Function at 0x13fb81210
Capabilities:
Check os version
Connect to wmi namespace via wbemlocator
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push rbp
push rbx
push rdi
push r13
push r15
lea rbp, [rsp - 0x230]
sub rsp, 0x330
mov rax, qword [0x13fb933b8]
xor rax, rsp
mov qword [rbp + 0x220], rax
xor edi, edi
mov dword [rsp + 0x78], edx
cmp dword [0x13fb93418], edi
mov r13, rcx
mov qword [rbp - 0x80], rcx
jne 0x13fb812e5
xor edx, edx
lea rcx, [rbp - 0x6c]
mov r8d, 0x110
mov ebx, edi
call sub.vcruntime140.dll_memset
lea rcx, [rbp - 0x70]
mov dword [rbp - 0x70], 0x114
call qword [sym.imp.kernel32.dll_GetVersionExW]
mov r9d, dword [rbp - 0x60]
lea rcx, [0x13fb88728]
mov r8d, dword [rbp - 0x68]
mov edx, dword [rbp - 0x6c]
call fcn.13fb82590
cmp dword [rbp - 0x60], 2
jne 0x13fb812bb
cmp dword [rbp - 0x6c], 0xa
jne 0x13fb812ae
cmp dword [rbp - 0x68], ebx
jne 0x13fb812ae
lea rcx, [0x13fb88750]
call fcn.13fb82590
mov ebx, 5
mov eax, dword [rbp - 0x64]
mov dword [0x13fb9341c], eax
test ebx, ebx
jne 0x13fb812c7
lea rcx, [0x13fb88778]
call fcn.13fb82590
lea rcx, [0x13fb88794]
call fcn.13fb82590
mov dword [0x13fb93418], ebx
test ebx, ebx
jne 0x13fb812e5
lea eax, [rbx - 0x65]
jmp 0x13fb81db7
mov ecx, pe_nt_image_headers64
mov qword [rsp + 0x368], rsi
mov dword [rsp + 0x50], edi
mov dword [rsp + 0x54], pe_nt_image_headers64
call sub.ucrtbase.dll_malloc
xor edx, edx
mov qword [rsp + 0x58], rax
xor ecx, ecx
mov byte [rax], dil
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov ebx, 1
test eax, eax
jns 0x13fb81336
cmp eax, 0x80010106
je 0x13fb81331
lea edx, [rbx + 0x64]
lea r15d, [rbx - 0x66]
jmp 0x13fb81452
movzx eax, di
jmp 0x13fb81338
mov eax, ebx
cmp word [0x13fb93404], di
mov rsi, 0xffffffffffffffff
mov word [0x13fb93400], ax
jne 0x13fb81390
mov qword [rsp + 0x40], rdi
xor r9d, r9d
mov dword [rsp + 0x38], edi
xor r8d, r8d
mov qword [rsp + 0x30], rdi
mov edx, esi
mov dword [rsp + 0x28], 3
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jns 0x13fb81389
lea edx, [rsi + 0x67]
lea r15d, [rsi - 0x65]
jmp 0x13fb81452
mov word [0x13fb93404], bx
lea rax, [0x13fb93410]
mov r8d, ebx
lea r9, [0x13fb90118]
mov qword [rsp + 0x20], rax
xor edx, edx
lea rcx, [0x13fb90108]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x13fb813c9
mov edx, 0x67
mov r15d, 0xffffff99
jmp 0x13fb81452
mov rcx, qword [0x13fb93410]
lea rdx, [0x13fb93408]
mov qword [rsp + 0x40], rdx
xor r9d, r9d
mov qword [rsp + 0x38], rdi
lea rdx, [0x13fb88508]
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov rax, qword [rcx]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call qword [rax + 0x18]
test eax, eax
jns 0x13fb81413
mov edx, 0x68
mov r15d, 0xffffff98
jmp 0x13fb81452
mov rcx, qword [0x13fb93408]
xor r9d, r9d
mov dword [rsp + 0x38], edi
xor r8d, r8d
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 3
lea edx, [r9 + 0xa]
mov dword [rsp + 0x20], 3
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x13fb81472
mov edx, 0x69
mov r15d, 0xffffff97
mov r8d, eax
lea rcx, [0x13fb884e8]
call fcn.13fb82590
lea rcx, [0x13fb88598]
call fcn.13fb82590
jmp 0x13fb81dac
mov qword [rsp + 0x370], r12
lea r9, [rbp + 0xd0]
mov qword [rsp + 0x378], r14
lea r8, [0x13fb885b8]
lea r10, [0x13fb885d0]
nop word [rax + rax]
movsx eax, byte [r8]
inc r8
mov edx, eax
lea ecx, [rax - 0x61]
cmp ecx, 0x19
ja 0x13fb814be
add eax, 0xd
cmp edx, 0x6d
jle 0x13fb814eb
lea eax, [rdx - 0xd]
jmp 0x13fb814eb
lea ecx, [rax - 0x41]
cmp ecx, 0x19
ja 0x13fb814d3
add eax, 0xd
cmp edx, 0x4d
jle 0x13fb814eb
lea eax, [rdx - 0xd]
jmp 0x13fb814eb
lea ecx, [rax - 0x20]
cmp ecx, 0x1e
ja 0x13fb814e0
sub eax, 0x1f
jmp 0x13fb814eb
lea ecx, [rax - 1]
cmp ecx, 0x1e
ja 0x13fb814eb
add eax, 0x1f
mov byte [r9], al
inc r9
cmp r8, r10
jb 0x13fb814a0
lea rax, [rbp + 0x120]
lea r9, [0x13fb885d0]
mov qword [rsp + 0x20], rax
lea r8, [0x13fb885e0]
lea rdx, [rbp + 0xd0]
lea rcx, [rsp + 0x50]
call fcn.13fb82680
test eax, eax
jle 0x13fb8155b
mov r15, qword [rsp + 0x58]
test r15, r15
je 0x13fb81556
movsxd rbx, dword [rsp + 0x50]
lea eax, [rbx + 1]
movsxd rcx, eax
call sub.ucrtbase.dll_malloc
mov r8, rbx
mov rdx, r15
mov rcx, rax
mov r14, rax
call sub.ucrtbase.dll_strncpy
mov byte [r14 + rbx], dil
jmp 0x13fb815cb
mov r14, rdi
jmp 0x13fb815cb
lea rcx, [0x13fb885f0]
call sub.ucrtbase.dll__mbsdup
mov r14, rax
test rax, rax
je 0x13fb815cb
mov rbx, rsi
inc rbx
cmp byte [rax + rbx], dil
jne 0x13fb81572
movsxd r15, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x54]
lea r13d, [rbx + r15]
lea eax, [r13 + 1]
cmp eax, ecx
jle 0x13fb815ae
add ecx, 0x100
mov dword [rsp + 0x54], ecx
movsxd rdx, ecx
mov rcx, qword [rsp + 0x58]
call sub.ucrtbase.dll_realloc
mov qword [rsp + 0x58], rax
jmp 0x13fb815b3
mov rax, qword [rsp + 0x58]
movsxd r8, ebx
lea rcx, [rax + r15]
mov rdx, r14
call sub.ucrtbase.dll_strncat
mov dword [rsp + 0x50], r13d
mov r13, qword [rbp - 0x80]
lea rax, [rbp + 0x120]
lea r9, [0x13fb885d0]
mov qword [rsp + 0x20], rax
lea r8, [0x13fb885fc]
lea rdx, [rbp + 0xd0]
lea rcx, [rsp + 0x50]
call fcn.13fb82680
test eax, eax
jle 0x13fb81630
movsxd rcx, dword [rsp + 0x50]
call sub.ucrtbase.dll_malloc
mov r12, rax
inc rsi
cmp byte [r14 + rsi], dil
jne 0x13fb81607
mov rcx, qword [rsp + 0x58]
mov rdx, rax
add rcx, rsi
sub rdx, rcx
nop
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x13fb81620
jmp 0x13fb81699
lea rcx, [0x13fb885f0]
call sub.ucrtbase.dll__mbsdup
mov r12, rax
test rax, rax
je 0x13fb81699
inc rsi
cmp byte [rax + rsi], dil
jne 0x13fb81644
movsxd rbx, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x54]
lea r15d, [rsi + rbx]
lea eax, [r15 + 1]
cmp eax, ecx
jle 0x13fb81680
add ecx, 0x100
mov dword [rsp + 0x54], ecx
movsxd rdx, ecx
mov rcx, qword [rsp + 0x58]
call sub.ucrtbase.dll_realloc
mov qword [rsp + 0x58], rax
jmp 0x13fb81685
mov rax, qword [rsp + 0x58]
movsxd r8, esi
lea rcx, [rax + rbx]
mov rdx, r12
call sub.ucrtbase.dll_strncat
mov dword [rsp + 0x50], r15d
lea rax, [rbp + 0x120]
lea r9, [0x13fb88608]
mov qword [rsp + 0x20], rax
lea r8, [0x13fb88614]
lea rdx, [rbp + 0xd0]
lea rcx, [rsp + 0x50]
call fcn.13fb82680
lea rax, [rbp + 0x120]
lea r9, [0x13fb88608]
mov qword [rsp + 0x20], rax
lea r8, [0x13fb88620]
lea rdx, [rbp + 0xd0]
lea rcx, [rsp + 0x50]
call fcn.13fb82680
lea rax, [rbp + 0x120]
lea r9, [0x13fb88608]
mov qword [rsp + 0x20], rax
lea r8, [0x13fb88630]
lea rdx, [rbp + 0xd0]
lea rcx, [rsp + 0x50]
call fcn.13fb82680
lea rax, [rbp + 0x120]
lea r9, [0x13fb88640]
mov qword [rsp + 0x20], rax
lea r8, [0x13fb88658]
lea rdx, [rbp + 0xd0]
lea rcx, [rsp + 0x50]
call fcn.13fb82680
mov ebx, eax
lea r9, [0x13fb8866c]
lea rax, [rbp + 0x120]
lea r8, [0x13fb88678]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0xd0]
lea rcx, [rsp + 0x50]
call fcn.13fb82680
add ebx, eax
lea r9, [0x13fb88688]
lea rax, [rbp + 0x120]
lea r8, [0x13fb88678]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0xd0]
lea rcx, [rsp + 0x50]
call fcn.13fb82680
add ebx, eax
lea r9, [0x13fb88688]
lea rax, [rbp + 0x120]
lea r8, [0x13fb88698]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0xd0]
lea rcx, [rsp + 0x50]
call fcn.13fb82680
lea rax, [rbp + 0x120]
lea r9, [0x13fb886a0]
mov qword [rsp + 0x20], rax
lea r8, [0x13fb885e0]
lea rdx, [rbp + 0xd0]
lea rcx, [rsp + 0x50]
call fcn.13fb82680
lea rax, [rbp + 0x120]
lea r9, [0x13fb886a0]
mov qword [rsp + 0x20], rax
lea r8, [0x13fb886b0]
lea rdx, [rbp + 0xd0]
lea rcx, [rsp + 0x50]
call fcn.13fb82680
lea rax, [rbp + 0x120]
lea r9, [0x13fb886a0]
mov qword [rsp + 0x20], rax
lea r8, [0x13fb88678]
lea rdx, [rbp + 0xd0]
lea rcx, [rsp + 0x50]
call fcn.13fb82680
lea rax, [rbp + 0x120]
lea r9, [0x13fb886c0]
mov qword [rsp + 0x20], rax
lea r8, [0x13fb885fc]
lea rdx, [rbp + 0xd0]
lea rcx, [rsp + 0x50]
call fcn.13fb82680
lea rax, [rbp + 0x120]
lea r9, [0x13fb886c0]
mov qword [rsp + 0x20], rax
lea r8, [0x13fb88678]
lea rdx, [rbp + 0xd0]
lea rcx, [rsp + 0x50]
call fcn.13fb82680
mov rcx, qword [0x13fb93408]
mov esi, eax
test rcx, rcx
je 0x13fb818be
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov qword [0x13fb93408], rdi
mov rcx, qword [0x13fb93410]
test rcx, rcx
je 0x13fb818d7
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x13fb93410], rdi
cmp word [0x13fb93400], di
je 0x13fb818ed
call qword [sym.imp.ole32.dll_CoUninitialize]
mov word [0x13fb93400], di
test ebx, ebx
jg 0x13fb818fe
test esi, esi
jne 0x13fb818fe
lea r15d, [rsi - 0x64]
jmp 0x13fb81d70
mov r15d, dword [rsp + 0x50]
test r15d, r15d
jle 0x13fb81d5e
movups xmm0, xmmword [0x13fb88540]
movzx eax, byte [0x13fb88550]
mov ecx, 0x24
mov qword [rsp + 0x68], rdi
movups xmmword [rbp + 0xb0], xmm0
mov byte [rbp + 0xc0], al
call sub.ucrtbase.dll_malloc
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
lea rcx, [rsp + 0x70]
xor edx, edx
mov rbx, rax
call qword [sym.imp.advapi32.dll_CryptAcquireContextW]
mov rsi, qword [rsp + 0x58]
test eax, eax
jne 0x13fb8197c
call qword [sym.imp.kernel32.dll_GetLastError]
mov edx, eax
lea rcx, [0x13fb88558]
call fcn.13fb82590
mov rbx, rdi
jmp 0x13fb81ab0
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x8003
call qword [sym.imp.advapi32.dll_CryptCreateHash]
test eax, eax
jne 0x13fb819c9
call qword [sym.imp.kernel32.dll_GetLastError]
mov edx, eax
lea rcx, [0x13fb88558]
call fcn.13fb82590
mov rcx, qword [rsp + 0x70]
xor edx, edx
call qword [sym.imp.advapi32.dll_CryptReleaseContext]
mov rbx, rdi
jmp 0x13fb81ab0
mov rcx, qword [rsp + 0x68]
xor r9d, r9d
mov r8d, r15d
mov rdx, rsi
call qword [sym.imp.advapi32.dll_CryptHashData]
test eax, eax
jne 0x13fb81a15
call qword [sym.imp.kernel32.dll_GetLastError]
mov edx, eax
lea rcx, [0x13fb88578]
call fcn.13fb82590
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.advapi32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x70]
xor edx, edx
call qword [sym.imp.advapi32.dll_CryptReleaseContext]
mov rbx, rdi
jmp 0x13fb81ab0
mov rcx, qword [rsp + 0x68]
lea r9, [rsp + 0x60]
lea r8, [rbp + 0x110]
mov dword [rsp + 0x60], 0x10
mov edx, 2
mov dword [rsp + 0x20], edi
call qword [sym.imp.advapi32.dll_CryptGetHashParam]
test eax, eax
je 0x13fb81a94
mov r8d, edi
mov r9d, edi
cmp dword [rsp + 0x60], edi
jbe 0x13fb81a94
nop dword [rax]
mov eax, r9d
lea rdx, [rbp + 0x110]
add rdx, rax
mov ecx, r8d
inc r8d
inc r9d
movzx eax, byte [rdx]
shr rax, 4
movzx eax, byte [rbp + rax + 0xb0]
mov byte [rcx + rbx], al
movzx eax, byte [rdx]
and eax, 0xf
movzx eax, byte [rbp + rax + 0xb0]
mov byte [r8 + rbx], al
inc r8d
cmp r9d, dword [rsp + 0x60]
jb 0x13fb81a50
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.advapi32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x70]
xor edx, edx
call qword [sym.imp.advapi32.dll_CryptReleaseContext]
mov byte [rbx + 0x20], dil
test rbx, rbx
mov qword [r13], rbx
mov r15d, 0xffffff9b
cmovne r15d, edi
je 0x13fb81d75
cmp dword [rsp + 0x78], edi
je 0x13fb81d75
mov r8d, dword [0x13fb9341c]
lea rdx, [0x13fb88718]
lea rcx, [rbp + 0x120]
call fcn.13fb829d0
test rsi, rsi
je 0x13fb81af8
mov rcx, rsi
call sub.ucrtbase.dll_free
mov ecx, pe_nt_image_headers64
mov dword [rsp + 0x50], edi
mov dword [rsp + 0x54], pe_nt_image_headers64
call sub.ucrtbase.dll_malloc
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov byte [rax], dil
mov rdx, qword [r13]
call fcn.13fb810b0
movsxd rbx, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x54]
lea esi, [rbx + 1]
lea eax, [rsi + 1]
cmp eax, ecx
jle 0x13fb81b55
add ecx, 0x100
mov dword [rsp + 0x54], ecx
movsxd rdx, ecx
mov rcx, qword [rsp + 0x58]
call sub.ucrtbase.dll_realloc
mov qword [rsp + 0x58], rax
jmp 0x13fb81b5a
mov rax, qword [rsp + 0x58]
lea rcx, [rax + rbx]
mov r8d, 1
lea rdx, [0x13fb88720]
call sub.ucrtbase.dll_strncat
mov rdx, r14
mov dword [rsp + 0x50], esi
lea rcx, [rsp + 0x50]
call section.sect_0
movsxd rbx, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x54]
lea esi, [rbx + 1]
lea eax, [rsi + 1]
cmp eax, ecx
jle 0x13fb81bb2
add ecx, 0x100
mov dword [rsp + 0x54], ecx
movsxd rdx, ecx
mov rcx, qword [rsp + 0x58]
call sub.ucrtbase.dll_realloc
mov qword [rsp + 0x58], rax
jmp 0x13fb81bb7
mov rax, qword [rsp + 0x58]
lea rcx, [rax + rbx]
mov r8d, 1
lea rdx, [0x13fb88720]
call sub.ucrtbase.dll_strncat
mov rdx, r12
mov dword [rsp + 0x50], esi
lea rcx, [rsp + 0x50]
call section.sect_0
movsxd rbx, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x54]
lea esi, [rbx + 3]
lea eax, [rsi + 1]
cmp eax, ecx
jle 0x13fb81c0f
add ecx, 0x100
mov dword [rsp + 0x54], ecx
movsxd rdx, ecx
mov rcx, qword [rsp + 0x58]
call sub.ucrtbase.dll_realloc
mov qword [rsp + 0x58], rax
jmp 0x13fb81c14
mov rax, qword [rsp + 0x58]
lea rcx, [rax + rbx]
mov r8d, 3
lea rdx, [0x13fb88724]
call sub.ucrtbase.dll_strncat
lea rdx, [rbp + 0x120]
mov dword [rsp + 0x50], esi
lea rcx, [rsp + 0x50]
call fcn.13fb810b0
mov r13d, dword [rsp + 0x50]
mov ebx, dword [rsp + 0x54]
inc r13d
lea eax, [r13 + 1]
cmp eax, ebx
jle 0x13fb81c6b
mov rcx, qword [rsp + 0x58]
add ebx, 0x100
movsxd rdx, ebx
call sub.ucrtbase.dll_realloc
mov rsi, rax
jmp 0x13fb81c70
mov rsi, qword [rsp + 0x58]
movsxd rcx, dword [rsp + 0x50]
lea rdx, [0x13fb88720]
add rcx, rsi
mov r8d, 1
call sub.ucrtbase.dll_strncat
lea eax, [r13 + 4]
cmp eax, ebx
jle 0x13fb81ca6
lea eax, [rbx + 0x100]
mov rcx, rsi
movsxd rdx, eax
call sub.ucrtbase.dll_realloc
mov rsi, rax
movsxd r10, r13d
mov r8, rsi
mov edx, edi
mov byte [r10 + rsi], dil
test rsi, rsi
je 0x13fb81ceb
movzx eax, byte [rsi]
mov r9d, edi
test al, al
je 0x13fb81ceb
mov ecx, r9d
and ecx, 0x80000007
jge 0x13fb81cd3
dec ecx
or ecx, 0xfffffff8
inc ecx
inc ecx
movsx eax, al
imul ecx, eax
inc r8
inc r9d
movzx eax, byte [r8]
add edx, ecx
test al, al
jne 0x13fb81cc1
and edx, 0x8000000f
jge 0x13fb81cfa
dec edx
or edx, 0xfffffff0
inc edx
test edx, edx
js 0x13fb81d12
cmp edx, 0xa
jge 0x13fb81d08
add dl, 0x30
jmp 0x13fb81d14
cmp edx, 0x10
jge 0x13fb81d12
add dl, 0x57
jmp 0x13fb81d14
mov dl, 0x58
mov rcx, qword [rbp - 0x80]
inc r13d
mov byte [r10 + rsi], dl
mov byte [r10 + rsi + 1], dil
mov rcx, qword [rcx]
call sub.ucrtbase.dll_free
test rsi, rsi
je 0x13fb81d55
lea eax, [r13 + 1]
movsxd rcx, eax
call sub.ucrtbase.dll_malloc
movsxd rbx, r13d
mov rdx, rsi
mov r8, rbx
mov rcx, rax
mov rdi, rax
call sub.ucrtbase.dll_strncpy
mov byte [rbx + rdi], 0
mov rax, qword [rbp - 0x80]
mov qword [rax], rdi
jmp 0x13fb81d75
lea rcx, [0x13fb886e0]
call fcn.13fb82590
mov r15d, 0xffffff9d
mov rsi, qword [rsp + 0x58]
test rsi, rsi
je 0x13fb81d82
mov rcx, rsi
call sub.ucrtbase.dll_free
test r14, r14
je 0x13fb81d8f
mov rcx, r14
call sub.ucrtbase.dll_free
mov r14, qword [rsp + 0x378]
test r12, r12
je 0x13fb81da4
mov rcx, r12
call sub.ucrtbase.dll_free
mov r12, qword [rsp + 0x370]
mov rsi, qword [rsp + 0x368]
mov eax, r15d
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.13fb87030
add rsp, 0x330
pop r15
pop r13
pop rdi
pop rbx
pop rbp
ret