Function at 0x4db3a0
Capabilities:
Get file size
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x48], 0
je 0x4db434
push dword [esi + 0x4c]
call fcn.005294af
add esp, 4
mov dword [esi + 4], eax
test eax, eax
jne 0x4db3d7
pop edi
mov dword [esi + 0x44], 8
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
push dword [esi + 0x4c]
push dword [esi + 0x48]
push eax
call fcn.00526b40
mov eax, dword [esi + 0x4c]
add esp, 0xc
mov dword [esi + 0x24], eax
mov edx, dword [esi + 4]
mov eax, 0x5a4d
mov word [esi + 0x1d], 0
mov ecx, 0x20b
cmp word [edx], ax
jne 0x4db570
mov eax, dword [edx + 0x3c]
add eax, edx
cmp dword [eax], 0x4550
jne 0x4db570
cmp word [eax + 0x18], cx
jne 0x4db532
mov edi, dword [eax + 0xa8]
mov ecx, dword [eax + 0xac]
jmp 0x4db53e
mov eax, dword [ebp + 8]
test eax, eax
jne 0x4db44c
pop edi
mov dword [esi + 0x44], 1
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
cmp byte [eax], 0
jne 0x4db462
pop edi
mov dword [esi + 0x44], 2
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
push 0
push 0x80
push 3
push 0
push 3
push accept
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4db493
pop edi
mov dword [esi + 0x44], 3
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x24], eax
cmp eax, 0xffffffff
jne 0x4db4bc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov dword [esi + 0x44], 0x21
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 4]
test eax, eax
je 0x4db4d3
push eax
call fcn.005294aa
add esp, 4
mov dword [esi + 4], 0
push dword [esi + 0x24]
call fcn.005294af
add esp, 4
mov dword [esi + 4], eax
test eax, eax
jne 0x4db4fd
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov dword [esi + 0x44], 4
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
push 0
lea ecx, [ebp - 4]
push ecx
push dword [esi + 0x24]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
cmp eax, dword [esi + 0x24]
je 0x4db3ec
pop edi
mov dword [esi + 0x44], 5
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
mov edi, dword [eax + 0x98]
mov ecx, dword [eax + 0x9c]
cmp dword [eax + 0x58], 0
setne al
mov byte [esi + 0x1e], al
test edi, edi
je 0x4db570
test ecx, ecx
je 0x4db570
sub dword [esi + 0x24], ecx
lea eax, [edx - 1]
mov ecx, dword [esi + 0x24]
add eax, edi
mov byte [esi + 0x1d], 1
cmp byte [eax], 0
jne 0x4db570
dec ecx
lea eax, [eax - 1]
mov dword [esi + 0x24], ecx
cmp byte [eax], 0
je 0x4db564
push ebx
mov ebx, dword [esi + 0x24]
movups xmm0, xmmword [ebx + edx - 0x10]
lea edi, [ebx + edx]
movups xmmword [esi + 0x28], xmm0
cmp dword [esi + 0x28], 0x32812622
jne 0x4db6a2
cmp dword [esi + 0x34], 0x32812621
jne 0x4db6a2
mov byte [esi + 0x1c], 1
xorps xmm1, xmm1
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x30]
add eax, 0x10
add ecx, eax
sub ebx, ecx
mov dword [esi + 0x20], ecx
mov dword [esi + 8], ebx
mov eax, dword [esi + 0x2c]
mov dword [esi + 0x38], eax
cmp ebx, 0x10
jbe 0x4db5c5
sub edi, ecx
movups xmm1, xmmword [edi - 0x10]
movd eax, xmm1
cmp eax, 0x32812624
jne 0x4db613
movaps xmm0, xmm1
psrldq xmm0, 0xc
movd eax, xmm0
cmp eax, 0x32812623
jne 0x4db613
movaps xmm0, xmm1
mov dword [esi + 0x24], ebx
movups xmmword [esi + 0x28], xmm1
mov byte [esi + 0x1c], 1
psrldq xmm1, 8
psrldq xmm0, 4
movd eax, xmm1
movd ecx, xmm0
add eax, 0x10
add eax, ecx
mov dword [esi + 0x38], ecx
sub ebx, eax
mov dword [esi + 0x20], eax
mov dword [esi + 8], ebx
cmp byte [esi + 0x1d], 0
jne 0x4db623
cmp byte [esi + 0x1e], 0
je 0x4db6c1
mov eax, 0x5a4d
cmp word [edx], ax
jne 0x4db6c1
mov edi, dword [edx + 0x3c]
mov eax, 0x20b
add edi, edx
xor ebx, ebx
cmp word [edi + 0x18], ax
jne 0x4db663
cmp dword [edi], 0x4550
mov ebx, edi
jne 0x4db677
mov dword [edi + 0xac], 0
mov dword [edi + 0xa8], 0
jmp 0x4db677
cmp dword [edi], 0x4550
jne 0x4db677
mov dword [edi + 0x9c], ebx
mov dword [edi + 0x98], ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push dword [esi + 8]
push dword [esi + 4]
call fcn.004dbdb0
add esp, 0x10
test eax, eax
je 0x4db6c1
mov eax, dword [ebp - 4]
test ebx, ebx
je 0x4db69d
mov dword [ebx + 0x58], eax
jmp 0x4db6c1
mov dword [edi + 0x58], eax
jmp 0x4db6c1
xorps xmm0, xmm0
movups xmmword [esi + 0x28], xmm0
mov eax, dword [esi + 0x24]
mov byte [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 8], eax
mov dword [esi + 0x38], 0
mov eax, dword [esi + 0x24]
cmp eax, dword [esi + 0x20]
jae 0x4db6e9
mov byte [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 8], 0
mov dword [esi + 0x38], 0
cmp byte [esi + 0x1c], 0
jne 0x4db701
pop ebx
pop edi
mov dword [esi + 0x44], 6
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 0x30]
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4db71e
push eax
call fcn.005294aa
add esp, 4
mov dword [esi + 0x14], 0
push dword [esi + 0x18]
call fcn.005294af
mov ecx, eax
add esp, 4
mov dword [esi + 0x14], ecx
test ecx, ecx
jne 0x4db744
pop ebx
pop edi
mov dword [esi + 0x44], 7
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 8]
push dword [esi + 0x18]
add eax, dword [esi + 4]
add eax, dword [esi + 0x38]
push eax
push ecx
call fcn.00526b40
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
add esp, 0xc
cmp dword [esi], 0
jne 0x4db78c
push 0xf0000000
push 1
push 0x55e610
push 0
push esi
call edi
test eax, eax
jne 0x4db78c
pop ebx
pop edi
mov dword [esi + 0x44], 8
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 0x10]
lea ebx, [esi + 0x10]
test eax, eax
je 0x4db7a3
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov dword [ebx], 0
push ebx
push 0
push 0
push dword [0x57fba4]
push 0x57fa90
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x4db81f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4db80d
push 0xf0000000
push 1
push 0x55e610
push 0
push esi
call edi
test eax, eax
jne 0x4db7f1
pop ebx
pop edi
mov dword [esi + 0x44], 0x62
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
push ebx
push 0
push 0
push dword [0x57fba4]
push 0x57fa90
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x4db81f
pop ebx
pop edi
mov dword [esi + 0x44], 9
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 0xc]
lea edi, [esi + 0xc]
test eax, eax
je 0x4db836
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov dword [edi], 0
push edi
push 0
push 0
push 0x8003
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x4db85e
pop ebx
pop edi
mov dword [esi + 0x44], 0xa
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 8]
add eax, dword [esi + 0x38]
push 0
push eax
push dword [esi + 4]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x4db888
pop ebx
pop edi
mov dword [esi + 0x44], 0xb
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
push 0
push 0
push dword [ebx]
push dword [esi + 0x18]
push dword [esi + 0x14]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_CryptVerifySignatureA]
test eax, eax
jne 0x4db900
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4db8ee
push 0xf0000000
push 1
push 0x55e610
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x4db8d6
pop ebx
pop edi
mov dword [esi + 0x44], 0x80
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
push 0
push 0
push dword [ebx]
push dword [esi + 0x18]
push dword [esi + 0x14]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_CryptVerifySignatureA]
test eax, eax
jne 0x4db900
pop ebx
pop edi
mov dword [esi + 0x44], 0xc
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
cmp byte [ebp + 0xc], 0
je 0x4db942
mov ebx, dword [ebp + 8]
push 0x5c
push ebx
call fcn.00527400
push dword [esi + 0x38]
test eax, eax
lea ecx, [eax + 1]
mov eax, dword [esi + 8]
cmovne ebx, ecx
add eax, dword [esi + 4]
push eax
push ebx
call fcn.00535438
add esp, 0x14
test eax, eax
je 0x4db942
pop ebx
pop edi
mov dword [esi + 0x44], 0xd
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 4]
test eax, eax
je 0x4db959
push eax
call fcn.005294aa
add esp, 4
mov dword [esi + 4], 0
pop ebx
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 8