Function at 0x1001fb70
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100acb85
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x100d800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x14]
xorps xmm0, xmm0
mov esi, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x18]
movq qword [ebp - 0x24], xmm0
mov dword [ebp - 0x1c], 0
push 0x10
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
call fcn.1006dc33
xorps xmm0, xmm0
mov dword [ebp - 0x24], eax
add esp, 4
mov dword [ebp - 0x14], 0
lea ecx, [eax + 0x10]
mov dword [ebp - 0x1c], ecx
movups xmmword [eax], xmm0
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x14]
call fcn.10009e80
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x30]
mov eax, dword [ebp - 0x20]
xorps xmm0, xmm0
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
movq qword [ebp - 0x30], xmm0
mov dword [ebp - 0x28], 0
call fcn.1001eaa0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push eax
push 0
push 0
push 0x8003
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1001fe73
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
sub ecx, eax
push 0
push ecx
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x24]
push 2
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov edx, dword [ebp - 0x38]
mov edi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x3c], ecx
mov esi, dword [edx + 4]
mov eax, dword [edx]
sub esi, eax
test edi, edi
je 0x1001fcf4
test eax, eax
jne 0x1001fcac
call fcn.10086f38
mov dword [eax], 0x16
jmp 0x1001fcef
test ecx, ecx
je 0x1001fcc1
cmp esi, edi
jb 0x1001fcc1
push edi
push ecx
push eax
call fcn.10083c30
add esp, 0xc
jmp 0x1001fcf4
push esi
push 0
push eax
call fcn.10083a60
add esp, 0xc
cmp dword [ebp - 0x3c], 0
jne 0x1001fce0
call fcn.10086f38
mov dword [eax], 0x16
jmp 0x1001fcef
cmp esi, edi
jae 0x1001fcf4
call fcn.10086f38
mov dword [eax], 0x22
call fcn.100869af
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1001fd02
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 4
push eax
mov eax, dword [ebp - 0x34]
push 0
push 0
push 0x8003
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1001fe8c
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
sub eax, ecx
push 0
push eax
push ecx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
sub eax, ecx
push 0
push eax
push ecx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x24]
push 2
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [ebp - 0x38]
mov edi, 0x18
mov eax, dword [eax]
add eax, 0x10
sub edi, dword [ebp - 0x18]
je 0x1001fdc1
test eax, eax
je 0x1001fdb1
mov ecx, dword [ebp - 0x24]
push edi
test ecx, ecx
je 0x1001fda6
push ecx
push eax
call fcn.10083c30
add esp, 0xc
jmp 0x1001fdc1
push 0
push eax
call fcn.10083a60
add esp, 0xc
call fcn.10086f38
mov dword [eax], 0x16
call fcn.100869af
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x24]
sub esi, edi
add ecx, edi
mov edi, dword [ebp - 0x40]
mov dword [ebp - 0x34], ecx
mov eax, dword [edi]
mov edi, dword [edi + 4]
sub edi, eax
test esi, esi
je 0x1001fe38
test eax, eax
jne 0x1001fded
call fcn.10086f38
mov dword [eax], 0x16
jmp 0x1001fe33
test ecx, ecx
je 0x1001fe05
cmp edi, esi
jb 0x1001fe05
push esi
push ecx
push eax
lfence
call fcn.10083c30
add esp, 0xc
jmp 0x1001fe38
push edi
push 0
push eax
call fcn.10083a60
add esp, 0xc
cmp dword [ebp - 0x34], 0
jne 0x1001fe24
call fcn.10086f38
mov dword [eax], 0x16
jmp 0x1001fe33
cmp edi, esi
jae 0x1001fe38
call fcn.10086f38
mov dword [eax], 0x22
call fcn.100869af
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1001fe46
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
lea ecx, [ebp - 0x30]
call fcn.10020530
lea ecx, [ebp - 0x24]
call fcn.10020530
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006d58e
mov esp, ebp
pop ebp
ret 0x14
push str.CreateSessionKey:_CryptCreateHash_failed
lea ecx, [ebp - 0x58]
call fcn.10005d60
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 3
call fcn.1000a520
push str.CreateSessionKey:_CryptCreateHash_failed
lea ecx, [ebp - 0x58]
call fcn.10005d60
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 5
call fcn.1000a520
int3