Function at 0x18002ca44
Capabilities:
Hash data via bcrypt
Read file via mapping

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x170
mov rax, qword [0x180093630]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov r13, qword [rsp + 0x1d8]
xor esi, esi
mov rbp, rcx
mov qword [rsp + 0x50], rdx
mov rcx, qword [rsp + 0x1d0]
mov rdi, r8
mov qword [rsp + 0x58], rcx
mov rax, rdx
mov qword [rsp + 0x48], r13
mov r12d, esi
mov qword [rsp + 0x40], rsi
mov r15d, esi
test rbp, rbp
jne 0x18002cab0
test rax, rax
je 0x18002ccc7
test rdi, rdi
je 0x18002ccc7
test rcx, rcx
je 0x18002ccc7
test r13, r13
je 0x18002ccc7
cmp r9d, 0x8003
jne 0x18002cadd
lea r14, [0x1800935f0]
jmp 0x18002caf1
cmp r9d, 0x800c
jne 0x18002ccc7
lea r14, [0x1800935d0]
cmp qword [r14], rsi
jne 0x18002cb0a
mov rcx, r14
call fcn.18002f798
mov esi, eax
test eax, eax
js 0x18002cc89
xor esi, esi
mov eax, dword [r14 + 0xc]
cmp dword [r13], eax
jae 0x18002cb1e
mov esi, 0xc0000023
jmp 0x18002cc89
mov r9d, dword [r14 + 8]
cmp r9d, 0x100
jbe 0x18002cb5a
mov ebx, r9d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r12, rax
test rax, rax
jne 0x18002cb54
mov esi, 0xc0000017
jmp 0x18002cc89
mov r9d, dword [r14 + 8]
jmp 0x18002cb5f
lea r12, [rsp + 0x60]
mov rcx, qword [r14]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x30], esi
mov r8, r12
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.bcrypt.dll_BCryptCreateHash]
mov esi, eax
test eax, eax
js 0x18002cc89
xor ebx, ebx
test rbp, rbp
je 0x18002cbdb
mov r15, rbp
mov rbp, rdi
test rdi, rdi
jle 0x18002cc54
mov r13d, 0x4000000
mov rcx, qword [rsp + 0x40]
cmp rbp, r13
mov rdx, r15
cmovg rbp, r13
xor r9d, r9d
mov r8d, ebp
call qword [sym.imp.bcrypt.dll_BCryptHashData]
mov esi, eax
test eax, eax
js 0x18002cc7b
add r15, rbp
add rbx, rbp
mov rbp, rdi
sub rbp, rbx
test rbp, rbp
jg 0x18002cba3
jmp 0x18002cc4f
mov rbp, rdi
test rdi, rdi
jle 0x18002cc54
mov r13d, 0x4000000
mov rcx, qword [rsp + 0x50]
cmp rbp, r13
mov r8, rbx
mov r9d, ebx
cmovg rbp, r13
mov edx, 4
shr r8, 0x20
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r15, rax
test rax, rax
je 0x18002ccc0
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov r8d, ebp
mov rdx, rax
call qword [sym.imp.bcrypt.dll_BCryptHashData]
mov esi, eax
test eax, eax
js 0x18002cc7b
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
add rbx, rbp
xor r15d, r15d
mov rbp, rdi
sub rbp, rbx
test rbp, rbp
jg 0x18002cbe9
mov r13, qword [rsp + 0x48]
mov r8d, dword [r14 + 0xc]
xor r9d, r9d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.bcrypt.dll_BCryptFinishHash]
mov esi, eax
test eax, eax
js 0x18002cc7b
mov eax, dword [r14 + 0xc]
xor esi, esi
mov dword [r13], eax
test r15, r15
je 0x18002cc89
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18002cc99
call qword [sym.imp.bcrypt.dll_BCryptDestroyHash]
test r12, r12
je 0x18002ccbc
lea rax, [rsp + 0x60]
cmp r12, rax
je 0x18002ccbc
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, esi
jmp 0x18002cccc
mov esi, 0xc0000022
jmp 0x18002cc89
mov eax, 0xc000000d
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180017170
mov rbx, qword [rsp + 0x1c8]
add rsp, 0x170
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret