Function at 0x140022310
Capabilities:
Hash data via bcrypt

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xc8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp - 0x11], rax
mov rax, qword [r8]
mov r15, qword [rbp + 0x6f]
mov r13, qword [rbp + 0x7f]
mov rsi, rcx
mov rcx, qword [r15]
and qword [r8], 0
and qword [r15], 0
and dword [r13], 0
mov r14, r9
mov qword [rbp - 0x71], rcx
mov qword [rbp - 0x69], r8
mov r12, rdx
mov qword [rbp - 0x61], rdx
mov qword [rsp + 0x40], rax
jmp 0x140022683
mov r12, qword [rbp - 0x61]
mov rdx, qword [r15]
mov rbx, rcx
mov ecx, dword [rsi]
sub rbx, rdx
cmp ecx, 6
jne 0x140022529
sub rax, qword [r8]
mov qword [rbp - 0x59], rbx
mov qword [rbp - 0x61], rax
test rbx, rbx
jne 0x1400223a2
test rax, rax
je 0x140022aab
mov eax, dword [rbp + 0x77]
mov qword [rsp + 0x38], r13
lea rcx, [rsi + 0x60]
mov dword [rsp + 0x30], eax
lea rax, [rbp - 0x59]
lea r8, [rbp - 0x61]
mov r9, r14
mov rdx, r12
mov qword [rsp + 0x20], rax
call fcn.140021d9c
mov ecx, dword [rsi + 0x208]
mov rbx, qword [rbp - 0x61]
mov edi, eax
dec ecx
je 0x140022410
sub ecx, 3
je 0x1400223fc
cmp ecx, 6
jne 0x140022422
mov rcx, qword [rsi + 0x238]
xor r9d, r9d
mov r8d, ebx
mov rdx, r12
call qword [sym.imp.bcrypt.dll_BCryptHashData]
jmp 0x140022422
lea rcx, [rsi + 0x220]
mov r8, rbx
mov rdx, r12
call fcn.1400ea94c
jmp 0x140022422
lea rcx, [rsi + 0x210]
mov r8, rbx
mov rdx, r12
call fcn.1400e9028
mov rax, qword [rbp - 0x59]
mov r8, qword [rbp - 0x69]
add r12, rbx
add qword [r15], rax
add qword [rsi + 0x18], rax
add qword [r8], rbx
add qword [rsi + 0x20], rbx
mov r9, qword [rsi + 0x20]
add r14, rax
mov qword [rbp - 0x61], r12
test edi, edi
jne 0x140022ab5
cmp dword [r13], 1
mov edi, reloc.WS2_32.dll_ntohs
jne 0x140022509
movzx ecx, word [rsi + 0x10]
and ecx, edi
jne 0x14002246a
xor eax, eax
jmp 0x140022481
dec ecx
mov eax, 0x55555556
imul ecx
mov eax, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
shl eax, cl
mov edx, dword [rsi + 0x14]
add rdx, rax
add rdx, qword [rsi + 0x18]
xor r8d, r8d
mov cl, dl
shr rdx, 7
or cl, 0x80
mov byte [rbp + r8 - 0x51], cl
inc r8d
test rdx, rdx
jne 0x14002248e
lea eax, [r8 - 1]
lea r10, [rbp - 0x51]
and byte [rbp + rax - 0x51], 0x7f
mov eax, r8d
add r10, rax
mov cl, r9b
shr r9, 7
or cl, 0x80
mov byte [rdx + r10], cl
inc edx
test r9, r9
jne 0x1400224b7
mov rcx, qword [rsi + 0x250]
lea ebx, [rdx + r8]
lea eax, [rdx - 1]
and byte [rax + r10], 0x7f
lea rdx, [rbp - 0x51]
mov r8d, ebx
call qword [sym.imp.bcrypt.dll_BCryptHashData]
inc qword [rsi + 0x28]
and dword [rsi + 4], 0
mov eax, ebx
mov dword [rsi], 7
add qword [rsi + 0x30], rax
and dword [rsi + 8], 0
jmp 0x140022a99
mov rcx, qword [rbp - 0x71]
test rax, rax
mov rax, qword [rsp + 0x40]
jne 0x140022375
test rbx, rbx
je 0x140022ac8
jmp 0x140022375
test rbx, rbx
je 0x140022ac0
test ecx, ecx
je 0x140022a06
dec ecx
je 0x14002291c
dec ecx
je 0x1400228d2
dec ecx
je 0x140022814
dec ecx
je 0x1400227e5
dec ecx
je 0x14002268d
mov rax, qword [rsp + 0x40]
cmp ecx, 2
mov rcx, qword [rbp - 0x71]
jne 0x140022375
mov al, byte [rsi + 0x18]
add al, byte [rsi + 8]
test al, 3
je 0x14002259d
lea rax, [rdx + 1]
mov qword [r15], rax
inc dword [rsi + 8]
mov al, byte [r14]
inc r14
test al, al
jne 0x140022912
mov rax, qword [rsp + 0x40]
jmp 0x140022524
movzx ecx, word [rsi + 0x10]
and ecx, edi
jne 0x1400225aa
xor r12d, r12d
jmp 0x1400225c3
dec ecx
mov eax, 0x55555556
mov r12d, 4
imul ecx
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
shl r12d, cl
mov edi, r12d
sub edi, dword [rsi + 4]
je 0x1400225f9
mov eax, edi
lea rcx, [rsi + 0x278]
mov rdx, r14
cmp rax, rbx
mov eax, dword [rsi + 4]
cmova edi, ebx
add rcx, rax
mov r8d, edi
mov ebx, edi
call qword [sym.imp.msvcrt.dll_memcpy]
add dword [rsi + 4], edi
add qword [r15], rbx
add r14, rbx
jmp 0x140022672
and dword [rsi + 4], 0
mov dword [rsi], 5
mov ecx, dword [rsi + 0x208]
dec ecx
je 0x14002264b
sub ecx, 3
je 0x14002263b
mov rax, qword [rsp + 0x40]
cmp ecx, 6
mov rcx, qword [rbp - 0x71]
mov edi, reloc.WS2_32.dll_ntohs
jne 0x140022371
lea rcx, [rsi + 0x228]
lea rdx, [rbp - 0x51]
call fcn.1400eab70
jmp 0x140022656
mov rax, qword [rsi + 0x220]
not rax
mov qword [rbp - 0x51], rax
jmp 0x140022656
mov eax, dword [rsi + 0x218]
not eax
mov dword [rbp - 0x51], eax
lea rdx, [rsi + 0x278]
lea rcx, [rbp - 0x51]
mov r8d, r12d
call qword [sym.imp.msvcrt.dll_memcmp]
test eax, eax
jne 0x140022912
mov r12, qword [rbp - 0x61]
mov r8, qword [rbp - 0x69]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rbp - 0x71]
mov edi, reloc.WS2_32.dll_ntohs
jmp 0x140022375
mov ecx, dword [rsi + 4]
test ecx, ecx
jne 0x14002273d
mov al, byte [r14]
lea rdi, [rsi + 0x278]
inc r14
mov byte [rdi], al
inc dword [rsi + 4]
inc qword [r15]
cmp byte [rdi], cl
jne 0x14002272b
mov rdx, qword [rsi + 0x28]
xor r8d, r8d
mov cl, dl
shr rdx, 7
or cl, 0x80
mov byte [r8 + rsi + 0x279], cl
inc r8d
test rdx, rdx
jne 0x1400226b8
lea eax, [r8 - 1]
lea rbx, [rsi + 0x240]
lea rdx, [rsi + 0x258]
and byte [rax + rsi + 0x279], 0x7f
lea eax, [r8 + 1]
mov ecx, eax
mov dword [rsi + 0xc], eax
add qword [rsi + 0x30], rcx
mov qword [rsi + 0x38], rcx
mov rcx, rbx
call fcn.1400eab70
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.1400eaaf0
mov r8d, dword [rsi + 0xc]
lea rcx, [rsi + 0x50]
mov rdx, rdi
call fcn.1400e9028
mov r8, qword [rbp - 0x69]
mov dword [rsi], 1
movzx eax, byte [rdi]
lea eax, [rax*4 + 4]
mov dword [rsi + 0x14], eax
jmp 0x14002267a
mov edi, dword [rsi + 0x14]
cmp ecx, edi
je 0x140022777
sub edi, ecx
mov rdx, r14
mov eax, edi
cmp rax, rbx
mov rax, rcx
lea rcx, [rsi + 0x278]
cmova edi, ebx
add rcx, rax
mov r8d, edi
mov ebx, edi
call qword [sym.imp.msvcrt.dll_memcpy]
add dword [rsi + 4], edi
add qword [r15], rbx
add r14, rbx
jmp 0x140022676
lea rbx, [rsi + 0x170]
lea rdx, [rsi + 0x278]
mov rcx, rbx
call fcn.140021fb4
test eax, eax
jne 0x140022aca
movzx eax, word [rsi + 0x10]
and qword [rsi + 0x18], 0
and qword [rsi + 0x20], 0
mov edi, reloc.WS2_32.dll_ntohs
mov dword [rsi], 6
and eax, edi
mov dword [rsi + 0x208], eax
cmp eax, 0xa
jne 0x1400227cc
lea rcx, [rsi + 0x228]
xor r8d, r8d
xor edx, edx
call fcn.1400eaaf0
lea rcx, [rsi + 0x60]
mov rdx, rbx
call fcn.140022118
test eax, eax
jne 0x140022aca
jmp 0x140022a99
cmp byte [r14], 0
je 0x140022801
test byte [rsi + 0x40], 3
jne 0x140022ab9
and dword [rsi + 4], 0
and dword [rsi], 0
jmp 0x140022a9d
lea rax, [rdx + 1]
inc r14
mov qword [r15], rax
inc qword [rsi + 0x40]
jmp 0x140022a9d
mov ecx, dword [rsi + 4]
mov edi, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov rdx, r14
sub edi, ecx
mov eax, edi
cmp rax, rbx
cmova edi, ebx
add rcx, 0x278
add rcx, rsi
mov r8d, edi
mov ebx, edi
call qword [sym.imp.msvcrt.dll_memcpy]
add dword [rsi + 4], edi
add qword [r15], rbx
mov r8, qword [rbp - 0x69]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rbp - 0x71]
add r14, rbx
cmp dword [rsi + 4], 0xc
mov edi, reloc.WS2_32.dll_ntohs
jne 0x140022375
inc qword [rsi + 0x48]
and qword [rsi + 0x40], 0
movzx ebx, word [rsi + 0x10]
lea rcx, [rsi + 0x27c]
mov dword [rsi], 4
mov eax, dword [rcx]
lea rax, [rax*4 + 4]
cmp qword [rsi + 0x30], rax
jne 0x140022912
lea edx, [rdi - 9]
call fcn.140011dcc
cmp dword [rsi + 0x278], eax
jne 0x140022912
movzx eax, byte [rsi + 0x281]
movzx ecx, byte [rsi + 0x280]
shl ecx, 8
or ecx, eax
movzx eax, bx
cmp eax, ecx
jne 0x140022912
lea rcx, [rsi + 0x282]
lea r8d, [rdi - 0xd]
lea rdx, [0x140171080]
jmp 0x1400229f3
cmp dword [rsi + 4], 4
jae 0x1400228f7
lea rax, [rdx + 1]
mov qword [r15], rax
mov al, byte [r14]
mov ecx, dword [rsi + 4]
mov byte [rcx + rsi + 0x278], al
inc dword [rsi + 4]
inc r14
jmp 0x140022a9d
mov eax, dword [rsi + 0x58]
and dword [rsi + 4], 0
mov dword [rsi], 3
not eax
cmp eax, dword [rsi + 0x278]
je 0x140022a9d
mov eax, 3
jmp 0x140022aca
mov eax, dword [rsi + 0xc]
cmp dword [rsi + 4], eax
jae 0x140022944
lea rax, [rdx + 1]
mov qword [r15], rax
mov eax, dword [rsi + 4]
mov dl, byte [r14]
mov cl, byte [rax + rsi + 0x278]
inc eax
inc r14
cmp dl, cl
mov dword [rsi + 4], eax
jmp 0x14002290c
mov rax, qword [rsi + 0x30]
cmp qword [rsi + 0x38], rax
jae 0x14002298d
sub rax, qword [rsi + 0x38]
lea rcx, [rsi + 0x50]
mov rdx, r14
cmp rbx, rax
cmova rbx, rax
mov r8, rbx
call fcn.1400e9028
mov rcx, qword [rsi + 0x250]
xor r9d, r9d
mov r8d, ebx
mov rdx, r14
call qword [sym.imp.bcrypt.dll_BCryptHashData]
add qword [r15], rbx
add r14, rbx
add qword [rsi + 0x38], rbx
jmp 0x140022a99
test byte [rsi + 0x38], 3
je 0x1400229c0
mov al, byte [r14]
lea rcx, [rsi + 0x50]
lea rdx, [rbp - 0x79]
mov r8d, 1
inc r14
mov byte [rbp - 0x79], al
call fcn.1400e9028
inc qword [r15]
inc qword [rsi + 0x38]
inc qword [rsi + 0x30]
cmp byte [rbp - 0x79], 0
jmp 0x1400229fb
and dword [rsi + 4], 0
add rax, 4
lea rcx, [rsi + 0x240]
lea rdx, [rbp - 0x51]
mov dword [rsi], 2
mov qword [rsi + 0x30], rax
call fcn.1400eab70
lea rdx, [rsi + 0x258]
mov r8d, 0x20
lea rcx, [rbp - 0x51]
call qword [sym.imp.msvcrt.dll_memcmp]
test eax, eax
jne 0x140022912
jmp 0x140022a99
mov ecx, dword [rsi + 4]
cmp ecx, 0xc
jae 0x140022a3b
cmp ecx, 6
jae 0x140022a26
lea rdx, [0x140171078]
mov al, byte [rcx + rdx]
cmp byte [r14], al
jne 0x140022ab9
mov al, byte [r14]
inc r14
mov byte [rcx + rsi + 0x278], al
inc dword [rsi + 4]
inc qword [r15]
jmp 0x140022a9d
movzx edx, byte [rsi + 0x27f]
lea rcx, [rsi + 0x27e]
movzx eax, byte [rcx]
shl ax, 8
or dx, ax
mov word [rsi + 0x10], dx
mov edx, 2
call fcn.140011dcc
cmp eax, dword [rsi + 0x280]
jne 0x140022ab9
cmp di, word [rsi + 0x10]
sbb eax, eax
and eax, 4
jne 0x140022aca
lea rcx, [rsi + 0x240]
xor r8d, r8d
xor edx, edx
mov dword [rsi], 5
call fcn.1400eaaf0
and qword [rsi + 0x30], 0
and qword [rsi + 0x28], 0
and dword [rsi + 4], 0
mov r8, qword [rbp - 0x69]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rbp - 0x71]
jmp 0x140022375
mov dword [r13], 2
jmp 0x140022ac8
mov eax, edi
jmp 0x140022aca
mov eax, reloc.SHELL32.dll_ILRemoveLastID
jmp 0x140022aca
mov dword [r13], 3
xor eax, eax
mov rcx, qword [rbp - 0x11]
xor rcx, rsp
call fcn.140001010
add rsp, 0xc8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret