Function at 0x1400a26b0
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push rdi
push rbx
sub rsp, 0x158
xor eax, eax
mov ecx, 0x11
mov rbx, qword [sym.imp.kernel32.dll_VerSetConditionMask]
mov r8d, 3
mov edx, 2
mov qword [rsp + 0x4c], 0
lea rdi, [rsp + 0x50]
mov qword [rsp + 0xd4], 0
rep stosq qword [rdi], rax
mov rax, qword [0x140193938]
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x40], rax
mov eax, 1
mov word [rsp + 0xd4], ax
call rbx
mov r8d, 3
mov edx, 1
mov rcx, rax
call rbx
mov r8d, 3
mov edx, 0x20
mov rcx, rax
call rbx
mov r8d, 3
mov edx, 0x10
mov rcx, rax
call rbx
lea rbx, [rsp + 0x40]
mov edx, 0x33
mov r8, rax
mov rcx, rbx
call qword [sym.imp.kernel32.dll_VerifyVersionInfoA]
test eax, eax
je 0x1400a2a30
mov edx, 0x104
mov rcx, rbx
call qword [sym.imp.kernel32.dll_GetSystemDirectoryA]
mov rdx, rbx
lea rcx, [rsp + 0x144]
sub eax, 1
cmp eax, 0x103
jbe 0x1400a279d
jmp 0x1400a2a14
add rdx, 1
cmp rdx, rcx
je 0x1400a2a14
cmp byte [rdx], 0
jne 0x1400a2790
mov r8, rcx
sub r8, rdx
je 0x1400a2a14
sub rdx, rcx
lea rax, [rbx + rdx + 0x104]
lea rdx, [0x1401935d0]
jmp 0x1400a27de
add rax, 1
add rdx, 1
mov byte [rax - 1], r9b
sub r8, 1
je 0x1400a2a10
movzx r9d, byte [rdx]
test r9b, r9b
jne 0x1400a27c8
mov byte [rax], 0
mov rax, rbx
jmp 0x1400a27fd
add rax, 1
cmp rax, rcx
je 0x1400a2a14
cmp byte [rax], 0
jne 0x1400a27f0
mov r8, rcx
sub r8, rax
je 0x1400a2a14
sub rax, rcx
lea rdx, str.bcrypt.dll
lea rax, [rbx + rax + 0x104]
jmp 0x1400a283d
add rax, 1
add rdx, 1
mov byte [rax - 1], cl
sub r8, 1
je 0x1400a2a10
movzx ecx, byte [rdx]
test cl, cl
jne 0x1400a2828
mov rcx, rbx
mov byte [rax], 0
call qword [sym.imp.kernel32.dll_LoadLibraryA]
mov qword [0x1401760a8], rax
mov rcx, rax
test rax, rax
je 0x1400a2a14
mov rbx, qword [sym.imp.kernel32.dll_GetProcAddress]
lea rdx, str.BCryptOpenAlgorithmProvider
call rbx
mov qword [0x1401760b0], rax
test rax, rax
je 0x1400a2a43
mov rcx, qword [0x1401760a8]
lea rdx, str.BCryptGetProperty
call rbx
mov qword [0x1401760b8], rax
test rax, rax
je 0x1400a2a43
mov rcx, qword [0x1401760a8]
lea rdx, str.BCryptCreateHash
call rbx
mov qword [0x1401760c0], rax
test rax, rax
je 0x1400a2a43
mov rcx, qword [0x1401760a8]
lea rdx, str.BCryptFinishHash
call rbx
mov qword [0x1401760c8], rax
test rax, rax
je 0x1400a2a43
mov rcx, qword [0x1401760a8]
lea rdx, str.BCryptHashData
call rbx
mov qword [0x1401760d0], rax
test rax, rax
je 0x1400a2a43
mov rcx, qword [0x1401760a8]
lea rdx, str.BCryptDestroyHash
call rbx
mov qword [0x1401760d8], rax
test rax, rax
je 0x1400a2a43
mov rcx, qword [0x1401760a8]
lea rdx, str.BCryptCloseAlgorithmProvider
call rbx
mov qword [0x1401760e0], rax
test rax, rax
je 0x1400a2a43
xor r8d, r8d
mov r9d, 0x20
lea rdx, [0x1401936f2]
lea rcx, [0x1401760e8]
call qword [0x1401760b0]
test eax, eax
js 0x1400a2a63
lea rdi, [rsp + 0x3c]
lea rbx, [0x14019372c]
mov dword [rsp + 0x28], 0
mov rcx, qword [0x1401760e8]
mov qword [rsp + 0x20], rdi
mov r9d, 4
lea r8, [0x1401760f0]
mov rdx, rbx
call qword [0x1401760b8]
test eax, eax
js 0x1400a2a63
xor r8d, r8d
mov r9d, 0x20
lea rdx, [0x140193746]
lea rcx, [0x1401760f8]
call qword [0x1401760b0]
test eax, eax
js 0x1400a2a63
mov qword [rsp + 0x20], rdi
mov rcx, qword [0x1401760f8]
mov r9d, 4
mov rdx, rbx
mov dword [rsp + 0x28], 0
lea r8, [0x140176100]
call qword [0x1401760b8]
test eax, eax
js 0x1400a2a63
mov dword [0x1401760a0], 2
xor eax, eax
add rsp, 0x158
pop rbx
pop rdi
ret
mov byte [rax - 1], 0
lea rdx, str.CryptoNG_library_could_not_be_loaded
mov ecx, 0x21
call fcn.1400da2e0
nop dword [rax]
mov eax, 0xffffffff
jmp 0x1400a2a05
lea rdx, str.CryptoNG_is_not_supported_on_this_platform
mov ecx, 0x21
call fcn.1400da2e0
jmp 0x1400a2a28
mov rcx, qword [0x1401760a8]
call qword [sym.imp.kernel32.dll_FreeLibrary]
lea rdx, str.CryptoNG_functions_could_not_be_loaded
mov ecx, 2
call fcn.1400da2e0
jmp 0x1400a2a28
mov ecx, 2
lea rdx, str.algorithm_provider_could_not_be_initialized
call fcn.1400da2e0
mov rcx, qword [0x1401760e8]
test rcx, rcx
je 0x1400a2a88
xor edx, edx
call qword [0x1401760e0]
mov rcx, qword [0x1401760f8]
test rcx, rcx
je 0x1400a2a9c
xor edx, edx
call qword [0x1401760e0]
mov rcx, qword [0x1401760a8]
test rcx, rcx
je 0x1400a2a28
call qword [sym.imp.kernel32.dll_FreeLibrary]
jmp 0x1400a2a28