Function at 0x10002e60
Capabilities:
Get file size
Hash data via wincrypt
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push ebx
mov ebx, ecx
mov dword [esp + 0x2c], 0
push esi
push edi
or edi, 0xffffffff
mov dword [esp + 0x3c], ebx
mov eax, dword [ebx + 4]
test eax, eax
je 0x10002e95
push eax
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
mov dword [ebx + 4], 0
lea eax, [ebx + 8]
mov dword [ebx + 8], 0
mov dword [esp + 0x38], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
sub eax, esi
je 0x10002eb6
dec eax
jne 0x10002ebb
mov esi, 0x8004
jmp 0x10002ebb
mov esi, 0x8003
xor ebx, ebx
test esi, esi
setne bl
cmp ebx, 1
jne 0x100030f9
push 0
push 0x80
push 3
push 0
push ebx
push Ordinal_4
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
xor ebx, ebx
cmp edi, 0xffffffff
mov dword [esp + 0x10], edi
setne bl
cmp ebx, 1
jne 0x100030f5
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [esp + 0x1c]
xor ecx, ecx
push 0
push 0
push 0
push 2
push 0
or ecx, eax
mov dword [esp + 0x38], edx
push edi
mov dword [esp + 0x30], ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
xor ebx, ebx
mov dword [esp + 0x14], eax
test eax, eax
setne bl
cmp ebx, 1
jne 0x100030ea
call fcn.10002ce0
xor ebx, ebx
mov dword [esp + 0x34], eax
test eax, eax
setne bl
cmp ebx, 1
jne 0x100030e6
mov edx, esi
mov ecx, eax
call fcn.10002d30
mov esi, eax
xor ebx, ebx
test esi, esi
mov dword [esp + 0xc], esi
setne bl
cmp ebx, 1
jne 0x100030c3
mov ebx, dword [esp + 0x18]
xorps xmm0, xmm0
mov eax, dword [esp + 0x24]
movlpd qword [esp + 0x28], xmm0
mov edx, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov dword [esp + 0x20], edx
lea ebx, [ebx]
mov ecx, ebx
sub ecx, edi
sbb eax, edx
test eax, eax
ja 0x10002fba
jb 0x10002fb4
cmp ecx, 0x100000
jae 0x10002fba
mov esi, ebx
sub esi, edi
jmp 0x10002fbf
mov esi, 0x100000
push esi
push edi
push edx
push 4
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
xor ebx, ebx
mov dword [esp + 0x28], eax
test eax, eax
setne bl
cmp ebx, 1
jne 0x100030b0
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x100030a8
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x100030a8
push 0
push esi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
mov ebx, eax
cmp ebx, 1
jne 0x100030ac
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edx, dword [esp + 0x20]
add edi, 0x100000
mov eax, dword [esp + 0x24]
mov ebx, dword [esp + 0x18]
adc edx, 0
mov dword [esp + 0x20], edx
cmp edx, eax
jb 0x10002fa0
ja 0x10003044
cmp edi, ebx
jbe 0x10002fa0
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 4]
test eax, eax
jne 0x10003053
xor ebx, ebx
jmp 0x100030bf
mov edi, dword [esp + 0x38]
test edi, edi
jne 0x1000305f
xor ebx, ebx
jmp 0x100030bf
push 0
lea ecx, [esp + 0x28]
mov dword [esp + 0x28], 0
push ecx
push 0
push 2
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov ebx, eax
cmp ebx, 1
jne 0x100030bf
mov eax, dword [esp + 0x24]
push eax
mov dword [edi], eax
call dword [sym.imp.MSVCR120.dll_malloc]
mov ecx, dword [esp + 0x40]
mov edx, eax
push edi
mov dword [ecx + 4], eax
mov ecx, esi
call fcn.10002d80
add esp, 8
cmp eax, ebx
cmovne ebx, eax
jmp 0x100030bf
xor ebx, ebx
jmp 0x100030b0
mov eax, dword [esp + 0x28]
test eax, eax
je 0x100030bb
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
test esi, esi
je 0x100030e6
mov eax, dword [esi + 4]
test eax, eax
je 0x100030dc
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov dword [esi + 4], 0
push esi
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
mov eax, dword [esp + 0x14]
test eax, eax
je 0x100030f5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x10003100
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x34]
test eax, eax
je 0x10003111
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8