Function at 0x1400199e0
Capabilities:
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rbp
push rbx
push rsi
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
xor ebx, ebx
mov r15d, r9d
mov dword [rbp + 0x38], ebx
mov r14, r8
mov qword [rbp - 0x28], rbx
mov esi, ebx
mov qword [rbp - 0x10], rbx
cmp edx, 0x41
jbe 0x140019c83
movabs rax, 0x6174614470707553
mov qword [rsp + 0x90], rdi
cmp qword [rcx], rax
jne 0x140019a30
mov eax, dword [rcx + 0x14]
lea rdi, [rcx + 0x18]
sub eax, 0x40
jmp 0x140019a36
mov rdi, rcx
lea eax, [rdx - 0x40]
mov dword [rbp - 0x30], eax
xor r9d, r9d
lea rax, [rbp - 0x18]
xor r8d, r8d
mov edx, 0x8004
mov qword [rsp + 0x20], rax
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140019c6d
mov rcx, qword [rbp - 0x18]
xor r9d, r9d
mov rdx, rdi
lea r8d, [r9 + 0x20]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rbp - 0x18]
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov edx, r15d
call qword [sym.imp.ADVAPI32.dll_CryptSignHashW]
test eax, eax
je 0x140019c63
mov edx, dword [rbp + 0x38]
mov ecx, 0x40
mov qword [rsp + 0xa0], r12
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r12, rax
test rax, rax
je 0x140019c5b
mov rcx, qword [rbp - 0x18]
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r12
mov edx, r15d
call qword [sym.imp.ADVAPI32.dll_CryptSignHashW]
test eax, eax
je 0x140019c52
lea rax, [rbp - 0x20]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x8004
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140019c52
mov r8d, dword [rbp + 0x38]
xor r9d, r9d
mov rcx, qword [rbp - 0x20]
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rbp - 0x20]
lea rdx, [rdi + 0x20]
xor r9d, r9d
lea r8d, [r9 + 0x20]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov r8, qword [rbp - 0x20]
lea rax, [rbp - 8]
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov edx, 0x6801
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x140019c48
xor r9d, r9d
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x28], rcx
lea rax, [rdi + 0x40]
mov rcx, qword [rbp - 8]
xor edx, edx
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov esi, eax
test eax, eax
je 0x140019c3e
mov edx, dword [rbp - 0x30]
lea rcx, [rdi + 0x58]
add edx, 0xffffffe8
lea r9, [0x140020630]
lea r8, [rbp - 0x28]
call fcn.14000c190
test eax, eax
je 0x140019c3e
mov rax, qword [rbp - 0x28]
cmp dword [rax], ebx
jbe 0x140019c2e
lea rdx, [rax + 8]
mov edi, ebx
shl rdi, 5
lea rcx, [0x140062250]
add rdx, rdi
mov r8b, 1
call qword [sym.imp.ntdll.dll_RtlEqualUnicodeString]
test al, al
jne 0x140019c24
mov rdx, qword [rbp - 0x28]
lea rcx, [0x140061ff8]
add rdx, 8
mov r8b, 1
add rdx, rdi
call qword [sym.imp.ntdll.dll_RtlEqualUnicodeString]
test al, al
je 0x140019c24
mov rax, qword [rbp - 0x28]
lea r9, [0x140013bb0]
lea r8, [rbp - 0x10]
mov edx, dword [rdi + rax + 0x18]
mov rcx, qword [rdi + rax + 0x20]
call fcn.14000c190
test eax, eax
je 0x140019c24
lea rdx, [0x140013be0]
lea rcx, [rbp - 0x10]
call fcn.14000c280
mov rax, qword [rbp - 0x28]
inc ebx
cmp ebx, dword [rax]
jb 0x140019bb3
lea rdx, [0x140020660]
lea rcx, [rbp - 0x28]
call fcn.14000c280
mov rcx, qword [rbp - 8]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r12, qword [rsp + 0xa0]
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rdi, qword [rsp + 0x90]
mov eax, esi
add rsp, 0x60
pop r15
pop r14
pop rsi
pop rbx
pop rbp
ret
mov eax, esi
add rsp, 0x60
pop r15
pop r14
pop rsi
pop rbx
pop rbp
ret