Function at 0x140104b16
Capabilities:
Authenticate hmac

Disassembly:
push rax
pushf
mov eax, 0x48c6b223
pushf
not eax
add eax, 0xf772c0a2
xor eax, 0xc9be786a
rol eax, 0xce
popf
pushf
not eax
add eax, 0x9f158b4f
xor eax, 0xeb967966
rol eax, 0xed
popf
pushf
not eax
add eax, 0x8a1a62ba
xor eax, 0xc8fcc579
rol eax, 0xd5
popf
cmp eax, 4
jne 0x140104b66
popf
pop rax
jmp 0x140104f94
cmp eax, 0
jne 0x140104b75
popf
pop rax
jmp 0x140104cfb
cmp eax, 3
jne 0x140104b84
popf
pop rax
jmp 0x140104eea
cmp eax, 1
jne 0x140104b93
popf
pop rax
jmp 0x140104dcd
cmp eax, 0xd
jne 0x140104ba2
popf
pop rax
jmp 0x1401053e7
cmp eax, 0x1a
jne 0x140104bb1
popf
pop rax
jmp 0x140105a36
cmp eax, 0xe
jne 0x140104bc0
popf
pop rax
jmp 0x14010547c
cmp eax, 0xb
jne 0x140104bcf
popf
pop rax
jmp 0x140105250
cmp eax, 0x19
jne 0x140104bde
popf
pop rax
jmp 0x1401059e6
cmp eax, 8
jne 0x140104bed
popf
pop rax
jmp 0x140105149
cmp eax, 0x10
jne 0x140104bfc
popf
pop rax
jmp 0x1401055da
cmp eax, 0x17
jne 0x140104c0b
popf
pop rax
jmp 0x14010594f
cmp eax, 9
jne 0x140104c1a
popf
pop rax
jmp 0x1401051c1
cmp eax, 0x12
jne 0x140104c29
popf
pop rax
jmp 0x140105719
cmp eax, 0x18
jne 0x140104c38
popf
pop rax
jmp 0x14010598b
cmp eax, 0x11
jne 0x140104c47
popf
pop rax
jmp 0x140105688
cmp eax, 0x1b
jne 0x140104c56
popf
pop rax
jmp 0x140105adb
cmp eax, 0x16
jne 0x140104c65
popf
pop rax
jmp 0x1401058c4
cmp eax, 0xa
jne 0x140104c74
popf
pop rax
jmp 0x14010520f
cmp eax, 0x14
jne 0x140104c83
popf
pop rax
jmp 0x1401057ea
cmp eax, 0xf
jne 0x140104c92
popf
pop rax
jmp 0x140105511
cmp eax, 0x13
jne 0x140104ca1
popf
pop rax
jmp 0x140105753
cmp eax, 0x15
jne 0x140104cb0
popf
pop rax
jmp 0x140105820
cmp eax, 2
jne 0x140104cbf
popf
pop rax
jmp 0x140104e74
cmp eax, 6
jne 0x140104cce
popf
pop rax
jmp 0x14010507b
cmp eax, 0xc
jne 0x140104cdd
popf
pop rax
jmp 0x1401052e5
cmp eax, 7
jne 0x140104cec
popf
pop rax
jmp 0x1401050ed
cmp eax, 5
jne 0x140104cfb
popf
pop rax
jmp 0x14010503f
push rbp
push rdi
push r14
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x50], rbx
mov qword [rbp + 0x58], rsi
mov rax, qword [0x140084080]
xor rax, rbp
mov qword [rbp + 0x10], rax
mov rdi, rdx
mov r14, rcx
test rdx, rdx
je 0x140104d87
push rax
pushf
mov eax, 0xe6074ce1
pushf
not eax
add eax, 0x8e34c42e
xor eax, 0xee544747
rol eax, 0xd0
popf
pushf
not eax
add eax, 0x9e7a3d1d
xor eax, 0xe27e03ca
rol eax, 0xc7
popf
pushf
not eax
add eax, 0xd2f3daa6
xor eax, 0x98b4b6ef
rol eax, 0xb8
popf
pushf
not eax
add eax, 0xed2984ca
xor eax, 0xbcdeb736
rol eax, 0x8d
popf
jmp 0x140104b57
push rax
pushf
mov eax, 0x737dee8a
pushf
not eax
add eax, 0x8166d2c3
xor eax, 0xf34ec827
rol eax, 0xf3
popf
pushf
not eax
add eax, 0xb5cbd3fc
xor eax, 0xe7fe2e53
rol eax, 0xfb
popf
pushf
not eax
add eax, 0x9bea2dcb
xor eax, 0xce51fe46
rol eax, 0x94
popf
jmp 0x140104b57
lea rax, [rbp]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
mov rcx, qword [rcx + 8]
jmp 0x140104de5
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
jmp 0x140104dec
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140104e2e
push rax
pushf
mov eax, 0x455cb1c4
pushf
not eax
add eax, 0x924b4cf6
xor eax, 0xe4286084
rol eax, 0x14
popf
pushf
not eax
add eax, 0xa21b25cc
xor eax, 0xe6c4995c
rol eax, 0xaf
popf
jmp 0x140104b57
push rax
pushf
mov eax, 0x824448f8
pushf
not eax
add eax, 0x823f0e44
xor eax, 0xf365a348
rol eax, 0xa5
popf
pushf
not eax
add eax, 0xdf199795
xor eax, 0xfad082c5
rol eax, 0x74
popf
pushf
not eax
add eax, 0xe4236013
xor eax, 0x84b8434d
rol eax, 0xbb
popf
jmp 0x140104b57
xor ebx, ebx
mov qword [rbp + 8], rbx
mov eax, dword [rbp]
cmp eax, 0x400
ja 0x140104eb7
push rax
pushf
mov eax, 0xeb3a5bfb
pushf
not eax
add eax, 0xccc0f6c1
xor eax, 0xee487caa
rol eax, 0x5a
popf
pushf
not eax
add eax, 0x8d6c256c
xor eax, 0xd12ce912
rol eax, 0x1a
popf
jmp 0x140104b57
push rax
pushf
mov eax, 0x295d70a2
pushf
not eax
add eax, 0xa6734568
xor eax, 0xbe4aaec9
rol eax, 0x12
popf
pushf
not eax
add eax, 0x830ee5ca
xor eax, 0x9adb984c
rol eax, 0x35
popf
jmp 0x140104b57
mov ecx, eax
call fcn.1400be724
test al, al
je 0x140104f3b
push rax
pushf
mov eax, 0xc8c8c56f
pushf
not eax
add eax, 0xbccdf2be
xor eax, 0xd2e62809
rol eax, 0x5d
popf
pushf
not eax
add eax, 0x8e7c89f8
xor eax, 0x977523f8
rol eax, 0x2a
popf
pushf
not eax
add eax, 0xd8942476
xor eax, 0x8469437a
rol eax, 0x38
popf
jmp 0x140104b57
push rax
pushf
mov eax, 0x42216b57
pushf
not eax
add eax, 0xb02b6b07
xor eax, 0xa0046ad8
rol eax, 0x68
popf
pushf
not eax
add eax, 0x8d607690
xor eax, 0xf3a3ccd3
rol eax, 0xe0
popf
pushf
not eax
add eax, 0xf1b9fe97
xor eax, 0xe0843b6d
rol eax, 0xd7
popf
pushf
not eax
add eax, 0xc1e3319f
xor eax, 0xcd204753
rol eax, 0xfc
popf
jmp 0x140104b57
mov eax, dword [rbp]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x140104ff9
push rax
pushf
mov eax, 0x12464b0f
pushf
not eax
add eax, 0xf4407878
xor eax, 0xc551287f
rol eax, 0xe5
popf
pushf
not eax
add eax, 0xe8764c2e
xor eax, 0xa904b830
rol eax, 0x57
popf
pushf
not eax
add eax, 0xad3cabc1
xor eax, 0xb426ba67
rol eax, 0x9e
popf
pushf
not eax
add eax, 0xa001f199
xor eax, 0xcefbaa01
rol eax, 0xba
popf
jmp 0x140104b57
push rax
pushf
mov eax, 0x64b9002f
pushf
not eax
add eax, 0x907cdb87
xor eax, 0xc4caa0ec
rol eax, 0x74
popf
pushf
not eax
add eax, 0x9aa8deee
xor eax, 0xce06eb1e
rol eax, 0x21
popf
pushf
not eax
add eax, 0xf2f6679f
xor eax, 0xd118510e
rol eax, 0xb7
popf
jmp 0x140104b57
movabs rcx, 0x7ffaea60757eb8c8
pushf
not rcx
add rcx, 0x70d5dbf9
xor rcx, 0x63572330
rol rcx, 0x27
popf
pushf
not rcx
add rcx, 0x47aa92fe
xor rcx, 0x7ae03cce
rol rcx, 0x9e
popf
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400e75ef
sub rsp, rcx
lea rsi, [rsp + 0x30]
jmp 0x140105250
mov eax, dword [rbp]
push rax
pushf
mov eax, 0xfc5847aa
pushf
not eax
add eax, 0xb9830b7a
xor eax, 0x8dc6e3c8
rol eax, 0x2b
popf
pushf
not eax
add eax, 0x9a4f5520
xor eax, 0xd39b1f58
rol eax, 0x56
popf
pushf
not eax
add eax, 0xd3202126
xor eax, 0xa912ae81
rol eax, 4
popf
pushf
not eax
add eax, 0xad44c351
xor eax, 0xedc99900
rol eax, 0x53
popf
jmp 0x140104b57
mov ecx, eax
add rcx, 0x10
jmp 0x140105150
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
jne 0x14010518e
push rax
pushf
mov eax, 0xc8becc4a
pushf
not eax
add eax, 0xf1ee6bbe
xor eax, 0xd82191ed
rol eax, 0xa1
popf
pushf
not eax
add eax, 0x87b9d23f
xor eax, 0xa5d5b501
rol eax, 0x6d
popf
jmp 0x140104b57
push rax
pushf
mov eax, 0xdd811589
pushf
not eax
add eax, 0xc7a20d1e
xor eax, 0x9ea7b4ca
rol eax, 0x53
popf
pushf
not eax
add eax, 0xc8e1f11e
xor eax, 0xadee4cb3
rol eax, 0xbd
popf
jmp 0x140104b57
mov rsi, rbx
jmp 0x140105250
mov qword [rax], rbx
mov rbx, rax
mov qword [rbp + 8], rax
lea rsi, [rax + 0x10]
push rax
pushf
mov eax, 0x4249f0f3
pushf
not eax
add eax, 0xaee7a0ec
xor eax, 0xcb4e1f1a
rol eax, 0x4f
popf
pushf
not eax
add eax, 0x9881a0f9
xor eax, 0xc010150f
rol eax, 0x35
popf
jmp 0x140104b57
test rsi, rsi
je 0x1401052b2
push rax
pushf
mov eax, 0xf698357e
pushf
not eax
add eax, 0x95ae00f2
xor eax, 0xc8f08962
rol eax, 0xec
popf
pushf
not eax
add eax, 0x86c78df3
xor eax, 0xdbaf1679
rol eax, 0xff
popf
pushf
not eax
add eax, 0xee369564
xor eax, 0xc5847be4
rol eax, 0x66
popf
pushf
not eax
add eax, 0xc34223cd
xor eax, 0xb5d8d57d
rol eax, 0xd5
popf
jmp 0x140104b57
push rax
pushf
mov eax, 0xbebfd3ea
pushf
not eax
add eax, 0x822a02c3
xor eax, 0xf0568fee
rol eax, 7
popf
pushf
not eax
add eax, 0x914a89a3
xor eax, 0xf2a9ee89
rol eax, 0x6e
popf
jmp 0x140104b57
lea rax, [rbp]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp]
mov r8, rsi
mov edx, 0x9f493870
pushf
not edx
add edx, 0xc9183294
xor edx, 0xc7bed527
rol edx, 0x6f
popf
pushf
not edx
add edx, 0x896260b7
xor edx, 0xa731c5c6
rol edx, 0x9b
popf
pushf
not edx
add edx, 0x955fd7ee
xor edx, 0xdea86688
rol edx, 0x44
popf
mov rcx, qword [r14 + 8]
jmp 0x14010533e
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14010538e
push rax
pushf
mov eax, 0x7a96d8
pushf
not eax
add eax, 0x8a734c8b
xor eax, 0x85158cf3
rol eax, 0xe
popf
pushf
not eax
add eax, 0xd1bc6935
xor eax, 0xd683dbfe
rol eax, 0x55
popf
pushf
not eax
add eax, 0x8c1793a3
xor eax, 0xcb2d75a3
rol eax, 0xf3
popf
jmp 0x140104b57
push rax
pushf
mov eax, 0x7898c17
pushf
not eax
add eax, 0xd81c8901
xor eax, 0xe6a666e6
rol eax, 0x2d
popf
pushf
not eax
add eax, 0xa7561c17
xor eax, 0xcc537475
rol eax, 0xa3
popf
pushf
not eax
add eax, 0xfafce74b
xor eax, 0xe8239a8b
rol eax, 0x72
popf
pushf
not eax
add eax, 0xe62e59d2
xor eax, 0xd6cf164c
rol eax, 0x4a
popf
jmp 0x140104b57
mov rsi, qword [rsi]
cmp byte [rdi + 0x4c], 0
je 0x140105449
push rax
pushf
mov eax, 0x1ecda791
pushf
not eax
add eax, 0xb83224a5
xor eax, 0xdb1d7f7b
rol eax, 0xde
popf
pushf
not eax
add eax, 0xd6ce94f4
xor eax, 0xe5f986e5
rol eax, 0x9d
popf
pushf
not eax
add eax, 0xe646ffd4
xor eax, 0xfa003468
rol eax, 0x21
popf
pushf
not eax
add eax, 0xf9236d63
xor eax, 0xc1808b39
rol eax, 0x71
popf
jmp 0x140104b57
push rax
pushf
mov eax, 0xcb397aa9
pushf
not eax
add eax, 0xa57509e2
xor eax, 0xeaae6473
rol eax, 0xb6
popf
pushf
not eax
add eax, 0xd1e1e97b
xor eax, 0xff15f800
rol eax, 0x36
popf
jmp 0x140104b57
lea rax, [rdi + 8]
cmp rax, rsi
je 0x1401054cb
push rax
pushf
mov eax, 0xc8d931cc
pushf
not eax
add eax, 0xd75b9382
xor eax, 0x811b25d5
rol eax, 5
popf
pushf
not eax
add eax, 0xf1e05d78
xor eax, 0xcd94e8b4
rol eax, 0x5c
popf
pushf
not eax
add eax, 0xd20843b3
xor eax, 0xaf361015
rol eax, 0x8b
popf
jmp 0x140104b57
push rax
pushf
mov eax, 0x64db34e3
pushf
not eax
add eax, 0xc2861770
xor eax, 0xbf690b42
rol eax, 0x76
popf
pushf
not eax
add eax, 0xdebfa1ba
xor eax, 0x9550f188
rol eax, 0xd3
popf
pushf
not eax
add eax, 0xe544231c
xor eax, 0xdb86506b
rol eax, 0x93
popf
jmp 0x140104b57
mov dword [rdi + 0x50], 7
lea rcx, [rdi + 0x58]
call fcn.1400c94c8
lea rcx, [rdi + 0x60]
call fcn.1400c94c8
lea rcx, [rdi + 0x68]
call fcn.1400c94c8
lea rcx, [rdi + 0x70]
call fcn.1400c94c8
mov byte [rdi + 0x4c], 0
mov rcx, rsi
jmp 0x140105544
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x140105594
push rax
pushf
mov eax, 0xb79570b7
pushf
not eax
add eax, 0xee66b0b8
xor eax, 0xf407a727
rol eax, 0x71
popf
pushf
not eax
add eax, 0xe5c53dea
xor eax, 0xb19f5d6c
rol eax, 0xb3
popf
pushf
not eax
add eax, 0xba664ad0
xor eax, 0x8fe1137c
rol eax, 0x82
popf
jmp 0x140104b57
push rax
pushf
mov eax, 0xdf38639b
pushf
not eax
add eax, 0xa2452fd8
xor eax, 0x8c948b26
rol eax, 0x30
popf
pushf
not eax
add eax, 0x8db2bf49
xor eax, 0xf235ca58
rol eax, 0xfb
popf
pushf
not eax
add eax, 0x8cdec254
xor eax, 0x97395524
rol eax, 0xa5
popf
jmp 0x140104b57
mov rcx, rsi
jmp 0x1401055de
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
cmp eax, 0x44
ja 0x14010562f
push rax
pushf
mov eax, 0x6a06a54e
pushf
not eax
add eax, 0xfa2b5f34
xor eax, 0xd041b097
rol eax, 0x72
popf
pushf
not eax
add eax, 0xa5cdf3b6
xor eax, 0xed20c4ee
rol eax, 0xf8
popf
pushf
not eax
add eax, 0x9472092d
xor eax, 0xd404e4f6
rol eax, 0x28
popf
jmp 0x140104b57
push rax
pushf
mov eax, 0x6f949aa7
pushf
not eax
add eax, 0xdd445fc1
xor eax, 0xe82c8d2a
rol eax, 0xac
popf
pushf
not eax
add eax, 0xf9a71f53
xor eax, 0x9e0fe168
rol eax, 0xb5
popf
pushf
not eax
add eax, 0xccb5b117
xor eax, 0xd5af3d3f
rol eax, 0xb8
popf
pushf
not eax
add eax, 0xa80d3473
xor eax, 0xfee76efc
rol eax, 0x70
popf
jmp 0x140104b57
mov byte [rdi + 0x4c], 1
lea rdx, [rdi + 8]
mov r8, rsi
mov ecx, eax
jmp 0x140105696
call qword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
je 0x1401056e6
push rax
pushf
mov eax, 0xbd71f8eb
pushf
not eax
add eax, 0xe0edb7b3
xor eax, 0xfdc90ce2
rol eax, 0x8f
popf
pushf
not eax
add eax, 0xdc2c1b83
xor eax, 0xe21b4f61
rol eax, 0xf4
popf
pushf
not eax
add eax, 0xd602be63
xor eax, 0xa87cae3c
rol eax, 0xa9
popf
jmp 0x140104b57
push rax
pushf
mov eax, 0xccc76dc6
pushf
not eax
add eax, 0xa94b3a07
xor eax, 0xce30bfa4
rol eax, 0xc0
popf
pushf
not eax
add eax, 0x947dd9e8
xor eax, 0x81ca6618
rol eax, 0x40
popf
jmp 0x140104b57
mov dword [rdi + 0x50], 8
push rax
pushf
mov eax, 0xb7b49b91
pushf
not eax
add eax, 0xb8a1d60c
xor eax, 0xaad04e38
rol eax, 0xde
popf
pushf
not eax
add eax, 0xa271623f
xor eax, 0xf7e2232e
rol eax, 0x97
popf
jmp 0x140104b57
mov dil, 0xdf
pushf
not dil
add dil, 0x73
xor dil, 0x11
rol dil, 0xd6
popf
pushf
not dil
add dil, 0x4f
xor dil, 0xbb
rol dil, 0xfd
popf
pushf
not dil
add dil, 0x76
xor dil, 0xe9
rol dil, 0xb2
popf
pushf
not dil
add dil, 0x63
xor dil, 0x72
rol dil, 0x1d
popf
jmp 0x140105820
xor dil, dil
push rax
pushf
mov eax, 0x39cfab78
pushf
not eax
add eax, 0x86fc534e
xor eax, 0xdfaecfa8
rol eax, 0xff
popf
pushf
not eax
add eax, 0x8c1e34f4
xor eax, 0xc2dfa0b5
rol eax, 0x33
popf
jmp 0x140104b57
test rbx, rbx
je 0x14010586b
push rax
pushf
mov eax, 0x8b45c506
pushf
not eax
add eax, 0x8bcef207
xor eax, 0x96496178
rol eax, 0xdd
popf
pushf
not eax
add eax, 0x9be5dec8
xor eax, 0xe0c1ba3b
rol eax, 0xef
popf
pushf
not eax
add eax, 0xf2df5116
xor eax, 0xbb5db02f
rol eax, 0x77
popf
jmp 0x140104b57
push rax
pushf
mov eax, 0x96006d12
pushf
not eax
add eax, 0xfe2cac4e
xor eax, 0xc9f821f2
rol eax, 0xeb
popf
pushf
not eax
add eax, 0xd28c368f
xor eax, 0x9a27dd7a
rol eax, 0x16
popf
pushf
not eax
add eax, 0xb89df7fa
xor eax, 0x966db562
rol eax, 0xb8
popf
pushf
not eax
add eax, 0xd7706b0a
xor eax, 0xc880c7cb
rol eax, 0x79
popf
jmp 0x140104b57
mov rcx, rbx
mov rbx, qword [rbx]
jmp 0x1401058cb
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rbx, rbx
jne 0x140105909
push rax
pushf
mov eax, 0xdaefc003
pushf
not eax
add eax, 0xa5b98969
xor eax, 0xe09148dd
rol eax, 0xf7
popf
pushf
not eax
add eax, 0xbe8f598a
xor eax, 0xe2542d49
rol eax, 0x4f
popf
jmp 0x140104b57
push rax
pushf
mov eax, 0x4a55e06d
pushf
not eax
add eax, 0xf5c19778
xor eax, 0xb5ac8f36
rol eax, 0x69
popf
pushf
not eax
add eax, 0xfc84aea0
xor eax, 0xd07b4303
rol eax, 0x82
popf
pushf
not eax
add eax, 0x9a580ae2
xor eax, 0xa09a354d
rol eax, 0xa0
popf
jmp 0x140104b57
movzx eax, dil
jmp 0x1401059e6
xor al, al
push rax
pushf
mov eax, 0xbca45a15
pushf
not eax
add eax, 0xbcffcc2f
xor eax, 0x96c7faf7
rol eax, 0x32
popf
pushf
not eax
add eax, 0x88346bdc
xor eax, 0xbb6050d2
rol eax, 0x48
popf
pushf
not eax
add eax, 0xaf0587e7
xor eax, 0xd9a574fc
rol eax, 0x3b
popf
pushf
not eax
add eax, 0xcabae03e
xor eax, 0xc24faa76
rol eax, 0x87
popf
jmp 0x140104b57
mov rcx, qword [rbp + 0x10]
xor rcx, rbp
call fcn.1400e02a0
mov rbx, qword [rbp + 0x50]
mov rsi, qword [rbp + 0x58]
lea rsp, [rbp + 0x20]
pop r14
pop rdi
pop rbp
ret
mov ecx, 0xe02836eb
pushf
not ecx
add ecx, 0xe5998bb6
xor ecx, 0xfa8b4119
rol ecx, 0x13
popf
pushf
not ecx
add ecx, 0xd8baa15c
xor ecx, 0x80655eb4
rol ecx, 0x65
popf
pushf
not ecx
add ecx, 0xd5ba4e02
xor ecx, 0xbd7f0ec7
rol ecx, 0xc7
popf
pushf
not ecx
add ecx, 0xf7e8bbfb
xor ecx, 0x95d45cae
rol ecx, 0x3b
popf
call fcn.1400e863f
int3
call fcn.1400af553
mov byte [rdi + 0x4c], 0
mov ecx, eax
call fcn.1400e863f
int3