Function at 0x100058fac
Capabilities:
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x160
mov rax, qword [0x10010f190]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov r14, qword [rsp + 0x1c0]
and qword [rsp + 0x48], 0
and qword [rsp + 0x58], 0
xor edi, edi
lea rax, [rsp + 0x48]
mov r13, r9
and qword [r9], rdi
and qword [rsp + 0x68], rdi
mov r12d, r8d
mov rbp, rdx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8003
mov rsi, rcx
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x100059039
and qword [rsp + 0x48], rdi
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x9f5013e
jmp 0x100059334
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
mov r8d, r12d
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x100059067
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x9fa013e
jmp 0x100059334
mov rcx, qword [rsp + 0x48]
and dword [rsp + 0x20], edi
lea r9, [rsp + 0x44]
lea r8, [rsp + 0xe0]
mov edx, 2
mov dword [rsp + 0x44], reloc.Cabinet.dll_FDICreate
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x1000590aa
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0xa00013e
jmp 0x100059334
lea rcx, [rsp + 0xa0]
mov edx, Ordinal_258
mov r8d, Ordinal_65
call sub.msvcrt.dll_memset
mov edx, dword [rsp + 0x44]
xor r11d, r11d
test edx, edx
je 0x1000590f1
lea r8, [rsp + 0xa0]
mov eax, edx
sub eax, r11d
inc r11d
dec eax
mov cl, byte [rsp + rax + 0xe0]
mov byte [r8], cl
inc r8
cmp r11d, edx
jb 0x1000590d5
mov byte [rsp + rdx + 0xa0], dl
lea eax, [rdx + 1]
lea r8, [rsp + 0x58]
mov byte [rsp + rax + 0xa0], 4
lea eax, [rdx + 2]
mov edx, 1
mov byte [rsp + rax + 0xa0], dil
mov rcx, rsi
mov byte [rsp + 0xde], 1
mov byte [rsp + 0xdf], dil
call qword [sym.imp.ADVAPI32.dll_CryptGetUserKey]
test eax, eax
jne 0x100059216
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov ebx, eax
cmp eax, 0x8009000d
je 0x100059158
mov edx, 0xa26013e
jmp 0x100059336
lea r8, [rsp + 0x68]
mov edx, 2
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptGetUserKey]
test eax, eax
jne 0x100059185
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0xa2c013e
jmp 0x100059334
mov rcx, qword [rsp + 0x68]
and dword [rsp + 0x50], edi
xor edx, edx
lea rax, [rsp + 0x50]
lea r8d, [rdx + 7]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call fcn.1000be9b0
mov ebx, eax
test eax, eax
je 0x1000591ca
xor r9d, r9d
mov r8d, eax
mov edx, 0xa38013e
xor ecx, ecx
call fcn.1000b51b8
mov rdi, qword [rsp + 0x60]
jmp 0x100059347
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x58]
xor r9d, r9d
mov dword [rdi + 4], 0xa400
mov r8d, dword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rdx, rdi
mov rcx, rsi
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x100059216
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0xa49013e
jmp 0x100059334
mov rcx, qword [rsp + 0x58]
xor edx, edx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xa0]
lea r9d, [rdx + 0x20]
lea r8d, [rdx + 1]
mov dword [rsp + Ordinal_65], 0x40
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x100059264
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0xa63013e
jmp 0x100059334
mov rax, qword [0x100119fa8]
mov r9d, dword [rsp + 0x40]
lea rcx, [rsp + reloc.certcli.dll_Ordinal_256]
mov qword [rcx], rax
mov eax, dword [0x100119fb0]
xor edx, edx
mov dword [rcx + 8], eax
movzx eax, word [reloc.WLDAP32.dll_Ordinal_65]
mov word [rcx + 0xc], ax
test r9d, r9d
je 0x1000592b9
lea r8, [rsp + 0x10e]
mov eax, r9d
sub eax, edx
inc edx
dec eax
mov cl, byte [rsp + rax + 0xa0]
mov byte [r8], cl
inc r8
cmp edx, r9d
jb 0x10005929e
xor r9d, r9d
lea rax, [rsp + reloc.certcli.dll_Ordinal_256]
mov qword [rsp + 0x30], r14
lea edx, [r9 + 0x22]
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0x80]
lea r8, [rsp + 0x70]
lea ecx, [rdx - 0x21]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x88], rbp
mov dword [rsp + 0x80], r12d
mov dword [rsp + 0x90], Ordinal_79
mov dword [rsp + 0x70], 2
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x20], 2
call fcn.1000b7c1c
test eax, eax
jne 0x100059345
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0xa87013e
mov ebx, eax
mov r8d, eax
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
jmp 0x100059347
xor ebx, ebx
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x100059357
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x100059367
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
test rdi, rdi
je 0x100059375
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x100059385
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov eax, ebx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1000ef870
add rsp, 0x160
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret