Function at 0x412880
Capabilities:
Get hostname
Get session user name
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt
Read file via mapping

Disassembly:
sub esp, 0x374
mov eax, dword [0x52e144]
xor eax, esp
mov dword [esp + 0x370], eax
push edi
mov edi, dword [esp + 0x37c]
cmp edi, 0x3e9
je 0x4128d7
cmp edi, 0x3ea
je 0x4128d7
cmp edi, 0x3eb
je 0x4128d7
cmp edi, 0x3ed
je 0x4128d7
mov eax, 7
pop edi
mov ecx, dword [esp + 0x370]
xor ecx, esp
call fcn.004b6da3
add esp, 0x374
ret
push ebx
push esi
xor ebx, ebx
push 0x3f
lea eax, [esp + 0x41]
push ebx
push eax
mov byte [esp + 0x48], bl
call fcn.004b6dc0
xor eax, eax
add esp, 0xc
mov byte [esp + 0x1c], bl
mov dword [esp + 0x1d], eax
mov dword [esp + 0x21], eax
mov dword [esp + 0x25], eax
mov dword [esp + 0x29], eax
mov dword [esp + 0x2d], eax
mov dword [esp + 0x31], eax
mov dword [esp + 0x35], eax
mov word [esp + 0x39], ax
mov byte [esp + 0x3b], al
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0xff
lea ecx, [esp + 0x281]
push ebx
push ecx
mov byte [esp + 0x288], bl
call fcn.004b6dc0
push 0xff
lea edx, [esp + 0x10d]
push ebx
push edx
mov byte [esp + 0x114], bl
call fcn.004b6dc0
mov esi, dword [sym.imp.KERNEL32.dll_GetComputerNameA]
add esp, 0x18
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x280]
push ecx
mov dword [esp + 0x1c], 0x100
call esi
mov dword [esp + 0x14], 0x100
cmp dword [esp + 0x388], ebx
je 0x412996
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x100]
push eax
call esi
jmp 0x4129a9
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x100]
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov eax, dword [esp + 0x27c]
push eax
push 0x50f234
call fcn.00404690
add esp, 4
push eax
lea ecx, [esp + 0x44]
push ecx
call fcn.004b79a8
push 0x7e
lea edx, [esp + 0x8d]
push ebx
push edx
mov byte [esp + 0x94], bl
call fcn.004b6dc0
add esp, 0x18
lea eax, [esp + 0x3c]
push eax
push ebx
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov esi, eax
cmp esi, ebx
jne 0x412a14
pop esi
pop ebx
mov eax, 1
pop edi
mov ecx, dword [esp + 0x370]
xor ecx, esp
call fcn.004b6da3
add esp, 0x374
ret
push 0x20
push ebx
push ebx
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, ebx
jne 0x412a49
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
mov eax, 2
pop edi
mov ecx, dword [esp + 0x370]
xor ecx, esp
call fcn.004b6da3
add esp, 0x374
ret
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x7c], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x80], edx
mov edx, dword [eax + 0xc]
push eax
mov dword [esp + 0x88], ecx
mov dword [esp + 0x8c], edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [esp + 0x107], bl
cmp edi, 0x3e9
jne 0x412a99
lea eax, [esp + 0xfc]
push eax
push 0x50f218
jmp 0x412af8
cmp edi, 0x3ea
jne 0x412abe
lea edx, [esp + 0xfc]
push edx
push 0x50f200
call fcn.00404690
add esp, 4
push eax
lea eax, [esp + 0x24]
push eax
jmp 0x412b06
cmp edi, 0x3eb
jne 0x412ae3
lea ecx, [esp + 0xfc]
push ecx
push 0x50f1e4
call fcn.00404690
add esp, 4
push eax
lea edx, [esp + 0x24]
push edx
jmp 0x412b06
cmp edi, 0x3ed
jne 0x412b0e
lea eax, [esp + 0xfc]
push eax
push 0x50f1c8
call fcn.00404690
add esp, 4
push eax
lea ecx, [esp + 0x24]
push ecx
call fcn.004b79a8
add esp, 0xc
push 0x7e
lea edx, [esp + 0x201]
push ebx
push edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
mov byte [esp + 0x208], bl
call fcn.004b6dc0
add esp, 0xc
push 0xf0000000
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push ebx
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x2c], 0x10
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x412b58
mov dword [esp + 0xc], ebx
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
push ebx
push ebx
push 0x8003
push edx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x412b90
pop esi
pop ebx
mov eax, 3
pop edi
mov ecx, dword [esp + 0x370]
xor ecx, esp
call fcn.004b6da3
add esp, 0x374
ret
lea eax, [esp + 0x1c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x412b97
mov ecx, dword [esp + 0x10]
push ebx
sub eax, edx
push eax
lea eax, [esp + 0x24]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x412be3
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x412bc6
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop esi
pop ebx
mov eax, 4
pop edi
mov ecx, dword [esp + 0x370]
xor ecx, esp
call fcn.004b6da3
add esp, 0x374
ret
mov ecx, dword [esp + 0x10]
push ebx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x204]
push eax
push 2
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x412c3e
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x412c11
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x412c21
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop esi
pop ebx
mov eax, 5
pop edi
mov ecx, dword [esp + 0x370]
xor ecx, esp
call fcn.004b6da3
add esp, 0x374
ret
mov eax, 0x10
xor ecx, ecx
jmp 0x412c50
mov edx, dword [esp + ecx + 0x7c]
cmp edx, dword [esp + ecx + 0x1fc]
jne 0x412c77
sub eax, 4
add ecx, 4
cmp eax, 4
jae 0x412c50
cmp edi, 0x3e9
jne 0x412cb3
push 0x50f1b0
jmp 0x412cde
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x412c86
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x412c96
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop esi
pop ebx
mov eax, 6
pop edi
mov ecx, dword [esp + 0x370]
xor ecx, esp
call fcn.004b6da3
add esp, 0x374
ret
cmp edi, 0x3ea
jne 0x412cc2
push 0x50f19c
jmp 0x412cde
cmp edi, 0x3eb
jne 0x412cd1
push 0x50f184
jmp 0x412cde
cmp edi, 0x3ed
jne 0x412cf1
push 0x50f168
call fcn.00404690
push eax
push 0x527e20
call fcn.00401350
add esp, 0xc
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x412d00
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x412d10
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [esp + 0x37c]
pop esi
pop ebx
pop edi
xor ecx, esp
xor eax, eax
call fcn.004b6da3
add esp, 0x374
ret