Function at 0x180006730
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov r14, qword [rbp + 0x58]
mov rbx, rcx
xor r15d, r15d
mov dword [rbp - 0x34], 0x20
lea rcx, [rbp - 0x48]
mov qword [rbp - 0x40], r15
mov rsi, r9
mov dword [rbp - 0x48], 0x18
mov rdi, rdx
mov dword [rbp - 0x44], 0xf0000000
call fcn.180006530
test rax, rax
jne 0x18000678f
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x180006946
jmp 0x18000693e
mov rax, qword [rbp - 0x40]
mov rcx, r15
mov qword [rbp - 0x50], rcx
test rax, rax
je 0x1800067a4
mov rdx, rax
jmp 0x1800067b8
lea rcx, [rbp - 0x48]
call fcn.180006530
mov rcx, qword [rbp - 0x50]
mov rdx, rax
mov rax, qword [rbp - 0x40]
test rdx, rdx
je 0x180006923
mov r9d, 0x10
lea rdx, [rbp - 0x48]
mov r8, rdi
lea rcx, [rbp - 0x50]
call fcn.180006680
test eax, eax
mov rax, qword [rbp - 0x40]
jne 0x18000691f
mov rdi, qword [rbp - 0x50]
test rax, rax
jne 0x1800067f5
lea rcx, [rbp - 0x48]
call fcn.180006530
xor r9d, r9d
mov qword [rsp + 0x20], rbx
mov r8, rdi
mov edx, 0x8009
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x180006847
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp - 0x50]
mov ebx, eax
test rcx, rcx
je 0x18000682d
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov qword [rbp - 0x50], r15
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x180006949
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x180006949
xor edx, edx
lea rcx, [rbp - 0x30]
lea r8d, [rdx + 0x28]
call sub.msvcrt.dll_memset
mov rcx, qword [rbx]
lea r8, [rbp - 0x30]
xor r9d, r9d
mov dword [rbp - 0x30], 0x800c
lea edx, [r9 + 5]
call qword [sym.imp.ADVAPI32.dll_CryptSetHashParam]
test eax, eax
je 0x180006812
mov r8d, dword [rbp + 0x50]
xor r9d, r9d
mov rcx, qword [rbx]
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x180006812
mov rcx, qword [rbx]
lea r9, [rbp - 0x38]
xor r8d, r8d
mov dword [rbp - 0x38], r15d
mov dword [rsp + 0x20], r15d
lea edi, [r8 + 2]
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x180006812
mov eax, dword [rbp - 0x34]
cmp dword [rbp - 0x38], eax
je 0x1800068d7
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x18000677d
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov qword [rbp - 0x50], r15
jmp 0x18000677d
mov rcx, qword [rbx]
lea r9, [rbp - 0x34]
mov r8, r14
mov dword [rsp + 0x20], r15d
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x180006812
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x180006909
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov qword [rbp - 0x50], r15
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x18000691a
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ebx, r15d
jmp 0x180006949
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x180006936
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rax, qword [rbp - 0x40]
mov qword [rbp - 0x50], r15
test rax, rax
je 0x180006946
mov rcx, rax
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
or ebx, 0xffffffff
mov eax, ebx
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret