Function at 0x1400d4630
Capabilities:
Enumerate pe sections
Hash data via bcrypt
Parse pe header

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x17]
sub rsp, 0xa8
mov rax, qword [0x1404680d8]
xor rax, rsp
mov qword [rbp + 7], rax
xor eax, eax
mov qword [rbp - 0x31], r8
mov qword [rbp - 9], rax
mov esi, eax
mov qword [rbp - 0x19], rax
mov r13d, eax
mov dword [rbp + 3], eax
mov rbx, r9
mov dword [rbp - 1], eax
mov r15, r8
mov dword [rbp - 0x11], eax
mov r14, rdx
mov eax, dword [rbp + 0x7f]
mov r12, rcx
mov qword [rbp - 0x29], rdx
mov qword [rbp - 0x21], rcx
sub eax, 1
je 0x1400d46d1
sub eax, 1
je 0x1400d46c8
sub eax, 1
je 0x1400d46bf
sub eax, 1
je 0x1400d46b6
cmp eax, 1
je 0x1400d46ad
mov eax, 0xc000000d
jmp 0x1400d4e0f
lea rdx, str.SHA512
jmp 0x1400d46d8
lea rdx, str.SHA384
jmp 0x1400d46d8
lea rdx, str.SHA256
jmp 0x1400d46d8
lea rdx, [0x1403dcb28]
jmp 0x1400d46d8
lea rdx, str.SHA1
xor r9d, r9d
lea rcx, [rbp - 9]
xor r8d, r8d
call qword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
mov edi, eax
test eax, eax
jns 0x1400d473a
call fcn.140024740
lea rcx, str._Error_0x_x_returned_by_BCryptOpenAlgorithmProvider___Hash
mov r9d, 0x236
mov dword [rsp + 0x38], edi
mov qword [rsp + 0x30], rcx
lea rcx, str.MbCommonSigCRYPTUSR
mov qword [rsp + 0x28], rcx
mov r10, qword [rax]
lea r8, str.d:jenkinsworkspace_n_mbcommon_srcmbcommoncryptouser.cpp
lea rdx, str.GetFileHash32
mov dword [rsp + 0x20], 2
mov rcx, rax
call qword [r10 + 0x20]
jmp 0x1400d4de0
mov rcx, qword [rbp - 9]
lea rax, [rbp + 3]
mov dword [rsp + 0x28], esi
lea r8, [rbp - 0x11]
mov r9d, 4
mov qword [rsp + 0x20], rax
lea rdx, str.ObjectLength
call qword [sym.imp.bcrypt.dll_BCryptGetProperty]
mov edi, eax
test eax, eax
jns 0x1400d477c
call fcn.140024740
lea rcx, str._Error_0x_x_returned_by_BCryptGetProperty_getting_object_length
mov r9d, 0x23d
jmp 0x1400d4700
mov ecx, dword [rbp - 0x11]
call fcn.14029981c
mov qword [rbp - 0x39], rax
mov rsi, rax
test rax, rax
jne 0x1400d47d8
call fcn.140024740
lea rcx, str._memory_allocation_failed
mov r9d, 0x246
mov qword [rsp + 0x30], rcx
lea rcx, str.MbCommonSigCRYPTUSR
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 2
mov r10, qword [rax]
lea r8, str.d:jenkinsworkspace_n_mbcommon_srcmbcommoncryptouser.cpp
lea rdx, str.GetFileHash32
mov rcx, rax
call qword [r10 + 0x20]
jmp 0x1400d4de0
mov rcx, qword [rbp - 9]
lea rax, [rbp + 3]
mov dword [rsp + 0x28], r13d
lea r8, [rbp - 1]
mov r9d, 4
mov qword [rsp + 0x20], rax
lea rdx, str.HashDigestLength
call qword [sym.imp.bcrypt.dll_BCryptGetProperty]
mov edi, eax
test eax, eax
jns 0x1400d481e
call fcn.140024740
lea rcx, str._Error_0x_x_returned_by_BCryptGetProperty_getting_hash_length
mov r9d, 0x24d
jmp 0x1400d4700
mov eax, dword [rbp - 1]
cmp dword [r14], eax
jae 0x1400d4881
mov edi, 0xc000000d
call fcn.140024740
mov ecx, dword [rbp - 1]
lea r8, str.d:jenkinsworkspace_n_mbcommon_srcmbcommoncryptouser.cpp
mov dword [rsp + 0x40], ecx
lea rdx, str.GetFileHash32
mov ecx, dword [r14]
mov r9d, 0x255
mov r10, qword [rax]
mov dword [rsp + 0x38], ecx
lea rcx, str._Invalid_hash_size:__u__need__u
mov qword [rsp + 0x30], rcx
lea rcx, str.MbCommonSigCRYPTUSR
mov qword [rsp + 0x28], rcx
mov rcx, rax
mov dword [rsp + 0x20], 2
call qword [r10 + 0x20]
jmp 0x1400d4de0
test r12, r12
jne 0x1400d48a7
mov edi, 0xc000000d
call fcn.140024740
lea rcx, str._Invalid_hash_buffer:__p
mov qword [rsp + 0x38], r13
mov r9d, 0x25c
jmp 0x1400d4704
mov r9d, dword [rbp - 0x11]
lea rdx, [rbp - 0x19]
mov rcx, qword [rbp - 9]
mov r8, rsi
mov dword [r14], eax
xor eax, eax
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.bcrypt.dll_BCryptCreateHash]
mov edi, eax
test eax, eax
jns 0x1400d48eb
call fcn.140024740
lea rcx, str._Error_0x_x_returned_by_BCryptCreateHash
mov r9d, 0x265
jmp 0x1400d4700
mov eax, 0x5a4d
lea r14, str.MbCommonSigCRYPTUSR
cmp word [r15], ax
je 0x1400d4939
call fcn.140024740
lea rcx, str.Not_A_Valid_Dos_Stub
mov r9d, 0x26e
mov qword [rsp + 0x30], rcx
lea r8, str.d:jenkinsworkspace_n_mbcommon_srcmbcommoncryptouser.cpp
mov qword [rsp + 0x28], r14
lea rdx, str.GetFileHash32
mov r10, qword [rax]
mov rcx, rax
mov dword [rsp + 0x20], 5
call qword [r10 + 0x20]
movsxd r12, dword [r15 + 0x3c]
add r12, r15
cmp dword [r12], 0x4550
je 0x1400d4973
call fcn.140024740
lea rcx, str.Not_A_Valid_PE_Executable
mov r9d, 0x275
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 5
jmp 0x1400d47bb
mov rcx, qword [rbp - 0x19]
mov r8d, r12d
sub r8d, r15d
xor r9d, r9d
add r8d, 0x58
mov rdx, r15
call qword [sym.imp.bcrypt.dll_BCryptHashData]
mov edi, eax
test eax, eax
jns 0x1400d49b8
call fcn.140024740
mov dword [rsp + 0x38], edi
lea rcx, str._Error_0x_x_returned_by_BCryptHashData
mov qword [rsp + 0x30], rcx
mov r9d, 0x287
mov qword [rsp + 0x28], r14
jmp 0x1400d4715
mov rcx, qword [rbp - 0x19]
lea rdx, [r12 + 0x5c]
xor r9d, r9d
lea r8d, [r9 + 0x3c]
call qword [sym.imp.bcrypt.dll_BCryptHashData]
mov edi, eax
test eax, eax
jns 0x1400d49f9
call fcn.140024740
mov dword [rsp + 0x38], edi
lea rcx, str._Error_0x_x_returned_by_BCryptHashData
mov qword [rsp + 0x30], rcx
mov r9d, 0x294
mov qword [rsp + 0x28], r14
jmp 0x1400d4715
movzx r8d, word [r12 + 6]
lea rdx, [r12 + 0xa0]
mov esi, dword [r12 + 0x54]
lea r9, [r12 + 0xa0]
mov dword [rbp - 0x3d], esi
test r8, r8
je 0x1400d4a4e
movzx eax, word [r12 + 0x14]
lea rcx, [r12 + 0x28]
add rcx, rax
nop word [rax + rax]
mov eax, dword [rcx + 4]
cmp eax, esi
jae 0x1400d4a41
cmp dword [rcx], r13d
jbe 0x1400d4a41
test eax, eax
cmovne esi, eax
add rcx, 0x28
sub r8, 1
jne 0x1400d4a30
mov dword [rbp - 0x3d], esi
mov rcx, qword [rbp - 0x19]
mov r8d, r15d
sub r8d, r9d
xor r9d, r9d
add r8d, esi
call qword [sym.imp.bcrypt.dll_BCryptHashData]
mov edi, eax
test eax, eax
jns 0x1400d4aaf
call fcn.140024740
mov dword [rsp + 0x38], edi
lea rcx, str._Error_0x_x_returned_by_BCryptHashData
mov qword [rsp + 0x30], rcx
lea r8, str.d:jenkinsworkspace_n_mbcommon_srcmbcommoncryptouser.cpp
mov qword [rsp + 0x28], r14
lea rdx, str.GetFileHash32
mov r10, qword [rax]
mov r9d, 0x2ae
mov rcx, rax
mov dword [rsp + 0x20], 2
call qword [r10 + 0x20]
jmp 0x1400d4ddc
movzx eax, word [r12 + 6]
mov dword [rbp - 0x41], esi
test ax, ax
je 0x1400d4cb2
movzx ecx, word [r12 + 0x14]
xor esi, esi
movzx r15d, ax
mov eax, r15d
mul ecx
mov ecx, eax
mov rax, 0xffffffffffffffff
cmovo rcx, rax
call fcn.14029981c
mov r13, rax
test rax, rax
jne 0x1400d4b2d
call fcn.140024740
lea rcx, str._Error_getting_memory
mov r9d, 0x2c3
mov qword [rsp + 0x30], rcx
lea r8, str.d:jenkinsworkspace_n_mbcommon_srcmbcommoncryptouser.cpp
mov qword [rsp + 0x28], r14
lea rdx, str.GetFileHash32
mov r10, qword [rax]
mov rcx, rax
mov dword [rsp + 0x20], 2
call qword [r10 + 0x20]
jmp 0x1400d4ddc
xor r11d, r11d
mov r8d, r11d
cmp r11w, word [r12 + 6]
jae 0x1400d4b6e
mov r9, r13
nop
movzx ecx, word [r12 + 0x14]
lea r9, [r9 + 8]
movsxd rax, r8d
add rcx, r12
inc r8d
lea rdx, [rax + rax*4]
lea rax, [rcx + 0x18]
lea rax, [rax + rdx*8]
mov qword [r9 - 8], rax
movzx eax, word [r12 + 6]
cmp r8d, eax
jl 0x1400d4b40
test r15d, r15d
je 0x1400d4cae
mov r10d, dword [rbp - 0x41]
nop dword [rax + rax]
movzx edx, word [r12 + 6]
mov r8d, r11d
cmp r11w, dx
jae 0x1400d4bd4
mov rdx, r13
mov rcx, qword [rdx]
test rcx, rcx
je 0x1400d4bbd
cmp dword [rcx + 0x10], 0
je 0x1400d4bb7
test rsi, rsi
jne 0x1400d4baa
mov rsi, rcx
jmp 0x1400d4bbd
mov eax, dword [rcx + 0x14]
cmp dword [rsi + 0x14], eax
jbe 0x1400d4bbd
mov rsi, rcx
jmp 0x1400d4bbd
mov qword [rdx], r11
dec r15d
movzx ecx, word [r12 + 6]
inc r8d
add rdx, 8
cmp r8d, ecx
jl 0x1400d4b92
movzx edx, cx
jmp 0x1400d4bd7
movzx ecx, dx
test rsi, rsi
je 0x1400d4c9e
mov r8d, dword [rsi + 0x14]
mov eax, r10d
sub eax, dword [rbp - 0x3d]
cmp r8d, eax
jb 0x1400d4c65
mov r9d, dword [rsi + 0x10]
mov rdx, r11
movzx r10d, cx
mov r14d, r9d
test r10, r10
je 0x1400d4c33
mov rax, qword [r13 + rdx*8]
test rax, rax
je 0x1400d4c2b
cmp dword [rax + 0x10], 0
jbe 0x1400d4c2b
cmp rax, rsi
je 0x1400d4c2b
mov ecx, dword [rax + 0x14]
lea eax, [r9 + r8]
cmp eax, ecx
jbe 0x1400d4c2b
sub ecx, r9d
sub ecx, r8d
add r14d, ecx
inc rdx
cmp rdx, r10
jl 0x1400d4c02
mov rcx, qword [rbp - 0x19]
mov rdx, r8
add rdx, qword [rbp - 0x31]
xor r9d, r9d
mov r8d, r14d
call qword [sym.imp.bcrypt.dll_BCryptHashData]
mov edi, eax
test eax, eax
js 0x1400d4d0c
add dword [rbp - 0x41], r14d
mov r10d, dword [rbp - 0x41]
xor r11d, r11d
movzx edx, word [r12 + 6]
movzx r9d, dx
mov r8d, r11d
mov rcx, r11
test r9d, r9d
je 0x1400d4c98
mov rdx, qword [r13 + rcx*8]
test rdx, rdx
je 0x1400d4c86
mov eax, dword [rsi + 0x14]
cmp dword [rdx + 0x14], eax
je 0x1400d4c93
inc r8d
inc rcx
cmp r8d, r9d
jl 0x1400d4c74
jmp 0x1400d4c98
mov qword [r13 + rcx*8], r11
mov rsi, r11
dec r15d
test r15d, r15d
jg 0x1400d4b80
lea r14, str.MbCommonSigCRYPTUSR
mov r15, qword [rbp - 0x31]
mov eax, dword [rbp - 0x41]
cmp ebx, eax
jbe 0x1400d4d71
mov r8d, ebx
sub r8d, dword [r12 + 0x9c]
sub r8d, eax
cmp r8d, ebx
ja 0x1400d4d35
mov ecx, ebx
mov edx, eax
sub rcx, rax
mov eax, r8d
cmp rax, rcx
ja 0x1400d4d35
mov rcx, qword [rbp - 0x19]
add rdx, r15
xor r9d, r9d
call qword [sym.imp.bcrypt.dll_BCryptHashData]
mov edi, eax
test eax, eax
jns 0x1400d4d71
call fcn.140024740
lea rcx, str._Error_0x_x_returned_by_BCryptHashData
mov r9d, 0x325
jmp 0x1400d4da1
call fcn.140024740
lea rcx, str._Error_0x_x_returned_by_BCryptHashData
mov dword [rsp + 0x38], edi
mov qword [rsp + 0x30], rcx
mov r9d, 0x301
lea rcx, str.MbCommonSigCRYPTUSR
mov qword [rsp + 0x28], rcx
jmp 0x1400d4daf
call fcn.140024740
lea rcx, str.Error_calculating_rest_of_data__
mov r9d, 0x31e
mov qword [rsp + 0x30], rcx
lea r8, str.d:jenkinsworkspace_n_mbcommon_srcmbcommoncryptouser.cpp
mov qword [rsp + 0x28], r14
lea rdx, str.GetFileHash32
mov r10, qword [rax]
mov rcx, rax
mov dword [rsp + 0x20], 2
call qword [r10 + 0x20]
mov rax, qword [rbp - 0x29]
xor r9d, r9d
mov rdx, qword [rbp - 0x21]
mov rcx, qword [rbp - 0x19]
mov r8d, dword [rax]
call qword [sym.imp.bcrypt.dll_BCryptFinishHash]
mov edi, eax
test eax, eax
jns 0x1400d4dcf
call fcn.140024740
lea rcx, str._Error_0x_x_returned_by_BCryptFinishHash
mov r9d, 0x330
mov dword [rsp + 0x38], edi
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], r14
mov r10, qword [rax]
lea r8, str.d:jenkinsworkspace_n_mbcommon_srcmbcommoncryptouser.cpp
lea rdx, str.GetFileHash32
mov dword [rsp + 0x20], 2
mov rcx, rax
call qword [r10 + 0x20]
test r13, r13
je 0x1400d4ddc
mov rcx, r13
call fcn.14028eb9c
mov rsi, qword [rbp - 0x39]
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x1400d4df1
xor edx, edx
call qword [sym.imp.bcrypt.dll_BCryptCloseAlgorithmProvider]
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x1400d4e00
call qword [sym.imp.bcrypt.dll_BCryptDestroyHash]
test rsi, rsi
je 0x1400d4e0d
mov rcx, rsi
call fcn.14028eb9c
mov eax, edi
mov rcx, qword [rbp + 7]
xor rcx, rsp
call fcn.140282c10
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret