Function at 0x180004300
Capabilities:
Initialize hashing via wincrypt

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x27]
sub rsp, 0xa0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x1f], rax
xor edi, edi
xor eax, eax
mov r13, r8
mov r14, rdx
mov r12, rcx
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x19], rdi
mov dword [rbp - 0x49], edi
mov esi, edi
mov qword [rbp - 0x41], rdi
mov dword [rbp - 0x45], edi
mov qword [rbp - 9], rdi
mov qword [rbp - 1], rax
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], rax
mov qword [rbp + 0x17], rax
test rcx, rcx
jne 0x180004369
mov ebx, 0x57
jmp 0x1800045a4
test rdx, rdx
je 0x18000435f
cmp dword [rcx], 0x80
mov ebx, edi
je 0x18000437f
mov ebx, 0x57
jmp 0x1800043b0
mov rax, qword [rcx + 8]
lea r9, [0x180002478]
mov r8d, 0x10
sub r9, rax
movzx ecx, byte [r9 + rax]
movzx edx, byte [rax]
cmp dl, cl
jb 0x1800043ab
ja 0x1800043ab
inc rax
dec r8
jne 0x180004393
jmp 0x1800043b0
mov ebx, 0x800b0003
test ebx, ebx
js 0x18000459c
mov rax, qword [r12 + 0x30]
mov qword [rsp + 0xf8], r15
mov ebx, edi
mov qword [rbp - 0x29], rdi
mov r15, rdi
test rax, rax
jne 0x180004403
lea r9d, [rax + 1]
lea r8, [0x1800024c0]
lea rcx, [rbp - 0x29]
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1800043fd
mov ebx, 0x80004005
jmp 0x180004407
mov r15, qword [rbp - 0x29]
jmp 0x180004407
mov qword [rbp - 0x29], rax
test ebx, ebx
js 0x180004538
lea r8, [rbp - 0x19]
mov edx, 0x80000000
mov rcx, r12
call fcn.1800039b0
mov ebx, eax
test eax, eax
js 0x180004538
mov rcx, qword [r12 + 8]
mov dword [rbp - 9], 1
mov eax, dword [rcx]
mov dword [rbp - 5], eax
mov eax, dword [rcx + 4]
mov dword [rbp - 1], eax
mov eax, dword [rcx + 8]
mov dword [rbp + 3], eax
mov eax, dword [rcx + 0xc]
mov dword [rbp + 7], eax
test r13, r13
jne 0x1800044d7
mov rcx, qword [r12 + 0x38]
mov rsi, qword [rbp - 0x29]
lea rdx, [rbp - 0x21]
mov qword [rbp - 0x11], rdi
mov dword [rbp - 0x21], edi
mov dword [rbp - 0x31], edi
call fcn.1800037b0
mov ebx, eax
test eax, eax
js 0x1800044c4
mov edx, dword [rbp - 0x21]
lea rax, [rbp - 0x11]
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1800044bc
mov rcx, qword [rbp - 0x11]
lea r9, [rbp - 0x31]
lea r8, [rbp - 0x45]
lea edx, [r13 + 4]
mov dword [rbp - 0x31], 4
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x1800044c4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [rbp - 0x11]
test rcx, rcx
je 0x1800044d3
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
test ebx, ebx
jmp 0x1800044fa
mov r8, qword [r12 + 0x38]
mov rdx, qword [rbp - 0x29]
mov rcx, qword [rbp - 0x19]
lea rax, [rbp - 0x45]
lea r9, [rbp - 0x41]
mov qword [rsp + 0x20], rax
call fcn.180003ab0
mov ebx, eax
test eax, eax
js 0x180004534
lea rax, [rbp - 0x49]
lea rsi, [0x180002518]
lea r8, [rbp - 9]
xor r9d, r9d
mov ecx, 0x10001
mov rdx, rsi
mov dword [rbp - 0x49], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptEncodeObject]
test eax, eax
jne 0x1800045ca
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rsi, qword [rbp - 0x41]
mov r14, rdi
test r15, r15
je 0x18000454b
xor edx, edx
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov r15, qword [rsp + 0xf8]
test rsi, rsi
je 0x18000456c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r14, r14
je 0x180004585
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x180004598
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x19], rdi
test ebx, ebx
jns 0x1800045a6
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
setns dil
mov eax, edi
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.180004f80
add rsp, 0xa0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ebx, dword [rbp - 0x49]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbp - 0x31], rax
test rax, rax
jne 0x1800045f9
mov rsi, qword [rbp - 0x41]
lea ebx, [rax + 8]
mov r14, rax
jmp 0x18000453b
lea rdx, [rbp - 0x49]
lea r8, [rbp - 9]
mov r9, rax
mov qword [rsp + 0x20], rdx
mov rdx, rsi
mov ecx, 0x10001
call qword [sym.imp.CRYPT32.dll_CryptEncodeObject]
test eax, eax
jne 0x180004630
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rsi, qword [rbp - 0x41]
mov r14, qword [rbp - 0x31]
mov ebx, eax
jmp 0x18000453b
mov rcx, qword [r12 + 0x38]
mov ebx, 0x80004005
mov eax, edi
test rcx, rcx
je 0x180004656
cmp byte [rcx], dil
je 0x18000472d
inc eax
inc rcx
cmp eax, 0x100
jb 0x180004641
mov edx, edi
test ebx, ebx
js 0x1800047d9
inc edx
mov ebx, 0x80004005
mov eax, edi
mov dword [rbp - 0x35], edx
mov rcx, rsi
nop
cmp byte [rcx], dil
je 0x180004741
inc eax
inc rcx
cmp eax, 0x100
jb 0x180004670
mov r8d, edi
test ebx, ebx
js 0x1800047d9
mov ecx, dword [rbp - 0x45]
mov r9d, dword [rbp - 0x49]
inc r8d
add ecx, edx
add ecx, r8d
lea eax, [rcx + r9 + 0x40]
test r13, r13
je 0x1800046b6
cmp dword [r14], eax
jae 0x1800046b6
mov dword [r14], eax
mov ebx, 0x7a
mov dword [r14], eax
test r13, r13
je 0x1800047d9
lea r10, [r13 + 0x40]
lea r11d, [rax - 0x40]
mov rdx, r8
mov rcx, r10
test r10, r10
je 0x1800047d4
mov eax, r11d
cmp rax, rdx
jb 0x1800047d4
test rdx, rdx
je 0x1800046ff
sub rsi, r10
nop dword [rax]
movzx eax, byte [rsi + rcx]
inc rcx
dec rdx
mov byte [rcx - 1], al
jne 0x1800046f0
mov r14, qword [rbp - 0x31]
sub r11d, r8d
mov qword [r13], r10
add r10, r8
mov edx, r11d
mov r8, r14
mov rcx, r10
call fcn.180002740
test eax, eax
je 0x180004756
mov rsi, qword [rbp - 0x41]
mov ebx, 0x7a
jmp 0x18000453b
cmp eax, 0x100
jae 0x180004656
mov edx, eax
mov ebx, edi
jmp 0x180004658
cmp eax, 0x100
jae 0x180004685
mov r8d, eax
mov ebx, edi
jmp 0x180004688
mov ecx, dword [rbp - 0x49]
mov esi, dword [rbp - 0x35]
mov qword [r13 + 0x10], r10
mov dword [r13 + 8], ecx
mov r8, qword [r12 + 0x38]
add r10, rcx
sub r11d, ecx
mov edx, esi
mov r9d, esi
mov rcx, r10
call fcn.180002740
test eax, eax
je 0x18000478e
mov rsi, qword [rbp - 0x41]
mov ebx, 0x7a
jmp 0x18000453b
mov r9d, dword [rbp - 0x45]
sub r11d, esi
mov rsi, qword [rbp - 0x41]
mov qword [r13 + 0x18], r10
add r10, rdx
mov r8, rsi
mov edx, r11d
mov rcx, r10
mov dword [r13 + 0x20], edi
mov qword [r13 + 0x28], rdi
call fcn.180002740
test eax, eax
je 0x1800047c4
mov ebx, 0x7a
jmp 0x18000453b
mov eax, dword [rbp - 0x45]
mov qword [r13 + 0x38], r10
mov dword [r13 + 0x30], eax
jmp 0x18000453b
mov ebx, 0x7a
mov rsi, qword [rbp - 0x41]
mov r14, qword [rbp - 0x31]
jmp 0x18000453b