Function at 0x1000c05f0
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb8
mov rax, qword [0x10010f190]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r12, qword [rsp + 0x120]
mov rbp, qword [rsp + 0x128]
xor r14d, r14d
movsxd rdi, ecx
mov r13, r8
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x58], r9
mov dword [rsp + 0x50], edx
mov r8d, edx
mov dword [rsp + 0x54], edi
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x38], r14
lea esi, [r14 + 1]
cmp dword [0x10011beb8], r14d
jne 0x1000c06b7
lea r8d, [r14 + 0x14]
lea rdx, [rsp + 0x78]
lea rcx, [0x100029eb0]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0x12
ja 0x1000c069e
lea rcx, [rsp + 0x78]
mov dword [0x10011bebc], esi
call qword [sym.imp.msvcrt.dll__wtoi]
mov dword [0x10011bec0], eax
mov edx, eax
mov dword [0x10011c8f4], eax
jmp 0x1000c06aa
mov eax, dword [0x10011bec0]
mov edx, dword [0x10011c8f4]
mov r8d, dword [rsp + 0x50]
mov dword [0x10011beb8], esi
jmp 0x1000c06c3
mov eax, dword [0x10011bec0]
mov edx, dword [0x10011c8f4]
cmp eax, r14d
jne 0x1000c06d2
bt r8d, 0x1f
mov cl, r14b
jae 0x1000c06d5
mov cl, sil
mov byte [rsp + 0x30], cl
cmp dword [0x10011bebc], r14d
jne 0x1000c06f1
cmp edi, r14d
jne 0x1000c06f1
bt r8d, 0x1e
mov r15b, r14b
jae 0x1000c06f4
mov r15b, sil
mov ebx, r8d
shr ebx, 0x1d
not bl
and bl, sil
cmp cl, r14b
jne 0x1000c070d
cmp r15b, r14b
je 0x1000c0cd9
cmp eax, r14d
je 0x1000c0722
add edx, esi
cmp edx, eax
sbb eax, eax
and eax, edx
mov edx, eax
mov dword [0x10011c8f4], eax
cmp r15b, r14b
je 0x1000c07a1
cmp bl, r14b
je 0x1000c073d
lea rdx, [0x100029ed0]
or ecx, 0xffffffff
call sub.certcli.dll_Ordinal_203
jmp 0x1000c0749
lea rcx, [0x100029f00]
call fcn.1000b99b0
mov edx, dword [rbp + 8]
lea r9, [0x100110d70]
lea r8, [0x100029f50]
mov cl, bl
call fcn.1000bf55c
mov edx, dword [rbp + 4]
lea r9, [0x100110c00]
lea r8, [0x100029f88]
mov cl, bl
call fcn.1000bf55c
cmp dword [rbp], 0x30
jb 0x1000c0797
cmp dword [rbp + 0x28], r14d
je 0x1000c0797
mov r8d, dword [rbp + 0x2c]
lea rdx, [0x100029fc0]
mov cl, bl
call fcn.1000c04ec
mov cl, byte [rsp + 0x30]
mov edx, dword [0x10011c8f4]
mov esi, r14d
mov dword [rsp + 0x40], r14d
mov qword [rsp + 0x70], rdi
cmp dword [rbp + 0xc], r14d
jbe 0x1000c0c08
mov r13, r14
cmp cl, r14b
je 0x1000c07d1
mov rcx, qword [rbp + 0x10]
mov r8d, esi
mov rcx, qword [r13 + rcx]
call fcn.1000bf848
cmp r15b, r14b
je 0x1000c083e
mov rax, qword [rbp + 0x10]
lea r9, [0x100110d70]
lea r8, [0x10002a010]
mov rcx, qword [r13 + rax]
mov edx, dword [rcx + 8]
mov cl, bl
call fcn.1000bf55c
mov r11, qword [rbp + 0x10]
lea r9, [0x100110c00]
mov rax, qword [r13 + r11]
lea r8, [0x10002a048]
mov cl, bl
mov edx, dword [rax + 4]
call fcn.1000bf55c
mov r11, qword [rbp + 0x10]
mov rax, qword [r13 + r11]
cmp dword [rax], 0x28
jb 0x1000c083e
cmp dword [rax + 0x20], r14d
je 0x1000c083e
mov r8d, dword [rax + 0x24]
lea rdx, [0x10002a080]
mov cl, bl
call fcn.1000c04ec
mov rcx, qword [rsp + 0x38]
cmp rcx, r14
je 0x1000c0853
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov qword [rsp + 0x38], r14
mov rcx, qword [rsp + 0x48]
cmp rcx, r14
je 0x1000c0865
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea r8, [0x10001e3a0]
lea rcx, [rsp + 0x48]
mov r9d, 1
xor edx, edx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
cmp eax, r14d
jne 0x1000c08ae
mov qword [rsp + 0x48], r14
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0xd2d01a3
jmp 0x1000c08e9
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8004
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
cmp eax, r14d
jne 0x1000c08fa
mov qword [rsp + 0x38], r14
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0xd3401a3
mov r8d, eax
xor r9d, r9d
xor ecx, ecx
mov edi, eax
call fcn.1000b51b8
jmp 0x1000c08fd
mov edi, r14d
cmp edi, r14d
je 0x1000c0947
mov rcx, qword [rsp + 0x48]
cmp rcx, r14
je 0x1000c0935
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
cmp eax, r14d
jne 0x1000c0930
call sub.KERNEL32.dll_GetLastError
xor r9d, r9d
mov r8d, edi
mov edx, 0xd3f01a3
xor ecx, ecx
call fcn.1000b51b8
mov qword [rsp + 0x48], r14
xor r9d, r9d
mov r8d, edi
mov edx, 0xf6d01a3
xor ecx, ecx
call fcn.1000b51b8
mov rcx, qword [rbp + 0x10]
mov r12d, r14d
mov rax, qword [r13 + rcx]
cmp dword [rax + 0xc], r14d
jbe 0x1000c0bdc
mov rax, qword [r13 + rcx]
mov rcx, qword [rax + 0x10]
mov rdi, qword [r14 + rcx]
test r15b, r15b
jne 0x1000c0981
cmp qword [rsp + 0x70], 0
jne 0x1000c0981
cmp dword [rdi + 0x10], 0
je 0x1000c0bbf
mov eax, dword [rdi + 0x10]
test bl, bl
je 0x1000c09aa
mov dword [rsp + 0x28], eax
mov eax, dword [rdi + 0x14]
lea rdx, [0x10002a0d0]
mov r9d, r12d
mov r8d, esi
or ecx, 0xffffffff
mov dword [rsp + 0x20], eax
call sub.certcli.dll_Ordinal_203
jmp 0x1000c09c3
mov r9d, dword [rdi + 0x14]
lea rcx, [0x10002a110]
mov r8d, r12d
mov edx, esi
mov dword [rsp + 0x20], eax
call fcn.1000b99b0
mov rcx, qword [rdi + 8]
mov r8b, 1
mov dl, bl
call fcn.1000c007c
test eax, eax
je 0x1000c09e7
xor r9d, r9d
mov r8d, eax
mov edx, 0xf8401a3
xor ecx, ecx
call fcn.1000b51b8
mov edx, dword [rdi + 0x14]
lea r9, [0x100110d70]
lea r8, [0x10002a180]
mov cl, bl
call fcn.1000bf55c
mov edx, dword [rdi + 0x10]
lea r9, [0x100110c00]
lea r8, [0x10002a1b0]
mov cl, bl
call fcn.1000bf55c
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x1000c0a33
mov r8, qword [rbp + 0x10]
mov ecx, dword [rsp + 0x50]
mov edx, r12d
mov r8, qword [r13 + r8]
call rax
mov rsi, qword [rdi + 0x18]
test rsi, rsi
je 0x1000c0aa1
cmp dword [rsi], 0x28
jb 0x1000c0aa1
mov r8, qword [rsi + 0x20]
test r8, r8
je 0x1000c0aa1
mov r9, qword [rsp + 0x38]
mov r8, qword [r8 + 8]
xor edx, edx
mov cl, bl
call fcn.1000c0344
test eax, eax
je 0x1000c0a72
xor r9d, r9d
mov r8d, eax
mov edx, 0xfa101a3
xor ecx, ecx
call fcn.1000b51b8
mov r8, qword [rsi + 0x20]
mov r9, qword [rsp + 0x38]
mov edx, 1
mov r8, qword [r8 + 0x10]
mov cl, bl
call fcn.1000c0344
test eax, eax
je 0x1000c0aa1
xor r9d, r9d
mov r8d, eax
mov edx, 0xfa801a3
xor ecx, ecx
call fcn.1000b51b8
cmp dword [rdi], 0x28
jb 0x1000c0ab8
mov r8, qword [rdi + 0x20]
lea rdx, [0x10002a1e0]
mov cl, bl
call fcn.1000bf5ec
cmp dword [rdi], 0x30
jb 0x1000c0acf
mov r8, qword [rdi + 0x28]
lea rdx, [0x10002a1f8]
mov cl, bl
call fcn.1000bf5ec
cmp dword [rdi], 0x38
jb 0x1000c0b01
mov rdx, qword [rdi + 0x30]
test rdx, rdx
je 0x1000c0b01
test bl, bl
je 0x1000c0af5
mov r8, rdx
lea rdx, [0x10002a214]
or ecx, 0xffffffff
call sub.certcli.dll_Ordinal_203
jmp 0x1000c0b01
lea rcx, [0x1000109c0]
call fcn.1000b99b0
mov rax, qword [rbp + 0x10]
lea esi, [r12 + 1]
mov rcx, qword [r13 + rax]
cmp esi, dword [rcx + 0xc]
jne 0x1000c0b27
mov rdx, qword [rsp + 0x38]
lea r8, [0x10002a220]
mov cl, bl
call fcn.1000bfd8c
mov rcx, qword [rsp + 0x38]
mov rax, qword [rdi + 8]
test rcx, rcx
je 0x1000c0b6c
mov r8d, dword [rax + 0x10]
mov rdx, qword [rax + 8]
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x1000c0b6c
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
xor r9d, r9d
mov edx, 0xdb801a3
mov r8d, eax
xor ecx, ecx
mov edi, eax
call fcn.1000b51b8
jmp 0x1000c0b6e
xor edi, edi
test edi, edi
je 0x1000c0b84
xor r9d, r9d
mov r8d, edi
mov edx, 0xfc701a3
xor ecx, ecx
call fcn.1000b51b8
mov rax, qword [rbp + 0x10]
mov rcx, qword [r13 + rax]
cmp esi, dword [rcx + 0xc]
jne 0x1000c0bbb
mov rdx, qword [rsp + 0x38]
lea r8, [0x10002a238]
mov cl, bl
call fcn.1000bfd8c
test eax, eax
je 0x1000c0bbb
xor r9d, r9d
mov r8d, eax
mov edx, 0xfcc01a3
xor ecx, ecx
call fcn.1000b51b8
mov esi, dword [rsp + 0x40]
mov rcx, qword [rbp + 0x10]
inc r12d
add r14, 8
mov rax, qword [r13 + rcx]
cmp r12d, dword [rax + 0xc]
jb 0x1000c095d
xor r14d, r14d
inc esi
add r13, 8
mov dword [rsp + 0x40], esi
cmp esi, dword [rbp + 0xc]
jae 0x1000c0bfa
mov edx, dword [0x10011c8f4]
mov cl, byte [rsp + 0x30]
jmp 0x1000c07bb
mov edi, dword [rsp + 0x54]
mov r12, qword [rsp + 0x60]
mov r13, qword [rsp + 0x68]
cmp r15b, r14b
je 0x1000c0cb7
cmp edi, r14d
je 0x1000c0c95
mov edx, 1
mov ecx, edi
call sub.certcli.dll_Ordinal_207
mov rdi, rax
cmp r12, r14
je 0x1000c0c52
cmp bl, r14b
je 0x1000c0c43
lea rdx, [0x10002a248]
mov r8, r12
or ecx, 0xffffffff
call sub.certcli.dll_Ordinal_203
jmp 0x1000c0c52
lea rcx, [0x10002a260]
mov rdx, r12
call fcn.1000b99b0
mov r8b, 1
mov dl, bl
mov rcx, r13
call fcn.1000c007c
cmp rdi, r14
je 0x1000c0c95
cmp bl, r14b
je 0x1000c0c7d
lea rdx, [0x10002a28c]
mov r8, rdi
or ecx, 0xffffffff
call sub.certcli.dll_Ordinal_203
jmp 0x1000c0c8c
lea rcx, [0x1000048e8]
mov rdx, rdi
call fcn.1000b99b0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp bl, r14b
je 0x1000c0cab
lea rdx, [0x10002a298]
or ecx, 0xffffffff
call sub.certcli.dll_Ordinal_203
jmp 0x1000c0cb7
lea rcx, [0x10002a2c0]
call fcn.1000b99b0
mov rcx, qword [rsp + 0x38]
cmp rcx, r14
je 0x1000c0cc7
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x48]
cmp rcx, r14
je 0x1000c0cd9
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1000ef870
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret