Hi Maarten,
+    if (pbHash && *pcbHash < 20)
+    {
+        SetLastError(ERROR_INSUFFICIENT_BUFFER);
+        return FALSE;
+    }
That's not correct, *pcbHash must be set to 20 if it's too small.
+        while (ReadFile(hFile, tempbuffer, TEMP_BLOCK_SIZE,
&readbytes, NULL) && readbytes)
+            CryptHashData(hash, tempbuffer, readbytes, 0);
You return TRUE if ReadFile fails, which is unlikely to be correct.
Thanks,
--Juan