Function at 0x1400a5a30
Capabilities:
Authenticate hmac
Get common file path

Disassembly:
xchg rsp, r11
mov rsp, r11
xchg rsp, r11
nop
mov qword [rsp - 8], rbp
sub rsp, 8
jmp 0x1400a5a91
add edx, 0x366f730
add edx, 0x10b1603c
xor edx, 0x2529421c
xor edx, 0x689dc19b
jmp 0x1400a5b8d
nop dword [rax + rax]
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
mov r15, r15
jne 0x1400a5a6a
jmp 0x1400a5b11
xor rax, rsp
xchg rsp, rax
mov qword [rbp + 0x3c0], rsp
jmp 0x1400a5bad
lea rbp, [r11 - 0x3f8]
mov dword [rsp - 0x34], 0x7becb080
add rsp, 0x329e24a4
sub rsp, 0x329e2994
mov rax, qword [0x1402567f0]
mov rbx, rbx
jmp 0x1400a5a80
mov qword [r11 - 0x20], rdi
xchg r15, r15
lea rcx, [rbp + 0x120]
xchg r10, r14
mov qword [r11 - 0x28], r10
jmp 0x1400a5b5b
mov dword [rbp - 0x24], eax
dec rcx
movzx eax, byte [0x14011e30c]
mov dword [rsp - 0x28], esp
mov byte [rbp - 0x20], al
jmp 0x1400a5a65
mov dword [rsp - 0x24], 0x153c1eaf
lea rdx, [rdx + 1]
test al, al
jne 0x1400a5b2a
mov dword [rsp - 0x28], 0x1c4faf19
jmp 0x1400a5bff
lea r8, [rbp + 0x120]
xor edx, edx
mov rsi, rsi
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
jmp 0x1400a5af0
xor r14d, r14d
movzx eax, r8b
mov dword [rsp - 0x1c], 0x7f45beec
mov dword [rsp + 0x48], r14d
mov edx, 0x25cbf6b9
xor edx, 0x289028f3
jmp 0x1400a5a48
xchg r14, r10
xchg rdx, r10
mov rdi, r10
xchg rdx, r10
jmp 0x1400a5b37
mov dword [rsp - 0x1c], 0x171ec69
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, dword [0x14011e308]
lea rcx, [rbp - 0x24]
mov dword [rsp - 0x1c], edi
jmp 0x1400a5ad7
sub edx, 0x6cc0b5b1
mov dword [rsp + 0x54], eax
mov r12, r12
mov dword [rsp + 0x50], r9d
test r8b, r8b
je 0x1400a5bcc
jmp 0x1400a5b6c
xchg rsp, rax
xchg rsi, rdx
mov qword [r11 - 0x18], rdx
xchg rsi, rdx
jmp 0x1400a5bbe
xchg rsi, rcx
mov rcx, rsi
xchg rcx, rsi
jmp 0x1400a5abd
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryA]
mov eax, dword [0x14011e308]
lea rcx, [rbp - 0x24]
jmp 0x1400a5c82
movzx eax, word [0x14011e310]
mov r11, r11
mov word [rcx], ax
mov eax, dword [rbp + 0x438]
cmp eax, 0xffffffff
jmp 0x1400a5c52
xchg rdi, rdi
lea rcx, [rbp - 0x24]
dec rcx
jmp 0x1400a5c0b
nop word [rax + rax]
mov dword [rsp - 0x28], ecx
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x1400a5c18
jmp 0x1400a5be1
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov rcx, rcx
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1400a5c36
jmp 0x1400a5bfc
mov rdx, rdx
je 0x1400a5ca7
mov dword [rbp + 0xd0], eax
jmp 0x1400a5fea
lea rcx, [rcx + 1]
jne 0x1400a5c9e
lea r8, [rbp + 0x120]
mov dword [rsp - 0x1c], esi
xor edx, edx
jmp 0x1400a5c2b
mov dword [rsp - 0x3c], 0x1fb29891
mov dword [rbp - 0x24], eax
dec rcx
movzx eax, byte [0x14011e30c]
mov byte [rbp - 0x20], al
mov dword [rsp - 0x10], edx
cmp byte [rcx + 1], r14b
jmp 0x1400a5c66
mov qword [rsp + 0x4e8], rbx
mov dword [rsp - 0x2c], esi
nop
movabs rbx, 0xffffffff151bbbf3
add rbx, 0x4e2ea41b
jmp 0x1400a5d3f
add edx, 0xae2830d
add edx, 0x248b458
add edx, 0x101eaff4
sub edx, 0x6b218c06
mov dword [rbp + 0x114], eax
jmp 0x1400a5f0e
jne 0x1400a603f
inc r8
lea rcx, [rsp + 0x58]
mov r15, r15
jmp 0x1400a5e9d
lea rdx, [rbp + 0x1a0]
mov ecx, 0x514461dc
add ecx, 0x1f72ef11
sub ecx, 0x6468c4
sub ecx, 0x2a69f872
jmp 0x1400a614c
add rdx, 0xb685132
mov r9d, 0x9c8708
add r9d, 0x3848d90d
jmp 0x1400a5e6b
sub rbx, 0xc57a0ba
xor rbx, 0x6f6666d
sub rbx, 0x3229ca03
sub rbx, 0x183e552a
add rbx, 0x71181de9
jmp 0x1400a5ed3
call fcn.1400a3680
mov dword [rsp - 0x28], esp
mov eax, dword [0x140258c30]
lea rcx, [rbp + 0xd4]
jmp 0x1400a605c
xor rdx, 0x61b852ad
sub rdx, 0x3f6a9d1b
xor rdx, 0x7a7846ce
sub rdx, 0x26c0aa5a
add rdx, 0x7fffffff
jmp 0x1400a5d26
lea rdx, [rbp + 0xcc]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
movsxd rax, dword [rbp + 0x428]
mov dword [rsp - 0x14], 0x6ab811f6
jmp 0x1400a5d03
add edx, 0x5268ae63
mov dword [rsp + 0x28], r14d
mov rbp, rbp
xchg r14, r9
mov qword [rsp + 0x20], r9
jmp 0x1400a604e
call fcn.1400b0370
mov eax, dword [str.n_f_vi]
xchg r8, r8
lea r8, [rbp + 0x2b3]
mov dword [rsp + 0x40], eax
lea rdx, [rsp + 0x40]
jmp 0x1400a610c
mov qword [rsp + 0x30], r9
xchg r9, rdx
mov edx, 0x37bcb661
jmp 0x1400a5e1b
add edx, 0x45c72965
sub edx, 0x1fdb3f3e
xor edx, 0xd040624
add edx, 0x218a74c9
sub edx, 0x49e05d8
jmp 0x1400a5dcb
sub dword [rbp + 0xd0], 0x3997337
add dword [rbp + 0xd0], 0x31eb9188
xor dword [rbp + 0xd0], 0x65596996
xor dword [rbp + 0xd0], 0xc0e70b22
jmp 0x1400a5fea
xor r9d, 0x3c7d0942
xor r9d, 0x7874c0ec
xor r9d, 0x4ef8c03e
add r9d, 0x383cc080
sub r9d, 0x642ecf0c
sub r9d, 0x6225931
xchg r12, rcx
jmp 0x1400a5ee9
xchg rsi, rdx
mov rsi, rdi
xchg rsi, rdx
jmp 0x1400a607e
sub byte [rbp + 0xc8], 0x4c
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
movzx ecx, byte [rbp + 0x1a0]
mov dword [rsp - 0x10], 0x17336c6f
lea rdx, [rbp + 0x2b0]
jmp 0x1400a6095
add rbx, 0x7fffffff
add rbx, 0x94b280b
mov r8, rbx
jmp 0x1400a6038
mov r12, qword [rax + 0x98]
xchg r12, rcx
mov rax, qword [0x1402595a0]
xor rax, rdx
mov dword [rsp - 0x2c], esp
lea rdx, [rsp + 0x48]
xchg r9, rdx
jmp 0x1400a5e09
call fcn.1400eb138
mov r11, r11
xchg r10, rdi
mov r10, qword [rsp + 0x4d8]
xchg rdi, r10
jmp 0x1400a5f71
xor byte [rsp + 0x40], 0x5c
xor byte [rsp + 0x40], 0x64
call fcn.14000ec30
lea r8, [0x140258c10]
xchg r15, r15
lea rdx, [0x14011e2f8]
lea rcx, [rbp + 0xd4]
jmp 0x1400a5d67
cmp byte [rdi + rbx], r14b
mov dword [rsp - 0x24], 0x2d4a30d8
jne 0x1400a608d
jmp 0x1400a60b5
jmp 0x1400a6182
test rax, rax
je 0x1400a5f81
mov word [rax], r14w
mov rbx, rbx
mov rax, qword [rsi + 0x30]
jmp 0x1400a5f8a
lea r8, [rsp + 0x50]
xchg r14, r8
mov qword [rsp + 0x38], r8
xchg r8, r14
movabs rdx, 0x9024ae7f13772043
jmp 0x1400a5d82
xchg rsi, rsi
xor byte [rsp + 0x44], 0x36
xor al, 0x38
xor byte [rsp + 0x45], 0x37
xchg rsp, rsp
mov byte [rsp + 0x46], al
jmp 0x1400a6129
mov r14, qword [rsp + 0x4d0]
mov rsi, qword [rsp + 0x4e0]
test eax, eax
mov r11, r11
jne 0x1400a617d
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400a5f6c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp - 0x28], ecx
mov ecx, eax
jmp 0x1400a5daa
xor r8d, 0x7135dd41
add r8d, 0x6ace2f79
sub r8d, 0x733e6b69
jmp 0x1400a5de6
mov dword [rsp - 0x14], 0x3e0bae29
xor byte [rsp + 0x42], 0x34
xor byte [rsp + 0x43], 0x35
mov word [rsp + 0x44], ax
movzx eax, byte [0x14011e306]
jmp 0x1400a5fa9
nop dword [rax]
inc r8
xchg r8, r8
cmp byte [rdi + r8], r14b
jmp 0x1400a5ced
xchg r14, r9
call rax
mov dword [rsp - 0x18], esp
jmp 0x1400a5fc4
mov edx, 0x7095fc55
xor edx, 0x798d1f49
xor edx, 0x115a541c
sub edx, 0xbf622a3
xor edx, 0x419b3086
jmp 0x1400a5cca
call fcn.1400f76c0
mov rdi, rdi
nop dword [rax]
inc rbx
jmp 0x1400a5f55
mov r8d, 0xcbfc31a
xor r8d, 0x3e32ded2
add r8d, 0x29ba09b3
add r8d, 0x1cfeba3a
jmp 0x1400a5ffb
mov dword [rbp - 0x28], ebx
mov rbx, qword [rsp + 0x4e8]
mov dword [rsp - 0x14], ecx
mov dword [rbp + 0xd0], 0x7ef6bdfb
sub dword [rbp + 0xd0], 0x53073f01
jmp 0x1400a5e3e
sub byte [rbp + 0xc8], 0x58
add byte [rbp + 0xc8], 1
add byte [rbp + 0xc8], 0x3b
xor byte [rbp + 0xc8], 0x36
sub byte [rbp + 0xc8], 0x16
sub byte [rbp + 0xc8], 3
jmp 0x1400a5eab
mov dword [rsp - 0x14], 0x74fca6c5
movzx eax, word [0x14011e304]
lea rcx, [rbp + 0x28]
xor byte [rsp + 0x41], 0x33
jmp 0x1400a6015
mov byte [rsp + 0x40], 0x67
sub byte [rsp + 0x40], 0x13
add byte [rsp + 0x40], 4
sub byte [rsp + 0x40], 0x37
add byte [rsp + 0x40], 0x20
add byte [rsp + 0x40], 0x23
jmp 0x1400a5f29
xor ecx, 0xbc6602a
add ecx, 0x2769f15
sub ecx, 0x50a52dae
mov qword [rbp + 0x20], rax
mov dword [rsp - 0x40], 0x31b32c97
mov byte [rbp + 0xc8], 0x52
add byte [rbp + 0xc8], 0x1a
jmp 0x1400a60dd
xor eax, eax
mov rsp, rsp
mov rcx, qword [rbp + 0x3c0]
jmp 0x1400a618e
xor rcx, rsp
call fcn.1400e9f70
sub rsp, 0xfffffffffffffb10
xchg rcx, rcx
nop
mov rbp, qword [rsp]
add rsp, 8
jmp 0x1400a61ae
ret