Function at 0x1000b4cf8
Capabilities:
Get file size
Get system information on windows
Hash data via bcrypt
Read file via mapping

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
xor r12d, r12d
mov rsi, rcx
lea rcx, [rax - 0x70]
mov r13, r8
mov rbx, rdx
mov rbp, r12
mov dword [rsp + 0x58], r12d
mov dword [rax + 0x18], r12d
mov dword [rax + 0x20], r12d
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x50], r12
mov rdi, r12
mov r14, r12
mov qword [r8], r12
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r15d, dword [rsp + 0xa0]
mov qword [rsp + 0x30], r12
lea r8d, [r12 + 1]
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
jne 0x1000b4dcc
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov ebx, eax
test eax, eax
jne 0x1000b4db4
xor r9d, r9d
xor r8d, r8d
mov edx, 0x18b2019a
xor ecx, ecx
call fcn.1000b51b8
mov ebx, 0x80070002
xor r9d, r9d
mov r8d, ebx
mov edx, 0x18b5019a
mov rcx, rsi
call fcn.1000b51b8
jmp 0x1000b5157
lea rdx, [rsp + 0x58]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor r9d, r9d
cmp eax, 0xffffffff
jne 0x1000b4dfb
mov ebx, 0x80070002
mov edx, 0x18bb019a
xor ecx, ecx
mov r8d, ebx
call fcn.1000b51b8
jmp 0x1000b514e
mov esi, dword [rsp + 0x58]
and qword [rsp + 0x28], rdi
and dword [rsp + 0x20], edi
xor edx, edx
mov eax, eax
shl rsi, 0x20
lea r8d, [rdx + 2]
mov rcx, r12
or rsi, rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsp + 0x70], rax
test rax, rax
jne 0x1000b4e4f
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x18c9019a
mov ebx, eax
mov r8d, eax
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000b513b
lea rcx, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
call sub.ncrypt.dll_BCryptOpenAlgorithmProvider
mov ebx, eax
test eax, eax
je 0x1000b4e76
bts ebx, 0x1c
mov edx, 0x18d6019a
mov r8d, ebx
jmp 0x1000b4e40
mov rcx, qword [rsp + 0x50]
and dword [rsp + 0x28], edi
lea rax, [rsp + 0x68]
lea r8, [rsp + reloc.certcli.dll_Ordinal_256]
lea rdx, [0x100021b58]
mov r9d, 4
mov qword [rsp + 0x20], rax
call sub.ncrypt.dll_BCryptGetProperty
mov ebx, eax
test eax, eax
je 0x1000b4eb7
bts ebx, 0x1c
mov edx, 0x18e3019a
mov r8d, ebx
jmp 0x1000b4e40
mov rcx, qword [rsp + 0x50]
and dword [rsp + 0x28], edi
lea rax, [rsp + 0x68]
lea r8, [rsp + 0x108]
lea rdx, [0x1000204d8]
mov r9d, 4
mov qword [rsp + 0x20], rax
call sub.ncrypt.dll_BCryptGetProperty
mov ebx, eax
test eax, eax
je 0x1000b4efb
bts ebx, 0x1c
mov edx, 0x18f0019a
mov r8d, ebx
jmp 0x1000b4e40
mov edx, dword [rsp + 0x108]
mov ecx, Ordinal_65
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r14, rax
xor eax, eax
cmp r14, rax
jne 0x1000b4f2a
mov r8d, 0x8007000e
mov edx, 0x18f8019a
mov ebx, r8d
jmp 0x1000b4e40
mov r9d, dword [rsp + 0x108]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], eax
lea rdx, [rsp + 0x60]
mov r8, r14
mov qword [rsp + 0x20], rax
call sub.ncrypt.dll_BCryptCreateHash
mov ebx, eax
test eax, eax
je 0x1000b4f68
bts ebx, 0x1c
mov edx, 0x1906019a
mov r8d, ebx
jmp 0x1000b4e40
xor r12d, r12d
test rsi, rsi
jle 0x1000b4fdf
mov rcx, qword [rsp + 0x70]
mov rax, rsi
mov ebx, esi
sub rax, r12
sub ebx, r12d
mov r8, r12
cmp r15, rax
mov r9d, r12d
mov edx, 4
cmovl ebx, r15d
sar r8, 0x20
mov eax, ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbp, rax
test rax, rax
je 0x1000b5041
mov rcx, qword [rsp + 0x60]
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
call sub.ncrypt.dll_BCryptHashData
mov ebx, eax
test eax, eax
jne 0x1000b5033
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
je 0x1000b500e
add r12, r15
xor ebp, ebp
cmp r12, rsi
jl 0x1000b4f70
mov edx, dword [rsp + reloc.certcli.dll_Ordinal_256]
mov esi, Ordinal_65
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
xor r9d, r9d
mov rdi, rax
test rax, rax
jne 0x1000b505c
mov r8d, 0x8007000e
mov edx, 0x1937019a
mov ebx, r8d
jmp 0x1000b5027
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x192d019a
mov ebx, eax
mov r8d, eax
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000b5136
bts ebx, 0x1c
mov edx, 0x1925019a
jmp 0x1000b511b
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x191a019a
mov ebx, eax
mov r8d, eax
jmp 0x1000b511e
mov r8d, dword [rsp + reloc.certcli.dll_Ordinal_256]
mov rcx, qword [rsp + 0x60]
mov rdx, rax
call sub.ncrypt.dll_BCryptFinishHash
mov ebx, eax
test eax, eax
je 0x1000b5085
bts ebx, 0x1c
mov edx, 0x1942019a
mov r8d, ebx
jmp 0x1000b5024
mov edx, dword [rsp + reloc.certcli.dll_Ordinal_256]
and dword [rsp + 0x40], 0
and qword [rsp + 0x20], 0
mov r12d, 1
lea r9, [rsp + 0x40]
mov r8, rdi
mov ecx, r12d
call fcn.1000b8150
mov ebx, eax
test eax, eax
je 0x1000b50bd
mov edx, 0x194c019a
jmp 0x1000b5021
mov edx, dword [rsp + 0x40]
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [r13], rax
test rax, rax
jne 0x1000b50e5
mov r8d, 0x8007000e
mov edx, 0x1952019a
mov ebx, r8d
jmp 0x1000b5024
mov edx, dword [rsp + reloc.certcli.dll_Ordinal_256]
lea r9, [rsp + 0x40]
mov r8, rdi
mov ecx, r12d
mov qword [rsp + 0x20], rax
call fcn.1000b8150
mov ebx, eax
test eax, eax
je 0x1000b5136
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_LocalFree]
and qword [r13], 0
mov edx, 0x1960019a
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
test rbp, rbp
je 0x1000b5136
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov r12, qword [rsp + 0x48]
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x1000b514e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1000b5166
call sub.ncrypt.dll_BCryptDestroyHash
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1000b5177
xor edx, edx
call sub.ncrypt.dll_BCryptCloseAlgorithmProvider
test r14, r14
je 0x1000b5185
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rdi, rdi
je 0x1000b5193
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebx
mov rbx, qword [rsp + 0xf0]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret