Function at 0x14008e220
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
xor r12d, r12d
mov dword [rbp - 0x2c], r12d
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x28], r12
mov dword [rbp - 0x30], r12d
mov dword [rsp + 0x20], 0xf0000000
mov r9d, Ordinal_27
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x14008e2cc
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], r12
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.14008f478
mov qword [rbx], rax
mov qword [rbx + 0x10], reloc.WS2_32.dll_setsockopt
mov qword [rbx + 0x18], Ordinal_32
movups xmm0, xmmword [str.TPM_DISABLED_OR_ERROR]
movups xmmword [rax], xmm0
mov ecx, dword [0x140104380]
mov dword [rax + 0x10], ecx
movzx ecx, byte [0x140104384]
mov byte [rax + 0x14], cl
mov byte [rax + 0x15], r12b
jmp 0x14008e41f
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, esi
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x14008e27b
mov r8d, dword [rdi + 8]
sub r8d, dword [rdi]
xor r9d, r9d
mov rdx, qword [rdi]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x14008e27b
mov dword [rsp + 0x20], r12d
lea r9, [rbp - 0x30]
xor r8d, r8d
mov edx, 2
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
xorps xmm0, xmm0
test eax, eax
je 0x14008e27e
mov r14d, dword [rbp - 0x30]
movdqu xmmword [rbp - 0x18], xmm0
mov rsi, r12
mov qword [rbp - 8], r12
test r14, r14
je 0x14008e370
mov edx, r14d
lea rcx, [rbp - 0x18]
call fcn.140078b80
mov r8d, r14d
xor edx, edx
mov rdi, qword [rbp - 0x18]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
lea r15, [rdi + r14]
mov qword [rbp - 0x10], r15
mov rsi, qword [rbp - 8]
jmp 0x14008e378
mov r15, qword [rbp - 0x10]
mov rdi, qword [rbp - 0x18]
mov dword [rsp + 0x20], r12d
lea r9, [rbp - 0x30]
mov r8, rdi
mov edx, 2
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x14008e43b
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], r12
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.14008f478
mov qword [rbx], rax
mov qword [rbx + 0x10], reloc.WS2_32.dll_setsockopt
mov qword [rbx + 0x18], Ordinal_32
movups xmm0, xmmword [str.TPM_DISABLED_OR_ERROR]
movups xmmword [rax], xmm0
mov ecx, dword [0x140104380]
mov dword [rax + 0x10], ecx
movzx ecx, byte [0x140104384]
mov byte [rax + 0x14], cl
mov byte [rax + 0x15], 0
test rdi, rdi
je 0x14008e41f
sub rsi, rdi
mov rax, rdi
cmp rsi, 0x1000
jb 0x14008e414
add rsi, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008e4f3
mov rdx, rsi
mov rcx, rdi
call fcn.14008f7c4
mov rax, rbx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x14008e44a
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x14008e45c
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
nop
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov dword [rbp - 0x2c], 2
mov r14, rdi
cmp rdi, r15
je 0x14008e4be
movzx r8d, byte [r14]
lea rdx, str._02x
lea rcx, [rbp + 0x48]
call fcn.14003eb50
lea rax, [rbp + 0x48]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x14008e4a0
lea rdx, [rbp + 0x48]
mov rcx, rbx
call fcn.14003af20
inc r14
cmp r14, r15
jne 0x14008e480
test rdi, rdi
je 0x14008e41f
sub rsi, rdi
mov rax, rdi
cmp rsi, 0x1000
jb 0x14008e414
add rsi, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14008e414
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3