Function at 0x108f54e
Capabilities:
Get file size
Get system information on windows
Hash data via bcrypt
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [ebp + 0x10]
push ebx
push esi
xor esi, esi
mov dword [eax], esi
push edi
lea eax, [ebp - 0x68]
push eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x28], esi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x4c]
push esi
push 0x80
push 3
push esi
push 1
push SysReAllocString
push dword [ebp + 8]
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 0x34], ebx
cmp ebx, 0xffffffff
jne 0x108f5d9
call fcn.01091f1e
mov edi, eax
cmp edi, esi
jne 0x108f5c6
push esi
push 0x18d6019a
call fcn.0108c503
mov edi, 0x80070002
push edi
push 0x18d9019a
push dword [ebp + 8]
call fcn.0108c53e
jmp 0x108f899
lea eax, [ebp - 0x2c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x108f5fe
mov edi, 0x80070002
push edi
push 0x18df019a
call fcn.0108c503
jmp 0x108f890
mov edi, dword [ebp - 0x2c]
push esi
push esi
push esi
push 2
xor ecx, ecx
push esi
xor edx, edx
or ecx, eax
push ebx
mov dword [ebp - 0x44], ecx
or edi, edx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x24], eax
cmp eax, esi
jne 0x108f632
call fcn.01091f1e
mov edi, eax
push edi
push 0x18ed019a
jmp 0x108f840
push esi
push esi
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
call sub.ncrypt.dll_BCryptOpenAlgorithmProvider
cmp eax, esi
je 0x108f656
or eax, 0x10000000
mov edi, eax
push edi
push 0x18fa019a
jmp 0x108f840
push esi
lea eax, [ebp - 0x30]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x1017e40
push dword [ebp - 4]
call sub.ncrypt.dll_BCryptGetProperty
cmp eax, esi
je 0x108f684
or eax, 0x10000000
mov edi, eax
push edi
push 0x1907019a
jmp 0x108f840
push esi
lea eax, [ebp - 0x30]
push eax
push 4
lea eax, [ebp - 0x18]
push eax
push 0x1015ee8
push dword [ebp - 4]
call sub.ncrypt.dll_BCryptGetProperty
cmp eax, esi
je 0x108f6b2
or eax, 0x10000000
mov edi, eax
push edi
push 0x1914019a
jmp 0x108f840
push dword [ebp - 0x18]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x28], eax
cmp eax, esi
jne 0x108f6d4
mov edi, 0x8007000e
push edi
push 0x191c019a
jmp 0x108f840
push esi
push esi
push esi
push dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
call sub.ncrypt.dll_BCryptCreateHash
cmp eax, esi
je 0x108f6fd
or eax, 0x10000000
mov edi, eax
push edi
push 0x192a019a
jmp 0x108f840
xor ebx, ebx
cmp edi, esi
mov dword [ebp - 0x3c], esi
jl 0x108f78b
jg 0x108f711
cmp dword [ebp - 0x44], esi
jbe 0x108f78b
xor edx, edx
mov ecx, dword [ebp - 0x44]
sub ecx, dword [ebp - 0x3c]
mov eax, edi
sbb eax, ebx
cmp edx, eax
jg 0x108f730
jl 0x108f728
cmp dword [ebp - 0x1c], ecx
jae 0x108f730
mov eax, dword [ebp - 0x1c]
mov dword [ebp + 8], eax
jmp 0x108f733
mov dword [ebp + 8], ecx
push dword [ebp + 8]
mov eax, ebx
push dword [ebp - 0x3c]
sar eax, 0x1f
push ebx
push 4
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0xc], eax
cmp eax, esi
je 0x108f7b1
push esi
push dword [ebp + 8]
push eax
push dword [ebp - 0x10]
call sub.ncrypt.dll_BCryptHashData
cmp eax, esi
jne 0x108f7c3
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
je 0x108f7d5
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x3c], eax
push 0
pop edx
adc ebx, edx
cmp ebx, edi
mov dword [ebp - 0xc], esi
jl 0x108f713
jg 0x108f78b
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x3c], eax
jb 0x108f713
push dword [ebp - 8]
mov ebx, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0x40
call ebx
mov edi, eax
mov dword [ebp - 0x14], edi
cmp edi, esi
jne 0x108f7e4
mov edi, 0x8007000e
push edi
push 0x195b019a
jmp 0x108f840
call fcn.01091f1e
mov edi, eax
push edi
push 0x193e019a
jmp 0x108f86f
or eax, 0x10000000
mov edi, eax
push edi
push 0x1949019a
jmp 0x108f86f
call fcn.01091f1e
mov edi, eax
push edi
push 0x1951019a
jmp 0x108f840
push esi
push dword [ebp - 8]
push edi
push dword [ebp - 0x10]
call sub.ncrypt.dll_BCryptFinishHash
cmp eax, esi
je 0x108f804
or eax, 0x10000000
mov edi, eax
push edi
push 0x1966019a
jmp 0x108f840
push esi
lea eax, [ebp - 0x20]
push eax
push edi
push dword [ebp - 8]
mov dword [ebp - 0x20], esi
push 1
call fcn.01091b77
mov edi, eax
cmp edi, esi
je 0x108f825
push edi
push 0x1970019a
jmp 0x108f840
push dword [ebp - 0x20]
push 0x40
call ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
cmp eax, esi
jne 0x108f847
mov edi, 0x8007000e
push edi
push 0x1976019a
call fcn.0108c503
jmp 0x108f882
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x14]
push dword [ebp - 8]
push 1
call fcn.01091b77
mov edi, eax
cmp edi, esi
je 0x108f882
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push edi
mov dword [ebx], esi
push 0x1984019a
call fcn.0108c503
cmp dword [ebp - 0xc], esi
je 0x108f882
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [ebp - 0x24], esi
je 0x108f890
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x10], esi
je 0x108f8a6
push dword [ebp - 0x10]
call sub.ncrypt.dll_BCryptDestroyHash
cmp dword [ebp - 4], esi
je 0x108f8b4
push esi
push dword [ebp - 4]
call sub.ncrypt.dll_BCryptCloseAlgorithmProvider
cmp dword [ebp - 0x28], esi
je 0x108f8c2
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x14], esi
je 0x108f8d0
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0xc