Function at 0x4a39c6
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [0x5184d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp + 8]
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x5c], edx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x44], eax
push edi
mov edi, eax
cmp esi, 0x10
je 0x4a3a2c
cmp esi, 0x20
je 0x4a3a2c
cmp esi, 0x40
je 0x4a3a2c
mov esi, 0x8000ffff
push esi
push 0xe3013e
jmp 0x4a3e6d
test ecx, ecx
je 0x4a3e62
test edx, edx
je 0x4a3e62
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_GetACP]
mov edx, eax
lea ecx, [ebp - 0x58]
call fcn.004c6584
test eax, eax
jne 0x4a3a6e
mov eax, 0x8007000e
push eax
push 0xed013e
mov esi, eax
call dword [sym.imp.certcli.dll_Ordinal_357]
mov ebx, dword [ebp - 0x58]
jmp 0x4a3e73
push 0xffffffffffffffff
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_GetACP]
mov edx, eax
lea ecx, [ebp - 0x6c]
call fcn.004c6584
test eax, eax
jne 0x4a3aa8
mov eax, 0x8007000e
push eax
push 0xf2013e
mov esi, eax
call dword [sym.imp.certcli.dll_Ordinal_357]
mov eax, dword [ebp - 0x6c]
mov ebx, dword [ebp - 0x58]
mov dword [ebp - 0x64], eax
jmp 0x4a3e73
mov ebx, dword [ebp - 0x58]
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a3ab0
mov eax, dword [ebp - 0x6c]
sub ecx, edx
mov edx, eax
mov dword [ebp - 0x64], eax
lea eax, [edx + 1]
mov dword [ebp - 0x4c], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x4a3ac7
sub edx, dword [ebp - 0x4c]
lea eax, [edx + ecx]
mov dword [ebp - 0x4c], eax
inc eax
mov dword [ebp - 0x68], eax
cmp eax, 0x10000
jb 0x4a3af2
mov esi, 0x80070216
push esi
push 0xfa013e
jmp 0x4a3e6d
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
mov dword [ebp - 0x50], edi
test edi, edi
jne 0x4a3b16
mov eax, 0x8007000e
push eax
mov esi, eax
push 0x100013e
jmp 0x4a3e6d
mov edx, dword [ebp - 0x68]
mov ecx, edi
push ebx
call fcn.00463eb0
mov eax, dword [ebp - 0x64]
mov ecx, edi
mov edx, dword [ebp - 0x68]
push eax
call fcn.004aad28
xor eax, eax
lea ecx, [ebp - 0x54]
push ecx
cmp esi, 0x10
push 0
setne al
add eax, 0x8003
push 0
push eax
push dword [ebp - 0x5c]
mov dword [ebp - 0x78], eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x4a3b67
call fcn.004c73cc
mov esi, eax
push esi
push 0x10d013e
jmp 0x4a3e6d
push 0
push dword [ebp - 0x4c]
push edi
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x4a3b8c
call fcn.004c73cc
mov esi, eax
push esi
push 0x115013e
jmp 0x4a3e6d
push 0
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], 0x14
push eax
lea eax, [ebp - 0x18]
push eax
push 2
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x4a3bbe
call fcn.004c73cc
mov esi, eax
push esi
push 0x11e013e
jmp 0x4a3e6d
mov edx, dword [ebp - 0x5c]
lea eax, [ebp - 0x18]
push ecx
push dword [ebp - 0x44]
push eax
push ecx
mov ecx, esi
call fcn.004a38f3
mov esi, eax
test esi, esi
je 0x4a3be2
push esi
push 0x129013e
jmp 0x4a3e6d
mov ecx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x70]
mov dword [ecx], eax
cmp eax, 0x20
jne 0x4a3da3
mov eax, dword [ebp - 8]
lea esi, [ebp - 0x18]
mov dword [ebp - 0x3c], 0x208
lea edi, [ebp - 0x30]
mov dword [ebp - 0x38], 0x6602
mov dword [ebp - 0x34], 0x10
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x3c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ecx + 4]
push esi
push 0
push 0
push 0x1c
push eax
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x4a3c4e
call fcn.004c73cc
mov esi, eax
push esi
push 0x150013e
call dword [sym.imp.certcli.dll_Ordinal_357]
mov edi, dword [ebp - 0x50]
jmp 0x4a3e73
push 0
lea eax, [ebp - 0x70]
mov dword [ebp - 0x70], 0x80
push eax
push 0x13
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
jne 0x4a3c78
call fcn.004c73cc
mov esi, eax
push esi
push 0x15c013e
jmp 0x4a3c40
push 0
lea eax, [ebp - 0x74]
mov dword [ebp - 0x74], 1
push eax
push 4
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
jne 0x4a3ca2
call fcn.004c73cc
mov esi, eax
push esi
push 0x165013e
jmp 0x4a3c40
mov esi, dword [ebp - 0x5c]
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push dword [ebp - 0x78]
push esi
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x4a3ccd
call fcn.004c73cc
mov esi, eax
push esi
push 0x18b013e
jmp 0x4a3c40
mov edi, dword [ebp - 0x50]
push 0
push dword [ebp - 0x4c]
push edi
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x4a3cf5
call fcn.004c73cc
mov esi, eax
push esi
push 0x192013e
jmp 0x4a3e6d
push 0
push 1
lea eax, [ebp - 0x3d]
mov byte [ebp - 0x3d], 1
push eax
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x4a3d20
call fcn.004c73cc
mov esi, eax
push esi
push 0x19c013e
jmp 0x4a3e6d
push 0
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x18]
push eax
push 2
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x4a3d4b
call fcn.004c73cc
mov esi, eax
push esi
push 0x1a2013e
jmp 0x4a3e6d
push ecx
push dword [ebp - 0x44]
lea eax, [ebp - 0x18]
mov edx, esi
push eax
push ecx
push 0x20
pop ecx
call fcn.004a38f3
mov esi, eax
test esi, esi
je 0x4a3d6f
push esi
push 0x1a6013e
jmp 0x4a3e6d
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x60]
push 0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
push 1
push dword [ecx + 4]
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
jne 0x4a3e5e
call fcn.004c73cc
mov esi, eax
push esi
push 0x1af013e
jmp 0x4a3e6d
cmp dword [0x51996c], 0
je 0x4a3de5
movzx eax, byte [ebp - 0x11]
push eax
movzx eax, byte [ebp - 0x12]
push eax
movzx eax, byte [ebp - 0x13]
push eax
movzx eax, byte [ebp - 0x14]
push eax
movzx eax, byte [ebp - 0x15]
push eax
movzx eax, byte [ebp - 0x16]
push eax
mov eax, dword [ebp - 0x18]
movzx ecx, ah
push ecx
movzx eax, al
push eax
push 0x420318
call fcn.004c5942
mov ecx, dword [ebp - 0x60]
add esp, 0x24
lea eax, [ecx + 8]
push 0x40
lea ecx, [ebp - 0x18]
push ecx
push eax
call fcn.004367e0
mov esi, eax
test esi, esi
je 0x4a3e02
push esi
push 0x17b013e
jmp 0x4a3e6d
cmp dword [0x51996c], 0
je 0x4a3e40
movzx eax, byte [ebp - 9]
push eax
movzx eax, byte [ebp - 0xa]
push eax
movzx eax, byte [ebp - 0xb]
push eax
movzx eax, byte [ebp - 0xc]
push eax
movzx eax, byte [ebp - 0xd]
push eax
movzx eax, byte [ebp - 0xe]
push eax
movzx eax, byte [ebp - 0xf]
push eax
movzx eax, byte [ebp - 0x10]
push eax
push 0x4203a8
call fcn.004c5942
add esp, 0x24
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x60]
add eax, 8
push eax
call fcn.00435120
mov esi, eax
test esi, esi
je 0x4a3e5e
push esi
push 0x1c7013e
jmp 0x4a3e6d
xor esi, esi
jmp 0x4a3e73
mov esi, 0x80004003
push esi
push 0xe8013e
call dword [sym.imp.certcli.dll_Ordinal_357]
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x18]
test eax, eax
je 0x4a3e86
mov byte [ecx], 0
inc ecx
sub eax, 1
jne 0x4a3e7d
push 0x1c
lea eax, [ebp - 0x3c]
pop ecx
mov byte [eax], 0
inc eax
sub ecx, 1
jne 0x4a3e8c
test ebx, ebx
je 0x4a3ea7
mov ecx, ebx
call fcn.004ca267
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x64]
test eax, eax
je 0x4a3eb5
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
test edi, edi
je 0x4a3ed2
mov ecx, dword [ebp - 0x68]
mov eax, edi
test ecx, ecx
je 0x4a3ecb
mov byte [eax], 0
inc eax
sub ecx, 1
jne 0x4a3ec2
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x54], 0
je 0x4a3ee1
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp dword [ebp - 0x48], 0
je 0x4a3ef0
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005036b0
leave
ret 0x10