Function at 0x140002890
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x120]
sub rsp, 0x220
mov rax, qword [0x14015a038]
xor rax, rsp
mov qword [rbp + 0x118], rax
mov rsi, rdx
mov qword [rsp + 0x58], rcx
xor ebx, ebx
mov dword [rsp + 0x60], ebx
mov rax, qword [rdx + 8]
cmp qword [rdx], rax
je 0x140003429
mov qword [rbp + 0xa8], rbx
movdqa xmm0, xmmword [0x14013a430]
movdqu xmmword [rbp + 0xb8], xmm0
mov byte [rbp + 0xa8], bl
mov dword [rbp + 0x108], 0x34536b31
mov dword [rbp + 0x10c], 0xf3f5537e
mov word [rbp + 0x110], 0xe9
lea rax, [rbp + 0x108]
mov r14, 0xffffffffffffffff
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x140002926
lea rdx, [rbp + 0x108]
lea rcx, [rbp + 0xa8]
call fcn.140011ad0
mov qword [rbp + 0xa0], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbx
mov rdi, rbx
mov r12, rbx
lea rax, [rsp + 0x38]
cmp rax, rsi
je 0x1400029a4
mov rbx, qword [rsi + 8]
mov rdi, qword [rsi]
sub rbx, rdi
je 0x140002986
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.14000d9d0
mov r8, rbx
mov rdx, rdi
mov rdi, qword [rsp + 0x38]
mov rcx, rdi
call fcn.14009de10
lea r12, [rdi + rbx]
mov qword [rsp + 0x40], r12
xor ebx, ebx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], rbx
cmp rdi, r12
je 0x140002a31
mov rbx, r12
sub rbx, rdi
cmp rbx, 0x1000
jb 0x1400029ef
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x14000345b
call fcn.14009b4d4
test rax, rax
je 0x140003485
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
jmp 0x140002a03
test rbx, rbx
je 0x1400029fe
mov rcx, rbx
call fcn.14009b4d4
jmp 0x140002a00
xor eax, eax
mov r15, rax
mov qword [rsp + 0x68], r15
lea rax, [r15 + rbx]
mov qword [rsp + 0x78], rax
mov r8, rbx
mov rdx, rdi
mov rcx, r15
call fcn.14009de10
mov r13, r15
sub r13, rdi
add r13, r12
mov qword [rsp + 0x70], r13
xor ebx, ebx
jmp 0x140002a3b
mov r13, qword [rsp + 0x70]
mov r15, qword [rsp + 0x68]
mov edx, 1
lea rcx, [rbp - 0x80]
call fcn.140007500
nop
mov edx, 0x1d
lea rcx, [rbp - 0x70]
call fcn.1400076f0
mov edx, 3
lea rcx, [rbp - 0x70]
call fcn.1400076f0
mov edx, 0x7da
lea rcx, [rbp - 0x70]
call fcn.1400076f0
lea rdx, [0x14012d8a8]
lea rcx, [rbp - 0x70]
call fcn.14000bfc0
nop
mov qword [rbp + 0xc8], rbx
mov qword [rbp + 0xd8], rbx
mov qword [rbp + 0xe0], 7
mov word [rbp + 0xc8], bx
mov dword [rsp + 0x60], 4
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], rax
mov rcx, qword [rbp + 8]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x140002af0
mov rax, qword [rbp - 0x28]
mov r8, qword [rax]
test r8, r8
je 0x140002af0
mov rax, qword [rbp - 0x48]
mov rdx, qword [rax]
cmp r8, qword [rbp]
cmovb r8, qword [rbp]
sub r8, rdx
sar r8, 1
jmp 0x140002b2b
test cl, 4
jne 0x140002b1d
mov rax, qword [rbp - 0x30]
mov rcx, qword [rax]
test rcx, rcx
je 0x140002b1d
mov rax, qword [rbp - 0x50]
mov rdx, qword [rax]
mov rax, qword [rbp - 0x18]
movsxd r8, dword [rax]
add r8, r8
sub r8, rdx
add r8, rcx
sar r8, 1
jmp 0x140002b2b
mov r8, qword [rbp + 0x88]
mov rdx, qword [rbp + 0x80]
test rdx, rdx
je 0x140002b3d
lea rcx, [rbp + 0xc8]
call fcn.1400123a0
nop
lea rcx, [rbp - 0x80]
call fcn.140002200
nop
lea rdx, [rbp + 0xc8]
cmp qword [rbp + 0xe0], 8
cmovae rdx, qword [rbp + 0xc8]
lea rcx, [rbp + 0x80]
call fcn.1400109a0
nop
lea rdx, [rbp + 0x80]
cmp qword [rbp + 0x98], 0x10
cmovae rdx, qword [rbp + 0x80]
mov r8, r14
inc r8
cmp byte [rdx + r8], 0
jne 0x140002b85
lea rcx, [rbp + 0xa8]
call fcn.140011ad0
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x140002bdd
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002bd8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003461
call fcn.14009b510
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0xa0]
call fcn.140037890
mov rdi, qword [rsp + 0x38]
test eax, eax
je 0x140002c2d
mov r12, qword [rsp + 0x40]
mov rcx, r12
sub rcx, rdi
mov rax, qword [rsp + 0x50]
lea rbx, [rax + 4]
cmp rbx, rcx
ja 0x140002c2d
mov esi, dword [rdi + rax]
mov qword [rsp + 0x50], rbx
lea eax, [rsi - 1]
cmp eax, 0xb
jbe 0x140002e3f
cmp esi, 0xe
je 0x140002e3f
sub r13, r15
mov rdx, qword [rsp + 0x48]
sub rdx, rdi
cmp r13, rdx
jbe 0x140002cc4
movabs rbx, 0x7fffffffffffffff
cmp r13, rbx
ja 0x140003467
mov rcx, rdx
shr rcx, 1
mov rax, rbx
sub rax, rcx
cmp rdx, rax
ja 0x140002c70
lea rbx, [rdx + rcx]
cmp rbx, r13
cmovb rbx, r13
test rdi, rdi
je 0x140002cb2
mov rax, rdi
cmp rdx, 0x1000
jb 0x140002c9a
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003479
mov rcx, rdi
call fcn.14009b510
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
xor eax, eax
mov qword [rsp + 0x48], rax
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.140009b60
mov rdi, qword [rsp + 0x38]
mov r8, r13
mov rdx, r15
mov rcx, rdi
call fcn.14009de10
lea rax, [rdi + r13]
mov qword [rsp + 0x40], rax
mov edx, 0xffffffff
lea rcx, [rbp + 0xe8]
call fcn.1400397b0
nop
cmp qword [rax + 0x18], 8
jb 0x140002cf7
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rbp + 0x80]
call fcn.1400109a0
nop
lea rdx, [rbp + 0x80]
cmp qword [rbp + 0x98], 0x10
cmovae rdx, qword [rbp + 0x80]
nop
inc r14
cmp byte [rdx + r14], 0
jne 0x140002d20
mov r8, r14
lea rcx, [rbp + 0xa8]
call fcn.140011ad0
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x140002d7b
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002d76
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000346d
call fcn.14009b510
xor r14d, r14d
mov qword [rbp + 0x90], r14
mov qword [rbp + 0x98], reloc.OLEAUT32.dll_SafeArrayDestroy
mov byte [rbp + 0x80], r14b
mov rdx, qword [rbp + 0x100]
cmp rdx, 8
jb 0x140002ddd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xe8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002dd8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003473
call fcn.14009b510
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0xa0]
call fcn.140037890
mov rdi, qword [rsp + 0x38]
test eax, eax
je 0x140002e26
mov qword [rsp + 0x50], r14
mov r12, qword [rsp + 0x40]
mov rcx, r12
sub rcx, rdi
cmp rcx, 4
jb 0x140002e26
mov esi, dword [rdi]
mov ebx, 4
mov qword [rsp + 0x50], rbx
lea eax, [rsi - 1]
cmp eax, 0xb
jbe 0x140002e42
cmp esi, 0xe
je 0x140002e42
mov rcx, qword [rsp + 0x58]
mov rcx, qword [rcx]
add rcx, 0x1f0
call fcn.14003a010
jmp 0x140003313
xor r14d, r14d
cmp esi, 0xe
setl r11b
mov byte [rsp + 0x30], r11b
mov edx, r14d
mov r9d, r14d
mov r10d, r14d
lea rax, [rbx + 4]
cmp rax, rcx
ja 0x140002e6b
mov edx, dword [rdi + rbx]
mov rbx, rax
mov qword [rsp + 0x50], rax
mov r13, qword [rsp + 0x58]
mov rax, qword [r13]
mov dword [rax + 0x1f0], edx
mov rdx, qword [r13]
xor eax, eax
lea r8, [rbx + 4]
cmp r8, rcx
ja 0x140002e94
mov eax, dword [rdi + rbx]
mov rbx, r8
mov qword [rsp + 0x50], rbx
cmp eax, 1
sete al
mov byte [rdx + 0x201], al
cmp esi, 2
jle 0x140002ec5
lea rax, [rbx + 4]
cmp rax, rcx
ja 0x140002eba
mov r9d, dword [rdi + rbx]
mov rbx, rax
mov qword [rsp + 0x50], rax
mov rax, qword [r13]
mov dword [rax + 0x1f4], r9d
cmp esi, 3
jle 0x140002eea
lea rax, [rbx + 4]
cmp rax, rcx
ja 0x140002edf
mov r10d, dword [rdi + rbx]
mov rbx, rax
mov qword [rsp + 0x50], rax
mov rax, qword [r13]
mov dword [rax + 0x1f8], r10d
cmp esi, 4
jle 0x140002f15
mov rdx, qword [r13]
xor eax, eax
lea r8, [rbx + 4]
cmp r8, rcx
ja 0x140002f09
mov eax, dword [rdi + rbx]
mov rbx, r8
mov qword [rsp + 0x50], rbx
cmp eax, 1
sete al
mov byte [rdx + 0x202], al
cmp esi, 5
jle 0x140002f39
mov r8, qword [r13]
lea rdx, [rbx + 4]
cmp rdx, rcx
ja 0x140002f39
mov eax, dword [rdi + rbx]
mov dword [r8 + 0x204], eax
mov rbx, rdx
mov qword [rsp + 0x50], rdx
cmp esi, 6
jle 0x140002f5d
mov r8, qword [r13]
lea rdx, [rbx + 4]
cmp rdx, rcx
ja 0x140002f5d
mov eax, dword [rdi + rbx]
mov dword [r8 + 0x208], eax
mov rbx, rdx
mov qword [rsp + 0x50], rdx
cmp esi, 7
jle 0x140002f8c
mov rdx, qword [r13]
add rdx, 0x258
lea rcx, [rsp + 0x38]
call fcn.140035dc0
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
movzx r11d, byte [rsp + 0x30]
cmp esi, 8
jle 0x140002fbf
mov rcx, qword [r13]
xor eax, eax
mov edx, eax
mov rax, r12
sub rax, rdi
lea r8, [rbx + 4]
cmp r8, rax
ja 0x140002fb3
mov edx, dword [rdi + rbx]
mov rbx, r8
mov qword [rsp + 0x50], rbx
cmp edx, 1
sete al
mov byte [rcx + 0x200], al
cmp esi, 9
jle 0x140003016
mov rcx, r12
sub rcx, rdi
lea rax, [rbx + 4]
cmp rax, rcx
ja 0x140002fdf
mov r14d, dword [rdi + rbx]
mov rbx, rax
mov qword [rsp + 0x50], rax
mov rax, qword [r13]
mov dword [rax + 0x20c], r14d
mov rdx, qword [r13]
xor r14d, r14d
mov eax, r14d
lea r8, [rbx + 4]
cmp r8, rcx
ja 0x140003008
mov eax, dword [rdi + rbx]
mov rbx, r8
mov qword [rsp + 0x50], rbx
cmp eax, 1
sete al
mov byte [rdx + 0x210], al
jmp 0x140003019
xor r14d, r14d
cmp esi, 0xa
jle 0x140003061
mov rdx, qword [r13]
add rdx, 0x290
movzx r8d, r11b
lea rcx, [rsp + 0x38]
call fcn.140033940
mov rdx, qword [r13]
add rdx, 0x270
movzx r8d, byte [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.140033940
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
cmp esi, 0xb
jle 0x14000308a
mov rdx, qword [r13]
mov rax, r12
sub rax, rdi
lea rcx, [rbx + 4]
cmp rcx, rax
ja 0x14000308a
mov eax, dword [rdi + rbx]
mov dword [rdx + 0x1fc], eax
mov rbx, rcx
mov qword [rsp + 0x50], rcx
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], r14
mov esi, ebx
mov qword [rsp + 0x58], r14
cmp rdi, r12
je 0x14000329a
mov rcx, qword [rbp + 0xa0]
test rcx, rcx
jne 0x140003161
mov dword [rsp + 0x20], 0xf0000008
mov r14d, 1
mov r9d, r14d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0xa0]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x140003157
xor eax, eax
mov dword [rsp + 0x20], eax
mov r9d, r14d
xor r8d, r8d
lea rdx, str.Spreadsheet_Tools
lea rcx, [rbp + 0xa0]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x140003157
mov dword [rsp + 0x20], 8
mov r9d, r14d
xor r8d, r8d
lea rdx, str.Spreadsheet_Tools
lea rcx, [rbp + 0xa0]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x140003157
mov dword [rsp + 0x20], 0x20
mov r9d, r14d
xor r8d, r8d
lea rdx, str.Spreadsheet_Tools
lea rcx, [rbp + 0xa0]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140003210
mov rcx, qword [rbp + 0xa0]
xor r14d, r14d
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8003
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140003210
test ebx, ebx
jne 0x14000318e
sub r12, rdi
mov rsi, r12
xor r9d, r9d
mov r8d, esi
mov rdx, rdi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1400031fc
mov dword [rsp + 0x60], reloc.WS2_32.dll_recv
lea r8, [rsp + 0x30]
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rbp + 0x80]
call fcn.140019c40
mov dword [rsp + 0x20], r14d
lea r9, [rsp + 0x60]
mov rsi, qword [rbp + 0x80]
mov r8, rsi
mov edx, 2
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x140003203
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x1400032a1
mov rsi, qword [rbp + 0x80]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x140003217
mov rsi, qword [rbp + 0x80]
mov r14, qword [rbp + 0x88]
mov rcx, r14
sub rcx, rsi
cmp rcx, 1
jbe 0x14000323a
lea r14, [rsi + 1]
mov qword [rbp + 0x88], r14
mov byte [rsi], reloc.OLEAUT32.dll_SafeArrayUnaccessData
jmp 0x1400032a8
jae 0x140003295
mov rax, qword [rbp + 0x90]
sub rax, rsi
cmp rax, 1
jae 0x140003275
lea r8, [rsp + 0x30]
mov edx, 1
lea rcx, [rbp + 0x80]
call fcn.140019c40
mov r14, qword [rbp + 0x88]
mov rsi, qword [rbp + 0x80]
mov byte [rsi], reloc.OLEAUT32.dll_SafeArrayUnaccessData
jmp 0x1400032a8
mov r12d, 1
sub r12, rcx
mov r8, r12
xor edx, edx
mov rcx, r14
call fcn.14009e4c0
add r14, r12
mov qword [rbp + 0x88], r14
mov byte [rsi], reloc.OLEAUT32.dll_SafeArrayUnaccessData
jmp 0x1400032a8
mov rsi, qword [rbp + 0x80]
mov r14, qword [rbp + 0x88]
mov ecx, ebx
add rcx, 4
add rcx, rdi
sub r14, rsi
mov r8, r14
mov rdx, rsi
call fcn.14009ee60
test eax, eax
je 0x1400032d4
mov rcx, qword [r13]
add rcx, 0x1f0
call fcn.14003a010
nop
test rsi, rsi
je 0x140003310
mov rdx, qword [rbp + 0x90]
sub rdx, rsi
mov rax, rsi
cmp rdx, 0x1000
jb 0x140003308
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003479
mov rcx, rsi
call fcn.14009b510
xor r14d, r14d
mov rdx, qword [rbp + 0xe0]
cmp rdx, 8
jb 0x140003359
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003354
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000347f
call fcn.14009b510
mov qword [rbp + 0xd8], r14
mov qword [rbp + 0xe0], 7
mov word [rbp + 0xc8], r14w
test r15, r15
je 0x1400033b1
mov rcx, qword [rsp + 0x78]
sub rcx, r15
mov rax, r15
cmp rcx, 0x1000
jb 0x1400033a5
add rcx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003485
mov rdx, rcx
mov rcx, r15
call fcn.14009b510
nop
test rdi, rdi
je 0x1400033ec
mov rdx, qword [rsp + 0x48]
sub rdx, rdi
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400033e3
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000348b
mov rcx, rdi
call fcn.14009b510
nop
mov rdx, qword [rbp + 0xc0]
cmp rdx, 0x10
jb 0x140003429
inc rdx
mov rcx, qword [rbp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003424
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003455
call fcn.14009b510
mov al, 1
mov rcx, qword [rbp + 0x118]
xor rcx, rsp
call fcn.14009b5b0
mov rbx, qword [rsp + 0x270]
add rsp, 0x220
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400ac408
nop
call fcn.140012140
nop
call fcn.1400ac408
int3
call fcn.140011500
nop
call fcn.1400ac408
nop
call fcn.1400ac408
int3
call fcn.1400ac408
nop
call fcn.1400ac408
nop
call fcn.1400ac408
nop
call fcn.1400ac408
int3