Function at 0x40aeb0
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Import public key
Initialize hashing via wincrypt
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
mov eax, 0x10d0
call fcn.00427270
mov eax, dword [0x43d00c]
pxor xmm0, xmm0
xor eax, ebp
cmp dword [ebp + 0x14], 0
mov dword [esp + 0x10c8], eax
mov dword [esp + 0x14], 0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
je 0x40b08a
mov eax, dword [ebp + 8]
test eax, eax
je 0x40b08a
cmp dword [ebp + 0xc], 0
je 0x40b08a
cmp dword [ebp + 0x10], 0
je 0x40b08a
cmp dword [eax], 0
je 0x40b0b6
lea esi, [esp + 0x14]
push 0xf0000000
push 0x18
push str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x40af81
push 0xf0000008
push 0x18
push str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x40af81
push 0xf0000000
push 0x18
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x40af81
push 0xf0000008
push 0x18
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x40b18b
xor ebx, ebx
lea edi, [esp + 0x20]
nop word [eax + eax]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + ebx*4]
test eax, eax
je 0x40b0a0
mov esi, dword [esp + 0x14]
test esi, esi
je 0x40b0a0
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx + ebx*4]
mov dword [esp + 0xa0], ecx
mov dword [esp + 0xa4], eax
lea eax, [esp + 0x10a0]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 2
push 2
lea eax, [esp + 0xc4]
push eax
push 2
call dword [sym.imp.CRYPT32.dll_CryptQueryObject]
test eax, eax
je 0x40b0a0
mov eax, dword [esp + 0x10a0]
mov eax, dword [eax + 0xc]
add eax, 0x38
push edi
push eax
push 0x10001
push esi
call dword [sym.imp.CRYPT32.dll_CryptImportPublicKeyInfo]
mov esi, eax
push dword [esp + 0x10a0]
call dword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
test esi, esi
je 0x40b0a0
inc ebx
add edi, 4
cmp dword [ebp + 0x14], ebx
jne 0x40af90
mov eax, dword [ebp + 8]
mov edi, dword [esp + 0x14]
pxor xmm0, xmm0
mov esi, dword [eax]
movdqa xmmword [esp + 0x60], xmm0
movdqa xmmword [esp + 0x70], xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x50], xmm0
test esi, esi
je 0x40b11a
push 2
push 0
push 0
push esi
call fcn.0041a6ba
add esp, 0x10
test eax, eax
je 0x40b133
push 2
call fcn.00415c8f
add esp, 4
push eax
push 1
push 0x32
push str.ERROR:_Could_not_seek_to_the_end_of_the_MAR_file._n
jmp 0x40b37a
push 2
call fcn.00415c8f
add esp, 4
push eax
push 1
push 0x24
push str.ERROR:_Invalid_parameter_specified._n
jmp 0x40b0ca
push 2
call fcn.00415c8f
add esp, 4
push eax
push 1
push 0x22
push str.ERROR:_Could_not_load_public_key._n
jmp 0x40b0ca
push 2
call fcn.00415c8f
add esp, 4
push eax
push 1
push 0x1d
push str.ERROR:_MAR_file_is_not_open._n
call fcn.0041f65e
add esp, 0x10
mov dword [esp], 0xffffffff
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x40b101
mov edi, dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
lea esi, [esp + 0x20]
jmp 0x40b0f6
add esi, 4
dec ebx
je 0x40b101
mov eax, dword [esi]
test eax, eax
je 0x40b0f0
push eax
call edi
jmp 0x40b0f0
mov ecx, dword [esp + 0x10c8]
xor ecx, ebp
call fcn.00412fa1
mov eax, dword [esp]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.00415c8f
add esp, 4
push eax
push 1
push 0x24
push str.ERROR:_Invalid_file_pointer_passed._n
jmp 0x40b37a
push esi
call fcn.0041b381
add esp, 4
cmp eax, 0x1f400001
sbb edx, 0
jl 0x40b15f
push 2
call fcn.00415c8f
add esp, 4
push eax
push 1
push 0x2d
push str.ERROR:_MAR_file_is_too_large_to_be_verified._n
jmp 0x40b37a
push 0
push 0
push 0x10
push esi
call fcn.0041a6ba
add esp, 0x10
test eax, eax
je 0x40b1ac
push 2
call fcn.00415c8f
add esp, 4
push eax
push 1
push 0x2e
push str.ERROR:_Could_not_seek_to_the_signature_block._n
jmp 0x40b37a
mov dword [esp + 0x14], 0
push 2
call fcn.00415c8f
add esp, 4
push eax
push 1
push 0x26
push str.ERROR:_Could_not_init_crytpo_library._n
jmp 0x40b0ca
lea eax, [esp + 0x1c]
push esi
push 1
push 4
push eax
call fcn.0041f44b
add esp, 0x10
cmp eax, 1
jne 0x40b366
mov dword [esp + 0xc], edi
push dword [esp + 0x1c]
call dword [sym.imp.WSOCK32.dll_ntohl]
cmp eax, 8
mov dword [esp + 0x1c], eax
ja 0x40b48d
mov edi, eax
test eax, eax
mov dword [esp], esi
je 0x40b2ad
lea eax, [esp + 0x40]
lea ebx, [esp + 0x60]
mov dword [esp + 4], eax
mov eax, edi
mov dword [esp + 8], eax
push esi
push 1
push 4
push ebx
call fcn.0041f44b
add esp, 0x10
cmp eax, 1
jne 0x40b3bb
push dword [ebx]
mov eax, dword [sym.imp.WSOCK32.dll_ntohl]
call eax
mov dword [esp + 0x10], eax
mov dword [ebx], eax
push esi
push 1
push 4
lea eax, [esp + 0x24]
push eax
call fcn.0041f44b
add esp, 0x10
cmp eax, 1
jne 0x40b3d1
push dword [esp + 0x18]
call dword [sym.imp.WSOCK32.dll_ntohl]
cmp eax, 0x801
mov dword [esp + 0x18], eax
jae 0x40b3e7
mov esi, eax
push eax
call fcn.0041facb
add esp, 4
mov ecx, dword [esp + 4]
test eax, eax
mov dword [ecx], eax
je 0x40b400
push dword [esp]
push 1
push esi
push eax
call fcn.0041f44b
add esp, 0x10
cmp eax, 1
jne 0x40b419
cmp dword [esp + 0x10], 2
jne 0x40b453
mov eax, dword [esp + 8]
mov esi, dword [esp]
add dword [esp + 4], 4
add ebx, 4
dec eax
jne 0x40b1fd
push esi
call fcn.0041b381
add esp, 4
and edx, eax
mov eax, 0xffffffff
cmp edx, 0xffffffff
je 0x40b387
pxor xmm0, xmm0
test edi, edi
movdqa xmmword [esp + 0x10a0], xmm0
movdqa xmmword [esp + 0x10b0], xmm0
movdqa xmmword [esp + 0x80], xmm0
movdqa xmmword [esp + 0x90], xmm0
je 0x40b3a5
cmp dword [esp + 0xc], 0
lea ebx, [esp + 0x10a0]
mov dword [esp + 4], edi
je 0x40b38f
mov esi, dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov edi, dword [esp + 4]
mov dword [ebx], 0
push ebx
push 0
push 0
push 0x800d
push dword [esp + 0x1c]
call esi
test eax, eax
je 0x40b38f
add ebx, 4
dec edi
jne 0x40b316
push 0
push 0
push 0
push dword [esp + 0xc]
call fcn.0041a6ba
add esp, 0x10
test eax, eax
je 0x40b4ac
push 2
call fcn.00415c8f
add esp, 4
push eax
push 1
push 0x2b
push str.ERROR:_Could_not_seek_to_start_of_the_file_n
jmp 0x40b37a
push 2
call fcn.00415c8f
add esp, 4
push eax
push 1
push 0x2c
push str.ERROR:_Could_not_read_number_of_signatures._n
call fcn.0041f65e
add esp, 0x10
mov eax, 0xffffffff
mov dword [esp], eax
jmp 0x40b0d9
push 2
call fcn.00415c8f
add esp, 4
push eax
push 1
push 0x2e
push str.ERROR:_Could_not_initialize_signature_handle._n
jmp 0x40b37a
push 2
call fcn.00415c8f
add esp, 4
push eax
push 1
push 0x2d
push str.ERROR:_There_must_be_at_least_one_signature._n
jmp 0x40b37a
push 2
call fcn.00415c8f
add esp, 4
push eax
push 1
push 0x2f
push str.ERROR:_Could_not_read_signatures_algorithm_ID._n
jmp 0x40b37a
push 2
call fcn.00415c8f
add esp, 4
push eax
push 1
push 0x29
push str.ERROR:_Could_not_read_signatures_length._n
jmp 0x40b37a
push 2
call fcn.00415c8f
add esp, 4
push eax
push 1
push 0x30
push str.ERROR:_Signature_length_is_too_large_to_verify._n
jmp 0x40b37a
push 2
call fcn.00415c8f
add esp, 4
push eax
push 1
push 0x2c
push str.ERROR:_Could_allocate_buffer_for_signature._n
jmp 0x40b37a
push 2
call fcn.00415c8f
add esp, 4
push eax
push 1
push 0x2b
push str.ERROR:_Could_not_read_extracted_signature._n
call fcn.0041f65e
add esp, 0x10
lea esi, [esp + 0x40]
push dword [esi]
call fcn.0041f641
add esp, 4
add esi, 4
dec edi
mov eax, 0xffffffff
jne 0x40b439
jmp 0x40b387
push 2
call fcn.00415c8f
add esp, 4
push eax
push 1
push 0x27
push str.ERROR:_Unknown_signature_algorithm_ID._n
call fcn.0041f65e
add esp, 0x10
lea esi, [esp + 0x40]
push dword [esi]
call fcn.0041f641
add esp, 4
add esi, 4
dec edi
mov eax, 0xffffffff
jne 0x40b473
jmp 0x40b387
push 2
call fcn.00415c8f
add esp, 4
push 8
push str.ERROR:_At_most__d_signatures_can_be_specified._n
push eax
call fcn.00405600
add esp, 0xc
jmp 0x40b382
mov ecx, dword [esp]
lea eax, [esp + 0x10a0]
lea edx, [esp + 0xa0]
push str.signature_block
mov edi, dword [esp + 8]
push edi
push eax
push 0x14
call fcn.0040ade0
add esp, 0x10
test eax, eax
jne 0x40b382
mov esi, dword [esp + 4]
lea ebx, [esp + 0x80]
mov ecx, dword [esp]
lea edx, [esp + 0xa0]
push str.signature_algorithm_ID
push esi
lea eax, [esp + 0x10a8]
push eax
push 4
call fcn.0040ade0
add esp, 0x10
test eax, eax
jne 0x40b382
mov ecx, dword [esp]
mov edx, ebx
push str.signature_length
push esi
lea eax, [esp + 0x10a8]
push eax
push 4
call fcn.0040ade0
add esp, 0x10
test eax, eax
jne 0x40b382
push dword [ebx]
call dword [sym.imp.WSOCK32.dll_ntohl]
cmp eax, 0x801
mov dword [ebx], eax
jae 0x40b565
push 1
push 0
push eax
push dword [esp + 0xc]
call fcn.0041a6ba
add esp, 0x10
test eax, eax
jne 0x40b57e
add ebx, 4
dec edi
jne 0x40b4e5
jmp 0x40b5f1
push 2
call fcn.00415c8f
add esp, 4
push eax
push 1
push 0x2f
push str.ERROR:_Embedded_signature_length_is_too_large._n
jmp 0x40b37a
push 2
call fcn.00415c8f
add esp, 4
push eax
push 1
push 0x26
push str.ERROR:_Could_not_seek_past_signature._n
jmp 0x40b37a
mov esi, dword [esp]
push esi
push 0x1000
push 1
lea eax, [esp + 0xac]
push eax
call fcn.0041f44b
add esp, 0x10
mov ebx, eax
push esi
call fcn.0041ef6a
add esp, 4
test eax, eax
jne 0x40b7bc
mov edi, dword [esp + 4]
lea esi, [esp + 0x10a0]
push 0
push ebx
lea eax, [esp + 0xa8]
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x40b7a3
add esi, 4
dec edi
jne 0x40b5d0
push dword [esp]
call fcn.0041ef3f
add esp, 4
test eax, eax
je 0x40b597
mov dword [esp], 0
mov eax, dword [esp]
mov esi, dword [esp + eax*4 + 0x80]
test esi, esi
je 0x40b78a
mov eax, dword [esp]
mov ebx, dword [esp + eax*4 + 0x40]
test ebx, ebx
je 0x40b78a
push esi
call fcn.0041facb
add esp, 4
test eax, eax
mov dword [esp + 8], eax
je 0x40b78a
xor eax, eax
cmp esi, 0x20
jb 0x40b6f2
lea ecx, [ebx + esi]
cmp dword [esp + 8], ecx
jae 0x40b65f
mov ecx, dword [esp + 8]
add ecx, esi
cmp ebx, ecx
jb 0x40b6f2
mov edx, dword [esp + 8]
mov eax, esi
lea ecx, [ebx + esi - 0x10]
pxor xmm3, xmm3
and eax, 0xffffffe0
mov edi, eax
add edx, 0x10
movdqu xmm1, xmmword [ecx]
movdqu xmm0, xmmword [ecx - 0x10]
add ecx, 0xffffffe0
movdqa xmm2, xmm1
punpckhbw xmm1, xmm3
punpcklbw xmm2, xmm3
pshufd xmm1, xmm1, 0x4e
pshufd xmm2, xmm2, 0x4e
pshuflw xmm1, xmm1, 0x1b
pshuflw xmm2, xmm2, 0x1b
pshufhw xmm1, xmm1, 0x1b
pshufhw xmm2, xmm2, 0x1b
packuswb xmm1, xmm2
movdqa xmm2, xmm0
punpckhbw xmm0, xmm3
punpcklbw xmm2, xmm3
pshufd xmm0, xmm0, 0x4e
movdqu xmmword [edx - 0x10], xmm1
pshufd xmm2, xmm2, 0x4e
pshuflw xmm0, xmm0, 0x1b
pshuflw xmm2, xmm2, 0x1b
pshufhw xmm0, xmm0, 0x1b
pshufhw xmm2, xmm2, 0x1b
packuswb xmm0, xmm2
movdqu xmmword [edx], xmm0
add edx, 0x20
add edi, 0xffffffe0
jne 0x40b675
cmp esi, eax
je 0x40b707
mov edx, dword [esp + 8]
mov ecx, esi
sub ecx, eax
add edx, eax
movzx eax, byte [ebx + ecx - 1]
mov byte [edx], al
inc edx
dec ecx
jne 0x40b6fc
push 0
push 0
mov eax, dword [esp + 8]
push dword [esp + eax*4 + 0x28]
push esi
mov edi, dword [esp + 0x18]
push edi
push dword [esp + eax*4 + 0x10b4]
call dword [sym.imp.ADVAPI32.dll_CryptVerifySignatureA]
mov esi, eax
push edi
call fcn.0041f641
add esp, 4
test esi, esi
je 0x40b78a
mov eax, dword [esp]
mov ecx, eax
inc ecx
cmp ecx, dword [esp + 4]
mov eax, ecx
mov dword [esp], ecx
jne 0x40b607
xor esi, esi
push dword [esp + esi*4 + 0x40]
call fcn.0041f641
add esp, 4
inc esi
cmp dword [esp + 4], esi
jne 0x40b74c
mov esi, dword [esp + 4]
xor eax, eax
cmp esi, dword [ebp + 0x14]
je 0x40b387
push 2
call fcn.00415c8f
add esp, 4
push esi
push esi
push str.ERROR:_Only__d_of__d_signatures_were_verified._n
push eax
call fcn.00405600
jmp 0x40b37f
push 2
call fcn.00415c8f
add esp, 4
push eax
push 1
push 0x22
push str.ERROR:_Error_verifying_signature._n
jmp 0x40b37a
push 2
call fcn.00415c8f
add esp, 4
push eax
push 1
push 0x36
push str.ERROR:_Error_updating_verify_context_with_data_block._n
jmp 0x40b37a
push 2
call fcn.00415c8f
add esp, 4
push eax
push 1
push 0x21
push str.ERROR:_Error_reading_data_block._n
jmp 0x40b37a