Function at 0x14010fd80
Capabilities:
Encrypt data using rc4 via systemfunction032

Disassembly:
mov dword [rsp + 0x10], edx
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xd8
xor r14d, r14d
mov r15, r9
mov rdi, r8
test ecx, ecx
je 0x14010fe31
mov eax, dword [r8]
test al, 0xf
jne 0x14010fe1e
lea edx, [r14 + 1]
mov ebx, r14d
test eax, eax
je 0x14010fe31
nop dword [rax + rax]
test edx, edx
je 0x14010fe0c
mov rcx, qword [rdi + 8]
lea r8, [rbp - 0x59]
mov esi, ebx
lea rdx, [rbp + 0x6f]
add rcx, rsi
call qword [sym.imp.ADVAPI32.dll_SystemFunction026]
test eax, eax
mov edx, r14d
setns dl
test eax, eax
js 0x14010fdf5
mov rax, qword [rdi + 8]
movups xmm0, xmmword [rbp - 0x59]
movups xmmword [rsi + rax], xmm0
jmp 0x14010fe01
lea rcx, str.ERROR_kuhl_m_lsadump_dcshadow_encode_sensitive_value___RtlEncryptNtOwfPwdWithIndex
call fcn.14000afb0
add ebx, 0x10
cmp ebx, dword [rdi]
jb 0x14010fdc0
test edx, edx
jne 0x14010fe31
mov eax, edx
add rsp, 0xd8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov edx, eax
lea rcx, str.ERROR_kuhl_m_lsadump_dcshadow_encode_sensitive_value___Unexpected_hash_len___u__n
call fcn.14000afb0
jmp 0x140110006
mov qword [rsp + 0x120], r12
lea rax, [rbp + 0xf]
test r15, r15
mov qword [rbp - 0x71], rax
mov eax, dword [rdi]
lea r12, [0x1401b2898]
cmovne r12, r15
mov qword [rsp + 0xd0], r13
mov dword [rbp - 0x79], 0x10
mov dword [rbp - 0x75], 0x10
lea r13d, [rax + 0x14]
cmp qword [r12 + 8], r14
je 0x14010ffea
cmp dword [r12], r14d
je 0x14010ffea
test eax, eax
je 0x14010ffe1
cmp qword [rdi + 8], r14
je 0x14010ffe1
mov edx, r13d
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r15, rax
test rax, rax
je 0x14010fff6
mov r8d, dword [rdi]
lea rcx, [rax + 0x14]
mov rdx, qword [rdi + 8]
mov rsi, rax
call fcn.14011b4a0
mov eax, dword [rdi]
lea rdx, [rsp + 0x20]
mov ecx, 0xffffff7c
mov dword [rbp + 0x67], eax
call qword [sym.imp.cryptdll.dll_CDLocateCheckSum]
test eax, eax
js 0x14010ffca
mov rax, qword [rsp + 0x20]
lea rdx, [rsp + 0x28]
xor ecx, ecx
call qword [rax + 0x10]
test eax, eax
js 0x14010ffca
mov rax, qword [rsp + 0x20]
lea r8, [rsi + 0x14]
mov edx, dword [rbp + 0x67]
mov rcx, qword [rsp + 0x28]
call qword [rax + reloc.ODBC32.dll_SQLAllocHandle]
mov rax, qword [rsp + 0x20]
lea rdx, [rsi + 0x10]
mov rcx, qword [rsp + 0x28]
call qword [rax + 0x20]
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x28]
mov ebx, eax
call qword [rdx + Ordinal_41]
test ebx, ebx
js 0x14010ffca
mov edx, 0x10
mov rcx, rsi
call qword [sym.imp.cryptdll.dll_CDGenerateRandomBits]
lea rcx, [rbp - 0x49]
call qword [sym.imp.cryptdll.dll_MD5Init]
mov r8d, dword [r12]
lea rcx, [rbp - 0x49]
mov rdx, qword [r12 + 8]
call qword [sym.imp.cryptdll.dll_MD5Update]
mov r8d, 0x10
lea rcx, [rbp - 0x49]
mov rdx, rsi
call qword [sym.imp.cryptdll.dll_MD5Update]
lea rcx, [rbp - 0x49]
call qword [sym.imp.cryptdll.dll_MD5Final]
lea eax, [r13 - 0x10]
mov dword [rbp - 0x65], eax
lea rdx, [rbp - 0x79]
mov dword [rbp - 0x69], eax
lea rcx, [rbp - 0x69]
lea rax, [rsi + 0x10]
mov qword [rbp - 0x61], rax
call qword [sym.imp.ADVAPI32.dll_SystemFunction032]
test eax, eax
js 0x14010ffae
mov rsi, qword [rdi + 8]
mov r14d, 1
mov qword [rdi + 8], r15
mov dword [rdi], r13d
jmp 0x14010ffba
lea rcx, str.ERROR_kull_m_rpc_drsr_CreateGetNCChangesReply_encrypt___RtlEncryptData2_n
call fcn.14000afb0
test rsi, rsi
je 0x14010fff6
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14010fff6
lea rcx, str.ERROR_kull_m_rpc_drsr_CreateGetNCChangesReply_encrypt___Unable_to_calculate_CRC32_n
call fcn.14000afb0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14010fff6
lea rcx, str.ERROR_kull_m_rpc_drsr_CreateGetNCChangesReply_encrypt___No_valid_data_n
jmp 0x14010fff1
lea rcx, str.ERROR_kull_m_rpc_drsr_CreateGetNCChangesReply_encrypt___No_Session_Key_n
call fcn.14000afb0
mov r13, qword [rsp + 0xd0]
mov r12, qword [rsp + 0x120]
mov eax, r14d
add rsp, 0xd8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret