Function at 0x6323bfc0
Capabilities:
Get file size
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
jmp 0x6323bfdb
cmp dword [ebp + 8], 0
jne 0x6323c00d
mov eax, 1
test eax, eax
je 0x6323bfec
jmp 0x6323bff9
push 0x6324c454
call fcn.63201050
add esp, 4
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x98], 1
xor al, al
jmp 0x6323c7b5
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
test eax, eax
jne 0x6323c043
mov ecx, 1
test ecx, ecx
je 0x6323c022
jmp 0x6323c02f
push str.Filename_is_NULL
call fcn.63201050
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x98], 2
xor al, al
jmp 0x6323c7b5
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x6323c094
mov ecx, 1
test ecx, ecx
je 0x6323c073
jmp 0x6323c080
push str.CreateFile_error_in_Read
call fcn.63201050
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x98], 3
xor al, al
jmp 0x6323c7b5
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x78], eax
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0x78], 0xffffffff
jne 0x6323c0cd
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x98], 0x21
xor al, al
jmp 0x6323c7b5
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0x58], 0
je 0x6323c0ef
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x58]
push ecx
call fcn.63210443
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x58], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x78]
push ecx
call fcn.632100d6
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x58], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x58], 0
jne 0x6323c143
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 1
test edx, edx
je 0x6323c122
jmp 0x6323c12f
push str.malloc_error
call fcn.63201050
add esp, 4
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x98], 4
xor al, al
jmp 0x6323c7b5
push 0
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x78]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x58]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
cmp edx, dword [ecx + 0x78]
je 0x6323c1a2
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 1
test ecx, ecx
je 0x6323c181
jmp 0x6323c18e
push str.ReadFile_error
call fcn.63201050
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x98], 5
xor al, al
jmp 0x6323c7b5
push 0x10
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x58]
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x78]
lea ecx, [ecx + eax - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
add edx, 0x7c
push edx
call fcn.63210f00
add esp, 0xc
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x7c], 0x32812622
jne 0x6323c228
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 0x88], 0x32812621
jne 0x6323c228
mov edx, dword [ebp - 0x14]
mov byte [edx + 0x70], 1
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x80]
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x84]
lea ecx, [ecx + eax + 0x10]
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x74], ecx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov edx, dword [eax + 0x78]
sub edx, dword [ecx + 0x74]
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x5c], edx
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x80]
mov dword [ecx + 0x8c], eax
jmp 0x6323c265
push 0x10
push 0
mov ecx, dword [ebp - 0x14]
add ecx, 0x7c
push ecx
call fcn.6320feb0
add esp, 0xc
mov edx, dword [ebp - 0x14]
mov byte [edx + 0x70], 0
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x74], 0
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x78]
mov dword [ecx + 0x5c], eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x8c], 0
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov ecx, dword [edx + 0x78]
cmp ecx, dword [eax + 0x74]
jae 0x6323c2a5
mov edx, dword [ebp - 0x14]
mov byte [edx + 0x70], 0
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x74], 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x78], 0
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x5c], 0
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x8c], 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x14]
movzx eax, byte [edx + 0x70]
test eax, eax
jne 0x6323c2ce
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x98], 6
xor al, al
jmp 0x6323c7b5
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x84]
mov dword [edx + 0x6c], ecx
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0x68], 0
je 0x6323c2ff
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x68]
push ecx
call fcn.63210443
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x68], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x6c]
push ecx
call fcn.632100d6
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x68], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x68], 0
jne 0x6323c349
mov ecx, 1
test ecx, ecx
je 0x6323c328
jmp 0x6323c335
push 0x6324c4b8
call fcn.63201050
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x98], 7
xor al, al
jmp 0x6323c7b5
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x6c]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x58]
mov ecx, dword [ebp - 0x14]
add eax, dword [ecx + 0x5c]
mov edx, dword [ebp - 0x14]
add eax, dword [edx + 0x8c]
push eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x68]
push ecx
call fcn.63210f00
add esp, 0xc
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0x54], 0
jne 0x6323c3c9
push 0xf0000000
push 1
push 0x6324c4c8
push 0
mov eax, dword [ebp - 0x14]
add eax, 0x54
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x6323c3c9
mov ecx, 1
test ecx, ecx
je 0x6323c3a8
jmp 0x6323c3b5
push 0x6324c4f4
call fcn.63201050
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x98], 8
xor al, al
jmp 0x6323c7b5
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x64], 0
je 0x6323c3e9
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x64]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x64], 0
mov ecx, dword [ebp - 0x14]
add ecx, 0x64
push ecx
push 0
push 0
mov edx, dword [0x6325a2cc]
push edx
push 0x6325a1b8
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x54]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x6323c4f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x6323c4c4
push 0xf0000000
push 1
push 0x6324c518
push 0
mov edx, dword [ebp - 0x14]
add edx, 0x54
push edx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x6323c46f
mov eax, 1
test eax, eax
je 0x6323c44e
jmp 0x6323c45b
push 0x6324c544
call fcn.63201050
add esp, 4
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x98], 0x62
xor al, al
jmp 0x6323c7b5
mov edx, dword [ebp - 0x14]
add edx, 0x64
push edx
push 0
push 0
mov eax, dword [0x6325a2cc]
push eax
push 0x6325a1b8
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x54]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x6323c4c2
mov eax, 1
test eax, eax
je 0x6323c4a1
jmp 0x6323c4ae
push 0x6324c568
call fcn.63201050
add esp, 4
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x98], 9
xor al, al
jmp 0x6323c7b5
jmp 0x6323c4f0
mov edx, 1
test edx, edx
je 0x6323c4cf
jmp 0x6323c4dc
push str.Public_key_import_failed.
call fcn.63201050
add esp, 4
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x98], 9
xor al, al
jmp 0x6323c7b5
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 0x60], 0
je 0x6323c510
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x60]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x60], 0
mov edx, dword [ebp - 0x14]
add edx, 0x60
push edx
push 0
push 0
push 0x8004
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x54]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x6323c55d
mov edx, 1
test edx, edx
je 0x6323c53c
jmp 0x6323c549
push str.Error_during_CryptCreateHash.
call fcn.63201050
add esp, 4
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x98], 0xa
xor al, al
jmp 0x6323c7b5
push 0
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x5c]
mov eax, dword [ebp - 0x14]
add edx, dword [eax + 0x8c]
push edx
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x58]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x60]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x6323c5b3
mov edx, 1
test edx, edx
je 0x6323c592
jmp 0x6323c59f
push str.Error_during_CryptHashData.
call fcn.63201050
add esp, 4
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x98], 0xb
xor al, al
jmp 0x6323c7b5
push 0
push 0
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x64]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x6c]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x68]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x60]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptVerifySignatureA]
test eax, eax
jne 0x6323c6bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x6323c693
push 0xf0000000
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push 0
mov eax, dword [ebp - 0x14]
add eax, 0x54
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x6323c63b
mov ecx, 1
test ecx, ecx
je 0x6323c61a
jmp 0x6323c627
push str.Error_during_CryptAcquireContext
call fcn.63201050
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x98], 0x80
xor al, al
jmp 0x6323c7b5
push 0
push 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x64]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x6c]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x68]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x60]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptVerifySignatureA]
test eax, eax
jne 0x6323c691
mov edx, 1
test edx, edx
je 0x6323c670
jmp 0x6323c67d
push 0x6324c62c
call fcn.63201050
add esp, 4
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x98], 0xc
xor al, al
jmp 0x6323c7b5
jmp 0x6323c6bf
mov ecx, 1
test ecx, ecx
je 0x6323c69e
jmp 0x6323c6ab
push str.Signature_not_validated_
call fcn.63201050
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x98], 0xc
xor al, al
jmp 0x6323c7b5
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
movzx ecx, byte [ebp + 0xc]
test ecx, ecx
je 0x6323c745
push 0x5c
mov edx, dword [ebp - 4]
push edx
call fcn.63202630
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x6323c6ef
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x6323c6f5
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x8c]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x58]
mov eax, dword [ebp - 0x14]
add edx, dword [eax + 0x5c]
push edx
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.63211d0d
add esp, 0xc
test eax, eax
je 0x6323c745
mov edx, 1
test edx, edx
je 0x6323c727
jmp 0x6323c734
push str.Filename_not_matched_
call fcn.63201050
add esp, 4
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x98], 0xd
xor al, al
jmp 0x6323c7b5
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 0x58], 0
je 0x6323c767
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x58]
push eax
call fcn.63210443
add esp, 4
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x58], 0
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0x68], 0
je 0x6323c789
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x68]
push ecx
call fcn.63210443
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x68], 0
mov eax, 1
test eax, eax
je 0x6323c794
jmp 0x6323c7a1
push str.The_signature_has_been_verified.
call fcn.63201050
add esp, 4
jmp 0x6323c7b3
mov al, 1
mov esp, ebp
pop ebp
ret 8