Function at 0x1400a5660
Capabilities:
Authenticate hmac
Get common file path

Disassembly:
xchg r12, rsp
mov r11, r12
xchg r12, rsp
nop
sub rsp, 8
mov qword [rsp], rbp
jmp 0x1400a575c
add edx, 0x5302af23
xor edx, 0x3d7ee866
xor edx, 0x66b11ec6
mov dword [rsp + 0x54], eax
mov dword [rsp - 0x38], 0x665186f
mov dword [rsp + 0x50], r9d
jmp 0x1400a56c0
lea rcx, [rbp - 0x24]
mov dword [rbp - 0x24], eax
mov dword [rsp - 0x30], 0x137ac223
dec rcx
movzx eax, byte [0x14011e30c]
mov byte [rbp - 0x20], al
jmp 0x1400a57ab
test r8b, r8b
je 0x1400a57e1
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xchg r8, r8
mov eax, dword [0x14011e308]
jmp 0x1400a569f
mov rdi, r13
xchg rdx, r13
xor r14d, r14d
xchg r10, r10
jmp 0x1400a5749
add edx, 0x2706cf79
xor edx, 0x7cb7d6e6
xor edx, 0x192705fe
jmp 0x1400a5677
nop word [rax + rax]
mov dword [rsp - 0x14], edi
movzx eax, byte [r8 + rdx]
jmp 0x1400a573b
lea rcx, [rcx + 1]
jne 0x1400a57b3
xchg r15, r15
lea r8, [rbp + 0x120]
xor edx, edx
nop dword [rax]
jmp 0x1400a5705
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jmp 0x1400a57ce
movzx eax, r8b
mov dword [rsp + 0x48], r14d
mov edx, 0x4656c66c
jmp 0x1400a56ee
lea rbp, [r11 - 0x3f8]
mov r9, r9
add rsp, 0xfffffffffffffb10
mov rax, qword [0x1402567f0]
xor rax, rsp
mov dword [rsp - 0x18], 0x18f4c945
mov qword [rbp + 0x3c0], rax
jmp 0x1400a57bc
mov rsi, rsp
xchg rcx, rsp
mov qword [r11 - 0x20], rdi
mov r11, r11
lea rcx, [rbp + 0x120]
mov qword [r11 - 0x28], r14
xchg r13, rdx
jmp 0x1400a56dd
mov r11, r11
nop dword [rax + rax]
cmp byte [rcx + 1], r14b
jmp 0x1400a571c
xchg rsi, rbp
mov qword [r11 - 0x18], rbp
xchg rbp, rsi
xchg rcx, rsp
jmp 0x1400a578b
mov dword [rsp - 0x18], 0x238e8b54
jne 0x1400a5712
jmp 0x1400a5827
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryA]
mov dword [rsp - 0x3c], 0x6464d483
mov eax, dword [0x14011e308]
lea rcx, [rbp - 0x24]
mov dword [rbp - 0x24], eax
mov r9, r9
dec rcx
jmp 0x1400a5862
movzx eax, byte [r8 + rdx]
mov r14, r14
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1400a5807
jmp 0x1400a5823
mov dword [rsp - 0x10], ecx
lea rcx, [rbp - 0x24]
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], r14b
mov dword [rsp - 0x3c], ebp
lea rcx, [rcx + 1]
jmp 0x1400a5875
mov eax, dword [rbp + 0x438]
cmp eax, 0xffffffff
je 0x1400a58cd
mov dword [rbp + 0xd0], eax
jmp 0x1400a58c0
movzx eax, byte [0x14011e30c]
mov byte [rbp - 0x20], al
cmp byte [rcx + 1], r14b
jmp 0x1400a5892
jne 0x1400a5837
movzx eax, word [0x14011e310]
mov word [rcx], ax
mov dword [rsp - 0x28], 0x8245e03
jmp 0x1400a5848
mov dword [rsp - 0x3c], 0x64663520
lea rcx, [rcx + 1]
jne 0x1400a586c
lea r8, [rbp + 0x120]
mov r10, r10
xor edx, edx
nop word [rax + rax]
jmp 0x1400a5807
mov dword [rsp - 0x34], 0x2016bf88
jmp 0x1400a5a64
mov qword [rsp + 0x4e8], rbx
nop
movabs rbx, 0xffffffff2da7a012
jmp 0x1400a5c71
mov r14, rbx
xchg r14, r8
nop dword [rax]
mov dword [rsp - 0x30], 0x9c1aa42
inc r8
cmp byte [rdi + r8], r14b
jmp 0x1400a5d1b
mov qword [rsp + 0x38], r12
xchg r12, r14
movabs rdx, 0x9024ae7f15305d74
add rdx, 0x59445615
xor rdx, 0x1b769475
xor rdx, 0x3b1e625c
xor rdx, 0x1d58b5d4
jmp 0x1400a59ec
xor ecx, 0x6b22e8e7
xchg r8, rax
mov qword [rbp + 0x20], r8
jmp 0x1400a5d3a
mov r11, r11
mov eax, dword [0x140258c30]
lea rcx, [rbp + 0xd4]
jmp 0x1400a5974
mov word [rax], r14w
mov rax, qword [rsi + 0x30]
lea r8, [rsp + 0x50]
xchg r14, r12
jmp 0x1400a5906
mov edx, 0x3c8e4034
xor edx, 0x51233c04
sub edx, 0x36b5dced
sub edx, 0x72ba5dd
sub edx, 0x154dc4f0
jmp 0x1400a5ae7
add ecx, 0x3c2d16c3
sub ecx, 0x3983ad67
xor ecx, 0x445eb8c0
jmp 0x1400a5939
mov byte [rsp + 0x40], reloc.WS2_32.dll_recv
add byte [rsp + 0x40], 0x3e
sub byte [rsp + 0x40], 0x14
xor byte [rsp + 0x40], 0x1b
add byte [rsp + 0x40], 0x2b
jmp 0x1400a5c14
mov r14, qword [rsp + 0x4d0]
mov rsi, qword [rsp + 0x4e0]
test eax, eax
mov dword [rsp - 0x38], ebp
jne 0x1400a5d8f
jmp 0x1400a5a4f
add rdx, 0x5a7f4980
mov r9d, 0x65fcae75
sub r9d, 0x562149a1
add r9d, 0x587f3add
xor r9d, 0x668ac712
add r9d, 0x42bdd81
add r9d, 0x5ebcd13
jmp 0x1400a5c57
lea rdx, [rbp + 0xcc]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
xchg r11, r11
movsxd rax, dword [rbp + 0x428]
lea rdx, [rbp + 0x1a0]
mov ecx, 0x1dd34753
xor ecx, 0x3101a094
jmp 0x1400a5996
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400a5d91
xor dword [rbp + 0xd0], 0xc4b3ce20
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp - 0x3c], 0x16175b6b
mov ecx, eax
jmp 0x1400a5a21
lea r8, [rbp + 0x2b3]
mov dword [rsp + 0x40], eax
lea rdx, [rsp + 0x40]
jmp 0x1400a5acf
add dword [rbp + 0xd0], 0xe63fb2c
add dword [rbp + 0xd0], 0x4f582d64
xor dword [rbp + 0xd0], 0x5cfe71e1
add dword [rbp + 0xd0], 0x38eb4d02
sub dword [rbp + 0xd0], 0x66d8a60f
add dword [rbp + 0xd0], 0x3aa81c58
jmp 0x1400a5a5a
movzx eax, word [0x14011e304]
mov r12, r12
lea rcx, [rbp + 0x28]
xor byte [rsp + 0x41], 0x33
jmp 0x1400a5bbc
xor edx, 0x4f2f98a1
xor edx, 0x2a90f699
sub edx, 0x7fc15a20
mov dword [rbp + 0x114], eax
call fcn.1400eb048
mov dword [rsp - 0x1c], ebp
mov rdi, qword [rsp + 0x4d8]
jmp 0x1400a5b15
test rax, rax
je 0x1400a5963
mov r9, r9
jmp 0x1400a595f
call fcn.1400f75d0
nop dword [rax]
mov r15, r15
inc rbx
cmp byte [rdi + rbx], r14b
jne 0x1400a5b35
mov dword [rbp - 0x28], ebx
jmp 0x1400a5b98
lea r8, [0x140258c10]
lea rdx, [0x14011e2f8]
lea rcx, [rbp + 0xd4]
call fcn.1400a33d0
jmp 0x1400a594a
add r8d, 0x5a4b890a
sub r8d, 0x12b5e9a9
sub r8d, 0x37c9130c
xor r8d, 0x2d5801d8
call fcn.1400b02a0
mov eax, dword [str.n_f_vi]
mov r15, r15
jmp 0x1400a5a79
mov rcx, rcx
mov rbx, qword [rsp + 0x4e8]
mov dword [rbp + 0xd0], 0x5060436d
sub dword [rbp + 0xd0], 0x3bad4c88
jmp 0x1400a5a8e
xor byte [rsp + 0x42], 0x34
xor byte [rsp + 0x43], 0x35
mov dword [rsp - 0x1c], 0x388c1336
mov word [rsp + 0x44], ax
movzx eax, byte [0x14011e306]
jmp 0x1400a5cbd
xor byte [rbp + 0xc8], 0x5c
add byte [rbp + 0xc8], 0x4b
add byte [rbp + 0xc8], 0x21
sub byte [rbp + 0xc8], 0x75
jmp 0x1400a5cfe
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
mov rbp, rbp
call rax
jmp 0x1400a59cb
sub byte [rsp + 0x40], 0x2b
sub byte [rsp + 0x40], 2
add byte [rsp + 0x40], 0x3d
call fcn.14000edd0
mov r12, r12
jmp 0x1400a5b4a
mov r8d, 0x6011aa52
sub r8d, 0x2467aee3
xor r8d, 0x306c2fd9
xor r8d, 0x184f5774
add r8d, 0xa00f0c5
jmp 0x1400a5b69
add r9d, 0x31a9b912
sub r9d, 0x228be54a
sub r9d, 0x2805d537
jmp 0x1400a5d64
xor rbx, 0x77d4ed0a
add rbx, 0x12dcda5d
xor rbx, 0x3ce55913
xor rbx, 0x1ab774a5
jmp 0x1400a5cda
xchg rdx, r11
mov edx, 0x3a33f41f
sub edx, 0x2650958a
add edx, 0x4521163b
sub edx, 0x4fc93f36
xor edx, 0x5d01c684
add edx, 0x6bc6d0e2
jmp 0x1400a5c00
xor byte [rsp + 0x44], 0x36
xor al, 0x38
mov dword [rsp - 0x44], 0x17d5aeb3
xor byte [rsp + 0x45], 0x37
mov byte [rsp + 0x46], al
jmp 0x1400a59ad
add rbx, 0x2333fc3c
xor rbx, 0x77d08be
add rbx, 0x7fffffff
xor rbx, 0x16b4f1bf
xchg r8, r14
jmp 0x1400a58e5
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [rsp - 0x24], edi
movzx ecx, byte [rbp + 0x1a0]
lea rdx, [rbp + 0x2b0]
jmp 0x1400a5c30
jne 0x1400a58fa
inc r8
xchg r14, r14
lea rcx, [rsp + 0x58]
xchg rdi, r14
mov rdx, r14
xchg rdi, r14
jmp 0x1400a5b26
xchg r8, rax
mov byte [rbp + 0xc8], 0x1e
add byte [rbp + 0xc8], 0x3a
sub byte [rbp + 0xc8], 0x13
xor byte [rbp + 0xc8], 0x46
add byte [rbp + 0xc8], 0x53
jmp 0x1400a5bdf
mov rcx, qword [rax + 0x98]
mov rax, qword [0x1402595a0]
mov dword [rsp - 0x18], 0x71e9ad8e
xor rax, rdx
lea rdx, [rsp + 0x48]
xchg r11, rdx
mov qword [rsp + 0x30], r11
jmp 0x1400a5c92
xor eax, eax
mov rcx, qword [rbp + 0x3c0]
mov dword [rsp - 0x34], 0x1b6aa851
xor rcx, rsp
call fcn.1400e9e80
sub rsp, 0xfffffffffffffb10
jmp 0x1400a5db4
xchg r11, r11
nop
mov rbp, qword [rsp]
add rsp, 8
ret