245fc
mov edi, 0xc000009a
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
jmp 0x140024ccc
mov edi, 0xc0000485
jmp 0x1400245fc
mov edx, dword [rbp - 0x61]
mov r9d, ebx
mov rcx, qword [rbp - 0x59]
mov r8, r14
call fcn.140024fe8
xor ebx, ebx
mov edi, eax
test eax, eax
js 0x1400245fc
test r15, r15
je 0x14002474f
or rsi, 0xffffffffffffffff
mov r14, rsi
inc r14
cmp word [r15 + r14*2], bx
jne 0x14002463c
mov rcx, qword [0x140033700]
xor r8d, r8d
mov edx, 0x4000
call fcn.140015224
mov r15, rax
mov dword [rbp + 0x77], ebx
lea rax, [0x14002c2d0]
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x21], rax
lea rdx, [rbp - 0x29]
lea rax, [rbp + 0x77]
mov dword [rbp - 0x11], 0x3fff
xor ecx, ecx
mov qword [rbp - 9], rax
mov byte [rbp - 1], 1
call fcn.1400021b0
test eax, eax
js 0x14002472e
mov eax, dword [rbp + 0x77]
test eax, eax
je 0x14002472e
mov byte [rax + r15], bl
inc rsi
cmp byte [r15 + rsi], bl
jne 0x1400246a4
add rsi, r15
mov rbx, r15
cmp r15, rsi
jae 0x14002472e
mov edx, 0xa
mov rcx, rbx
call sub.ntoskrnl.exe_strchr
mov r10, rax
xor eax, eax
test r10, r10
cmove r10, rsi
mov rdx, r10
sub rdx, rbx
cmp rdx, 1
jbe 0x1400246e7
cmp byte [rdx + rbx - 1], 0xd
jne 0x1400246ec
dec rdx
test rdx, rdx
je 0x140024720
mov r8d, eax
test r14d, r14d
je 0x14002471b
mov r9, qword [rsp + 0x48]
mov eax, r8d
cmp rax, rdx
jae 0x14002471b
movzx ecx, word [r9]
movsx eax, byte [rbx]
cmp eax, ecx
jne 0x14002471b
inc r8d
add r9, 2
inc rbx
cmp r8d, r14d
jb 0x1400246f9
cmp r8d, r14d
je 0x140024729
lea rbx, [r10 + 1]
cmp rbx, rsi
jmp 0x1400246b6
mov edi, 0xc0000804
mov edx, 0x4000
mov rcx, r15
call fcn.14000ee44
mov r14, qword [rbp - 0x69]
xor r15d, r15d
test edi, edi
js 0x1400245fc
mov rsi, qword [rsp + 0x40]
or dword [0x1400339d0], 1
lea rcx, [rbp + 0x77]
xorps xmm0, xmm0
mov qword [rbp + 0x77], r15
movups xmmword [rbp + 7], xmm0
call fcn.140023d0c
movabs rax, 0xfffff78000000014
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x69]
mov rax, qword [rax]
mov qword [rbp - 0x69], rax
call qword [sym.imp.ntoskrnl.exe_ExSystemTimeToLocalTime]
test rsi, rsi
jne 0x1400247a0
test r13, r13
je 0x1400247a0
mov rsi, r13
mov qword [rsp + 0x40], r13
mov r13, r15
jmp 0x1400247ac
mov rbx, r15
test rsi, rsi
je 0x140024996
lea rdx, [0x14002c2f0]
mov rcx, rsi
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
jne 0x1400247d4
mov eax, dword [0x1400339d0]
and eax, 0xffffe5ff
or eax, 0x500
jmp 0x14002498d
lea rdx, [0x14002c310]
mov rcx, rsi
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
jne 0x1400247fb
mov eax, dword [0x1400339d0]
and eax, 0xffffe4ff
bts eax, 0xa
jmp 0x14002498d
lea rdx, [0x14002c320]
mov rcx, rsi
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
jne 0x140024822
mov eax, dword [0x1400339d0]
and eax, 0xffffe8ff
bts eax, 0xb
jmp 0x14002498d
lea rdx, [0x14002c340]
mov rcx, rsi
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
je 0x14002497d
lea rdx, [0x14002c360]
mov rcx, rsi
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
je 0x14002497d
lea rdx, [0x14002c370]
mov rcx, rsi
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
je 0x14002496c
lea rdx, [0x14002c380]
mov rcx, rsi
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
je 0x14002496c
lea rdx, [0x14002c3a0]
mov rcx, rsi
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
je 0x14002495a
lea rdx, [0x14002c3c0]
mov rcx, rsi
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
je 0x14002495a
lea rdx, [0x14002c3d0]
mov rcx, rsi
call sub.ntoskrnl.exe_wcsstr
test rax, rax
je 0x140024948
mov ebx, 5
lea rdx, [0x14002c3e0]
mov r8d, ebx
mov rcx, rsi
call sub.ntoskrnl.exe__wcsnicmp
test eax, eax
jne 0x1400248f4
mov eax, dword [0x1400339d0]
and eax, 0xfffff9ff
or eax, 0x1900
jmp 0x14002498d
mov r8, rbx
lea rdx, [0x14002c3f0]
mov rcx, rsi
call sub.ntoskrnl.exe__wcsnicmp
test eax, eax
movabs rsi, 0x46b8e92d8000
mov eax, dword [0x1400339d0]
jne 0x140024933
mov rbx, qword [rbp - 0x79]
and eax, 0xfffffaff
or eax, 0x1a00
mov dword [0x1400339d0], eax
add rbx, rsi
jmp 0x1400249a0
and eax, 0xfffff8ff
mov rbx, r15
or eax, 0x1800
mov dword [0x1400339d0], eax
jmp 0x1400249a0
mov eax, dword [0x1400339d0]
and eax, 0xffffecff
or eax, 0xc00
jmp 0x14002498d
mov eax, dword [0x1400339d0]
and eax, 0xfffff1ff
or eax, 0x1100
jmp 0x14002498d
mov eax, dword [0x1400339d0]
and eax, 0xfffff0ff
bts eax, 0xc
jmp 0x14002498d
mov eax, dword [0x1400339d0]
and eax, 0xfffffcff
or eax, 0x1c00
mov rbx, r15
mov dword [0x1400339d0], eax
movabs rsi, 0x46b8e92d8000
mov r9d, dword [0x1400339d0]
mov eax, r9d
shr eax, 8
and eax, 0x1c
cmp eax, 4
jne 0x1400249c1
or r9d, 0xe000
jmp 0x140024b9f
cmp eax, 0x1c
jne 0x140024a08
test r13, r13
je 0x1400249d5
mov rcx, r13
call sub.ntoskrnl.exe__wtoi
jmp 0x1400249da
mov eax, 7
mov r9d, dword [0x1400339d0]
movsx rbx, ax
movabs rax, 0xc92a69c000
imul rbx, rax
add rbx, qword [rbp - 0x79]
btr r9d, 0xe
or r9d, 0xa000
jmp 0x140024b9f
test r13, r13
je 0x140024b8c
lea rdx, [0x14002c400]
mov rcx, r13
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
je 0x140024b8c
lea rdx, [0x14002c420]
mov rcx, r13
call sub.ntoskrnl.exe__wcsicmp
mov r9d, dword [0x1400339d0]
test eax, eax
je 0x1400249f7
mov eax, r9d
shr eax, 8
and eax, 0x1c
cmp eax, 0xc
je 0x140024a59
cmp eax, 0x18
jne 0x140024ba6
lea rdx, [0x14002c440]
mov rcx, r13
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
jne 0x140024a86
mov r9d, dword [0x1400339d0]
and r9d, 0xffffe4ff
or r9d, 0xe400
jmp 0x140024b9f
lea rdx, [0x14002c450]
mov rcx, r13
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
jne 0x140024adf
mov r9d, dword [0x1400339d0]
mov eax, r9d
and eax, 0x1c00
cmp eax, 0x1800
jne 0x140024abd
btr r9d, 0xf
or r9d, 0x6000
jmp 0x140024ac9
btr r9d, 0xe
or r9d, 0xa000
mov rbx, qword [rbp - 0x79]
movabs rcx, 0x23da2f18d8000
add rbx, rcx
jmp 0x140024b9f
lea rdx, [0x14002c460]
mov rcx, r13
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
jne 0x140024b0a
mov r9d, dword [0x1400339d0]
btr r9d, 0xf
or r9d, 0x6000
jmp 0x140024b9f
lea rdx, [0x14002c3f0]
mov rcx, r13
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
jne 0x140024b62
mov eax, dword [0x1400339d0]
btr eax, 0xf
mov r9d, eax
and eax, 0x1c00
or r9d, 0x6000
mov dword [0x1400339d0], r9d
cmp eax, 0x1800
jne 0x140024b59
and r9d, 0xfffffaff
or r9d, 0x1a00
mov dword [0x1400339d0], r9d
mov rbx, qword [rbp - 0x79]
add rbx, rsi
jmp 0x140024ba6
lea rdx, [0x14002c470]
mov rcx, r13
call sub.ntoskrnl.exe__wcsicmp
mov r9d, dword [0x1400339d0]
test eax, eax
jne 0x140024b93
and r9d, 0xffff70ff
or r9d, 0x7000
jmp 0x140024b9f
mov r9d, dword [0x1400339d0]
and r9d, 0xffff5fff
bts r9d, 0xe
mov dword [0x1400339d0], r9d
mov ecx, r9d
shr ecx, 8
mov edx, ecx
and edx, 0x1c
cmp edx, 4
jne 0x140024bbc
or rbx, 0xffffffffffffffff
jmp 0x140024bdc
test rbx, rbx
jne 0x140024bd2
mov rbx, qword [rbp - 0x79]
movabs r8, 0x11ed178c6c000
add rbx, r8
lea eax, [rdx - 8]
test eax, 0xfffffff7
je 0x140024bec
and ecx, 0x1f
cmp cl, 0x1a
je 0x140024bec
mov r10b, r15b
cmp edx, 0x1c
jne 0x140024bef
mov r10b, 1
mov rcx, qword [rbp - 0x49]
cmp rbx, 0xffffffffffffffff
je 0x140024c49
cmp rbx, rcx
jge 0x140024c09
or r9d, 2
mov dword [0x1400339d0], r9d
mov r8, rbx
movabs rax, 0xd6bf94d5e57a42bd
sub r8, rcx
imul r8
add rdx, r8
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov dword [0x1400339d4], edx
test r10b, r10b
jne 0x140024c49
cmp rbx, qword [rbp + 0x77]
jge 0x140024c49
or r9d, 4
mov dword [0x1400339d0], r9d
mov eax, r9d
mov edx, r9d
shr eax, 1
shr edx, 2
test r10b, r10b
cmovne edx, eax
test dl, 1
je 0x1400245fc
mov eax, r9d
and eax, 0x1c00
cmp eax, 0x1c00
je 0x140024c8f
movabs rax, 0x1792f8648000
add rax, rbx
cmp rax, rcx
jl 0x140024c8f
or r9d, 0x20
mov dword [0x1400339d0], r9d
test r9b, 0x20
jne 0x1400245fc
and r9d, 0xfffffffe
mov edi, 0xc0000193
mov dword [0x1400339d0], r9d
jmp 0x1400245fc
mov rcx, qword [rsp + 0x50]
mov edi, edx
mov qword [rsp + 0x58], rdi
mov edi, 0xc000009a
test rcx, rcx
je 0x140024cd9
jmp 0x140024cd1
mov rbx, rax
mov rsi, rax
mov rcx, qword [rsp + 0x50]
mov edx, dword [rbp + 0x7f]
call fcn.14000ee44
test r12, r12
je 0x140024ceb
mov edx, 0x800
mov rcx, r12
call fcn.14000ee44
mov rcx, qword [rbp - 0x51]
test rcx, rcx
je 0x140024cfe
mov edx, 0x800
call fcn.14000ee44
test rbx, rbx
je 0x140024d0b
mov rcx, rbx
call fcn.1400152c0
test r13, r13
je 0x140024d18
mov rcx, r13
call fcn.1400152c0
test rsi, rsi
je 0x140024d25
mov rcx, rsi
call fcn.1400152c0
mov rbx, qword [rsp + 0x58]
lea rcx, [rbp - 0x41]
call fcn.14002517c
mov rcx, qword [rbp - 0x59]
test rcx, rcx
je 0x140024d47
mov edx, 0x7668704b
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
test r14, r14
je 0x140024d56
mov edx, ebx
mov rcx, r14
call fcn.14000ee44
mov rcx, qword [rbp - 0x71]
test rcx, rcx
je 0x140024d64
call fcn.14000f854
mov eax, edi
add rsp, 0xf8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret