Function at 0x140070828
Capabilities:
Hash data via bcrypt

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
xor r13d, r13d
mov r14, rdx
mov qword [rbp - 0x10], r13
mov r15d, r13d
mov qword [rbp - 8], r13
mov esi, r13d
mov dword [rbp + 0x50], r13d
mov r12, rcx
mov dword [rbp + 0x48], r13d
mov dword [rbp + 0x58], r13d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ebx, eax
test r14, r14
je 0x140070a47
test r12, r12
je 0x140070a47
xor r9d, r9d
mov qword [r14], r13
xor r8d, r8d
lea rdx, str.SHA1
lea rcx, [rbp - 0x10]
call qword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
mov edi, eax
test eax, eax
jne 0x1400709cc
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x58]
mov dword [rsp + 0x28], r13d
lea r9d, [r13 + 4]
lea r8, [rbp + 0x50]
mov qword [rsp + 0x20], rax
lea rdx, str.ObjectLength
call qword [sym.imp.bcrypt.dll_BCryptGetProperty]
mov edi, eax
test eax, eax
jne 0x1400709cc
mov edi, dword [rbp + 0x50]
call qword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
mov r8d, edi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15, rax
test rax, rax
je 0x140070942
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x58]
mov dword [rsp + 0x28], r13d
lea r9d, [r13 + 4]
lea r8, [rbp + 0x48]
mov qword [rsp + 0x20], rax
lea rdx, str.HashDigestLength
call qword [sym.imp.bcrypt.dll_BCryptGetProperty]
mov edi, eax
test eax, eax
jne 0x1400709cc
mov edi, dword [rbp + 0x48]
call qword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
mov r8d, edi
lea edx, [r13 + 8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
jne 0x14007094c
mov edi, 0xc0000017
jmp 0x1400709cc
mov r9d, dword [rbp + 0x50]
lea rdx, [rbp - 8]
mov rcx, qword [rbp - 0x10]
mov r8, r15
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.bcrypt.dll_BCryptCreateHash]
mov edi, eax
test eax, eax
jne 0x1400709cc
or rax, 0xffffffffffffffff
inc rax
cmp word [r12 + rax*2], r13w
jne 0x14007097a
mov rcx, qword [rbp - 8]
lea r8d, [rax*2 + 2]
xor r9d, r9d
mov rdx, r12
call qword [sym.imp.bcrypt.dll_BCryptHashData]
mov edi, eax
test eax, eax
jne 0x1400709cc
mov r8d, dword [rbp + 0x48]
xor r9d, r9d
mov rcx, qword [rbp - 8]
mov rdx, rsi
call qword [sym.imp.bcrypt.dll_BCryptFinishHash]
mov edi, eax
test eax, eax
jne 0x1400709cc
mov edx, dword [rbp + 0x48]
mov r8, r14
mov rcx, rsi
call fcn.140070720
mov edi, eax
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1400709dd
xor edx, edx
call qword [sym.imp.bcrypt.dll_BCryptCloseAlgorithmProvider]
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x1400709ec
call qword [sym.imp.bcrypt.dll_BCryptDestroyHash]
test r15, r15
je 0x140070a05
call qword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rsi, rsi
je 0x140070a1e
call qword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
je 0x140070a41
mov rsi, qword [r14]
test rsi, rsi
je 0x140070a41
call qword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [r14], r13
bts edi, 0x1c
jmp 0x140070a4c
mov edi, 0x80070057
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetLastError]
mov rbx, qword [rsp + 0x90]
mov eax, edi
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret