Function at 0x1401157c0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data using sha1 via wincrypt
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt
Inspect section memory permissions

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], r8d
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x930]
sub rsp, 0xa30
xor r14d, r14d
mov r13, rdx
mov qword [rsp + 0x50], r14
mov rbx, rcx
mov qword [rbp - 0x30], r14
mov r15d, r14d
mov qword [rbp + 0x988], r14
mov edi, r14d
mov esi, r14d
test rcx, rcx
je 0x1401171d9
mov rcx, qword [r13 + 0x38]
lea rdx, [rbp + 0x988]
call qword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
mov r12d, dword [rbp + 0x980]
bt r12d, 0x1b
jae 0x140116352
mov rsi, qword [rbx + 8]
mov edi, r12d
and edi, 0x7000000
test rsi, rsi
je 0x1401171ad
bt r12d, 0x1c
jb 0x140115863
mov rax, qword [0x1401b29a8]
mov rcx, rsi
movzx edx, word [rbx]
mov r8, qword [rax + 0x20]
call qword [r8]
cmp edi, 0x1000000
je 0x140115d51
movzx edx, word [rbx]
mov rcx, rsi
cmp edi, 0x2000000
je 0x14011588d
mov r8d, 1
call fcn.1400124b0
jmp 0x1401171ad
lea r9, [0x1400119f0]
lea r8, [rbp - 0x30]
call fcn.1400101f0
test eax, eax
je 0x1401171ad
mov rdx, qword [rbp - 0x30]
mov ebx, r14d
mov dword [rbp + 0x970], ebx
cmp dword [rdx], r14d
jbe 0x140115d32
lea r15, [0x14014d1b0]
mov r12, 0xffffffffffffffff
lea rdi, [0x1401ac2a8]
mov rsi, qword [rbp + 0x988]
mov eax, ebx
lea rax, [rax + rax*2]
lea rax, [rax + 1]
lea rax, [rdx + rax*8]
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140115d22
cmp word [rax + 0xa], r14w
je 0x140115d22
mov edx, dword [rax + 4]
mov ecx, edx
sub ecx, 1
je 0x140115bae
sub ecx, 1
je 0x140115a3d
sub ecx, 1
je 0x140115a2c
cmp ecx, 1
je 0x140115934
lea rcx, str._n_t___08x_:
call fcn.14000afb0
jmp 0x140115d09
lea rcx, str._n_t__DPAPI____:
call fcn.14000afb0
test rsi, rsi
je 0x140115d09
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], r14
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x140115d09
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
test rax, rax
je 0x140115d09
cmp byte [rax], 1
jb 0x140115d09
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov ecx, r14d
mov edx, dword [rax]
mov rax, r15
cmp dword [rax], edx
je 0x140115d09
inc ecx
add rax, 4
cmp ecx, 8
jb 0x1401159a1
mov rbx, qword [0x1401ac2a8]
cmp rbx, rdi
je 0x1401159e2
mov rdx, qword [rbx + 0x28]
mov rcx, rsi
call fcn.14011ebc8
test eax, eax
jne 0x1401159da
cmp dword [rbx + 0x10], r14d
jge 0x140115d03
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x1401159c0
mov edx, 0xa0
lea ecx, [rdx - 0x60]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x140115d03
mov rcx, rsi
call fcn.14011eaf0
mov qword [rbx + 0x28], rax
mov rcx, qword [0x1401ac2b0]
mov qword [rbx + 8], rcx
mov qword [rbx], rdi
mov rcx, qword [0x1401ac2b0]
mov qword [rcx], rbx
mov qword [0x1401ac2b0], rbx
jmp 0x140115d03
lea rcx, str._n_t__RootKey__:
call fcn.14000afb0
jmp 0x140115d09
lea rcx, str._n_t__SHA1_____:
call fcn.14000afb0
test rsi, rsi
je 0x140115d09
mov r13, qword [rax + 0x10]
lea rdx, [rsp + 0x40]
mov rcx, rsi
mov qword [rsp + 0x40], r14
call qword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x140115d09
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
test rax, rax
je 0x140115d09
cmp byte [rax], 1
jb 0x140115d09
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov ecx, r14d
mov edx, dword [rax]
mov rax, r15
nop
cmp dword [rax], edx
je 0x140115d09
inc ecx
add rax, 4
cmp ecx, 8
jb 0x140115ab0
mov rbx, qword [0x1401ac2a8]
cmp rbx, rdi
je 0x140115af2
nop
mov rdx, qword [rbx + 0x28]
mov rcx, rsi
call fcn.14011ebc8
test eax, eax
jne 0x140115aea
cmp dword [rbx + 0x10], r14d
jge 0x140115ba3
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x140115ad0
mov edx, 0xa0
lea ecx, [rdx - 0x60]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x140115d03
mov rcx, rsi
call fcn.14011eaf0
mov qword [rbx + 0x28], rax
mov rcx, qword [0x1401ac2b0]
mov qword [rbx + 8], rcx
mov qword [rbx], rdi
mov rcx, qword [0x1401ac2b0]
mov qword [rcx], rbx
mov qword [0x1401ac2b0], rbx
mov r9, qword [rbx + 0x28]
mov rcx, r12
nop
inc rcx
cmp word [r9 + rcx*2], r14w
jne 0x140115b40
add ecx, ecx
test byte [rbx + 0x10], 2
jne 0x140115d03
test r13, r13
je 0x140115d03
movups xmm0, xmmword [r13]
lea rdx, [rbx + 0x54]
mov dword [rsp + 0x30], Ordinal_26
add ecx, 2
mov r8d, SQLAllocHandle
movups xmmword [rdx], xmm0
mov eax, dword [r13 + 0x10]
mov dword [rdx + 0x10], eax
lea rax, [rbx + 0x68]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov ecx, 0x8004
call fcn.1400035d0
or dword [rbx + 0x10], 2
jmp 0x140115d03
test rbx, rbx
je 0x140115d03
jmp 0x140115b37
lea rcx, str._n_t__NTLM_____:
call fcn.14000afb0
test rsi, rsi
je 0x140115d09
mov r13, qword [rax + 0x10]
lea rdx, [rsp + 0x40]
mov rcx, rsi
mov qword [rsp + 0x40], r14
call qword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x140115d09
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
test rax, rax
je 0x140115d09
cmp byte [rax], 1
jb 0x140115d09
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov ecx, r14d
mov edx, dword [rax]
mov rax, r15
nop
cmp dword [rax], edx
je 0x140115d09
inc ecx
add rax, 4
cmp ecx, 8
jb 0x140115c20
mov rbx, qword [0x1401ac2a8]
cmp rbx, rdi
je 0x140115c62
nop
mov rdx, qword [rbx + 0x28]
mov rcx, rsi
call fcn.14011ebc8
test eax, eax
jne 0x140115c5a
cmp dword [rbx + 0x10], r14d
jge 0x140115d47
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x140115c40
mov edx, 0xa0
lea ecx, [rdx - 0x60]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x140115d03
mov rcx, rsi
call fcn.14011eaf0
mov qword [rbx + 0x28], rax
mov rcx, qword [0x1401ac2b0]
mov qword [rbx + 8], rcx
mov qword [rbx], rdi
mov rcx, qword [0x1401ac2b0]
mov qword [rcx], rbx
mov qword [0x1401ac2b0], rbx
mov r9, qword [rbx + 0x28]
mov rcx, r12
nop
inc rcx
cmp word [r9 + rcx*2], r14w
jne 0x140115cb0
add ecx, ecx
test byte [rbx + 0x10], 1
jne 0x140115d03
test r13, r13
je 0x140115d03
movups xmm0, xmmword [r13]
add ecx, 2
mov dword [rsp + 0x30], Ordinal_26
lea rax, [rbx + 0x40]
mov r8d, 0x10
mov qword [rsp + 0x28], rax
lea rdx, [rbx + 0x30]
mov dword [rsp + 0x20], ecx
mov ecx, 0x8004
movups xmmword [rdx], xmm0
call fcn.1400035d0
test eax, eax
je 0x140115d03
or dword [rbx + 0x10], 1
mov ebx, dword [rbp + 0x970]
mov rax, qword [rsp + 0x50]
xor r8d, r8d
movzx edx, word [rax + 0xa]
mov rcx, qword [rax + 0x10]
call fcn.1400124b0
mov rdx, qword [rbp - 0x30]
inc ebx
mov dword [rbp + 0x970], ebx
cmp ebx, dword [rdx]
jb 0x1401158d0
lea rdx, [0x140011a20]
lea rcx, [rbp - 0x30]
call fcn.140010310
jmp 0x1401171ad
test rbx, rbx
je 0x140115d03
jmp 0x140115ca7
mov rcx, qword [r13]
call fcn.140118960
mov r15, rax
movsxd rax, dword [rax]
mov rcx, qword [rax + rsi + 8]
test rcx, rcx
je 0x140115d72
add rcx, rsi
mov qword [rax + rsi + 8], rcx
movsxd rax, dword [r15 + 4]
mov rcx, rax
mov rdx, qword [rax + rsi + 8]
test rdx, rdx
je 0x140115d90
lea rax, [rdx + rsi]
mov qword [rcx + rsi + 8], rax
mov eax, dword [r15 + 4]
movsxd r8, dword [r15]
lea rcx, str._n_t__yonghuming_:__wZ_n_t__test___:__wZ
movsxd rdx, eax
add r8, rsi
add rdx, rsi
call fcn.14000afb0
movsxd rax, dword [r15 + 8]
test eax, eax
je 0x1401160b6
cmp byte [rax + rsi], r14b
je 0x1401160b6
movsxd rcx, dword [r15 + 0x2c]
add rcx, rsi
movzx edx, word [rcx]
lea eax, [rdx - 0xa0]
test eax, 0xffffffef
je 0x140115de3
add rcx, 2
call fcn.140117320
jmp 0x14011631a
lea r8, [rbp + 0x970]
lea rdx, [rsp + 0x40]
call fcn.140117200
test eax, eax
je 0x14011631a
mov edx, dword [rbp + 0x970]
cmp edx, 0x34
jne 0x14011607d
movsxd rax, dword [r15 + 0xc]
mov r13, qword [rsp + 0x40]
cmp byte [rax + rsi], r14b
je 0x140115e29
xor r8d, r8d
mov rcx, r13
lea edx, [r8 + 0x10]
call fcn.1400124b0
movsxd rax, dword [r15 + 0x10]
cmp byte [rax + rsi], r14b
je 0x140115e43
xor r8d, r8d
lea rcx, [r13 + 0x10]
lea edx, [r8 + 0x10]
call fcn.1400124b0
movsxd rax, dword [r15 + 0x14]
cmp byte [rax + rsi], r14b
je 0x140115e5d
xor r8d, r8d
lea rcx, [r13 + 0x20]
lea edx, [r8 + 0x14]
call fcn.1400124b0
mov r12, qword [rbp + 0x988]
test r12, r12
je 0x1401160a8
movsxd rax, dword [r15 + 0xc]
movzx ecx, byte [rax + rsi]
movsxd rax, dword [r15 + 0x14]
test cl, cl
jne 0x140115e91
cmp byte [rax + rsi], r14b
je 0x1401160a8
lea rax, [r13 + 0x20]
mov qword [rbp - 0x40], rax
jmp 0x140115ea5
cmp byte [rax + rsi], r14b
je 0x140115ea1
lea rax, [r13 + 0x20]
mov qword [rbp - 0x40], rax
jmp 0x140115ea5
mov qword [rbp - 0x40], r14
test cl, cl
mov qword [rbp + 0x970], r14
mov rax, r14
lea rdx, [rbp + 0x970]
cmovne rax, r13
mov rcx, r12
mov qword [rsp + 0x50], rax
call qword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
mov rcx, qword [rbp + 0x970]
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x1401160a8
mov rcx, qword [rbp + 0x970]
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
test rax, rax
je 0x1401160a8
cmp byte [rax], 1
jb 0x1401160a8
mov rcx, qword [rbp + 0x970]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov ecx, dword [rax]
lea rax, [0x14014d1b0]
cmp dword [rax], ecx
je 0x1401160a8
inc r14d
add rax, 4
cmp r14d, 8
jb 0x140115f16
mov rbx, qword [0x1401ac2a8]
lea rdi, [0x1401ac2a8]
cmp rbx, rdi
je 0x140115f61
nop
mov rdx, qword [rbx + 0x28]
mov rcx, r12
call fcn.14011ebc8
test eax, eax
jne 0x140115f59
cmp dword [rbx + 0x10], eax
jge 0x140116073
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x140115f40
mov edx, 0xa0
lea ecx, [rdx - 0x60]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x1401160a8
mov rcx, r12
call fcn.14011eaf0
mov qword [rbx + 0x28], rax
mov rcx, qword [0x1401ac2b0]
mov qword [rbx + 8], rcx
mov qword [rbx], rdi
mov rcx, qword [0x1401ac2b0]
mov qword [rcx], rbx
mov qword [0x1401ac2b0], rbx
mov r9, qword [rbx + 0x28]
mov r12, 0xffffffffffffffff
inc r12
cmp word [r9 + r12*2], 0
jne 0x140115fb1
add r12d, r12d
test byte [rbx + 0x10], 1
jne 0x14011600b
mov rax, qword [rsp + 0x50]
test rax, rax
je 0x14011600b
movups xmm0, xmmword [rax]
lea ecx, [r12 + 2]
mov dword [rsp + 0x30], Ordinal_26
lea rax, [rbx + 0x40]
mov r8d, 0x10
mov qword [rsp + 0x28], rax
lea rdx, [rbx + 0x30]
mov dword [rsp + 0x20], ecx
mov ecx, 0x8004
movups xmmword [rdx], xmm0
call fcn.1400035d0
test eax, eax
je 0x14011600b
or dword [rbx + 0x10], 1
test byte [rbx + 0x10], 2
jne 0x1401160a8
mov rax, qword [rbp - 0x40]
test rax, rax
je 0x1401160a8
movups xmm0, xmmword [rax]
lea rdx, [rbx + 0x54]
mov dword [rsp + 0x30], Ordinal_26
lea r9d, [r12 + 2]
mov ecx, 0x8004
movups xmmword [rdx], xmm0
mov eax, dword [rax + 0x10]
mov r8d, SQLAllocHandle
mov dword [rdx + 0x10], eax
lea rax, [rbx + 0x68]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r9d
mov r9, qword [rbx + 0x28]
call fcn.1400035d0
or dword [rbx + 0x10], 2
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14011631a
test rbx, rbx
je 0x1401160a8
jmp 0x140115fa6
lea rcx, str.ERROR_kuhl_m_sekurlsa_genericCredsOutput___Size_error_for_NtlmHash_LsaIso_output___u__n
call fcn.14000afb0
mov r13, qword [rsp + 0x40]
mov r8d, 0x100001
mov rcx, r13
call fcn.1400124b0
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.14000afb0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14011631a
movsxd rax, dword [r15 + 0x10]
cmp byte [rax + rsi], r14b
je 0x1401160d3
movsxd rcx, dword [r15 + 0x20]
xor r8d, r8d
add rcx, rsi
lea edx, [r8 + 0x10]
call fcn.1400124b0
movsxd rax, dword [r15 + 0xc]
cmp byte [rax + rsi], r14b
je 0x1401160f0
movsxd rcx, dword [r15 + 0x1c]
xor r8d, r8d
add rcx, rsi
lea edx, [r8 + 0x10]
call fcn.1400124b0
movsxd rax, dword [r15 + 0x14]
cmp byte [rax + rsi], r14b
je 0x14011610d
movsxd rcx, dword [r15 + 0x24]
xor r8d, r8d
add rcx, rsi
lea edx, [r8 + 0x14]
call fcn.1400124b0
cmp qword [rbp + 0x988], r14
je 0x14011631a
movsxd rax, dword [r15 + 0xc]
movzx ecx, byte [rax + rsi]
movsxd rax, dword [r15 + 0x14]
test cl, cl
jne 0x14011613d
cmp byte [rax + rsi], r14b
je 0x14011631a
movsxd r13, dword [r15 + 0x24]
add r13, rsi
jmp 0x14011614f
cmp byte [rax + rsi], r14b
je 0x14011614c
movsxd r13, dword [r15 + 0x24]
add r13, rsi
jmp 0x14011614f
mov r13, r14
test cl, cl
je 0x140116160
movsxd rbx, dword [r15 + 0x1c]
add rbx, rsi
mov qword [rbp - 0x40], rbx
jmp 0x140116164
mov qword [rbp - 0x40], r14
mov r12, qword [rbp + 0x988]
lea rdx, [rbp + 0x970]
mov rcx, r12
mov qword [rbp + 0x970], r14
call qword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
mov rcx, qword [rbp + 0x970]
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x14011631a
mov rcx, qword [rbp + 0x970]
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
test rax, rax
je 0x14011631a
cmp byte [rax], 1
jb 0x14011631a
mov rcx, qword [rbp + 0x970]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov ecx, dword [rax]
lea rax, [0x14014d1b0]
nop
cmp dword [rax], ecx
je 0x14011631a
inc r14d
add rax, 4
cmp r14d, 8
jb 0x1401161d0
mov rbx, qword [0x1401ac2a8]
lea rdi, [0x1401ac2a8]
cmp rbx, rdi
je 0x140116221
nop dword [rax + rax]
mov rdx, qword [rbx + 0x28]
mov rcx, r12
call fcn.14011ebc8
test eax, eax
jne 0x140116219
cmp dword [rbx + 0x10], eax
jge 0x140116348
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x140116200
mov edx, 0xa0
lea ecx, [rdx - 0x60]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x14011631a
mov rcx, r12
call fcn.14011eaf0
mov qword [rbx + 0x28], rax
mov rcx, qword [0x1401ac2b0]
mov qword [rbx + 8], rcx
mov qword [rbx], rdi
mov rcx, qword [0x1401ac2b0]
mov qword [rcx], rbx
mov qword [0x1401ac2b0], rbx
mov r9, qword [rbx + 0x28]
mov r12, 0xffffffffffffffff
inc r12
cmp word [r9 + r12*2], 0
jne 0x140116271
add r12d, r12d
test byte [rbx + 0x10], 1
jne 0x1401162ca
mov rax, qword [rbp - 0x40]
test rax, rax
je 0x1401162ca
movups xmm0, xmmword [rax]
lea ecx, [r12 + 2]
mov dword [rsp + 0x30], Ordinal_26
lea rax, [rbx + 0x40]
mov r8d, 0x10
mov qword [rsp + 0x28], rax
lea rdx, [rbx + 0x30]
mov dword [rsp + 0x20], ecx
mov ecx, 0x8004
movups xmmword [rdx], xmm0
call fcn.1400035d0
test eax, eax
je 0x1401162ca
or dword [rbx + 0x10], 1
test byte [rbx + 0x10], 2
jne 0x14011631a
test r13, r13
je 0x14011631a
movups xmm0, xmmword [r13]
mov r9, qword [rbx + 0x28]
lea rdx, [rbx + 0x54]
lea ecx, [r12 + 2]
mov dword [rsp + 0x30], Ordinal_26
movups xmmword [rdx], xmm0
mov eax, dword [r13 + 0x10]
mov r8d, SQLAllocHandle
mov dword [rdx + 0x10], eax
lea rax, [rbx + 0x68]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov ecx, 0x8004
call fcn.1400035d0
or dword [rbx + 0x10], 2
movsxd rax, dword [r15 + 0x18]
test eax, eax
je 0x1401171ad
cmp byte [rax + rsi], 0
je 0x1401171ad
movsxd rcx, dword [r15 + 0x28]
xor r8d, r8d
add rcx, rsi
lea edx, [r8 + 0x10]
call fcn.1400124b0
jmp 0x1401171ad
test rbx, rbx
je 0x14011631a
jmp 0x140116266
bt r12d, 0xc
jae 0x1401165a7
cmp qword [rbx + 8], rsi
je 0x14011639d
mov rdx, qword [0x1401b29b0]
mov rcx, rbx
call fcn.14000cb70
test eax, eax
je 0x14011639d
bt r12d, 0x1c
jb 0x140116393
mov rax, qword [0x1401b29a8]
movzx edx, word [rbx + 2]
mov rcx, qword [rbx + 8]
mov r8, qword [rax + 0x20]
call qword [r8]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x1401171ad
bt r12d, 0x1c
jb 0x1401163c3
mov rax, qword [0x1401b29a8]
movzx edx, word [rbx + 0x22]
mov r8, qword [rax + 0x20]
call qword [r8]
lea rcx, [rbp + 0xb0]
call qword [sym.imp.advapi32.dll_A_SHAInit]
movzx r8d, word [rbx + 0x20]
lea rcx, [rbp + 0xb0]
mov rdx, qword [rbx + 0x28]
call qword [sym.imp.advapi32.dll_A_SHAUpdate]
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0xb0]
call qword [sym.imp.advapi32.dll_A_SHAFinal]
movzx edx, word [rbx + 0x20]
xor r8d, r8d
mov rcx, qword [rbx + 0x28]
call fcn.1400124b0
mov rcx, qword [0x140144a58]
lea rax, [rbp + 0x40]
mov r8d, SQLAllocHandle
movzx edx, byte [rax]
call fcn.14000afb0
lea rax, [rax + 1]
sub r8, 1
jne 0x140116418
mov r12, qword [rbp + 0x988]
test r12, r12
je 0x1401171ad
lea rdx, [rbp + 0x970]
mov qword [rbp + 0x970], r14
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
mov rcx, qword [rbp + 0x970]
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x1401171ad
mov rcx, qword [rbp + 0x970]
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
test rax, rax
je 0x1401171ad
cmp byte [rax], 1
jb 0x1401171ad
mov rcx, qword [rbp + 0x970]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov ecx, dword [rax]
lea rax, [0x14014d1b0]
nop dword [rax]
cmp dword [rax], ecx
je 0x1401171ad
inc r14d
add rax, 4
cmp r14d, 8
jb 0x1401164a0
mov rbx, qword [0x1401ac2a8]
lea rdi, [0x1401ac2a8]
cmp rbx, rdi
je 0x1401164f1
nop dword [rax + rax]
mov rdx, qword [rbx + 0x28]
mov rcx, r12
call fcn.14011ebc8
test eax, eax
jne 0x1401164e9
cmp dword [rbx + 0x10], esi
jge 0x14011659c
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x1401164d0
mov edx, 0xa0
lea ecx, [rdx - 0x60]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x1401171ad
mov rcx, r12
call fcn.14011eaf0
mov qword [rbx + 0x28], rax
mov rcx, qword [0x1401ac2b0]
mov qword [rbx + 8], rcx
mov qword [rbx], rdi
mov rcx, qword [0x1401ac2b0]
mov qword [rcx], rbx
mov qword [0x1401ac2b0], rbx
mov r9, qword [rbx + 0x28]
mov r12, 0xffffffffffffffff
inc r12
cmp word [r9 + r12*2], si
jne 0x140116541
add r12d, r12d
test byte [rbx + 0x10], 2
jne 0x1401171ad
movups xmm0, xmmword [rbp + 0x40]
lea rdx, [rbx + 0x54]
mov dword [rsp + 0x30], Ordinal_26
lea ecx, [r12 + 2]
mov r8d, SQLAllocHandle
movups xmmword [rdx], xmm0
mov eax, dword [rbp + 0x50]
mov dword [rdx + 0x10], eax
lea rax, [rbx + 0x68]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov ecx, 0x8004
call fcn.1400035d0
or dword [rbx + 0x10], 2
jmp 0x1401171ad
test rbx, rbx
je 0x1401171ad
jmp 0x140116536
bt r12d, 0x17
jae 0x140116601
lea rcx, str._n_t__Smartcard
call fcn.14000afb0
cmp qword [rbx + 8], rsi
je 0x1401171ad
mov rdx, qword [0x1401b29b0]
mov rcx, rbx
call fcn.14000cb70
test eax, eax
je 0x1401171ad
bt r12d, 0x1c
jb 0x1401165f8
mov rax, qword [0x1401b29a8]
movzx edx, word [rbx + 2]
mov rcx, qword [rbx + 8]
mov r8, qword [rax + 0x20]
call qword [r8]
mov rcx, qword [rbx + 8]
jmp 0x1401171a7
bt r12d, 0x15
jae 0x140116761
mov ecx, dword [rbx]
call fcn.1400d99f0
mov rdx, rax
lea rcx, str._t____s
call fcn.14000afb0
movzx eax, word [rbx + 8]
mov word [rsp + 0x5a], ax
mov word [rsp + 0x58], ax
test ax, ax
je 0x140116744
mov rax, qword [rbx + 0x10]
lea rcx, [rsp + 0x58]
mov rdx, qword [0x1401b29b0]
mov qword [rsp + 0x60], rax
call fcn.14000cb70
test eax, eax
je 0x140116750
bt r12d, 0x14
jae 0x1401166f7
mov rax, qword [rbx + 8]
cmp rax, 0x64
jbe 0x1401166f7
mov rcx, qword [rsp + 0x60]
cmp rax, 0x8f
ja 0x1401166d4
lea r8, [rbp + 0x970]
lea rdx, [rsp + 0x40]
call fcn.140117200
test eax, eax
je 0x140116728
mov edx, dword [rbp + 0x970]
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
call fcn.1400124b0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.14000afb0
jmp 0x1401171ad
mov edx, eax
call fcn.140117320
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.14000afb0
jmp 0x1401171ad
bt r12d, 0x1c
jb 0x140116716
mov rax, qword [0x1401b29a8]
movzx edx, word [rsp + 0x5a]
mov rcx, qword [rsp + 0x60]
mov r8, qword [rax + 0x20]
call qword [r8]
movzx edx, word [rsp + 0x58]
xor r8d, r8d
mov rcx, qword [rsp + 0x60]
call fcn.1400124b0
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.14000afb0
jmp 0x1401171ad
lea rcx, str._no_size__buffer_is_incorrect_
call fcn.14000afb0
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.14000afb0
jmp 0x1401171ad
bt r12d, 0x14
jae 0x140116772
movups xmm0, xmmword [rbx + 0x28]
movups xmmword [rbx + 0x20], xmm0
jmp 0x1401167e2
bt r12d, 0x10
jae 0x1401167e2
mov ecx, dword [rbx + 0x28]
test ecx, ecx
je 0x1401167da
sub ecx, 1
je 0x1401167a2
cmp ecx, 1
je 0x140116798
lea rcx, str.ERROR_kuhl_m_sekurlsa_genericCredsOutput___Unknown_version_in_Kerberos_credentials_structure_n
call fcn.14000afb0
jmp 0x1401167e2
movups xmm0, xmmword [rbx + 0x30]
movups xmmword [rbx + 0x20], xmm0
jmp 0x1401167e2
movzx eax, word [rbx + 0x30]
lea rcx, [rsp + 0x58]
mov word [rsp + 0x5a], ax
mov word [rsp + 0x58], ax
mov rax, qword [rbx + 0x38]
mov dword [rbx + 0x20], r14d
mov qword [rbx + 0x28], r14
mov rdx, qword [0x1401b29b0]
mov qword [rsp + 0x60], rax
call fcn.14000cb70
test eax, eax
cmovne rsi, qword [rsp + 0x60]
mov dword [rbx + 0x20], r14d
mov qword [rbx + 0x28], r14
cmp qword [rbx + 8], r14
jne 0x1401167f8
cmp qword [rbx + 0x18], r14
jne 0x1401167f8
cmp qword [rbx + 0x28], r14
je 0x1401171ad
mov rdx, qword [0x1401b29b0]
mov rcx, rbx
call fcn.14000cb70
test eax, eax
je 0x14011681c
bt r12d, 0x1e
jb 0x140116817
mov r15, rbx
jmp 0x14011681c
mov qword [rsp + 0x50], rbx
mov rdx, qword [0x1401b29b0]
lea r12, [rbx + 0x10]
mov rcx, r12
call fcn.14000cb70
test eax, eax
je 0x140116849
test dword [rbp + 0x980], 0x40000000
jne 0x140116846
mov qword [rsp + 0x50], r12
jmp 0x140116849
mov r15, r12
mov rcx, qword [rbx + 0x28]
lea rax, [rbp - 0x28]
mov qword [rbp - 0x38], rax
lea r12, [rbx + 0x20]
mov rax, qword [0x1401b29b0]
mov qword [rsp + 0x48], rax
mov dword [rbp - 0x28], r14d
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x40], r14
mov qword [rsp + 0x40], rcx
mov qword [rbx + 0x28], r14
test rcx, rcx
je 0x140116952
movzx eax, word [rbx + 0x22]
test ax, ax
je 0x140116952
mov edx, eax
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp - 0x40], rax
test rax, rax
je 0x140116952
movzx r8d, word [rbx + 0x22]
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x40]
mov qword [rbx + 0x28], rax
call fcn.14000a6f0
test eax, eax
je 0x140116952
test dword [rbp + 0x980], 0x10000000
jne 0x1401168eb
mov rax, qword [0x1401b29a8]
movzx edx, word [rbx + 0x22]
mov rcx, qword [rbx + 0x28]
mov r8, qword [rax + 0x20]
call qword [r8]
mov rdi, r12
test r12, r12
je 0x140116952
cmp word [r12], 2
mov dword [rbp + 0x970], 2
jne 0x14011691b
mov rax, qword [r12 + 8]
movzx ecx, word [rax]
call qword [sym.imp.USER32.dll_IsCharAlphaNumericW]
test eax, eax
jne 0x140116a3b
movzx edx, word [r12]
lea r8, [rbp + 0x970]
mov rcx, qword [r12 + 8]
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
test eax, eax
jne 0x140116a3b
movzx edx, word [r12]
lea r8d, [rax + 1]
mov rcx, qword [r12 + 8]
call fcn.1400124b0
jmp 0x140116a3b
test dword [rbp + 0x980], 0x20000000
jne 0x140116c18
test rsi, rsi
je 0x140116a2f
lea r8, [rbp + 0x970]
mov rcx, rsi
lea rdx, [rsp + 0x40]
call fcn.140117200
test eax, eax
je 0x140116a24
lea rcx, str._n_t______Password:
call fcn.14000afb0
mov ebx, dword [rbp + 0x970]
movzx eax, bx
mov r12, qword [rsp + 0x40]
mov word [rsp + 0x5a], bx
mov rcx, r12
mov qword [rsp + 0x60], rcx
mov word [rsp + 0x58], bx
cmp ebx, 0xffff
jae 0x140116a0b
mov dword [rbp + 0x970], 2
cmp bx, 2
jne 0x1401169e4
movzx ecx, word [r12]
call qword [sym.imp.USER32.dll_IsCharAlphaNumericW]
test eax, eax
jne 0x1401169f8
mov rcx, qword [rsp + 0x60]
movzx eax, word [rsp + 0x58]
movzx edx, ax
lea r8, [rbp + 0x970]
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
test eax, eax
je 0x140116a0b
lea rdx, [rsp + 0x58]
lea rcx, [0x14015fbb8]
call fcn.14000afb0
jmp 0x140116a1b
mov r8d, 1
mov edx, ebx
mov rcx, r12
call fcn.1400124b0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140116a3b
lea rcx, str._null_
call fcn.14000afb0
test r15, r15
je 0x14011718a
movzx eax, word [r15]
test ax, ax
je 0x140116c21
cmp qword [r15 + 8], r14
je 0x140116c21
lea rdx, [rax + 2]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x140116c21
movzx r8d, word [r15]
mov rcx, rax
mov rdx, qword [r15 + 8]
call fcn.14011b4a0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CredIsMarshaledCredentialW]
test eax, eax
je 0x140116c0d
lea rcx, str._n_t__Marshaled:
call fcn.14000afb0
lea r8, [rsp + 0x40]
mov rcx, rbx
lea rdx, [rbp + 0x970]
call qword [sym.imp.ADVAPI32.dll_CredUnmarshalCredentialW]
test eax, eax
je 0x140116bf9
mov ecx, dword [rbp + 0x970]
sub ecx, 1
je 0x140116b94
sub ecx, 1
je 0x140116b67
sub ecx, 1
je 0x140116b2c
cmp ecx, 1
je 0x140116b07
lea rcx, str._____
call fcn.14000afb0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CredFree]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140116c21
lea rcx, str._UsernameForPacked___
call fcn.14000afb0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CredFree]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140116c21
lea rcx, str._BinaryBlob_
call fcn.14000afb0
mov rcx, qword [rsp + 0x40]
mov r8d, 1
mov edx, dword [rcx]
mov rcx, qword [rcx + 8]
call fcn.1400124b0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CredFree]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140116c21
mov rdx, qword [rsp + 0x40]
lea rcx, str._UsernameTarget___s_n
mov rdx, qword [rdx]
call fcn.14000afb0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CredFree]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140116c21
mov rax, qword [rsp + 0x40]
mov edx, dword [rax]
cmp edx, 0x18
jne 0x140116bd7
lea rcx, str._Cert__SHA1:
call fcn.14000afb0
mov rcx, qword [rsp + 0x40]
xor r8d, r8d
add rcx, 4
lea edx, [r8 + 0x14]
call fcn.1400124b0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CredFree]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140116c21
lea rcx, str.ERROR_kuhl_m_sekurlsa_trymarshal___Credential__cbSize_is__u_n
call fcn.14000afb0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CredFree]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140116c21
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_kuhl_m_sekurlsa_trymarshal___CredUnmarshalCredential__0x_08x__n
call fcn.14000afb0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140116c21
test r15, r15
je 0x14011718a
mov rbx, qword [rsp + 0x50]
test rbx, rbx
je 0x140117180
mov rcx, qword [r13 + 0x18]
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_CharLowerW]
mov rcx, qword [r15 + 8]
call qword [sym.imp.USER32.dll_CharLowerW]
mov rcx, qword [r13 + 0x20]
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_CharLowerW]
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_CharLowerW]
mov rax, qword [r13 + 0x18]
mov r12, 0xffffffffffffffff
mov rdx, r12
mov rcx, qword [rax + 8]
inc rdx
cmp word [rcx + rdx*2], r14w
jne 0x140116c71
test rdx, rdx
je 0x140116ca8
mov r8, qword [r15 + 8]
sub r8, rcx
nop word [rax + rax]
movzx eax, word [rcx]
cmp word [rcx + r8], ax
jne 0x140117180
add rcx, 2
sub rdx, 1
jne 0x140116c90
mov rax, qword [r13 + 0x20]
mov rdx, r12
mov rcx, qword [rax + 8]
inc rdx
cmp word [rcx + rdx*2], r14w
jne 0x140116cb3
test rdx, rdx
je 0x140116ce8
mov r8, qword [rbx + 8]
sub r8, rcx
nop dword [rax]
movzx eax, word [rcx]
cmp word [rcx + r8], ax
jne 0x140117180
add rcx, 2
sub rdx, 1
jne 0x140116cd0
mov rsi, rdi
test rdi, rdi
je 0x140117180
cmp word [r15], 1
jb 0x140117180
cmp word [rbx], 1
jb 0x140117180
cmp word [rdi], 1
jb 0x140117180
xor edx, edx
lea rcx, [rbp + 0x130]
mov r8d, 0x200
call fcn.14011adb0
xor edx, edx
lea rcx, [rbp + 0x530]
mov r8d, 0x200
call fcn.14011adb0
xor edx, edx
lea rcx, [rbp + 0x330]
mov r8d, 0x200
call fcn.14011adb0
xor edx, edx
lea rcx, [rbp + 0x730]
mov r8d, 0x200
call fcn.14011adb0
mov r8, qword [r15 + 8]
lea rcx, [rbp + 0x130]
mov r9, r12
mov edx, 0x100
call fcn.14012a1b8
mov r8, qword [rbx + 8]
lea rcx, [rbp + 0x530]
mov r9, r12
mov edx, 0x100
call fcn.14012a1b8
mov r9, r12
lea r8, [0x1401b3220]
mov edx, 0x100
lea rcx, [rbp + 0x330]
call fcn.14012a1b8
mov r9, r12
lea r8, [0x1401b2de0]
mov edx, 0x100
lea rcx, [rbp + 0x730]
call fcn.14012a1b8
lea rax, [rbp + 0x130]
mov rdx, r12
inc rdx
cmp word [rax + rdx*2], r14w
jne 0x140116dd3
lea rcx, [rbp + 0x130]
call qword [sym.imp.USER32.dll_CharUpperBuffW]
lea rax, [rbp + 0x530]
mov rdx, r12
inc rdx
cmp word [rax + rdx*2], r14w
jne 0x140116df4
lea rcx, [rbp + 0x530]
call qword [sym.imp.USER32.dll_CharUpperBuffW]
lea rax, [rbp + 0x330]
mov rdx, r12
inc rdx
cmp word [rax + rdx*2], r14w
jne 0x140116e15
lea rcx, [rbp + 0x330]
call qword [sym.imp.USER32.dll_CharUpperBuffW]
lea rax, [rbp + 0x730]
mov rdx, r12
inc rdx
cmp word [rax + rdx*2], r14w
jne 0x140116e36
lea rcx, [rbp + 0x730]
call qword [sym.imp.USER32.dll_CharUpperBuffW]
lea rax, [rbp + 0x130]
lea r8, [rbp + 0x330]
sub r8, rax
nop
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140116e74
add rax, 2
test ecx, ecx
jne 0x140116e60
test edx, edx
jne 0x140117180
lea rax, [rbp + 0x530]
lea r8, [rbp + 0x730]
sub r8, rax
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140116ea4
add rax, 2
test ecx, ecx
jne 0x140116e90
test edx, edx
jne 0x140117180
cmp dword [0x1401b2cc8], r14d
ja 0x140117180
movdqu xmm1, xmmword [0x1401b2fe0]
mov r9d, r12d
movdqu xmm0, xmmword [0x1401b2ff0]
mov ecx, 0xfde9
mov rbx, qword [rsi + 8]
mov qword [rsp + 0x38], r14
mov r8, rbx
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x70], 0xff00ffff
mov dword [rsp + 0x74], 0xc1c8d3e5
mov dword [rsp + 0x78], 0xfbfd869b
mov dword [rsp + 0x7c], 0xfefefefa
pxor xmm1, xmmword [rsp + 0x70]
movdqu xmmword [rbp + 0x60], xmm1
movdqu xmm1, xmmword [0x1401b3000]
mov dword [rbp - 0x80], 0xfefefefe
mov dword [rbp - 0x7c], 0xe1edfefe
mov dword [rbp - 0x78], 0x3b52b9d6
mov dword [rbp - 0x74], 0xf64c64b5
pxor xmm0, xmmword [rbp - 0x80]
movdqu xmmword [rbp + 0x70], xmm0
movdqu xmm0, xmmword [0x1401b3010]
mov dword [rbp - 0x70], 0xfefef3f9
mov dword [rbp - 0x6c], 0xf2f3f3fe
mov dword [rbp - 0x68], 0xc4f6f2e9
mov dword [rbp - 0x64], 0x7da4b8bc
pxor xmm1, xmmword [rbp - 0x70]
movdqu xmmword [rbp + 0x80], xmm1
xorps xmm1, xmm1
mov dword [rbp - 0x60], 0xff00ff65
mov dword [rbp - 0x5c], 0xb7ff00ff
mov dword [rbp - 0x58], 0x496393a2
mov dword [rbp - 0x54], 0x35496335
pxor xmm0, xmmword [rbp - 0x60]
mov dword [rsp + 0x28], r14d
movups xmmword [rbp - 0x10], xmm1
mov qword [rsp + 0x20], r14
movups xmmword [rbp], xmm1
movups xmmword [rbp + 0x10], xmm1
movups xmmword [rbp + 0x20], xmm1
movdqu xmmword [rbp + 0x90], xmm0
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [rsp + 0x38], r14
mov r9d, r12d
mov qword [rsp + 0x30], r14
mov r8, rbx
mov dword [rsp + 0x28], eax
xor edx, edx
lea rax, [rbp - 0x10]
mov ecx, 0xfde9
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rax, [rbp - 0x10]
nop word [rax + rax]
cmp byte [rax + r12 + 1], r14b
lea r12, [r12 + 1]
jne 0x140116ff0
lea ecx, [r12 + 1]
mov r8d, Ordinal_69
mov dword [rbp + 0x970], ecx
sub r8d, ecx
mov eax, ecx
xor edx, edx
lea rcx, [rbp - 0x10]
add rcx, rax
call fcn.14011adb0
movdqu xmm0, xmmword [rbp - 0x10]
lea rcx, [rbp - 0x28]
pxor xmm0, xmmword [rsp + 0x70]
mov r9d, reloc.ODBC32.dll_SQLAllocHandle
movdqu xmm1, xmmword [rbp]
xor r8d, r8d
pxor xmm1, xmmword [rbp - 0x80]
xor edx, edx
movdqu xmmword [rbp - 0x10], xmm0
movdqu xmm0, xmmword [rbp + 0x10]
pxor xmm0, xmmword [rbp - 0x70]
movdqu xmmword [rbp], xmm1
movdqu xmm1, xmmword [rbp + 0x20]
pxor xmm1, xmmword [rbp - 0x60]
movdqu xmmword [rbp + 0x10], xmm0
movdqu xmmword [rbp + 0x20], xmm1
mov qword [rbp - 0x28], r14
mov qword [rsp + 0x40], r14
mov qword [rbp - 0x40], r14
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov ebx, eax
test eax, eax
je 0x14011712d
mov rcx, qword [rbp - 0x28]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x8003
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov ebx, eax
test eax, eax
je 0x14011712d
mov rcx, qword [rsp + 0x40]
lea rdx, [rbp + 0x60]
xor r9d, r9d
lea r8d, [r9 + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov ebx, eax
test eax, eax
je 0x14011712d
mov r8, qword [rsp + 0x40]
lea rax, [rbp - 0x40]
mov rcx, qword [rbp - 0x28]
mov r9d, 1
mov edx, 0x660e
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
mov ebx, eax
test eax, eax
je 0x14011712d
mov rcx, qword [rbp - 0x40]
lea rax, [rbp + 0x970]
xor r9d, r9d
mov dword [rsp + 0x30], Ordinal_69
mov qword [rsp + 0x28], rax
xor edx, edx
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov ebx, eax
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x14011713c
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14011714c
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x14011715d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test ebx, ebx
je 0x140117180
mov eax, dword [rbp + 0x970]
lea rdx, [rbp - 0x10]
mov r8d, eax
mov dword [0x1401b2cc8], eax
lea rcx, [0x1401b3420]
call fcn.14011b4a0
mov rcx, qword [r15 + 8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rsp + 0x50]
test rax, rax
je 0x14011719e
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rdi, rdi
je 0x1401171ad
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
test byte [rbp + 0x980], 2
je 0x1401171c2
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.14000afb0
mov r12, qword [rbp + 0x988]
test r12, r12
je 0x1401171e5
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1401171e5
lea rcx, str.LUID_KO_n
call fcn.14000afb0
mov rbx, qword [rsp + 0xa78]
add rsp, 0xa30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret