Function at 0x1400e4864
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
xor ecx, ecx
mov r13b, r9b
lea rsi, [rax - 0x50]
and r13b, 7
lea rbx, [rax - 0x48]
mov qword [rax - 0x50], rcx
mov qword [rax - 0x48], rcx
mov r12, r9
movsx rax, r13b
sub r12, rax
mov r14d, r8d
mov r15, rdx
mov ebp, ecx
lea edi, [rcx + 1]
cmp r13b, cl
je 0x1400e48c6
lea rsi, [r12 - 0x18]
lea rbx, [rsi + 8]
cmp qword [rbx], rcx
jne 0x1400e4b0e
cmp r8d, 0xffffcfc7
jne 0x1400e4ab7
lea rdx, [0x14012b12c]
or r8, 0xffffffffffffffff
mov rcx, r12
call fcn.1400634d4
lea rcx, [rsp + 0x50]
mov edx, 0x1c00
xor ebx, ebx
mov dword [rsp + 0x44], 0x400
mov r13d, edi
mov esi, edi
call fcn.1400633a8
mov r11, qword [rsp + 0x50]
lea rcx, [rsp + 0xd8]
lea rax, [r11 + 0x1800]
lea rbp, [r11 + 0x1000]
mov qword [rsp + 0x28], rcx
and qword [rsp + 0x20], rbx
mov qword [rsp + 0x58], rax
lea r15, [r11 + 0x1400]
xor ecx, ecx
jmp 0x1400e4972
lea rax, [rsp + 0xd8]
lea r9, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov ecx, ebx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_CryptEnumProviderTypesW]
add ebx, edi
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
mov ecx, ebx
lea r9, [rsp + 0x40]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptEnumProviderTypesW]
xor edx, edx
test eax, eax
jne 0x1400e4939
and dword [rsp + 0x20], eax
lea rcx, [rsp + 0x60]
mov r9d, edi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1400e4aa6
mov rcx, qword [rsp + 0x60]
lea r9, [rsp + 0x44]
mov r8, r15
mov edx, edi
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ADVAPI32.dll_CryptGetProvParam]
test eax, eax
je 0x1400e4a8d
and dword [rsp + 0x48], 0
mov rcx, qword [rsp + 0x58]
mov r13d, dword [r15]
lea rdx, [r15 + 4]
mov eax, 0x63
mov ebp, dword [rdx + 4]
mov r14d, dword [rdx]
cmp ebp, eax
cmovb eax, ebp
add rdx, 8
mov r8d, eax
mov ebx, eax
call fcn.1401077e0
mov rdx, qword [rsp + 0x58]
mov ecx, r13d
and ecx, 0xe000
mov byte [rbx + rdx], 0
cmp ecx, 0x2000
je 0x1400e4a4c
cmp ecx, 0x6000
je 0x1400e4a43
cmp ecx, 0x8000
je 0x1400e4a3a
lea rax, [0x14012b124]
lea r8, [0x14012b11c]
cmp ecx, 0xa000
cmove rax, r8
jmp 0x1400e4a53
lea rax, [0x14012b114]
jmp 0x1400e4a53
lea rax, [0x14012b10c]
jmp 0x1400e4a53
lea rax, [0x14012b104]
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x30], rdx
lea rdx, str._8.8xh___4d___4s___4d___s_r_n
mov r9d, r14d
mov r8d, r13d
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov rdx, qword [rsp + 0x50]
mov rcx, r12
call fcn.14006345c
mov r13d, dword [rsp + 0x48]
jmp 0x1400e4a8f
xor esi, esi
test esi, esi
jne 0x1400e49a5
mov rcx, qword [rsp + 0x60]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor edi, edi
lea rcx, [rsp + 0x50]
call fcn.14005b104
mov eax, edi
jmp 0x1400e4c1d
lea r8, str.Microsoft_Base_Cryptographic_Provider_v1.0
mov r9d, edi
xor edx, edx
mov rcx, rsi
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1400e4ae3
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400e4c1d
mov rcx, qword [rsi]
xor r9d, r9d
xor r8d, r8d
mov edx, r14d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x1400e4b0e
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor r15d, r15d
mov ebp, eax
jmp 0x1400e4bf7
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rbx]
xor r9d, r9d
mov r8d, r15d
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
xor r15d, r15d
cmp eax, r15d
jne 0x1400e4b3a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
jmp 0x1400e4bf7
test r13b, 2
je 0x1400e4b47
xor eax, eax
jmp 0x1400e4c1d
mov rcx, qword [rbx]
lea r9, [rsp + 0xd8]
lea r8, [rsp + 0x40]
mov edx, 4
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0xd8], 4
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov edx, dword [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.1400633a8
mov r13, qword [rsp + 0x60]
mov eax, dword [rsp + 0x40]
mov rcx, qword [rbx]
lea r9, [rsp + 0xd8]
mov r8, r13
mov edx, 2
mov dword [rsp + 0xd8], eax
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov byte [r12], r15b
mov r14d, r15d
cmp dword [rsp + 0xd8], r15d
jbe 0x1400e4bed
movzx r8d, byte [r13]
lea rdx, [0x140127458]
mov rcx, r12
call qword [sym.imp.USER32.dll_wsprintfA]
add r14d, edi
add r12, 2
add r13, rdi
cmp r14d, dword [rsp + 0xd8]
jb 0x1400e4bc4
lea rcx, [rsp + 0x60]
call fcn.14005b104
mov rcx, qword [rbx]
cmp rcx, r15
je 0x1400e4c08
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov qword [rbx], r15
mov rcx, qword [rsi]
cmp rcx, r15
je 0x1400e4c1b
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov qword [rsi], r15
mov eax, ebp
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret