Function at 0xa1200
Capabilities:
Check os version
Connect to wmi namespace via wbemlocator
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
sub esp, 0x2a0
mov eax, dword [0xb2340]
xor eax, esp
mov dword [esp + 0x29c], eax
cmp dword [0xb2378], 0
mov eax, dword [esp + 0x2a4]
push esi
mov dword [esp + 0x1c], eax
jne 0xa12de
push 0x110
xor esi, esi
lea eax, [esp + 0x30]
push esi
push eax
call sub.vcruntime140.dll_memset
add esp, 0xc
mov dword [esp + 0x28], 0x114
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.kernel32.dll_GetVersionExW]
push dword [esp + 0x38]
push dword [esp + 0x34]
push dword [esp + 0x34]
push 0xa7498
call fcn.000a1c30
add esp, 0x10
cmp dword [esp + 0x38], 2
jne 0xa12a1
cmp dword [esp + 0x2c], 0xa
jne 0xa1294
cmp dword [esp + 0x30], esi
jne 0xa1294
push 0xa74c0
call fcn.000a1c30
add esp, 4
mov esi, 5
mov eax, dword [esp + 0x34]
mov dword [0xb237c], eax
test esi, esi
jne 0xa12ae
push 0xa74e4
call fcn.000a1c30
add esp, 4
push 0xa7500
call fcn.000a1c30
add esp, 4
mov dword [0xb2378], esi
test esi, esi
jne 0xa12de
lea eax, [esi - 0x65]
pop esi
mov ecx, dword [esp + 0x29c]
xor ecx, esp
call fcn.000a59d2
add esp, 0x2a0
ret
push 0x100
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x100
call sub.ucrtbase.dll_malloc
add esp, 4
mov dword [esp + 0xc], eax
mov byte [eax], 0
push 0
push 0
call dword [sym.imp.combase.dll_CoInitializeEx]
test eax, eax
jns 0xa132a
cmp eax, 0x80010106
je 0xa1326
mov esi, 0xffffff9b
mov ecx, 0x65
jmp 0xa13f9
xor eax, eax
jmp 0xa132f
mov eax, 1
cmp word [0xb236c], 0
mov word [0xb2368], ax
jne 0xa1375
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.combase.dll_CoInitializeSecurity]
test eax, eax
jns 0xa136a
mov esi, 0xffffff9a
mov ecx, 0x66
jmp 0xa13f9
mov eax, 1
mov word [0xb236c], ax
push 0xb2374
push 0xae2fc
push 1
push 0
push 0xae2ec
call dword [sym.imp.combase.dll_CoCreateInstance]
test eax, eax
jns 0xa139e
mov esi, 0xffffff99
mov ecx, 0x67
jmp 0xa13f9
mov eax, dword [0xb2374]
push 0xb2370
push 0
push 0
mov ecx, dword [eax]
push 0
push 0
push 0
push 0
push 0xa7290
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
jns 0xa13d1
mov esi, 0xffffff98
mov ecx, 0x68
jmp 0xa13f9
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [0xb2370]
call dword [sym.imp.combase.dll_CoSetProxyBlanket]
test eax, eax
jns 0xa142a
mov esi, 0xffffff97
mov ecx, 0x69
push eax
push ecx
push 0xa7274
call fcn.000a1c30
push 0xa7314
call fcn.000a1c30
add esp, 0x10
mov eax, esi
pop esi
mov ecx, dword [esp + 0x29c]
xor ecx, esp
call fcn.000a59d2
add esp, 0x2a0
ret
push ebx
push ebp
push edi
lea eax, [esp + 0x15c]
push eax
push 0xa7334
call fcn.000a1c60
lea eax, [esp + 0x1b4]
push eax
push 0xa734c
push 0xa735c
lea eax, [esp + 0x170]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.000a1ce0
add esp, 0x1c
test eax, eax
jle 0xa1496
mov edi, dword [esp + 0x18]
test edi, edi
je 0xa1492
mov esi, dword [esp + 0x10]
lea eax, [esi + 1]
push eax
call sub.ucrtbase.dll_malloc
push esi
mov ebp, eax
push edi
push ebp
call sub.ucrtbase.dll_strncpy
add esp, 0x10
mov byte [esi + ebp], 0
jmp 0xa14b0
xor ebp, ebp
jmp 0xa14b0
push 0xa736c
call sub.ucrtbase.dll__mbsdup
mov ebp, eax
lea eax, [esp + 0x14]
push ebp
push eax
call fcn.000a1090
add esp, 0xc
lea eax, [esp + 0x1ac]
push eax
push 0xa734c
push 0xa7378
lea eax, [esp + 0x168]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.000a1ce0
add esp, 0x14
test eax, eax
jle 0xa1514
push dword [esp + 0x10]
call sub.ucrtbase.dll_malloc
mov edx, ebp
mov ebx, eax
add esp, 4
mov dword [esp + 0x2c], ebx
lea eax, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0xa14f2
mov ecx, dword [esp + 0x18]
sub edx, eax
add ecx, edx
mov edx, ebx
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0xa1505
jmp 0xa1532
push 0xa736c
call sub.ucrtbase.dll__mbsdup
mov ebx, eax
lea eax, [esp + 0x14]
push ebx
push eax
mov dword [esp + 0x38], ebx
call fcn.000a1090
add esp, 0xc
lea eax, [esp + 0x1ac]
push eax
push 0xa7380
push 0xa738c
lea eax, [esp + 0x168]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.000a1ce0
lea eax, [esp + 0x1c0]
push eax
push 0xa7380
push 0xa7394
lea eax, [esp + 0x17c]
push eax
lea eax, [esp + 0x34]
push eax
call fcn.000a1ce0
lea eax, [esp + 0x1d4]
push eax
push 0xa7380
push 0xa73a4
lea eax, [esp + 0x190]
push eax
lea eax, [esp + 0x48]
push eax
call fcn.000a1ce0
lea eax, [esp + 0x1e8]
push eax
push 0xa73b0
push 0xa73c8
lea eax, [esp + 0x1a4]
push eax
lea eax, [esp + 0x5c]
push eax
call fcn.000a1ce0
add esp, 0x50
mov edi, eax
lea eax, [esp + 0x1ac]
push eax
push 0xa73dc
push 0xa73e4
lea eax, [esp + 0x168]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.000a1ce0
add edi, eax
lea eax, [esp + 0x1c0]
push eax
push 0xa73f4
push 0xa73e4
lea eax, [esp + 0x17c]
push eax
lea eax, [esp + 0x34]
push eax
call fcn.000a1ce0
add edi, eax
lea eax, [esp + 0x1d4]
push eax
push 0xa73f4
push 0xa7400
lea eax, [esp + 0x190]
push eax
lea eax, [esp + 0x48]
push eax
call fcn.000a1ce0
mov eax, dword [esp + 0x2f4]
add esp, 0x3c
and eax, 1
mov dword [esp + 0x30], eax
jne 0xa169c
lea eax, [esp + 0x1ac]
push eax
push 0xa7408
push 0xa735c
lea eax, [esp + 0x168]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.000a1ce0
lea eax, [esp + 0x1c0]
push eax
push 0xa7408
push 0xa7418
lea eax, [esp + 0x17c]
push eax
lea eax, [esp + 0x34]
push eax
call fcn.000a1ce0
add esp, 0x28
mov eax, 0xa7408
jmp 0xa16a1
mov eax, 0xa7424
lea ecx, [esp + 0x1ac]
push ecx
push eax
push 0xa73e4
lea eax, [esp + 0x168]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.000a1ce0
lea eax, [esp + 0x1c0]
push eax
push 0xa7434
push 0xa7378
lea eax, [esp + 0x17c]
push eax
lea eax, [esp + 0x34]
push eax
call fcn.000a1ce0
lea eax, [esp + 0x1d4]
push eax
push 0xa7434
push 0xa73e4
lea eax, [esp + 0x190]
push eax
lea eax, [esp + 0x48]
push eax
call fcn.000a1ce0
mov edx, dword [0xb2370]
add esp, 0x3c
mov esi, eax
test edx, edx
je 0xa172a
mov ecx, dword [edx]
push edx
mov ecx, dword [ecx + 8]
call ecx
mov dword [0xb2370], 0
mov ecx, dword [0xb2374]
test ecx, ecx
je 0xa1746
mov eax, dword [ecx]
push ecx
mov eax, dword [eax + 8]
call eax
mov dword [0xb2374], 0
cmp word [0xb2368], 0
je 0xa175e
call dword [sym.imp.combase.dll_CoUninitialize]
xor eax, eax
mov word [0xb2368], ax
test edi, edi
jg 0xa176e
test esi, esi
jne 0xa176e
lea ebx, [esi - 0x64]
jmp 0xa1be1
mov ebx, dword [esp + 0x10]
test ebx, ebx
jle 0xa1bcf
movups xmm0, xmmword [0xa72c4]
mov al, byte [0xa72d4]
push 0x24
mov dword [esp + 0x28], 0
movups xmmword [esp + 0x14c], xmm0
mov byte [esp + 0x15c], al
call sub.ucrtbase.dll_malloc
add esp, 4
mov edi, eax
lea eax, [esp + 0x20]
push 0xf0000000
push 1
push 0
push 0
push eax
call dword [sym.imp.advapi32.dll_CryptAcquireContextW]
mov esi, dword [esp + 0x18]
test eax, eax
jne 0xa17e2
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push 0xa72d8
call fcn.000a1c30
add esp, 8
xor edi, edi
jmp 0xa18f0
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 0x8003
push dword [esp + 0x30]
call dword [sym.imp.advapi32.dll_CryptCreateHash]
test eax, eax
jne 0xa1825
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push 0xa72d8
call fcn.000a1c30
add esp, 8
push 0
push dword [esp + 0x24]
call dword [sym.imp.advapi32.dll_CryptReleaseContext]
xor edi, edi
jmp 0xa18f0
push 0
push ebx
push esi
push dword [esp + 0x30]
call dword [sym.imp.advapi32.dll_CryptHashData]
test eax, eax
jne 0xa1867
push dword [sym.imp.kernel32.dll_GetLastError]
push 0xa72f8
call fcn.000a1c30
add esp, 8
push dword [esp + 0x24]
call dword [sym.imp.advapi32.dll_CryptDestroyHash]
push 0
push dword [esp + 0x24]
call dword [sym.imp.advapi32.dll_CryptReleaseContext]
xor edi, edi
jmp 0xa18f0
push 0
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0x10
push eax
lea eax, [esp + 0x1a4]
push eax
push 2
push dword [esp + 0x34]
call dword [sym.imp.advapi32.dll_CryptGetHashParam]
test eax, eax
je 0xa18d6
xor edx, edx
cmp dword [esp + 0x1c], edx
jbe 0xa18d6
mov ecx, edi
nop dword [eax + eax]
movzx eax, byte [esp + edx + 0x19c]
lea ecx, [ecx + 2]
shr eax, 4
movzx eax, byte [esp + eax + 0x148]
mov byte [ecx - 2], al
movzx eax, byte [esp + edx + 0x19c]
inc edx
and eax, 0xf
movzx eax, byte [esp + eax + 0x148]
mov byte [ecx - 1], al
cmp edx, dword [esp + 0x1c]
jb 0xa18a0
push dword [esp + 0x24]
call dword [sym.imp.advapi32.dll_CryptDestroyHash]
push 0
push dword [esp + 0x24]
call dword [sym.imp.advapi32.dll_CryptReleaseContext]
mov byte [edi + 0x20], 0
mov eax, dword [esp + 0x28]
mov ebx, 0xffffff9b
mov dword [eax], edi
xor eax, eax
test edi, edi
cmovne ebx, eax
mov dword [esp + 0x20], ebx
je 0xa1be5
test byte [esp + 0x2b8], 2
je 0xa1be5
push dword [0xb237c]
lea eax, [esp + 0x1b0]
push 0xa7488
push eax
call fcn.000a1fd0
add esp, 0xc
test esi, esi
je 0xa195a
push esi
call sub.ucrtbase.dll_free
add esp, 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
lea eax, [esp + 0x10]
push eax
call fcn.000a10f0
mov eax, dword [esp + 0x2c]
push dword [eax]
lea eax, [esp + 0x18]
push eax
call fcn.000a1090
mov esi, dword [esp + 0x1c]
add esp, 0xc
mov ecx, dword [esp + 0x14]
lea edi, [esi + 1]
lea eax, [edi + 1]
cmp eax, ecx
jle 0xa19a6
add ecx, 0x100
push ecx
push dword [esp + 0x1c]
mov dword [esp + 0x1c], ecx
call sub.ucrtbase.dll_realloc
add esp, 8
mov dword [esp + 0x18], eax
jmp 0xa19aa
mov eax, dword [esp + 0x18]
push 1
add eax, esi
push 0xa7490
push eax
call sub.ucrtbase.dll_strncat
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], edi
push ebp
push eax
call section.sect_0
mov esi, dword [esp + 0x24]
add esp, 0x14
mov ecx, dword [esp + 0x14]
lea edi, [esi + 1]
lea eax, [edi + 1]
cmp eax, ecx
jle 0xa19fa
add ecx, 0x100
push ecx
push dword [esp + 0x1c]
mov dword [esp + 0x1c], ecx
call sub.ucrtbase.dll_realloc
add esp, 8
mov dword [esp + 0x18], eax
jmp 0xa19fe
mov eax, dword [esp + 0x18]
push 1
add eax, esi
push 0xa7490
push eax
call sub.ucrtbase.dll_strncat
push dword [esp + 0x38]
lea eax, [esp + 0x20]
mov dword [esp + 0x20], edi
push eax
call section.sect_0
add esp, 0x14
cmp dword [esp + 0x30], 0
je 0xa1a6c
mov ebx, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
inc ebx
lea eax, [ebx + 1]
cmp eax, edi
jle 0xa1a50
add edi, 0x100
push edi
push dword [esp + 0x1c]
call sub.ucrtbase.dll_realloc
add esp, 8
mov esi, eax
jmp 0xa1a54
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
push 1
add eax, esi
push 0xa7490
push eax
call sub.ucrtbase.dll_strncat
add esp, 0xc
jmp 0xa1ad3
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
lea edi, [esi + 3]
lea eax, [edi + 1]
cmp eax, ecx
jle 0xa1a9b
add ecx, 0x100
push ecx
push dword [esp + 0x1c]
mov dword [esp + 0x1c], ecx
call sub.ucrtbase.dll_realloc
add esp, 8
mov dword [esp + 0x18], eax
jmp 0xa1a9f
mov eax, dword [esp + 0x18]
push 3
add eax, esi
push 0xa7494
push eax
call sub.ucrtbase.dll_strncat
lea eax, [esp + 0x1b8]
mov dword [esp + 0x1c], edi
push eax
lea eax, [esp + 0x20]
push eax
call fcn.000a1090
mov esi, dword [esp + 0x2c]
add esp, 0x14
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
lea eax, [ebx + 1]
mov dword [esp + 0x1c], eax
inc eax
cmp eax, edi
jle 0xa1af1
add edi, 0x100
push edi
push esi
call sub.ucrtbase.dll_realloc
add esp, 8
mov esi, eax
push 1
lea eax, [esi + ebx]
push 0xa7490
push eax
call sub.ucrtbase.dll_strncat
mov ebx, dword [esp + 0x28]
add esp, 0xc
lea eax, [ebx + 4]
cmp eax, edi
jle 0xa1b21
add edi, 0x100
push edi
push esi
call sub.ucrtbase.dll_realloc
add esp, 8
mov esi, eax
mov edi, esi
mov byte [esi + ebx], 0
xor edx, edx
test edi, edi
je 0xa1b59
mov al, byte [esi]
xor ebx, ebx
test al, al
je 0xa1b55
mov ecx, ebx
and ecx, 0x80000007
jns 0xa1b44
dec ecx
or ecx, 0xfffffff8
inc ecx
inc ecx
movsx eax, al
imul ecx, eax
inc edi
inc ebx
mov al, byte [edi]
add edx, ecx
test al, al
jne 0xa1b35
mov ebx, dword [esp + 0x1c]
and edx, 0x8000000f
jns 0xa1b6a
dec edx
or edx, 0xfffffff0
add edx, 1
js 0xa1b7e
cmp edx, 0xa
jge 0xa1b74
add dl, 0x30
jmp 0xa1b80
cmp edx, 0x10
jge 0xa1b7e
add dl, 0x57
jmp 0xa1b80
mov dl, 0x58
mov eax, dword [esp + 0x28]
mov byte [esi + ebx], dl
mov byte [esi + ebx + 1], 0
inc ebx
push dword [eax]
call sub.ucrtbase.dll_free
add esp, 4
test esi, esi
je 0xa1bc1
lea eax, [ebx + 1]
push eax
call sub.ucrtbase.dll_malloc
push ebx
mov edi, eax
push esi
push edi
call sub.ucrtbase.dll_strncpy
mov eax, dword [esp + 0x38]
add esp, 0x10
mov byte [edi + ebx], 0
mov ebx, dword [esp + 0x20]
mov dword [eax], edi
jmp 0xa1be5
mov eax, dword [esp + 0x28]
xor edi, edi
mov ebx, dword [esp + 0x20]
mov dword [eax], edi
jmp 0xa1be5
push 0xa7450
call fcn.000a1c30
add esp, 4
mov ebx, 0xffffff9d
mov esi, dword [esp + 0x18]
test esi, esi
je 0xa1bf2
push esi
call sub.ucrtbase.dll_free
add esp, 4
test ebp, ebp
je 0xa1bff
push ebp
call sub.ucrtbase.dll_free
add esp, 4
mov eax, dword [esp + 0x2c]
test eax, eax
je 0xa1c10
push eax
call sub.ucrtbase.dll_free
add esp, 4
mov ecx, dword [esp + 0x2ac]
mov eax, ebx
pop edi
pop ebp
pop ebx
pop esi
xor ecx, esp
call fcn.000a59d2
add esp, 0x2a0
ret