Function at 0x108c3ff
Capabilities:
Get file size
Get system information on windows
Hash data via bcrypt
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [ebp + 0x10]
push ebx
push esi
xor esi, esi
mov dword [eax], esi
push edi
lea eax, [ebp - 0x68]
push eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x28], esi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x4c]
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 8]
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 0x34], ebx
cmp ebx, 0xffffffff
jne 0x108c48a
call fcn.0108edc3
mov edi, eax
cmp edi, esi
jne 0x108c477
push esi
push 0x18b2019a
call fcn.010893e6
mov edi, 0x80070002
push edi
push 0x18b5019a
push dword [ebp + 8]
call fcn.01089421
jmp 0x108c74a
lea eax, [ebp - 0x2c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x108c4af
mov edi, 0x80070002
push edi
push 0x18bb019a
call fcn.010893e6
jmp 0x108c741
mov edi, dword [ebp - 0x2c]
push esi
push esi
push esi
push 2
xor ecx, ecx
push esi
xor edx, edx
or ecx, eax
push ebx
mov dword [ebp - 0x44], ecx
or edi, edx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x24], eax
cmp eax, esi
jne 0x108c4e3
call fcn.0108edc3
mov edi, eax
push edi
push 0x18c9019a
jmp 0x108c6f1
push esi
push esi
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
call sub.ncrypt.dll_BCryptOpenAlgorithmProvider
cmp eax, esi
je 0x108c507
or eax, 0x10000000
mov edi, eax
push edi
push 0x18d6019a
jmp 0x108c6f1
push esi
lea eax, [ebp - 0x30]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x10177b8
push dword [ebp - 4]
call sub.ncrypt.dll_BCryptGetProperty
cmp eax, esi
je 0x108c535
or eax, 0x10000000
mov edi, eax
push edi
push 0x18e3019a
jmp 0x108c6f1
push esi
lea eax, [ebp - 0x30]
push eax
push 4
lea eax, [ebp - 0x18]
push eax
push 0x1015860
push dword [ebp - 4]
call sub.ncrypt.dll_BCryptGetProperty
cmp eax, esi
je 0x108c563
or eax, 0x10000000
mov edi, eax
push edi
push 0x18f0019a
jmp 0x108c6f1
push dword [ebp - 0x18]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x28], eax
cmp eax, esi
jne 0x108c585
mov edi, 0x8007000e
push edi
push 0x18f8019a
jmp 0x108c6f1
push esi
push esi
push esi
push dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
call sub.ncrypt.dll_BCryptCreateHash
cmp eax, esi
je 0x108c5ae
or eax, 0x10000000
mov edi, eax
push edi
push 0x1906019a
jmp 0x108c6f1
xor ebx, ebx
cmp edi, esi
mov dword [ebp - 0x3c], esi
jl 0x108c63c
jg 0x108c5c2
cmp dword [ebp - 0x44], esi
jbe 0x108c63c
xor edx, edx
mov ecx, dword [ebp - 0x44]
sub ecx, dword [ebp - 0x3c]
mov eax, edi
sbb eax, ebx
cmp edx, eax
jg 0x108c5e1
jl 0x108c5d9
cmp dword [ebp - 0x1c], ecx
jae 0x108c5e1
mov eax, dword [ebp - 0x1c]
mov dword [ebp + 8], eax
jmp 0x108c5e4
mov dword [ebp + 8], ecx
push dword [ebp + 8]
mov eax, ebx
push dword [ebp - 0x3c]
sar eax, 0x1f
push ebx
push 4
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0xc], eax
cmp eax, esi
je 0x108c662
push esi
push dword [ebp + 8]
push eax
push dword [ebp - 0x10]
call sub.ncrypt.dll_BCryptHashData
cmp eax, esi
jne 0x108c674
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
je 0x108c686
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x3c], eax
push 0
pop edx
adc ebx, edx
cmp ebx, edi
mov dword [ebp - 0xc], esi
jl 0x108c5c4
jg 0x108c63c
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x3c], eax
jb 0x108c5c4
push dword [ebp - 8]
mov ebx, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0x40
call ebx
mov edi, eax
mov dword [ebp - 0x14], edi
cmp edi, esi
jne 0x108c695
mov edi, 0x8007000e
push edi
push 0x1937019a
jmp 0x108c6f1
call fcn.0108edc3
mov edi, eax
push edi
push 0x191a019a
jmp 0x108c720
or eax, 0x10000000
mov edi, eax
push edi
push 0x1925019a
jmp 0x108c720
call fcn.0108edc3
mov edi, eax
push edi
push 0x192d019a
jmp 0x108c6f1
push esi
push dword [ebp - 8]
push edi
push dword [ebp - 0x10]
call sub.ncrypt.dll_BCryptFinishHash
cmp eax, esi
je 0x108c6b5
or eax, 0x10000000
mov edi, eax
push edi
push 0x1942019a
jmp 0x108c6f1
push esi
lea eax, [ebp - 0x20]
push eax
push edi
push dword [ebp - 8]
mov dword [ebp - 0x20], esi
push 1
call fcn.0108ea28
mov edi, eax
cmp edi, esi
je 0x108c6d6
push edi
push 0x194c019a
jmp 0x108c6f1
push dword [ebp - 0x20]
push 0x40
call ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
cmp eax, esi
jne 0x108c6f8
mov edi, 0x8007000e
push edi
push 0x1952019a
call fcn.010893e6
jmp 0x108c733
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x14]
push dword [ebp - 8]
push 1
call fcn.0108ea28
mov edi, eax
cmp edi, esi
je 0x108c733
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push edi
mov dword [ebx], esi
push 0x1960019a
call fcn.010893e6
cmp dword [ebp - 0xc], esi
je 0x108c733
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [ebp - 0x24], esi
je 0x108c741
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x10], esi
je 0x108c757
push dword [ebp - 0x10]
call sub.ncrypt.dll_BCryptDestroyHash
cmp dword [ebp - 4], esi
je 0x108c765
push esi
push dword [ebp - 4]
call sub.ncrypt.dll_BCryptCloseAlgorithmProvider
cmp dword [ebp - 0x28], esi
je 0x108c773
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x14], esi
je 0x108c781
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0xc