Function at 0x6e8cbe50
Capabilities:
Hash data via bcrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x40], ecx
xor ecx, ecx
mov dword [ebp - 0xc], ebx
mov ebx, edx
mov dword [ebp - 8], esi
mov dword [esp + 8], ecx
mov dword [ebp - 0x3c], eax
mov eax, dword [edi + 8]
mov dword [esp], 1
mov dword [esp + 4], eax
call sym.crypt32.dll_CryptFindOIDInfo
sub esp, 0xc
test eax, eax
je 0x6e8cbe92
cmp dword [eax + 0xc], 4
mov esi, eax
je 0x6e8cbeb0
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x80090008
xor ebx, ebx
mov esi, dword [ebp - 8]
mov eax, ebx
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov edx, dword [eax + 0x10]
cmp edx, 0xffffffff
je 0x6e8cbf80
cmp dword [eax + 0x14], 3
mov ecx, edx
jbe 0x6e8cbec9
mov eax, dword [eax + 0x18]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x6e8cbf58
mov dword [esp + 4], ebx
lea eax, [ebp - 0x20]
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x40]
mov dword [esp + 0xc], ecx
mov dword [ebp - 0x44], edx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call sym.crypt32.dll_CryptImportPublicKeyInfoEx
mov edx, dword [ebp - 0x44]
sub esp, 0x1c
test eax, eax
mov ebx, eax
je 0x6e8cbea1
lea eax, [ebp - 0x1c]
xor ebx, ebx
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x3c]
xor esi, esi
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.advapi32.dll_CryptCreateHash
sub esp, 0x14
test eax, eax
mov ebx, eax
jne 0x6e8cc140
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sub.advapi32.dll_CryptDestroyKey
sub esp, 4
jmp 0x6e8cbea1
mov dword [esp], edx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], edx
call sym.crypt32.dll_I_CryptGetDefaultCryptProv
mov ecx, dword [ebp - 0x48]
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x3c], eax
sub esp, 4
jmp 0x6e8cbed4
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call fcn.6e8cb740
test eax, eax
mov ebx, eax
je 0x6e8cbea1
mov dword [ebp - 0x24], 0
mov eax, dword [esi + 0x1c]
xor edx, edx
mov dword [esp + 8], edx
xor esi, esi
mov dword [esp + 0xc], esi
mov dword [ebp - 0x20], 0
mov dword [esp + 4], eax
lea eax, [ebp - 0x20]
mov dword [esp], eax
call sub.bcrypt.dll_BCryptOpenAlgorithmProvider
mov dword [ebp - 0x3c], 0
sub esp, 0x10
test eax, eax
mov ebx, eax
jne 0x6e8cc0d0
xor eax, eax
xor edx, edx
mov dword [esp + 0x18], eax
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x24]
xor ebx, ebx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
mov dword [esp], eax
call sub.bcrypt.dll_BCryptCreateHash
sub esp, 0x1c
test eax, eax
mov ebx, eax
jne 0x6e8cc0d0
xor eax, eax
mov dword [esp + 0xc], eax
mov eax, dword [edi]
mov dword [esp + 8], eax
mov eax, dword [edi + 4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.bcrypt.dll_BCryptHashData
sub esp, 0x10
test eax, eax
mov ebx, eax
jne 0x6e8cc0d0
lea eax, [ebp - 0x1c]
xor esi, esi
mov dword [esp + 0x10], eax
mov eax, 4
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x28]
mov dword [esp + 8], eax
mov eax, str.HashDigestLength
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 0x14], esi
mov dword [esp], eax
call sub.bcrypt.dll_BCryptGetProperty
sub esp, 0x18
test eax, eax
mov ebx, eax
jne 0x6e8cc0d0
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sym.crypt32.dll_CryptMemAlloc
mov dword [ebp - 0x3c], eax
sub esp, 4
test eax, eax
mov esi, eax
je 0x6e8cc43c
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x28]
xor ebx, ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.bcrypt.dll_BCryptFinishHash
sub esp, 0x10
test eax, eax
mov ebx, eax
jne 0x6e8cc446
lea esi, [esi]
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x6e8cc0e2
mov dword [esp], eax
call sub.bcrypt.dll_BCryptDestroyHash
sub esp, 4
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x6e8cc0fa
mov dword [esp], eax
xor edx, edx
mov dword [esp + 4], edx
call sub.bcrypt.dll_BCryptCloseAlgorithmProvider
sub esp, 8
test ebx, ebx
jne 0x6e8cc180
mov eax, dword [edi + 0x14]
test eax, eax
jne 0x6e8cc1ce
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0xd
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call sym.crypt32.dll_CryptMemFree
sub esp, 4
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call sub.bcrypt.dll_BCryptDestroyKey
sub esp, 4
jmp 0x6e8cbea1
xor ecx, ecx
mov dword [esp + 0xc], ecx
mov eax, dword [edi]
mov dword [esp + 8], eax
mov eax, dword [edi + 4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.advapi32.dll_CryptHashData
sub esp, 0x10
test eax, eax
mov ebx, eax
jne 0x6e8cc19b
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.advapi32.dll_CryptDestroyHash
sub esp, 4
jmp 0x6e8cbf3f
mov dword [esp], ebx
xor ebx, ebx
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
sub esp, 4
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], edx
jmp 0x6e8cc128
xor eax, eax
xor edx, edx
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov eax, dword [edi + 0x14]
mov dword [esp + 8], eax
mov eax, dword [edi + 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.advapi32.dll_CryptVerifySignatureW
sub esp, 0x18
mov ebx, eax
jmp 0x6e8cc167
mov dword [esp], eax
call sym.crypt32.dll_CryptMemAlloc
mov dword [ebp - 0x44], eax
sub esp, 4
test eax, eax
je 0x6e8cc396
mov eax, dword [edi + 0x14]
xor edx, edx
mov esi, dword [ebp - 0x44]
test eax, eax
je 0x6e8cc206
add eax, dword [edi + 0x18]
mov ecx, edx
not ecx
movzx eax, byte [eax + ecx]
mov byte [esi + edx], al
inc edx
mov eax, dword [edi + 0x14]
cmp eax, edx
ja 0x6e8cc1f0
mov edi, dword [ebp - 0x40]
mov ecx, 0x12
mov esi, dword [edi]
mov edi, 0x6e92aed6
mov dword [ebp - 0x40], esi
repe cmpsb byte [esi], byte es:[edi]
seta dl
sbb dl, 0
test dl, dl
je 0x6e8cc251
test byte [0x6e926040], 1
jne 0x6e8cc3a8
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x80090008
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call sym.crypt32.dll_CryptMemFree
sub esp, 4
jmp 0x6e8cc11a
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x44]
lea edi, [ebp - 0x20]
mov dword [esp + 0x18], edi
lea edx, [ebp - 0x1c]
xor esi, esi
mov dword [esp + 0x1c], edx
mov edi, 0x8000
mov dword [esp + 0x14], esi
mov dword [esp + 8], eax
mov eax, 0x2f
mov dword [esp + 0x10], edi
mov dword [esp + 4], eax
mov dword [esp], 1
call sym.crypt32.dll_CryptDecodeObjectEx
sub esp, 0x20
test eax, eax
mov ebx, eax
je 0x6e8cc23e
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
test edx, edx
je 0x6e8cc412
mov edi, dword [eax + 8]
test edi, edi
je 0x6e8cc412
add edi, edx
mov dword [esp], edi
call sym.crypt32.dll_CryptMemAlloc
push ecx
mov esi, eax
mov eax, dword [ebp - 0x20]
test esi, esi
je 0x6e8cc457
mov edx, dword [eax]
xor ecx, ecx
test edx, edx
je 0x6e8cc2e7
add edx, dword [eax + 4]
mov ebx, ecx
not ebx
movzx eax, byte [edx + ebx]
mov byte [esi + ecx], al
inc ecx
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
cmp edx, ecx
ja 0x6e8cc2cf
mov edx, dword [eax + 8]
test edx, edx
je 0x6e8cc30d
xor ecx, ecx
add edx, dword [eax + 0xc]
mov ebx, ecx
not ebx
movzx edx, byte [edx + ebx]
lea ebx, [esi + ecx]
inc ecx
add ebx, dword [eax]
mov byte [ebx], dl
mov eax, dword [ebp - 0x20]
mov edx, dword [eax + 8]
cmp edx, ecx
ja 0x6e8cc2f0
mov dword [esp], eax
xor ebx, ebx
call dword [sym.imp.kernel32.dll_LocalFree]
mov eax, dword [ebp - 0x44]
sub esp, 4
mov dword [esp], eax
call sym.crypt32.dll_CryptMemFree
mov eax, dword [ebp - 0x28]
xor ecx, ecx
sub esp, 4
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp + 4], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], edi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x10], esi
mov dword [esp], eax
call sub.bcrypt.dll_BCryptVerifySignature
sub esp, 0x1c
test eax, eax
mov ebx, eax
jne 0x6e8cc372
mov ebx, 1
mov dword [esp], esi
call sym.crypt32.dll_CryptMemFree
sub esp, 4
jmp 0x6e8cc11a
test byte [0x6e926040], 1
jne 0x6e8cc3e5
mov dword [esp], ebx
xor ebx, ebx
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
sub esp, 4
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], edx
jmp 0x6e8cc362
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0xe
jmp 0x6e8cc11a
mov eax, dword [ebp - 0x40]
mov edx, 0xffffffff
call fcn.6e8c5eb0
mov edx, 0x6e926040
mov dword [esp + 4], edx
mov dword [esp], 0
mov dword [esp + 0x10], eax
mov eax, str.Unsupported_public_key_type:__s_n
mov dword [esp + 0xc], eax
mov eax, str.CNG_PrepareSignature
mov dword [esp + 8], eax
call fcn.6e8c5b50
jmp 0x6e8cc231
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Failed_to_verify_signature:__08x_n
mov dword [esp + 8], str.CNG_VerifySignature
mov dword [esp + 4], 0x6e926040
mov dword [esp], 0
call fcn.6e8c5b50
jmp 0x6e8cc37b
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LocalFree]
mov eax, dword fs:[0x18]
push ebx
mov dword [eax + 0x34], 0xd
mov eax, dword [ebp - 0x44]
xor ebx, ebx
mov dword [esp], eax
call sym.crypt32.dll_CryptMemFree
push eax
jmp 0x6e8cc11a
mov ebx, 0xc0000017
jmp 0x6e8cc0d0
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call sym.crypt32.dll_CryptMemFree
push ecx
jmp 0x6e8cc0d0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LocalFree]
mov eax, dword fs:[0x18]
push edx
mov dword [eax + 0x34], 0xe
jmp 0x6e8cc429