Function at 0x1ee1ea0
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [ebp + 8]
push ebx
push edi
xor ebx, ebx
push ebx
push 0x8000000
push 3
push ebx
push 1
push 0x80000000
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1ee1ee8
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0xf0000000
push 1
push ebx
push ebx
lea ecx, [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1ee1f14
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
push edx
push ebx
push ebx
push 0x8003
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x1ee1f4d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
lea edx, [ebp - 0xc]
push edx
push 0x400
lea eax, [ebp - 0x420]
push eax
push edi
call esi
cmp eax, ebx
je 0x1ee1fd7
lea esp, [esp]
mov ecx, dword [ebp - 0xc]
cmp ecx, ebx
je 0x1ee1fd3
mov edx, dword [ebp - 4]
push ebx
push ecx
lea ecx, [ebp - 0x420]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1ee1fa8
push ebx
lea eax, [ebp - 0xc]
push eax
push 0x400
lea ecx, [ebp - 0x420]
push ecx
push edi
call esi
cmp eax, ebx
jne 0x1ee1f70
jmp 0x1ee1fd7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 8]
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, ebx
jne 0x1ee2002
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 8]
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
push ebx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x20]
push ecx
push 2
push edx
mov dword [ebp - 0x10], 0x10
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x1ee208b
mov esi, dword [ebp - 0x10]
xor eax, eax
cmp esi, ebx
jbe 0x1ee205c
jmp 0x1ee2030
movzx ecx, byte [ebp + eax - 0x20]
mov edx, ecx
shr edx, 4
mov dl, byte [edx + str.0123456789ABCDEF]
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEF]
mov byte [eax*2 + 0x1ef6fbc], dl
mov byte [eax*2 + 0x1ef6fbd], cl
inc eax
cmp eax, esi
jb 0x1ee2030
mov edx, dword [ebp - 4]
push edx
mov byte [esi*2 + 0x1ef6fbc], bl
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 8]
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
mov eax, 0x1ef6fbc
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret