Function at 0x140011c00
Capabilities:
Hash data via bcrypt
Print debug messages

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov dword [rsp + 0x40], 0xc0000001
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140013b80]
lea rcx, [rsp + 0x58]
call sub.ksecdd.sys_BCryptOpenAlgorithmProvider
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x140011f65
lea rcx, [0x140013b90]
call sub.ntoskrnl.exe_DbgPrint
cmp dword [rsp + 0x40], 0
jne 0x140011f57
mov dword [rsp + 0x28], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rsp + 0x48]
lea rdx, [0x140013bb0]
mov rcx, qword [rsp + 0x58]
call sub.ksecdd.sys_BCryptGetProperty
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x140011f4b
mov eax, dword [rsp + 0x48]
mov edx, eax
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0
je 0x140011f3d
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x48]
mov r8, qword [rsp + 0x70]
lea rdx, [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
call sub.ksecdd.sys_BCryptCreateHash
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x140011f22
xor r9d, r9d
mov r8d, dword [rsp + 0xa8]
mov rdx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x68]
call sub.ksecdd.sys_BCryptHashData
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x140011f0a
mov dword [rsp + 0x28], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rsp + 0x44]
lea rdx, [0x140013bd0]
mov rcx, qword [rsp + 0x58]
call sub.ksecdd.sys_BCryptGetProperty
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x140011efc
mov eax, dword [rsp + 0x44]
mov edx, eax
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140011eee
xor r9d, r9d
mov r8d, dword [rsp + 0x44]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x68]
call sub.ksecdd.sys_BCryptFinishHash
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x140011ed3
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140013c00]
lea rcx, [rsp + 0x80]
call sub.ksecdd.sys_BCryptOpenAlgorithmProvider
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x140011ec5
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8c
lea rax, str.ECS5B
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
lea r8, [0x140013c20]
xor edx, edx
mov rcx, qword [rsp + 0x80]
call sub.ksecdd.sys_BCryptImportKeyPair
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x140011ea8
mov dword [rsp + 0x30], 0
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x44]
mov r8, qword [rsp + 0x50]
xor edx, edx
mov rcx, qword [rsp + 0x78]
call sub.ksecdd.sys_BCryptVerifySignature
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x140011e6e
lea rcx, [0x140013c40]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x140011e9c
mov qword [rsp + 0x88], 0xfffffffffeced300
lea r8, [rsp + 0x88]
xor edx, edx
mov cl, 1
call qword [sym.imp.ntoskrnl.exe_KeDelayExecutionThread]
mov edx, dword [rsp + 0x40]
lea rcx, [0x140013c50]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rsp + 0x78]
call sub.ksecdd.sys_BCryptDestroyKey
jmp 0x140011eb4
lea rcx, [0x140013c70]
call sub.ntoskrnl.exe_DbgPrint
xor edx, edx
mov rcx, qword [rsp + 0x80]
call sub.ksecdd.sys_BCryptCloseAlgorithmProvider
jmp 0x140011ed1
lea rcx, [0x140013c90]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x140011edf
lea rcx, [0x140013cb0]
call sub.ntoskrnl.exe_DbgPrint
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x140011efa
lea rcx, [0x140013cd0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x140011f08
lea rcx, [0x140013cf0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x140011f16
lea rcx, [0x140013d20]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rsp + 0x68]
call sub.ksecdd.sys_BCryptDestroyHash
jmp 0x140011f2e
lea rcx, [0x140013d40]
call sub.ntoskrnl.exe_DbgPrint
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x140011f49
lea rcx, [0x140013d60]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x140011f57
lea rcx, [0x140013d90]
call sub.ntoskrnl.exe_DbgPrint
xor edx, edx
mov rcx, qword [rsp + 0x58]
call sub.ksecdd.sys_BCryptCloseAlgorithmProvider
jmp 0x140011f71
lea rcx, [0x140013dc0]
call sub.ntoskrnl.exe_DbgPrint
mov eax, dword [rsp + 0x40]
add rsp, 0x98
ret