Function at 0x108f573
Capabilities:
Get file size
Get system information on windows
Hash data via bcrypt
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [ebp + 0x10]
push ebx
push esi
xor esi, esi
mov dword [eax], esi
push edi
lea eax, [ebp - 0x68]
push eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x28], esi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x4c]
push esi
push 0x80
push 3
push esi
push 1
push SysReAllocString
push dword [ebp + 8]
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 0x34], ebx
cmp ebx, 0xffffffff
jne 0x108f5fe
call fcn.01091f43
mov edi, eax
cmp edi, esi
jne 0x108f5eb
push esi
push 0x18b2019a
call fcn.0108c55a
mov edi, 0x80070002
push edi
push 0x18b5019a
push dword [ebp + 8]
call fcn.0108c595
jmp 0x108f8be
lea eax, [ebp - 0x2c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x108f623
mov edi, 0x80070002
push edi
push 0x18bb019a
call fcn.0108c55a
jmp 0x108f8b5
mov edi, dword [ebp - 0x2c]
push esi
push esi
push esi
push 2
xor ecx, ecx
push esi
xor edx, edx
or ecx, eax
push ebx
mov dword [ebp - 0x44], ecx
or edi, edx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x24], eax
cmp eax, esi
jne 0x108f657
call fcn.01091f43
mov edi, eax
push edi
push 0x18c9019a
jmp 0x108f865
push esi
push esi
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
call sub.ncrypt.dll_BCryptOpenAlgorithmProvider
cmp eax, esi
je 0x108f67b
or eax, 0x10000000
mov edi, eax
push edi
push 0x18d6019a
jmp 0x108f865
push esi
lea eax, [ebp - 0x30]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x1017e80
push dword [ebp - 4]
call sub.ncrypt.dll_BCryptGetProperty
cmp eax, esi
je 0x108f6a9
or eax, 0x10000000
mov edi, eax
push edi
push 0x18e3019a
jmp 0x108f865
push esi
lea eax, [ebp - 0x30]
push eax
push 4
lea eax, [ebp - 0x18]
push eax
push 0x1015f18
push dword [ebp - 4]
call sub.ncrypt.dll_BCryptGetProperty
cmp eax, esi
je 0x108f6d7
or eax, 0x10000000
mov edi, eax
push edi
push 0x18f0019a
jmp 0x108f865
push dword [ebp - 0x18]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x28], eax
cmp eax, esi
jne 0x108f6f9
mov edi, 0x8007000e
push edi
push 0x18f8019a
jmp 0x108f865
push esi
push esi
push esi
push dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
call sub.ncrypt.dll_BCryptCreateHash
cmp eax, esi
je 0x108f722
or eax, 0x10000000
mov edi, eax
push edi
push 0x1906019a
jmp 0x108f865
xor ebx, ebx
cmp edi, esi
mov dword [ebp - 0x3c], esi
jl 0x108f7b0
jg 0x108f736
cmp dword [ebp - 0x44], esi
jbe 0x108f7b0
xor edx, edx
mov ecx, dword [ebp - 0x44]
sub ecx, dword [ebp - 0x3c]
mov eax, edi
sbb eax, ebx
cmp edx, eax
jg 0x108f755
jl 0x108f74d
cmp dword [ebp - 0x1c], ecx
jae 0x108f755
mov eax, dword [ebp - 0x1c]
mov dword [ebp + 8], eax
jmp 0x108f758
mov dword [ebp + 8], ecx
push dword [ebp + 8]
mov eax, ebx
push dword [ebp - 0x3c]
sar eax, 0x1f
push ebx
push 4
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0xc], eax
cmp eax, esi
je 0x108f7d6
push esi
push dword [ebp + 8]
push eax
push dword [ebp - 0x10]
call sub.ncrypt.dll_BCryptHashData
cmp eax, esi
jne 0x108f7e8
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
je 0x108f7fa
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x3c], eax
push 0
pop edx
adc ebx, edx
cmp ebx, edi
mov dword [ebp - 0xc], esi
jl 0x108f738
jg 0x108f7b0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x3c], eax
jb 0x108f738
push dword [ebp - 8]
mov ebx, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0x40
call ebx
mov edi, eax
mov dword [ebp - 0x14], edi
cmp edi, esi
jne 0x108f809
mov edi, 0x8007000e
push edi
push 0x1937019a
jmp 0x108f865
call fcn.01091f43
mov edi, eax
push edi
push 0x191a019a
jmp 0x108f894
or eax, 0x10000000
mov edi, eax
push edi
push 0x1925019a
jmp 0x108f894
call fcn.01091f43
mov edi, eax
push edi
push 0x192d019a
jmp 0x108f865
push esi
push dword [ebp - 8]
push edi
push dword [ebp - 0x10]
call sub.ncrypt.dll_BCryptFinishHash
cmp eax, esi
je 0x108f829
or eax, 0x10000000
mov edi, eax
push edi
push 0x1942019a
jmp 0x108f865
push esi
lea eax, [ebp - 0x20]
push eax
push edi
push dword [ebp - 8]
mov dword [ebp - 0x20], esi
push 1
call fcn.01091b9c
mov edi, eax
cmp edi, esi
je 0x108f84a
push edi
push 0x194c019a
jmp 0x108f865
push dword [ebp - 0x20]
push 0x40
call ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
cmp eax, esi
jne 0x108f86c
mov edi, 0x8007000e
push edi
push 0x1952019a
call fcn.0108c55a
jmp 0x108f8a7
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x14]
push dword [ebp - 8]
push 1
call fcn.01091b9c
mov edi, eax
cmp edi, esi
je 0x108f8a7
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push edi
mov dword [ebx], esi
push 0x1960019a
call fcn.0108c55a
cmp dword [ebp - 0xc], esi
je 0x108f8a7
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [ebp - 0x24], esi
je 0x108f8b5
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x10], esi
je 0x108f8cb
push dword [ebp - 0x10]
call sub.ncrypt.dll_BCryptDestroyHash
cmp dword [ebp - 4], esi
je 0x108f8d9
push esi
push dword [ebp - 4]
call sub.ncrypt.dll_BCryptCloseAlgorithmProvider
cmp dword [ebp - 0x28], esi
je 0x108f8e7
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x14], esi
je 0x108f8f5
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0xc