Function at 0x436450
Capabilities:
Create new key via cryptacquirecontext
Get file size
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52687d
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x58e5a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x30], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x5c], eax
xor eax, eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
mov dword [ebp - 4], eax
cmp dword [edx + 0x14], 8
jb 0x4364b1
mov edx, dword [edx]
push 0
push 0x8000000
push 3
push 0
push 7
push SysReAllocString
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x4c], esi
mov byte [ebp - 4], 1
cmp esi, 0xffffffff
je 0x43682a
test esi, esi
je 0x43682a
push 0
push 0
push dword [ebp - 0x5c]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push 0
push 0
push 0
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
mov dword [ebp - 0x50], edi
mov byte [ebp - 4], 2
test edi, edi
je 0x4367c8
cmp edi, 0xffffffff
je 0x4367c8
mov dword [ebp - 0x18], 0
push 0xf0000000
push 0x18
push 0
push 0
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 3
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x436552
mov ecx, dword [ebp - 0x54]
lea eax, [ebp - 0x48]
push eax
call fcn.00408df0
jmp 0x43679c
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 4
push eax
push 0
push 0
push 0x8004
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x436588
mov ecx, dword [ebp - 0x54]
lea eax, [ebp - 0x48]
push eax
call fcn.00408df0
jmp 0x43678e
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x1c], edx
test ecx, ecx
je 0x4365f6
nop
mov eax, ecx
cmp ecx, 0xa00000
mov ecx, 0xa00000
cmova eax, ecx
push eax
push edx
push 0
push 4
push edi
mov dword [ebp - 0x64], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x5c], eax
test eax, eax
je 0x436577
push 0
push dword [ebp - 0x64]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x436627
mov eax, dword [ebp - 0x64]
push dword [ebp - 0x5c]
add dword [ebp - 0x1c], eax
sub dword [ebp - 0x60], eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [ebp - 0x60]
mov edx, dword [ebp - 0x1c]
test ecx, ecx
jne 0x4365a0
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 4
push eax
lea eax, [ebp - 0x30]
push eax
push 4
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x436641
mov ecx, dword [ebp - 0x54]
lea eax, [ebp - 0x48]
push eax
call fcn.00408df0
jmp 0x43678e
mov ecx, dword [ebp - 0x54]
lea eax, [ebp - 0x48]
push eax
call fcn.00408df0
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x43678e
xor ecx, ecx
mov dword [ebp - 0x20], 0
xorps xmm0, xmm0
mov dword [ebp - 0x20], ecx
movq qword [ebp - 0x28], xmm0
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x436676
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.004391f0
mov ecx, dword [ebp - 0x28]
push 0
lea eax, [ebp - 0x2c]
push eax
push ecx
push 2
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x60], ecx
cmp eax, ecx
je 0x436739
nop dword [eax]
mov al, byte [eax]
mov byte [ebp - 0x55], al
mov byte [ebp - 4], 6
call fcn.00410080
mov ecx, eax
test ecx, ecx
je 0x43689d
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1c], eax
movzx eax, byte [ebp - 0x55]
push eax
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 7
push str._02X
push eax
call fcn.00431d90
mov eax, dword [ebp - 0x1c]
add esp, 0xc
mov edx, eax
lea ecx, [edx + 2]
mov dword [ebp - 0x64], ecx
nop word [eax + eax]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x4366f0
sub edx, dword [ebp - 0x64]
lea ecx, [ebp - 0x48]
sar edx, 1
push edx
push eax
call fcn.0040e5d0
mov byte [ebp - 4], 5
or eax, 0xffffffff
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x436729
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp eax, dword [ebp - 0x60]
jne 0x4366a0
mov ecx, dword [ebp - 0x54]
lea eax, [ebp - 0x48]
push eax
call fcn.00408df0
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x43678e
mov edx, dword [ebp - 0x20]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x43676f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x436898
push edx
push ecx
call fcn.004d24a7
add esp, 8
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x43679c
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4367ac
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push esi
call edi
lea ecx, [ebp - 0x48]
call fcn.00409020
mov eax, dword [ebp - 0x54]
jmp 0x43687d
mov eax, dword [ebp - 0x54]
movups xmm0, xmmword [ebp - 0x48]
mov dword [eax], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x38]
movq qword [eax + 0x10], xmm0
xor eax, eax
mov word [ebp - 0x48], ax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 7
test edi, edi
je 0x43681a
cmp edi, 0xffffffff
je 0x43681a
push edi
call eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call eax
lea ecx, [ebp - 0x48]
call fcn.00409020
mov eax, dword [ebp - 0x54]
jmp 0x43687d
movups xmm0, xmmword [ebp - 0x48]
mov dword [edi], 0
xor eax, eax
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov word [ebp - 0x48], ax
movups xmmword [edi], xmm0
movq xmm0, qword [ebp - 0x38]
movq qword [edi + 0x10], xmm0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 7
cmp esi, 0xffffffff
je 0x436873
test esi, esi
je 0x436873
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x48]
call fcn.00409020
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d2a60
mov esp, ebp
pop ebp
ret
call fcn.004e0791
push 0x80004005
call fcn.0040fbc0
int3