Function at 0x4cda35
Capabilities:
Get file size
Get system information on windows
Hash data via bcrypt
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5c
mov eax, dword [ebp + 0x10]
or dword [esp + 8], 0xffffffff
push ebx
push esi
mov ebx, ecx
mov esi, edx
xor ecx, ecx
mov dword [esp + 0x20], esi
push edi
mov dword [eax], ecx
mov edi, ecx
lea eax, [esp + 0x44]
mov dword [esp + 0x30], ecx
push eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x40], ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x60]
push 1
push esi
push 5
mov dword [esp + 0x18], eax
call dword [sym.imp.CRYPT32.dll_CryptFindOIDInfo]
test eax, eax
je 0x4cdabb
cmp dword [eax], 0x20
jb 0x4cdabb
mov ecx, dword [eax + 0x1c]
test ecx, ecx
je 0x4cdabb
xor eax, eax
cmp ax, word [ecx]
je 0x4cdabb
mov eax, dword [ebp + 0xc]
mov esi, ecx
mov dword [esp + 0x24], esi
mov dword [eax], ecx
jmp 0x4cdacc
push 0x80091002
push 0x199e019a
push esi
call dword [sym.imp.certcli.dll_Ordinal_359]
push 0xffffffffffffffff
push 0x429050
push 0xffffffffffffffff
push ebx
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
dec eax
sub eax, 1
je 0x4cdbdf
xor eax, eax
push eax
push 0x80
push 3
push eax
push 1
push SysReAllocString
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
jne 0x4cdb3a
call fcn.004c73cc
mov esi, eax
test esi, esi
jne 0x4cdb28
push eax
push 0x19eb019a
call dword [sym.imp.certcli.dll_Ordinal_357]
mov esi, 0x80070002
push esi
push 0x19ee019a
push ebx
call dword [sym.imp.certcli.dll_Ordinal_359]
jmp 0x4cdf17
lea ecx, [esp + 0x30]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x4cdb65
mov esi, 0x80070002
push esi
push 0x19f4019a
call dword [sym.imp.certcli.dll_Ordinal_357]
mov eax, dword [esp + 0x14]
jmp 0x4cdf10
mov ecx, dword [esp + 0x30]
xor ebx, ebx
xor edx, edx
or ebx, eax
mov eax, dword [esp + 0xc]
or ecx, edx
mov dword [esp + 0x28], ecx
cmp eax, 0x20000000
jae 0x4cdb98
cmp ecx, edx
jl 0x4cdb98
jg 0x4cdb8e
cmp ebx, 0x10000000
jbe 0x4cdb98
mov dword [esp + 0xc], 0x20000000
jmp 0x4cdbb5
cmp eax, 0x100000
jae 0x4cdbb5
cmp ecx, edx
jl 0x4cdbb5
jg 0x4cdbad
cmp ebx, 0x80000
jbe 0x4cdbb5
mov dword [esp + 0xc], 0x100000
push edx
push edx
push edx
push 2
push edx
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esp + 0x2c], eax
test eax, eax
jne 0x4cdbe1
call fcn.004c73cc
mov esi, eax
push esi
push 0x1a0c019a
jmp 0x4cdb56
mov ebx, edi
push ecx
push ecx
mov edx, esi
lea ecx, [esp + 0x24]
call fcn.004da786
mov esi, eax
test esi, esi
je 0x4cdc0f
or esi, 0x10000000
push esi
push 0x1a1a019a
push dword [esp + 0x2c]
call dword [sym.imp.certcli.dll_Ordinal_359]
jmp 0x4cdef8
push ecx
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x44]
push eax
push 4
lea eax, [esp + 0x1c]
mov edx, 0x423618
push eax
call fcn.004da80a
mov esi, eax
test esi, esi
je 0x4cdc41
or esi, 0x10000000
push esi
push 0x1a27019a
jmp 0x4cdef2
push ecx
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x44]
push eax
push 4
lea eax, [esp + 0x2c]
mov edx, 0x421d38
push eax
call fcn.004da80a
mov esi, eax
test esi, esi
je 0x4cdc73
or esi, 0x10000000
push esi
push 0x1a34019a
jmp 0x4cdef2
push dword [esp + 0x20]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [esp + 0x3c], eax
test eax, eax
jne 0x4cdc99
mov eax, 0x8007000e
push eax
mov esi, eax
push 0x1a3c019a
jmp 0x4cdef2
xor ecx, ecx
push ecx
push ecx
push ecx
push dword [esp + 0x2c]
push eax
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x34]
call dword [sym.imp.ncrypt.dll_BCryptCreateHash]
mov esi, eax
test esi, esi
je 0x4cdcea
xor eax, eax
push eax
push esi
push 0x56501c4
push eax
call dword [sym.imp.certcli.dll_Ordinal_360]
test esi, esi
jle 0x4cdcd7
movzx esi, si
or esi, 0x80070000
test esi, esi
je 0x4cdcea
or esi, 0x10000000
push esi
push 0x1a4a019a
jmp 0x4cdef2
mov eax, dword [esp + 0x28]
xor ecx, ecx
mov edx, ecx
mov esi, ecx
mov dword [esp + 0x34], edx
mov dword [esp + 0x24], esi
cmp eax, ecx
jl 0x4cddbf
jg 0x4cdd0e
cmp ebx, ecx
jbe 0x4cddbf
mov ecx, ebx
sub ecx, edx
sbb eax, esi
xor esi, esi
cmp esi, eax
jg 0x4cdd28
mov esi, dword [esp + 0xc]
jl 0x4cdd24
cmp esi, ecx
jae 0x4cdd28
mov eax, edx
jmp 0x4cdd2e
mov eax, edx
mov esi, ebx
sub esi, eax
push esi
push eax
push dword [esp + 0x2c]
push 4
push dword [esp + 0x3c]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esp + 0x38], eax
test eax, eax
je 0x4cde16
xor ecx, ecx
push ecx
push esi
push eax
push dword [esp + 0x24]
call dword [sym.imp.ncrypt.dll_BCryptHashData]
mov esi, eax
test esi, esi
je 0x4cdd82
xor eax, eax
push eax
push esi
push 0x57501c4
push eax
call dword [sym.imp.certcli.dll_Ordinal_360]
test esi, esi
jle 0x4cdd80
movzx esi, si
or esi, 0x80070000
test esi, esi
jne 0x4cddf5
push dword [esp + 0x38]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
je 0x4cdde3
mov edx, dword [esp + 0x34]
add edx, dword [esp + 0xc]
mov esi, dword [esp + 0x24]
push 0
pop eax
adc esi, eax
mov dword [esp + 0x34], edx
mov eax, dword [esp + 0x28]
mov dword [esp + 0x24], esi
cmp esi, eax
jl 0x4cdd0e
jg 0x4cddbf
cmp edx, ebx
jb 0x4cdd0e
push dword [esp + 0x10]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
jne 0x4cde28
mov eax, 0x8007000e
push eax
mov esi, eax
push 0x1a7b019a
jmp 0x4cdef2
call fcn.004c73cc
mov esi, eax
push esi
push 0x1a71019a
jmp 0x4cdef2
or esi, 0x10000000
push esi
push 0x1a69019a
call dword [sym.imp.certcli.dll_Ordinal_357]
push dword [esp + 0x38]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x4cdef8
call fcn.004c73cc
mov esi, eax
push esi
push 0x1a5e019a
jmp 0x4cdef2
xor ebx, ebx
push ebx
push dword [esp + 0x14]
push edi
push dword [esp + 0x24]
call dword [sym.imp.ncrypt.dll_BCryptFinishHash]
mov esi, eax
test esi, esi
je 0x4cde70
push ebx
push esi
push 0x58501c4
push ebx
call dword [sym.imp.certcli.dll_Ordinal_360]
test esi, esi
jle 0x4cde5d
movzx esi, si
or esi, 0x80070000
test esi, esi
je 0x4cde70
or esi, 0x10000000
push esi
push 0x1a86019a
jmp 0x4cdef2
movzx eax, byte [ebp + 8]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x28], ebx
lea ebx, [eax*2 + 1]
xor eax, eax
push eax
lea eax, [esp + 0x2c]
mov ecx, ebx
push eax
push edi
call fcn.004c612a
mov esi, eax
test esi, esi
je 0x4cdea1
push esi
push 0x1a90019a
jmp 0x4cdef2
push dword [esp + 0x28]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
test eax, eax
jne 0x4cdec5
mov eax, 0x8007000e
push eax
mov esi, eax
push 0x1a96019a
jmp 0x4cdef2
mov edx, dword [esp + 0x10]
mov ecx, ebx
push eax
lea eax, [esp + 0x2c]
push eax
push edi
call fcn.004c612a
mov esi, eax
test esi, esi
je 0x4cdef8
mov ebx, dword [ebp + 0x10]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
push esi
mov dword [ebx], eax
push 0x1aa4019a
call dword [sym.imp.certcli.dll_Ordinal_357]
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x4cdf07
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x4cdf17
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x18], 0
je 0x4cdf3c
push dword [esp + 0x18]
call dword [sym.imp.ncrypt.dll_BCryptDestroyHash]
test eax, eax
je 0x4cdf3c
xor ecx, ecx
push ecx
push eax
push 0x58d01c4
push ecx
call dword [sym.imp.certcli.dll_Ordinal_360]
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x4cdf49
call fcn.004da8e3
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x4cdf58
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
test edi, edi
je 0x4cdf63
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc