Function at 0x14000d980
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push rbx
push rsi
push r14
mov eax, 0x40
call fcn.1400100f0
sub rsp, rax
mov rsi, rcx
mov r14, rdx
mov rcx, 0xffffffffffffffff
mov rbx, rcx
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x14000d9a2
test rbx, rbx
jne 0x14000d9bc
xor eax, eax
add rsp, 0x40
pop r14
pop rsi
pop rbx
ret
movzx eax, word [rsi + rbx*2 - 2]
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rdi
cmp ax, 0x5c
je 0x14000d9d7
cmp ax, 0x2f
jne 0x14000d9da
dec rbx
lea rdi, [rbx + 2]
mov eax, 2
mul rdi
cmovo rax, rcx
mov rcx, rax
call fcn.14000ef7c
lea r8, [rdi + rdi]
xor edx, edx
mov rcx, rax
mov rbp, rax
call sub.VCRUNTIME140.dll_memset
lea r8, [rbx + 1]
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcslwr]
xor edi, edi
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
mov dword [rsp + 0x70], edi
xor edx, edx
mov qword [rsp + 0x38], rdi
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x30], rdi
lea r9d, [rdi + 1]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x14000da81
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x14000dbb2
lea r9d, [rdi + 1]
mov dword [rsp + 0x20], 0xf0000008
xor r8d, r8d
lea rcx, [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x14000dbb2
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x8003
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x14000dbb2
mov rcx, qword [rsp + 0x30]
lea r8d, [rbx + rbx]
xor r9d, r9d
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x14000dbb2
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x70]
mov dword [rsp + 0x78], 4
mov edx, 4
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x14000dbb2
mov ecx, dword [rsp + 0x70]
call fcn.14000ef7c
mov r8d, dword [rsp + 0x70]
xor edx, edx
mov rcx, rax
mov rsi, rax
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x70]
mov r8, rsi
mov dword [rsp + 0x20], edi
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x14000dbb2
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000db43
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000db55
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, rbp
call fcn.14000ef74
mov r8d, 0x104
lea rdx, str.SOFTWARELibreOfficeMaintenanceService_
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
lea rbx, [r14 + 0x50]
cmp dword [rsp + 0x70], edi
jbe 0x14000dba3
nop dword [rax]
mov ecx, edi
lea rdx, str._.2x
movzx r8d, byte [rcx + rsi]
mov rcx, rbx
call qword [sym.imp.USER32.dll_wsprintfW]
add rbx, 4
inc edi
cmp edi, dword [rsp + 0x70]
jb 0x14000db80
mov rcx, rsi
call fcn.14000ef74
mov eax, 1
jmp 0x14000dbbc
mov rcx, rbp
call fcn.14000ef74
xor eax, eax
mov rbp, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rsi
pop rbx
ret