Function at 0x140024230
Capabilities:
Hash data via bcrypt

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xf8
xor r12d, r12d
lea rcx, [rbp - 0x41]
mov ebx, r12d
mov qword [rsp + 0x58], r12
mov qword [rbp - 0x71], rbx
mov r14d, r12d
mov qword [rbp - 0x59], r12
mov esi, r12d
mov qword [rbp - 0x69], r12
mov r13d, r12d
mov dword [rbp + 0x6f], r12d
mov r15d, r12d
mov qword [rbp - 0x79], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x50], r12
mov qword [0x1400339a0], r12
call fcn.14002512c
mov edi, eax
test eax, eax
js 0x1400243cc
mov rcx, qword [0x1400336c8]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r12w
jne 0x1400242a3
mov rcx, qword [0x1400336c0]
lea edi, [rax*2 + 0x40]
mov edx, edi
mov dword [rbp + 0x7f], edi
xor r8d, r8d
call fcn.1400152d4
mov rcx, qword [0x1400336c0]
xor r8d, r8d
mov edx, 0x800
mov qword [rsp + 0x48], rax
mov rbx, rax
call fcn.1400152d4
mov rcx, qword [0x1400336c0]
xor r8d, r8d
mov edx, 0x800
mov r12, rax
call fcn.1400152d4
xor edx, edx
mov qword [rbp - 0x61], rax
test rbx, rbx
je 0x140024deb
test r12, r12
je 0x140024deb
test rax, rax
je 0x140024deb
mov r9, qword [0x1400336c8]
mov rcx, rbx
mov r8, qword [0x140033520]
mov edx, edi
call fcn.140003a40
xor ecx, ecx
xor r9d, r9d
mov dword [rsp + 0x30], ecx
mov r8d, 0x120089
mov dword [rsp + 0x28], 1
lea rcx, [rsp + 0x58]
mov rdx, rbx
mov dword [rsp + 0x20], 1
call fcn.14000f99c
xor ebx, ebx
test eax, eax
jns 0x14002441d
mov edi, 0xc0000225
mov rcx, qword [rsp + 0x48]
mov edx, dword [rbp + 0x7f]
call fcn.14000eef4
test r12, r12
je 0x14002438e
mov edx, 0x800
mov rcx, r12
call fcn.14000eef4
mov rcx, qword [rbp - 0x61]
test rcx, rcx
je 0x1400243a1
mov edx, 0x800
call fcn.14000eef4
test rsi, rsi
je 0x1400243ae
mov rcx, rsi
call fcn.140015370
test r13, r13
je 0x1400243bb
mov rcx, r13
call fcn.140015370
test rbx, rbx
je 0x1400243c8
mov rcx, rbx
call fcn.140015370
mov rbx, qword [rbp - 0x71]
lea rcx, [rbp - 0x41]
call fcn.1400250e0
mov rcx, qword [rbp - 0x59]
test rcx, rcx
je 0x1400243e9
mov edx, 0x7668704b
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
test r14, r14
je 0x1400243f8
mov edx, ebx
mov rcx, r14
call fcn.14000eef4
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140024407
call fcn.14000f904
mov eax, edi
add rsp, 0xf8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rcx, qword [rsp + 0x58]
xor edx, edx
call fcn.14000fb2c
mov edi, eax
test eax, eax
js 0x14002436f
mov rcx, qword [rsp + 0x58]
lea r8, [rbp + 0x6f]
mov rdx, r12
call fcn.140004e40
xor edi, edi
test eax, eax
js 0x14002474c
mov edx, 0x3a
mov rcx, r12
call sub.ntoskrnl.exe_wcschr
test rax, rax
je 0x14002474c
cmp rax, r12
je 0x14002474c
lea rbx, [rax + 2]
mov edx, 0x20
jbe 0x14002448e
mov rcx, rax
sub rax, 2
cmp word [rax], dx
ja 0x14002448b
cmp rax, r12
ja 0x140024478
jmp 0x14002448e
mov rax, rcx
mov word [rax], di
jmp 0x1400244a0
test ax, ax
je 0x14002474c
add rbx, 2
movzx eax, word [rbx]
cmp ax, dx
jbe 0x140024493
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], di
jne 0x1400244ac
lea rax, [rbx + rax*2]
jmp 0x1400244c7
mov rcx, rax
sub rax, 2
cmp word [rax], dx
ja 0x1400244ce
cmp rax, rbx
ja 0x1400244bb
jmp 0x1400244d1
mov rax, rcx
mov rdx, r12
mov word [rax], di
lea rcx, [0x14002c140]
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
jne 0x140024531
test r14, r14
jne 0x140024531
mov rcx, rbx
call fcn.140025334
mov rcx, qword [0x1400336c0]
xor r8d, r8d
mov edx, eax
mov qword [rbp - 0x71], rax
mov rdi, rax
call fcn.1400152d4
mov qword [rbp - 0x69], rax
mov r14, rax
test rax, rax
je 0x140024736
mov r8d, edi
mov rdx, rax
mov rcx, rbx
call fcn.1400251d4
xor edi, edi
jmp 0x140024720
or rax, 0xffffffffffffffff
inc rax
cmp word [r12 + rax*2], di
jne 0x140024535
mov rdi, qword [rbp - 0x61]
lea r8, [rbp + 0x67]
add eax, eax
mov rcx, rdi
mov r9, r12
mov dword [rsp + 0x20], eax
mov edx, 0x800
call qword [sym.imp.ntoskrnl.exe_RtlUnicodeToUTF8N]
xor ecx, ecx
test eax, eax
js 0x140024579
mov r8d, dword [rbp + 0x67]
xor r9d, r9d
mov rcx, qword [rbp - 0x39]
mov rdx, rdi
call sub.ksecdd.sys_BCryptHashData
xor ecx, ecx
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], cx
jne 0x14002457d
add eax, eax
lea r8, [rbp + 0x67]
mov r9, rbx
mov dword [rsp + 0x20], eax
mov edx, 0x800
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlUnicodeToUTF8N]
test eax, eax
js 0x1400245b8
mov r8d, dword [rbp + 0x67]
xor r9d, r9d
mov rcx, qword [rbp - 0x39]
mov rdx, rdi
call sub.ksecdd.sys_BCryptHashData
mov rdx, r12
lea rcx, [0x14002c160]
call sub.ntoskrnl.exe__wcsicmp
xor edi, edi
test eax, eax
jne 0x1400245e6
cmp qword [rsp + 0x50], rdi
jne 0x1400245e6
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140024044
jmp 0x140024720
mov rdx, r12
lea rcx, [0x14002c170]
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
jne 0x14002464a
test rsi, rsi
jne 0x14002464a
lea edx, [rax + 0x2d]
mov rcx, rbx
call sub.ntoskrnl.exe_wcschr
test rax, rax
je 0x14002462c
mov word [rax], di
test r13, r13
jne 0x14002462c
mov rcx, qword [0x1400336c0]
lea rdx, [rax + 2]
xor r8d, r8d
call fcn.1400152dc
mov r13, rax
mov rcx, qword [0x1400336c0]
xor r8d, r8d
mov rdx, rbx
call fcn.1400152dc
mov rsi, rax
mov qword [rbp - 0x79], rax
jmp 0x140024720
mov rdx, r12
lea rcx, [0x14002c180]
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
jne 0x14002467c
test r13, r13
jne 0x14002467c
mov rcx, qword [0x1400336c0]
xor r8d, r8d
mov rdx, rbx
call fcn.1400152dc
mov r13, rax
jmp 0x140024720
mov rdx, r12
lea rcx, [0x14002c190]
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
jne 0x1400246b0
test r15, r15
jne 0x1400246b0
mov rcx, qword [0x1400336c0]
xor r8d, r8d
mov rdx, rbx
call fcn.1400152dc
mov r15, rax
mov qword [rsp + 0x40], rax
jmp 0x140024720
mov rdx, r12
lea rcx, [0x14002c1b0]
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
jne 0x1400246cd
mov rcx, rbx
call sub.ntoskrnl.exe__wtol
jmp 0x140024720
mov rdx, r12
lea rcx, [0x14002c1c0]
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
jne 0x1400246fa
lea rdx, [0x14002c1e0]
mov rcx, rbx
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
je 0x140024720
mov edi, 0xc0000024
jmp 0x14002473b
mov rdx, r12
lea rcx, [0x14002c200]
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
jne 0x140024720
lea rdx, [0x1400339b0]
mov rcx, rbx
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
jne 0x140024745
mov rcx, qword [rsp + 0x58]
lea r8, [rbp + 0x6f]
mov rdx, r12
call fcn.140004e40
jmp 0x140024446
mov edi, 0xc000009a
mov rbx, qword [rsp + 0x40]
jmp 0x14002436f
mov edi, 0xc0000485
jmp 0x14002473b
lea r8, [rbp - 0x51]
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x41]
call fcn.14002502c
xor ebx, ebx
mov edi, eax
test eax, eax
js 0x140024ddd
test r14, r14
jne 0x140024775
mov edi, 0xc0000079
jmp 0x14002473b
mov edi, ebx
test r15, r15
je 0x140024899
or rsi, 0xffffffffffffffff
mov r14, rsi
inc r14
cmp word [r15 + r14*2], bx
jne 0x140024787
mov rcx, qword [0x1400336c0]
xor r8d, r8d
mov edx, 0x4000
call fcn.1400152d4
mov r15, rax
mov dword [rbp + 0x77], ebx
lea rax, [0x14002c210]
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x21], rax
lea rdx, [rbp - 0x29]
lea rax, [rbp + 0x77]
mov dword [rbp - 0x11], 0x3fff
xor ecx, ecx
mov qword [rbp - 9], rax
mov byte [rbp - 1], 1
call fcn.1400021b0
test eax, eax
js 0x140024879
mov eax, dword [rbp + 0x77]
test eax, eax
je 0x140024879
mov byte [rax + r15], bl
inc rsi
cmp byte [r15 + rsi], bl
jne 0x1400247ef
add rsi, r15
mov rbx, r15
cmp r15, rsi
jae 0x140024879
mov edx, 0xa
mov rcx, rbx
call sub.ntoskrnl.exe_strchr
mov r10, rax
xor eax, eax
test r10, r10
cmove r10, rsi
mov rdx, r10
sub rdx, rbx
cmp rdx, 1
jbe 0x140024832
cmp byte [rdx + rbx - 1], 0xd
jne 0x140024837
dec rdx
test rdx, rdx
je 0x14002486b
mov r8d, eax
test r14d, r14d
je 0x140024866
mov r9, qword [rsp + 0x40]
mov eax, r8d
cmp rax, rdx
jae 0x140024866
movzx ecx, word [r9]
movsx eax, byte [rbx]
cmp eax, ecx
jne 0x140024866
inc r8d
add r9, 2
inc rbx
cmp r8d, r14d
jb 0x140024844
cmp r8d, r14d
je 0x140024874
lea rbx, [r10 + 1]
cmp rbx, rsi
jmp 0x140024801
mov edi, 0xc0000804
mov edx, 0x4000
mov rcx, r15
call fcn.14000eef4
mov rsi, qword [rbp - 0x79]
xor r15d, r15d
test edi, edi
js 0x140024ddd
mov r14, qword [rbp - 0x69]
or dword [0x1400339a0], 1
lea rcx, [rbp + 0x77]
xorps xmm0, xmm0
mov qword [rbp + 0x77], r15
movups xmmword [rbp + 7], xmm0
call fcn.140023dcc
movabs rax, 0xfffff78000000014
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x79]
mov rax, qword [rax]
mov qword [rbp - 0x79], rax
call qword [sym.imp.ntoskrnl.exe_ExSystemTimeToLocalTime]
test rsi, rsi
jne 0x1400248e5
test r13, r13
je 0x1400248e5
mov rsi, r13
mov r13, r15
jmp 0x1400248f1
mov rbx, r15
test rsi, rsi
je 0x140024ac9
lea rdx, [0x14002c230]
mov rcx, rsi
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
jne 0x140024919
mov eax, dword [0x1400339a0]
and eax, 0xffffe5ff
or eax, 0x500
jmp 0x140024ac0
lea rdx, [0x14002c250]
mov rcx, rsi
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
jne 0x140024940
mov eax, dword [0x1400339a0]
and eax, 0xffffe4ff
bts eax, 0xa
jmp 0x140024ac0
lea rdx, [0x14002c260]
mov rcx, rsi
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
jne 0x140024967
mov eax, dword [0x1400339a0]
and eax, 0xffffe8ff
bts eax, 0xb
jmp 0x140024ac0
lea rdx, [0x14002c280]
mov rcx, rsi
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
je 0x140024ab0
lea rdx, [0x14002c2a0]
mov rcx, rsi
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
je 0x140024ab0
lea rdx, [0x14002c2b0]
mov rcx, rsi
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
je 0x140024a9f
lea rdx, [0x14002c2c0]
mov rcx, rsi
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
je 0x140024a9f
lea rdx, [0x14002c2e0]
mov rcx, rsi
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
je 0x140024a8d
lea rdx, [0x14002c300]
mov rcx, rsi
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
je 0x140024a8d
lea rdx, [0x14002c310]
mov rcx, rsi
call sub.ntoskrnl.exe_wcsstr
test rax, rax
je 0x140024a7b
mov ebx, 5
lea rdx, [0x14002c320]
mov r8d, ebx
mov rcx, rsi
call sub.ntoskrnl.exe__wcsnicmp
test eax, eax
jne 0x140024a35
mov eax, dword [0x1400339a0]
and eax, 0xfffff9ff
or eax, 0x1900
jmp 0x140024ac0
mov r8, rbx
lea rdx, [0x14002c330]
mov rcx, rsi
call sub.ntoskrnl.exe__wcsnicmp
test eax, eax
mov eax, dword [0x1400339a0]
jne 0x140024a6f
mov rbx, qword [rsp + 0x50]
and eax, 0xfffffaff
or eax, 0x1a00
movabs rcx, 0x46b8e92d8000
add rbx, rcx
jmp 0x140024ac3
and eax, 0xfffff8ff
or eax, 0x1800
jmp 0x140024ac0
mov eax, dword [0x1400339a0]
and eax, 0xffffecff
or eax, 0xc00
jmp 0x140024ac0
mov eax, dword [0x1400339a0]
and eax, 0xfffff1ff
or eax, 0x1100
jmp 0x140024ac0
mov eax, dword [0x1400339a0]
and eax, 0xfffff0ff
bts eax, 0xc
jmp 0x140024ac0
mov eax, dword [0x1400339a0]
and eax, 0xfffffcff
or eax, 0x1c00
mov rbx, r15
mov dword [0x1400339a0], eax
mov r9d, dword [0x1400339a0]
mov eax, r9d
shr eax, 8
and eax, 0x1c
cmp eax, 4
jne 0x140024aea
or r9d, 0xe000
jmp 0x140024cd5
cmp eax, 0x1c
jne 0x140024b32
test r13, r13
je 0x140024afe
mov rcx, r13
call sub.ntoskrnl.exe__wtoi
jmp 0x140024b03
mov eax, 7
mov r9d, dword [0x1400339a0]
movsx rbx, ax
movabs rax, 0xc92a69c000
imul rbx, rax
add rbx, qword [rsp + 0x50]
btr r9d, 0xe
or r9d, 0xa000
jmp 0x140024cd5
test r13, r13
je 0x140024cc2
lea rdx, [0x14002c340]
mov rcx, r13
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
je 0x140024cc2
lea rdx, [0x14002c360]
mov rcx, r13
call sub.ntoskrnl.exe__wcsicmp
mov r9d, dword [0x1400339a0]
test eax, eax
je 0x140024b21
mov eax, r9d
shr eax, 8
and eax, 0x1c
cmp eax, 0xc
je 0x140024b83
cmp eax, 0x18
jne 0x140024cdc
lea rdx, [0x14002c380]
mov rcx, r13
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
jne 0x140024bb0
mov r9d, dword [0x1400339a0]
and r9d, 0xffffe4ff
or r9d, 0xe400
jmp 0x140024cd5
lea rdx, [0x14002c390]
mov rcx, r13
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
jne 0x140024c0a
mov r9d, dword [0x1400339a0]
mov eax, r9d
and eax, 0x1c00
cmp eax, 0x1800
jne 0x140024be7
btr r9d, 0xf
or r9d, 0x6000
jmp 0x140024bf3
btr r9d, 0xe
or r9d, 0xa000
mov rbx, qword [rsp + 0x50]
movabs rcx, 0x23da2f18d8000
add rbx, rcx
jmp 0x140024cd5
lea rdx, [0x14002c3a0]
mov rcx, r13
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
jne 0x140024c35
mov r9d, dword [0x1400339a0]
btr r9d, 0xf
or r9d, 0x6000
jmp 0x140024cd5
lea rdx, [0x14002c330]
mov rcx, r13
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
jne 0x140024c98
mov eax, dword [0x1400339a0]
btr eax, 0xf
mov r9d, eax
and eax, 0x1c00
or r9d, 0x6000
mov dword [0x1400339a0], r9d
cmp eax, 0x1800
jne 0x140024c84
and r9d, 0xfffffaff
or r9d, 0x1a00
mov dword [0x1400339a0], r9d
mov rbx, qword [rsp + 0x50]
movabs rcx, 0x46b8e92d8000
add rbx, rcx
jmp 0x140024cdc
lea rdx, [0x14002c3b0]
mov rcx, r13
call sub.ntoskrnl.exe__wcsicmp
mov r9d, dword [0x1400339a0]
test eax, eax
jne 0x140024cc9
and r9d, 0xffff70ff
or r9d, 0x7000
jmp 0x140024cd5
mov r9d, dword [0x1400339a0]
and r9d, 0xffff5fff
bts r9d, 0xe
mov dword [0x1400339a0], r9d
mov ecx, r9d
shr ecx, 8
mov edx, ecx
and edx, 0x1c
cmp edx, 4
jne 0x140024cf2
or rbx, 0xffffffffffffffff
jmp 0x140024d13
test rbx, rbx
jne 0x140024d09
mov rbx, qword [rsp + 0x50]
movabs r8, 0x11ed178c6c000
add rbx, r8
lea eax, [rdx - 8]
test eax, 0xfffffff7
je 0x140024d23
and ecx, 0x1f
cmp cl, 0x1a
je 0x140024d23
mov r10b, r15b
cmp edx, 0x1c
jne 0x140024d26
mov r10b, 1
mov rcx, qword [rbp - 0x49]
cmp rbx, 0xffffffffffffffff
je 0x140024d80
cmp rbx, rcx
jge 0x140024d40
or r9d, 2
mov dword [0x1400339a0], r9d
mov r8, rbx
movabs rax, 0xd6bf94d5e57a42bd
sub r8, rcx
imul r8
add rdx, r8
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov dword [0x1400339a4], edx
test r10b, r10b
jne 0x140024d80
cmp rbx, qword [rbp + 0x77]
jge 0x140024d80
or r9d, 4
mov dword [0x1400339a0], r9d
mov eax, r9d
mov edx, r9d
shr eax, 1
shr edx, 2
test r10b, r10b
cmovne edx, eax
test dl, 1
je 0x140024ddd
mov eax, r9d
and eax, 0x1c00
cmp eax, 0x1c00
je 0x140024dc2
movabs rax, 0x1792f8648000
add rax, rbx
cmp rax, rcx
jl 0x140024dc2
or r9d, 0x20
mov dword [0x1400339a0], r9d
test r9b, 0x20
jne 0x140024ddd
and r9d, 0xfffffffe
mov edi, 0xc0000193
mov dword [0x1400339a0], r9d
jmp 0x14002473b
mov rbx, qword [rsp + 0x40]
mov r14, qword [rbp - 0x69]
jmp 0x14002436f
mov rcx, qword [rsp + 0x48]
mov rbx, rdx
mov dword [rbp - 0x71], edx
mov edi, 0xc000009a
test rcx, rcx
je 0x14002437c
jmp 0x140024374