Function at 0x14009c448
Capabilities:
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
xor r13d, r13d
mov dword [rbp - 0x20], 0x750053
mov rdi, rcx
mov dword [rbp + 0x38], r13d
lea rcx, str.hid_SuppDa_sd6C4OBLlNSh
mov qword [rbp - 0x48], r13
mov r12d, r13d
mov qword [rbp - 0x40], r13
mov r15d, r9d
mov dword [rbp - 0x1c], 0x700070
mov r14, r8
mov dword [rbp - 0x18], 0x610044
mov esi, edx
mov dword [rbp - 0x14], 0x610074
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.hid_E___R__7ZsisEqj2osJ
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.hid_E___R__wtKbeRUq4hCr
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.hid_E___R__aiEIzHpHFQcE
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.hid_E___R__KBSnn3wStWSo
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, 0x41
jbe 0x14009c848
mov rax, qword [rdi]
cmp rax, qword [rbp - 0x20]
jne 0x14009c502
mov eax, dword [rdi + 0x14]
lea rbx, [rdi + 0x18]
sub eax, 0x40
jmp 0x14009c508
mov rbx, rdi
lea eax, [rsi - 0x40]
mov dword [rbp - 0x50], eax
mov edi, 0x8004
lea rax, [rbp - 0x30]
mov edx, edi
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x14009c848
mov rcx, qword [rbp - 0x30]
xor r9d, r9d
mov rdx, rbx
lea r8d, [r9 + 0x20]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rbp - 0x30]
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r13
mov edx, r15d
call qword [sym.imp.ADVAPI32.dll_CryptSignHashW]
test eax, eax
je 0x14009c83e
mov edx, dword [rbp + 0x38]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x14009c83e
mov rcx, qword [rbp - 0x30]
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov edx, r15d
call qword [sym.imp.ADVAPI32.dll_CryptSignHashW]
test eax, eax
je 0x14009c835
lea rax, [rbp - 0x38]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, edi
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x14009c835
mov r8d, dword [rbp + 0x38]
xor r9d, r9d
mov rcx, qword [rbp - 0x38]
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rbp - 0x38]
lea rdx, [rbx + 0x20]
xor r9d, r9d
lea r8d, [r9 + 0x20]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov r8, qword [rbp - 0x38]
lea rax, [rbp - 0x28]
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov edx, 0x6801
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x14009c82b
xor r9d, r9d
lea rcx, [rbp - 0x50]
mov qword [rsp + 0x28], rcx
lea rax, [rbx + 0x40]
mov rcx, qword [rbp - 0x28]
xor edx, edx
mov qword [rsp + 0x20], rax
lea r14d, [r9 + 1]
mov r8d, r14d
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov r12d, eax
test eax, eax
je 0x14009c821
mov edx, dword [rbp - 0x50]
lea rcx, [rbx + 0x58]
add edx, 0xffffffe8
lea r9, [0x140010c00]
lea r8, [rbp - 0x48]
call fcn.14000f428
test eax, eax
je 0x14009c821
mov rax, qword [rbp - 0x48]
mov edi, r13d
cmp dword [rax], r13d
jbe 0x14009c811
lea r15d, [r14 + 0xf]
lea r8, [rax + 8]
mov ebx, edi
shl rbx, 5
lea rcx, str.____u___wZ
add r8, rbx
mov edx, edi
call fcn.14000b314
mov rdx, qword [rbp - 0x48]
lea rcx, [0x1400f92b8]
add rdx, 8
mov r8b, r14b
add rdx, rbx
call qword [sym.imp.ntdll.dll_RtlEqualUnicodeString]
test al, al
je 0x14009c751
mov rax, qword [rbp - 0x48]
mov rbx, qword [rbx + rax + 0x20]
mov edx, dword [rbx]
test edx, edx
je 0x14009c714
cmp edx, 4
je 0x14009c6ef
lea rcx, str._nUnknown_version:__u_n
call fcn.14000b314
jmp 0x14009c7f6
test byte [rbx + 4], 2
je 0x14009c7f6
lea rcx, str._n__NTLM:
call fcn.14000b314
lea rcx, [rbx + 0xc]
xor r8d, r8d
mov edx, r15d
jmp 0x14009c7f1
test byte [rbx + 4], r14b
je 0x14009c735
lea rcx, str._n____LM:
call fcn.14000b314
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, r15d
call fcn.1400115ec
test byte [rbx + 4], 2
je 0x14009c7f6
lea rcx, str._n__NTLM:
call fcn.14000b314
lea rcx, [rbx + 0x18]
jmp 0x14009c709
mov rdx, qword [rbp - 0x48]
lea rcx, [0x1400f91b0]
add rdx, 8
mov r8b, r14b
add rdx, rbx
call qword [sym.imp.ntdll.dll_RtlEqualUnicodeString]
test al, al
je 0x14009c7d2
mov rcx, qword [rbp - 0x48]
lea r9, [0x140010830]
lea r8, [rbp - 0x40]
mov edx, dword [rbx + rcx + 0x18]
mov rcx, qword [rbx + rcx + 0x20]
call fcn.14000f428
test eax, eax
je 0x14009c7f6
mov rdx, qword [rbp - 0x40]
mov ebx, r13d
cmp dword [rdx], r13d
jbe 0x14009c7c0
mov eax, ebx
lea rcx, [rax*2 + 1]
add rcx, rax
lea rcx, [rdx + rcx*8]
xor edx, edx
call fcn.1400c04e0
mov rdx, qword [rbp - 0x40]
add ebx, r14d
cmp ebx, dword [rdx]
jb 0x14009c79d
lea rdx, [0x14001085c]
lea rcx, [rbp - 0x40]
call fcn.14000f510
jmp 0x14009c7f6
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.14000b314
mov rcx, qword [rbp - 0x48]
mov r8d, 0x100001
mov edx, dword [rbx + rcx + 0x18]
mov rcx, qword [rbx + rcx + 0x20]
call fcn.1400115ec
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.14000b314
mov rax, qword [rbp - 0x48]
add edi, r14d
cmp edi, dword [rax]
jb 0x14009c68c
lea rdx, [0x140010c2c]
lea rcx, [rbp - 0x48]
call fcn.14000f510
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
lea r11, [rsp + 0x80]
mov eax, r12d
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret