Function at 0x1400c1f48
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
xor edi, edi
mov rbp, r9
mov ebx, r8d
mov r12, rdx
mov r13, rcx
mov qword [rax - 0x70], rdi
cmp r8d, 0xffffcfc7
jne 0x1400c2177
lea rdx, [0x1400fd60c]
or r8, 0xffffffffffffffff
mov rcx, r9
call fcn.140058040
lea esi, [rdi + 1]
lea rcx, [rsp + 0x60]
mov edx, 0x1c00
mov r14d, esi
mov r12d, esi
mov ebx, edi
mov dword [rsp + 0x6c], 0x400
call fcn.140057f14
mov r11, qword [rsp + 0x60]
lea rcx, [rsp + 0x58]
lea r15, [r11 + 0x1400]
lea rax, [r11 + 0x1800]
mov qword [rsp + 0x28], rcx
lea r13, [r11 + 0x1000]
xor ecx, ecx
mov qword [rsp + 0x88], r15
mov qword [rsp + 0x70], rax
jmp 0x1400c201d
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov ecx, ebx
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_CryptEnumProviderTypesW]
lea rax, [rsp + 0x58]
add ebx, esi
mov qword [rsp + 0x28], rax
mov ecx, ebx
lea r9, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_CryptEnumProviderTypesW]
xor edx, edx
cmp eax, edi
jne 0x1400c1ff0
lea rcx, [rsp + 0x80]
mov r9d, esi
xor r8d, r8d
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
cmp eax, edi
je 0x1400c2166
mov rcx, qword [rsp + 0x80]
lea r9, [rsp + 0x6c]
mov r8, r15
mov edx, esi
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_CryptGetProvParam]
cmp eax, edi
je 0x1400c2148
mov r14d, dword [r15]
mov rcx, qword [rsp + 0x70]
lea rdx, [r15 + 4]
mov r13d, dword [rdx + 4]
mov r15d, dword [rdx]
mov eax, 0x63
cmp r13d, eax
cmovb eax, r13d
add rdx, 8
mov r8d, eax
mov ebx, eax
call fcn.1400d8fc0
mov rdx, qword [rsp + 0x70]
mov ecx, r14d
and ecx, 0xe000
mov byte [rbx + rdx], dil
cmp ecx, 0x2000
je 0x1400c2100
cmp ecx, 0x6000
je 0x1400c20f7
cmp ecx, 0x8000
je 0x1400c20ee
lea rax, [0x1400fd604]
lea r8, [0x1400fd5fc]
cmp ecx, 0xa000
cmove rax, r8
jmp 0x1400c2107
lea rax, [0x1400fd5f4]
jmp 0x1400c2107
lea rax, [0x1400fd5ec]
jmp 0x1400c2107
lea rax, [0x1400fd5e4]
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rdx
lea rdx, str._8.8xh___4d___4s___4d___s_r_n
mov r9d, r15d
mov r8d, r14d
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov rdx, qword [rsp + 0x60]
mov rcx, rbp
call fcn.140057fc8
mov r15, qword [rsp + 0x88]
mov r14d, edi
jmp 0x1400c214b
mov r12d, edi
cmp r12d, edi
jne 0x1400c2058
mov rcx, qword [rsp + 0x80]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov esi, edi
lea rcx, [rsp + 0x60]
call fcn.14005041c
mov eax, esi
jmp 0x1400c22eb
mov esi, 1
lea r8, str.Microsoft_Base_Cryptographic_Provider_v1.0
lea rcx, [rsp + 0x48]
xor edx, edx
mov r9d, esi
mov dword [rsp + 0xd0], 4
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
cmp eax, edi
jne 0x1400c21b5
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400c22eb
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
cmp eax, edi
jne 0x1400c21f2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, ebx
jmp 0x1400c22eb
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov r8d, r12d
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
cmp eax, edi
jne 0x1400c221f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x40]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x1400c21de
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0xd0]
lea r8, [rsp + 0x54]
mov edx, 4
mov dword [rsp + 0xd0], 4
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov edx, dword [rsp + 0x54]
lea rcx, [rsp + 0x78]
call fcn.140057f14
mov rbx, qword [rsp + 0x78]
mov eax, dword [rsp + 0x54]
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0xd0]
mov r8, rbx
mov edx, 2
mov dword [rsp + 0xd0], eax
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
lea rdx, [0x1400f0ea0]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [rsp + 0xd0], edi
jbe 0x1400c22c7
movzx r8d, byte [rbx]
lea rdx, str._02X
mov rcx, rbp
call qword [sym.imp.USER32.dll_wsprintfA]
add edi, esi
add rbp, 2
add rbx, rsi
cmp edi, dword [rsp + 0xd0]
jb 0x1400c22a1
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea rcx, [rsp + 0x78]
call fcn.14005041c
xor eax, eax
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret