Function at 0x1003b831
Capabilities:
Get file size
Hash data via bcrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x10086084]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x44], eax
xor ebx, ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x30], edx
lea edi, [ebp - 0x1c]
mov dword [ebp - 0x4c], ecx
mov esi, ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x38], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x34], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
cmp dword [edx + 0x20], ebx
jne 0x1003b894
mov esi, 0x80070057
push esi
push 0x206
mov ecx, 0x100079d4
call fcn.1003a254
jmp 0x1003bb5b
push 2
pop edx
call fcn.1001a46f
mov edi, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x24]
push eax
push dword [edi + 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1003b8f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0x80070000
test eax, eax
jle 0x1003b8c9
movzx eax, ax
or eax, edi
test eax, eax
jns 0x1003b8de
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1003b8e5
movzx esi, si
or esi, edi
jmp 0x1003b8e3
mov esi, 0x80004005
test esi, esi
jns 0x1003bb5b
push esi
push 0x212
jmp 0x1003b885
mov edx, dword [ebp - 0x30]
mov ecx, dword [edx + 8]
add ecx, dword [edx + 0x18]
mov eax, dword [edx + 0xc]
adc eax, dword [edx + 0x1c]
or byte [edi + 0x3f], 0x10
mov dword [edi + 0x40], ecx
mov ecx, edi
mov dword [edi + 0x44], eax
mov dword [edi + 0x48], ebx
mov dword [edi + 0x4c], ebx
call fcn.1005159e
mov ecx, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
push ebx
push ebx
add dword [ecx + 0x18], eax
mov eax, dword [ebp - 0x20]
adc dword [ecx + 0x1c], eax
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x4c]
push eax
call fcn.10031271
test eax, eax
jne 0x1003b980
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0x80070000
test eax, eax
jle 0x1003b953
movzx eax, ax
or eax, edi
test eax, eax
jns 0x1003b968
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1003b96f
movzx esi, si
or esi, edi
jmp 0x1003b96d
mov esi, 0x80004005
test esi, esi
jns 0x1003bb5b
push esi
push 0x226
jmp 0x1003b885
cmp dword [ebp - 0x48], ebx
je 0x1003b98d
lea ecx, [ebp - 0x34]
call fcn.1003f36f
mov ecx, dword [ebp - 0x24]
mov eax, ecx
mov edx, dword [ebp - 0x20]
or eax, edx
je 0x1003ba90
xor eax, eax
lea edi, [ebp - 0x70]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x40], eax
test edx, edx
jne 0x1003b9b8
mov edi, ecx
cmp ecx, dword [ebp - 0x28]
jb 0x1003b9bb
mov edi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x70]
push ebx
push eax
mov eax, dword [ebp - 0x44]
push edi
mov ecx, dword [eax + 0x14]
call fcn.10028fbd
test eax, eax
je 0x1003bae2
cmp dword [ebp - 0x48], ebx
je 0x1003ba01
mov eax, dword [ebp - 0x34]
push ebx
push edi
push dword [ebp - 0x2c]
push dword [eax]
call dword [sym.imp.bcrypt.dll_BCryptHashData]
test eax, eax
jns 0x1003ba01
push 7
pop ecx
int 0x29
add dword [ebp - 0x38], edi
mov ecx, dword [ebp - 0x24]
adc dword [ebp - 0x3c], ebx
sub ecx, edi
mov edx, dword [ebp - 0x20]
sbb edx, ebx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], edx
test edi, edi
je 0x1003ba83
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x58], edi
mov ecx, dword [eax + 0x20]
mov dword [ebp - 0x54], ecx
mov eax, dword [ecx + 0x1c]
mov edx, dword [ecx + 0x18]
sub eax, edx
mov dword [ebp - 0x5c], eax
cmp edi, eax
jae 0x1003ba3d
mov eax, edi
mov dword [ebp - 0x50], edi
jmp 0x1003ba40
mov dword [ebp - 0x50], eax
push eax
push dword [ebp - 0x40]
lea eax, [ecx + 0x28]
add eax, edx
push eax
call sub.msvcrt.dll_memcpy
mov ecx, dword [ebp - 0x54]
add esp, 0xc
mov eax, dword [ebp - 0x50]
sub edi, eax
add dword [ebp - 0x40], eax
add dword [ecx + 0x18], eax
mov eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x5c]
jb 0x1003ba79
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x4c]
call fcn.1003bb70
mov esi, eax
test esi, esi
js 0x1003bada
test edi, edi
jne 0x1003ba1b
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov eax, ecx
or eax, edx
jne 0x1003b99d
mov edi, dword [ebp - 0x44]
cmp dword [ebp - 0x48], ebx
je 0x1003bab4
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 0x34]
call fcn.1003f27c
lea edx, [ebp - 0x1c]
mov ecx, ebx
mov eax, dword [edx + ecx*4]
cmp eax, dword [edi + ecx*4 + 0x58]
jne 0x1003bb28
inc ecx
cmp ecx, 5
jne 0x1003baa5
cmp dword [edi + 0x7c], ebx
je 0x1003bb45
lea eax, [edi + 0x30]
mov ecx, ebx
test eax, eax
je 0x1003bb3b
test byte [eax + 0xf], 0x10
je 0x1003bb35
mov ecx, dword [eax + 0xc]
mov ebx, dword [eax + 8]
and ecx, 0xffffff
jmp 0x1003bb3b
push esi
push 0x285
jmp 0x1003bb1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0x80070000
test eax, eax
jle 0x1003baf8
movzx eax, ax
or eax, edi
test eax, eax
jns 0x1003bb0d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1003bb14
movzx esi, si
or esi, edi
jmp 0x1003bb12
mov esi, 0x80004005
test esi, esi
jns 0x1003bb45
push esi
push 0x24c
mov ecx, 0x100079d4
call fcn.1003a254
jmp 0x1003bb45
mov esi, 0x80070570
push esi
push 0x299
jmp 0x1003bb1c
mov ebx, dword [eax + 0x18]
mov ecx, dword [eax + 0x1c]
push ecx
push ebx
push dword [ebp - 0x4c]
call fcn.1001bd30
mov ebx, dword [ebp - 0x34]
test ebx, ebx
je 0x1003bb5b
push dword [ebx]
call dword [sym.imp.bcrypt.dll_BCryptDestroyHash]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10083b20
mov esp, ebp
pop ebp
ret 4