Function at 0x1400e7b00
Capabilities:
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rbp
push rsi
push rdi
push r12
push r14
mov rbp, rsp
sub rsp, 0x60
xor r12d, r12d
mov esi, r9d
mov dword [rbp + 0x38], r12d
mov rdi, r8
mov qword [rbp - 0x28], r12
mov r14d, r12d
mov qword [rbp - 0x20], r12
cmp edx, 0x41
jbe 0x1400e802b
movabs rax, 0x6174614470707553
mov qword [rsp + 0x90], rbx
cmp qword [rcx], rax
jne 0x1400e7b53
mov eax, dword [rcx + 0x14]
lea rbx, [rcx + 0x18]
sub eax, 0x40
jmp 0x1400e7b59
mov rbx, rcx
lea eax, [rdx - 0x40]
mov dword [rbp - 0x30], eax
xor r9d, r9d
lea rax, [rbp - 0x10]
xor r8d, r8d
mov edx, 0x8004
mov qword [rsp + 0x20], rax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1400e8026
mov rcx, qword [rbp - 0x10]
xor r9d, r9d
mov rdx, rbx
mov qword [rsp + 0xa0], r15
lea r8d, [r9 + 0x20]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r12
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_CryptSignHashW]
test eax, eax
je 0x1400e7fe9
mov edx, dword [rbp + 0x38]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r15, rax
test rax, rax
je 0x1400e7ffd
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r15
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_CryptSignHashW]
test eax, eax
je 0x1400e7fca
lea rax, [rbp - 0x18]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x8004
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1400e7fde
mov r8d, dword [rbp + 0x38]
xor r9d, r9d
mov rcx, qword [rbp - 0x18]
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rbp - 0x18]
lea rdx, [rbx + 0x20]
xor r9d, r9d
lea r8d, [r9 + 0x20]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov r8, qword [rbp - 0x18]
lea rax, [rbp - 8]
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov edx, 0x6801
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x1400e7fa1
xor r9d, r9d
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x28], rcx
lea rax, [rbx + 0x40]
mov rcx, qword [rbp - 8]
xor edx, edx
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov r14d, eax
test eax, eax
je 0x1400e7f6e
mov edx, dword [rbp - 0x30]
lea rcx, [rbx + 0x58]
add edx, 0xffffffe8
lea r9, [0x140011b20]
lea r8, [rbp - 0x28]
call fcn.1400101f0
test eax, eax
je 0x1400e7f82
mov rax, qword [rbp - 0x28]
mov edi, r12d
cmp dword [rax], r12d
jbe 0x1400e7f3c
nop dword [rax]
mov ebx, edi
lea r8, [rax + 8]
shl rbx, 5
lea rcx, str.____u___wZ
add r8, rbx
mov edx, edi
call fcn.14000afb0
mov rdx, qword [rbp - 0x28]
lea rcx, [0x14014dcd8]
add rdx, 8
mov r8b, 1
add rdx, rbx
call qword [sym.imp.ntdll.dll_RtlEqualUnicodeString]
test al, al
je 0x1400e7e0a
mov rax, qword [rbp - 0x28]
mov r10, qword [rbx + rax + 0x20]
mov edx, dword [r10]
test edx, edx
je 0x1400e7d87
cmp edx, 4
je 0x1400e7d44
lea rcx, str._nUnknown_version:__u_n
call fcn.14000afb0
jmp 0x1400e7f22
test byte [r10 + 4], 2
je 0x1400e7f22
lea rcx, str._n__NTLM:
call fcn.14000afb0
mov rcx, qword [0x140144a58]
lea rax, [r10 + 0xc]
mov r8d, 0x10
nop dword [rax]
movzx edx, byte [rax]
call fcn.14000afb0
lea rax, [rax + 1]
sub r8, 1
jne 0x1400e7d70
jmp 0x1400e7f22
mov eax, dword [r10 + 4]
mov r9, qword [0x140144a58]
test al, 1
je 0x1400e7dc9
lea rcx, str._n____LM:
call fcn.14000afb0
lea rax, [r10 + 8]
mov r8d, 0x10
nop dword [rax]
movzx edx, byte [rax]
mov rcx, r9
call fcn.14000afb0
lea rax, [rax + 1]
sub r8, 1
jne 0x1400e7db0
mov eax, dword [r10 + 4]
test al, 2
je 0x1400e7f22
lea rcx, str._n__NTLM:
call fcn.14000afb0
lea rax, [r10 + 0x18]
mov r8d, 0x10
nop word [rax + rax]
movzx edx, byte [rax]
mov rcx, r9
call fcn.14000afb0
lea rax, [rax + 1]
sub r8, 1
jne 0x1400e7df0
jmp 0x1400e7f22
mov rdx, qword [rbp - 0x28]
lea rcx, [0x14014d988]
add rdx, 8
mov r8b, 1
add rdx, rbx
call qword [sym.imp.ntdll.dll_RtlEqualUnicodeString]
test al, al
je 0x1400e7efe
mov rax, qword [rbp - 0x28]
lea r9, [0x1400119f0]
lea r8, [rbp - 0x20]
mov edx, dword [rbx + rax + 0x18]
mov rcx, qword [rbx + rax + 0x20]
call fcn.1400101f0
test eax, eax
je 0x1400e7f22
mov rdx, qword [rbp - 0x20]
mov ebx, r12d
cmp dword [rdx], ebx
jbe 0x1400e7eec
mov eax, ebx
lea r9, [rax*2 + 1]
add r9, rax
lea r9, [rdx + r9*8]
test r9, r9
je 0x1400e7ee2
cmp word [r9 + 0xa], r12w
je 0x1400e7ee2
mov edx, dword [r9 + 4]
mov eax, edx
sub eax, 1
je 0x1400e7ec1
sub eax, 1
je 0x1400e7eb8
sub eax, 1
je 0x1400e7eaf
cmp eax, 1
je 0x1400e7ea6
lea rcx, str._n_t___08x_:
call fcn.14000afb0
jmp 0x1400e7ecd
lea rcx, str._n_t__DPAPI____:
jmp 0x1400e7ec8
lea rcx, str._n_t__RootKey__:
jmp 0x1400e7ec8
lea rcx, str._n_t__SHA1_____:
jmp 0x1400e7ec8
lea rcx, str._n_t__NTLM_____:
call fcn.14000afb0
movzx edx, word [r9 + 0xa]
xor r8d, r8d
mov rcx, qword [r9 + 0x10]
call fcn.1400124b0
mov rdx, qword [rbp - 0x20]
inc ebx
cmp ebx, dword [rdx]
jb 0x1400e7e61
lea rdx, [0x140011a20]
lea rcx, [rbp - 0x20]
call fcn.140010310
jmp 0x1400e7f22
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.14000afb0
mov rax, qword [rbp - 0x28]
mov r8d, 0x100001
mov edx, dword [rbx + rax + 0x18]
mov rcx, qword [rbx + rax + 0x20]
call fcn.1400124b0
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.14000afb0
mov rax, qword [rbp - 0x28]
inc edi
cmp edi, dword [rax]
jb 0x1400e7ce0
lea rdx, [0x140011b50]
lea rcx, [rbp - 0x28]
call fcn.140010310
mov rcx, qword [rbp - 8]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1400e7ffd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_kuhl_m_lsadump_decryptSCCache___CryptDecrypt__0x_08x__n
call fcn.14000afb0
mov rcx, qword [rbp - 8]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1400e7ffd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_kuhl_m_lsadump_decryptSCCache___CryptDeriveKey_RC4___0x_08x__n
call fcn.14000afb0
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1400e7ffd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_kuhl_m_lsadump_decryptSCCache___CryptSignHash_data___0x_08x__n
call fcn.14000afb0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1400e7ffd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_kuhl_m_lsadump_decryptSCCache___CryptSignHash_init___0x_08x__n
call fcn.14000afb0
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov r15, qword [rsp + 0xa0]
mov eax, r14d
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, r12d
jmp 0x1400e8012
mov eax, r12d
add rsp, 0x60
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret