Function at 0x14004c6b0
Capabilities:
Hash data using sha256

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x238
movaps xmmword [rsp + 0x220], xmm7
movaps xmmword [rsp + 0x210], xmm6
mov rdi, rdx
mov r15, rcx
mov rax, qword [0x1402b3040]
xor rax, rsp
mov qword [rsp + 0x208], rax
movabs rbp, 0x8000000000000010
mov eax, dword [0x1402c57a8]
mov ecx, dword [0x1402c2098]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14004ca3f
movsx rbx, byte [rdi + 0x17]
test rbx, rbx
jns 0x14004c72b
mov rbx, qword [rdi + 8]
mov rdi, qword [rdi]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
add rbp, 0xffffffffffffffe7
cmp rbx, rbp
ja 0x14004d292
cmp rbx, 0xb
jb 0x14004c7ce
mov rax, rbx
or rax, 3
cmp rax, 0xb
mov edx, Ordinal_14
cmovne rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1400123a0
xor r14d, r14d
lea rsi, [rsp + 0x30]
movzx eax, word [rdi + r14*2]
lea ecx, [rax - 0x61]
lea edx, [rax - 0x20]
cmp cx, 0x1a
cmovae edx, eax
mov rcx, rsi
call fcn.140159290
inc r14
cmp rbx, r14
jne 0x14004c775
mov r11, qword [0x1402c5798]
movzx eax, byte [rsp + 0x47]
test r11, r11
je 0x14004d276
test al, al
lea rdx, [rsp + 0x30]
mov r8, qword [rdx + 8]
mov r9, rax
cmovs r9, r8
mov rcx, qword [rdx]
cmovs rdx, rcx
lea r10, [0x1402c5798]
jmp 0x14004c7e1
test rbx, rbx
jne 0x14004c76d
jmp 0x14004c797
add r11, 8
mov r11, qword [r11]
test r11, r11
je 0x14004c836
movsx rbx, byte [r11 + 0x37]
mov rsi, rbx
test rbx, rbx
jns 0x14004c7f2
mov rsi, qword [r11 + 0x28]
cmp r9, rsi
mov rdi, rsi
cmovb rdi, r9
test rdi, rdi
je 0x14004c828
test bl, bl
js 0x14004c80b
lea rbx, [r11 + 0x20]
jmp 0x14004c80f
mov rbx, qword [r11 + 0x20]
xor r14d, r14d
movzx ebp, word [rdx + r14*2]
cmp word [rbx + r14*2], bp
ja 0x14004c831
jb 0x14004c7d5
inc r14
cmp rdi, r14
jne 0x14004c812
cmp rsi, r9
jne 0x14004d26b
mov r10, r11
jmp 0x14004c7d9
lea r11, [0x1402c5798]
cmp r10, r11
je 0x14004c8a1
movsx rdi, byte [r10 + 0x37]
mov r11, rdi
test rdi, rdi
jns 0x14004c853
mov r11, qword [r10 + 0x28]
cmp r11, r9
mov rsi, r9
cmovb rsi, r11
test rsi, rsi
je 0x14004c887
test dil, dil
js 0x14004c86d
lea rdi, [r10 + 0x20]
jmp 0x14004c871
mov rdi, qword [r10 + 0x20]
xor ebx, ebx
movzx ebp, word [rdi + rbx*2]
cmp word [rdx + rbx*2], bp
ja 0x14004c890
jb 0x14004c8a1
inc rbx
cmp rsi, rbx
jne 0x14004c873
cmp r9, r11
jne 0x14004d285
mov edx, dword [r10 + 0x38]
mov rcx, r15
call fcn.14004d2c0
jmp 0x14004c9ed
movaps xmm6, xmmword [0x140272a70]
lea rsi, [rsp + 0x58]
movaps xmmword [rsi - 8], xmm6
movaps xmmword [rsi + 8], xmm6
movabs rdx, 0xaaaaaaaaaaaaaaaa
mov qword [rsi + 0x18], rdx
movabs rdx, 0x40000000003
mov qword [rsi - 8], rdx
test al, al
cmovns r8, rax
lea rdx, [rsp + 0x30]
cmovs rdx, rcx
add r8, r8
xorps xmm7, xmm7
lea rdi, [rsp + 0x80]
movups xmmword [rdi + 0x5c], xmm7
movaps xmmword [rdi + 0x50], xmm7
movaps xmmword [rdi + 0x40], xmm7
movaps xmmword [rdi + 0x30], xmm7
movaps xmmword [rdi + 0x20], xmm7
movaps xmm0, xmmword [0x14028bf90]
movaps xmmword [rdi], xmm0
movaps xmm0, xmmword [0x14028bfa0]
movaps xmmword [rdi + 0x10], xmm0
mov dword [rdi + 0x6c], 0x20
mov rcx, rdi
call fcn.14016e000
mov rcx, rsi
mov rdx, rdi
call fcn.14016e340
movaps xmmword [rdi], xmm7
movaps xmmword [rdi + 0x10], xmm7
movaps xmmword [rdi + 0x20], xmm7
movaps xmmword [rdi + 0x30], xmm7
movaps xmmword [rdi + 0x40], xmm7
movaps xmmword [rdi + 0x50], xmm7
movaps xmmword [rdi + 0x60], xmm7
movaps xmmword [rdi + 0x30], xmm6
mov dword [rdi + 0x40], 0xaaaaaaaa
mov word [rdi], 0xa01
mov dword [rdi + 2], 0
mov word [rdi + 6], 0xf00
movaps xmm0, xmmword [rsi - 8]
movaps xmm1, xmmword [rsi + 8]
movups xmmword [rdi + 8], xmm0
movups xmmword [rdi + 0x18], xmm1
mov rax, qword [rsi + 0x18]
mov qword [rdi + 0x28], rax
lea rcx, [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x14004d290
lea rcx, [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
test eax, eax
je 0x14004d29c
mov esi, eax
mov rcx, rsi
call fcn.14019aa78
lea rcx, [rax + rsi]
xor edx, edx
mov r8, rax
add r8, rdx
je 0x14004d290
mov r9b, byte [rsp + rdx + 0x80]
mov byte [r8], r9b
inc rdx
cmp rsi, rdx
jne 0x14004c9bd
mov r8, rax
add r8, rdx
mov qword [r15], rax
mov qword [r15 + 8], r8
mov qword [r15 + 0x10], rcx
cmp byte [rsp + 0x47], 0
jns 0x14004c9fe
mov rcx, qword [rsp + 0x30]
call fcn.14019aab4
mov rcx, qword [rsp + 0x208]
xor rcx, rsp
cmp rcx, qword [0x1402b3040]
je 0x14004ca18
call fcn.14019d280
int3
mov rax, r15
movaps xmm6, xmmword [rsp + 0x210]
movaps xmm7, xmmword [rsp + 0x220]
add rsp, 0x238
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x1402c57a8]
call fcn.14019ae60
cmp dword [0x1402c57a8], 0xffffffff
jne 0x14004c71a
mov ecx, 0x20
call fcn.14019aa78
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x88], reloc.WLDAP32.dll_Ordinal_14
lea rcx, [rax + 0x1c]
lea rdx, str.INTERNETCLIENT
cmp rax, rdx
seta r8b
cmp rcx, rdx
setbe cl
or cl, r8b
je 0x14004d290
movups xmm0, xmmword [0x14028bfbc]
movups xmmword [rax + 0xc], xmm0
movups xmm0, xmmword [str.INTERNETCLIENT]
movups xmmword [rax], xmm0
mov word [rax + 0x1c], 0
mov dword [rsp + 0x98], 0
mov ecx, 0x30
call fcn.14019aa78
mov qword [rsp + 0xa0], rax
lea rsi, [rbp + 8]
mov qword [rsp + 0xb0], rsi
mov qword [rsp + 0xa8], Ordinal_26
lea rcx, [rax + 0x28]
lea rdx, str.INTERNETCLIENTSERVER
cmp rax, rdx
seta r8b
cmp rcx, rdx
setbe cl
or cl, r8b
je 0x14004d290
movups xmm0, xmmword [0x14028bfde]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [str.INTERNETCLIENTSERVER]
movups xmmword [rax], xmm0
movabs rcx, 0x52004500560052
mov qword [rax + 0x20], rcx
mov word [rax + 0x28], 0
mov dword [rsp + 0xb8], 1
mov ecx, 0x38
call fcn.14019aa78
mov qword [rsp + 0xc0], rax
lea rbx, [rbp + 0xc]
mov qword [rsp + 0xd0], rbx
mov qword [rsp + 0xc8], reloc.WLDAP32.dll_Ordinal_26
lea rcx, [rax + 0x34]
lea rdx, str.PRIVATENETWORKCLIENTSERVER
cmp rax, rdx
seta r8b
cmp rcx, rdx
setbe cl
or cl, r8b
je 0x14004d290
movups xmm0, xmmword [0x14028c018]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [0x14028c008]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [str.PRIVATENETWORKCLIENTSERVER]
movups xmmword [rax], xmm0
mov dword [rax + 0x30], 0x520045
mov word [rax + 0x34], 0
mov dword [rsp + 0xd8], 2
mov ecx, 0x20
call fcn.14019aa78
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xf0], rbp
mov qword [rsp + 0xe8], Ordinal_26
lea rcx, [rax + 0x1e]
lea rdx, str.PICTURESLIBRARY
cmp rax, rdx
seta r8b
cmp rcx, rdx
setbe cl
or cl, r8b
je 0x14004d290
movups xmm0, xmmword [0x14028c03c]
movups xmmword [rax + 0xe], xmm0
movups xmm0, xmmword [str.PICTURESLIBRARY]
movups xmmword [rax], xmm0
mov word [rax + 0x1e], 0
mov dword [rsp + 0xf8], 3
mov ecx, 0x20
call fcn.14019aa78
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x110], rbp
mov qword [rsp + 0x108], Ordinal_14
lea rcx, [rax + 0x1a]
lea rdx, str.VIDEOSLIBRARY
cmp rax, rdx
seta r8b
cmp rcx, rdx
setbe cl
or cl, r8b
je 0x14004d290
movups xmm0, xmmword [0x14028c058]
movups xmmword [rax + 0xa], xmm0
movups xmm0, xmmword [str.VIDEOSLIBRARY]
movups xmmword [rax], xmm0
mov word [rax + 0x1a], 0
mov dword [rsp + 0x118], 4
mov ecx, 0x20
call fcn.14019aa78
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x130], rbp
mov qword [rsp + 0x128], Ordinal_14
lea rcx, [rax + 0x18]
lea rdx, str.MUSICLIBRARY
cmp rax, rdx
seta r8b
cmp rcx, rdx
setbe cl
or cl, r8b
je 0x14004d290
movups xmm0, xmmword [str.MUSICLIBRARY]
movups xmmword [rax], xmm0
movabs rcx, 0x59005200410052
mov qword [rax + 0x10], rcx
mov word [rax + 0x18], 0
mov dword [rsp + 0x138], 5
mov ecx, Ordinal_41
call fcn.14019aa78
mov qword [rsp + 0x140], rax
lea r14, [rbp + 4]
mov qword [rsp + 0x150], r14
mov qword [rsp + 0x148], Ordinal_26
lea rcx, [rax + 0x20]
lea rdx, str.DOCUMENTSLIBRARY
cmp rax, rdx
seta r8b
cmp rcx, rdx
setbe cl
or cl, r8b
je 0x14004d290
movups xmm0, xmmword [0x14028c094]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [str.DOCUMENTSLIBRARY]
movups xmmword [rax], xmm0
mov word [rax + 0x20], 0
mov dword [rsp + 0x158], 6
mov ecx, 0x38
call fcn.14019aa78
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x170], rbx
mov qword [rsp + 0x168], Ordinal_26
lea rcx, [rax + 0x30]
lea rdx, str.ENTERPRISEAUTHENTICATION
cmp rax, rdx
seta r8b
cmp rcx, rdx
setbe cl
or cl, r8b
je 0x14004d290
movups xmm0, xmmword [0x14028c0c6]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [0x14028c0b6]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [str.ENTERPRISEAUTHENTICATION]
movups xmmword [rax], xmm0
mov word [rax + 0x30], 0
mov dword [rsp + 0x178], 7
mov ecx, 0x30
call fcn.14019aa78
mov qword [rsp + 0x180], rax
mov qword [rsp + 0x190], rsi
mov qword [rsp + 0x188], Ordinal_26
lea rcx, [rax + 0x2c]
lea rdx, str.SHAREDUSERCERTIFICATES
cmp rax, rdx
seta r8b
cmp rcx, rdx
setbe cl
or cl, r8b
je 0x14004d290
movups xmm0, xmmword [0x14028c0f4]
movups xmmword [rax + 0x1c], xmm0
movups xmm0, xmmword [0x14028c0e8]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [str.SHAREDUSERCERTIFICATES]
movups xmmword [rax], xmm0
mov word [rax + 0x2c], 0
mov dword [rsp + 0x198], 8
mov ecx, Ordinal_41
call fcn.14019aa78
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0x1b0], r14
mov qword [rsp + 0x1a8], Ordinal_26
lea rcx, [rax + 0x20]
lea rdx, str.REMOVABLESTORAGE
cmp rax, rdx
seta r8b
cmp rcx, rdx
setbe cl
or cl, r8b
je 0x14004d290
movups xmm0, xmmword [0x14028c116]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [str.REMOVABLESTORAGE]
movups xmmword [rax], xmm0
mov word [rax + 0x20], 0
mov dword [rsp + 0x1b8], 9
mov ecx, 0x20
call fcn.14019aa78
mov qword [rsp + 0x1c0], rax
mov qword [rsp + 0x1d0], rbp
mov qword [rsp + 0x1c8], Ordinal_14
lea rcx, [rax + 0x18]
lea rdx, str.APPOINTMENTS
cmp rax, rdx
seta r8b
cmp rcx, rdx
setbe cl
or cl, r8b
je 0x14004d290
mov qword [rsp + 0x28], r15
movups xmm0, xmmword [str.APPOINTMENTS]
movups xmmword [rax], xmm0
movabs rcx, 0x530054004e0045
mov qword [rax + 0x10], rcx
mov word [rax + 0x18], 0
lea rbx, [rsp + 0x1e0]
mov dword [rbx - 8], 0xa
mov byte [rbx + 0x17], 8
lea rax, [rsp + 0x1f0]
lea rcx, str.CONTACTS
cmp rbx, rcx
seta dl
cmp rax, rcx
setbe al
or al, dl
je 0x14004d290
lea r12, [rsp + 0xa0]
lea rsi, [rsp + 0xc0]
lea rax, [rsp + 0x1c0]
movups xmm0, xmmword [str.CONTACTS]
movups xmmword [rbx], xmm0
mov word [rax + 0x30], 0
mov dword [rax + 0x38], Ordinal_14
lea r14, [rsp + 0x58]
xorps xmm6, xmm6
movups xmmword [r14], xmm6
mov qword [r14 - 8], r14
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], r9
lea r15, [rsp + 0x50]
lea r13, [rsp + 0x30]
mov rcx, r15
mov rdx, r13
mov r8, r14
call fcn.14004d3a0
mov qword [rsp + 0x20], r12
mov rcx, r15
mov rdx, r13
mov r8, r14
mov r9, r12
call fcn.14004d3a0
mov qword [rsp + 0x20], rsi
mov rcx, r15
mov rdx, r13
mov r8, r14
mov r9, rsi
call fcn.14004d3a0
lea r9, [rsp + 0xe0]
mov qword [rsp + 0x20], r9
mov rcx, r15
mov rdx, r13
mov r8, r14
call fcn.14004d3a0
lea r9, [rsp + 0x100]
mov qword [rsp + 0x20], r9
mov rcx, r15
mov rdx, r13
mov r8, r14
call fcn.14004d3a0
lea r9, [rsp + 0x120]
mov qword [rsp + 0x20], r9
mov rcx, r15
mov rdx, r13
mov r8, r14
call fcn.14004d3a0
lea r9, [rsp + 0x140]
mov qword [rsp + 0x20], r9
mov rcx, r15
mov rdx, r13
mov r8, r14
call fcn.14004d3a0
lea r9, [rsp + 0x160]
mov qword [rsp + 0x20], r9
mov rcx, r15
mov rdx, r13
mov r8, r14
call fcn.14004d3a0
lea r9, [rsp + 0x180]
mov qword [rsp + 0x20], r9
mov rcx, r15
mov rdx, r13
mov r8, r14
call fcn.14004d3a0
lea r9, [rsp + 0x1a0]
mov qword [rsp + 0x20], r9
mov rcx, r15
mov rdx, r13
mov r8, r14
call fcn.14004d3a0
lea r9, [rsp + 0x1c0]
mov qword [rsp + 0x20], r9
mov rcx, r15
mov rdx, r13
mov r8, r14
call fcn.14004d3a0
mov qword [rsp + 0x20], rbx
mov rcx, r15
mov rdx, r13
mov r8, r14
mov r9, rbx
call fcn.14004d3a0
mov rax, qword [r15]
mov rcx, qword [r15 + 8]
mov qword [0x1402c5790], rax
mov qword [0x1402c5798], rcx
mov rax, qword [r15 + 0x10]
mov qword [0x1402c57a0], rax
test rax, rax
je 0x14004d2a8
lea rax, [0x1402c5798]
mov qword [rcx + 0x10], rax
mov qword [rsp + 0x50], r14
movups xmmword [r14], xmm6
xor ecx, ecx
call fcn.140037f20
cmp byte [rsp + 0x1f7], 0
mov r15, qword [rsp + 0x28]
jns 0x14004d15d
mov rcx, qword [rsp + 0x1e0]
call fcn.14019aab4
cmp byte [rsp + 0x1d7], 0
jns 0x14004d174
mov rcx, qword [rsp + 0x1c0]
call fcn.14019aab4
cmp byte [rsp + 0x1b7], 0
jns 0x14004d18b
mov rcx, qword [rsp + 0x1a0]
call fcn.14019aab4
cmp byte [rsp + 0x197], 0
jns 0x14004d1a2
mov rcx, qword [rsp + 0x180]
call fcn.14019aab4
cmp byte [rsp + 0x177], 0
jns 0x14004d1b9
mov rcx, qword [rsp + 0x160]
call fcn.14019aab4
cmp byte [rsp + 0x157], 0
jns 0x14004d1d0
mov rcx, qword [rsp + 0x140]
call fcn.14019aab4
cmp byte [rsp + 0x137], 0
jns 0x14004d1e7
mov rcx, qword [rsp + 0x120]
call fcn.14019aab4
cmp byte [rsp + 0x117], 0
jns 0x14004d1fe
mov rcx, qword [rsp + 0x100]
call fcn.14019aab4
cmp byte [rsp + 0xf7], 0
jns 0x14004d215
mov rcx, qword [rsp + 0xe0]
call fcn.14019aab4
cmp byte [rsp + 0xd7], 0
jns 0x14004d22c
mov rcx, qword [rsp + 0xc0]
call fcn.14019aab4
cmp byte [rsp + 0xb7], 0
jns 0x14004d243
mov rcx, qword [rsp + 0xa0]
call fcn.14019aab4
cmp byte [rsp + 0x97], 0
jns 0x14004d25a
mov rcx, qword [rsp + 0x80]
call fcn.14019aab4
lea rcx, [0x1402c57a8]
call fcn.14019ad84
jmp 0x14004c71a
jb 0x14004c7d5
jmp 0x14004c831
mov rcx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
jmp 0x14004c8a1
jb 0x14004c8a1
jmp 0x14004c890
ud2
lea rcx, [rsp + 0x30]
call fcn.1401da290
xor ecx, ecx
xor r8d, r8d
xor eax, eax
jmp 0x14004c9e2
lea rax, [0x1402c5798]
mov qword [0x1402c5790], rax
jmp 0x14004d13c