Function at 0x442947
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.0044ce70
mov eax, dword [0x46e008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1014], eax
xor eax, eax
push 0x1000
push eax
mov esi, eax
mov dword [ebp - 0x1010], eax
mov dword [ebp - 0x1008], eax
mov dword [ebp - 0x100c], eax
lea eax, [ebp - 0x1004]
push eax
call fcn.0042f710
add esp, 0xc
lea eax, [ebp - 0x1010]
push 0xf0000040
push dword [ebp + 0xc]
push esi
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x4429df
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4429cd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4429d4
mov esi, 0x80004005
push esi
push 0xd3
jmp 0x442a96
lea eax, [ebp - 0x1008]
push eax
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x1010]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x442a52
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x442a14
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x442a1b
mov esi, 0x80004005
push esi
push 0xd9
jmp 0x442a96
push 0
cmp dword [ebp - 0x100c], esi
je 0x442b05
push dword [ebp - 0x100c]
lea eax, [ebp - 0x1004]
push eax
push dword [ebp - 0x1008]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x442adf
push 0
lea eax, [ebp - 0x100c]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x442a23
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x442a89
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x442a90
mov esi, 0x80004005
push esi
push 0xe1
push str.c:_agent_work13_s_srclibsdutilcryputil.cpp
call fcn.004038f5
cmp dword [ebp - 0x1008], 0
je 0x442ab5
push dword [ebp - 0x1008]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp dword [ebp - 0x1010], 0
je 0x442acc
push 0
push dword [ebp - 0x1010]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042de30
leave
ret 0x18
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x442af6
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x442afd
mov esi, 0x80004005
push esi
push 0xec
jmp 0x442a96
lea eax, [ebp + 0x18]
push eax
push dword [ebp - 0x1014]
push 2
push dword [ebp - 0x1008]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x442b4a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x442b38
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x442b3f
mov esi, 0x80004005
push esi
push 0xf3
jmp 0x442a96
test ebx, ebx
je 0x442aa0
push 1
push ebx
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x442aa0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x442b7f
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x442b86
mov esi, 0x80004005
push esi
push 0xfa
jmp 0x442a96