Function at 0x180195afc
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
mov byte [rax + 0x18], r8b
mov byte [rax + 0x10], dl
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x408]
sub rsp, 0x4c8
mov qword [rbp + 0xf0], 0xfffffffffffffffe
mov r14, rcx
mov r9d, dword [0x1802bccdc]
mov rax, qword gs:[0x58]
mov edi, 4
mov rbx, qword [rax + r9*8]
or r15, 0xffffffffffffffff
xor r12d, r12d
lea esi, [r15 + 0x11]
lea r13d, [r15 + 0xa]
mov eax, dword [rbx + rdi]
cmp dword [0x1802c82b8], eax
jle 0x180195d86
lea rcx, [0x1802c82b8]
call fcn.1802696f0
cmp dword [0x1802c82b8], r15d
jne 0x180195d86
lea rax, [rbp + 0x70]
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x7c], 4
mov byte [rbp - 0x78], 0x47
mov byte [rbp - 0x77], 0x76
mov byte [rbp - 0x76], 0x61
mov byte [rbp - 0x75], 0x65
mov byte [rbp - 0x74], 0x70
mov byte [rbp - 0x73], 0x61
mov byte [rbp - 0x72], 0x50
mov byte [rbp - 0x71], 0x6b
mov byte [rbp - 0x70], 0x6b
mov byte [rbp - 0x6f], 0x68
mov byte [rbp - 0x6e], 0x6c
mov byte [rbp - 0x6d], 0x61
mov byte [rbp - 0x6c], 0x68
mov byte [rbp - 0x6b], 0x74
mov byte [rbp - 0x6a], 0x37
mov byte [rbp - 0x69], 0x36
mov byte [rbp - 0x68], 0x57
mov byte [rbp - 0x67], 0x6a
mov byte [rbp - 0x66], 0x65
mov byte [rbp - 0x65], 0x74
mov byte [rbp - 0x64], 0x77
mov byte [rbp - 0x63], 0x6c
mov byte [rbp - 0x62], 0x6b
mov byte [rbp - 0x61], 0x70
xor eax, eax
mov byte [rbp - 0x60], al
mov al, byte [rbp - 0x78]
mov edx, r12d
mov al, byte [rbp + rdx - 0x78]
mov ecx, dword [rbp - 0x7c]
xor cl, al
mov byte [rbp + rdx - 0x78], cl
inc rdx
cmp rdx, 0x18
jb 0x180195bfc
mov byte [rbp - 0x60], r12b
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], r12
mov qword [rbp + 0x88], r12
lea rax, [rbp - 0x78]
mov r8, r15
inc r8
cmp byte [rax + r8], r12b
jne 0x180195c32
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x70]
call fcn.18007b70c
nop
mov dword [rsp + 0x64], 0x1f
mov byte [rsp + 0x68], 0x74
mov byte [rsp + 0x69], 0x7a
mov byte [rsp + 0x6a], 0x6d
mov byte [rsp + 0x6b], 0x71
mov byte [rsp + 0x6c], 0x7a
mov byte [rsp + 0x6d], 0x73
mov byte [rsp + 0x6e], 0x2c
mov byte [rsp + 0x6f], 0x2d
xor eax, eax
mov byte [rsp + 0x70], al
mov al, byte [rsp + 0x68]
mov rdx, r12
mov al, byte [rsp + rdx + 0x68]
mov ecx, dword [rsp + 0x64]
xor cl, al
mov byte [rsp + rdx + 0x68], cl
inc rdx
cmp rdx, 8
jb 0x180195c86
mov byte [rsp + 0x70], r12b
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp], xmm1
lea rax, [rsp + 0x68]
mov r8, r15
inc r8
cmp byte [rax + r8], r12b
jne 0x180195cb9
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x10]
call fcn.18007b70c
nop
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0xf8]
call fcn.180188b20
nop
mov qword [rsp + 0x20], r12
mov r9b, 1
lea r8, [rbp + 0x70]
mov rdx, rax
lea rcx, [0x1802c5c80]
call fcn.18008908c
nop
mov rdx, qword [rbp + 8]
cmp rdx, rsi
jb 0x180195d3b
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180195d36
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180195d36
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180269534
movdqa xmm0, xmmword [0x180280de0]
movdqu xmmword [rbp], xmm0
mov byte [rbp - 0x10], r12b
mov r8, r13
xor edx, edx
lea rcx, [rsp + 0x68]
call qword [sym.imp.VCRUNTIME140.dll_memset]
nop
xor edx, edx
lea r8d, [rdx + 0x19]
lea rcx, [rbp - 0x78]
call qword [sym.imp.VCRUNTIME140.dll_memset]
lea rcx, [0x18027e154]
call fcn.18026951c
nop
lea rcx, [0x1802c82b8]
call fcn.180269690
mov eax, dword [rbx + rdi]
cmp dword [0x1802c6d58], eax
jle 0x180195f9e
lea rcx, [0x1802c6d58]
call fcn.1802696f0
cmp dword [0x1802c6d58], r15d
jne 0x180195f9e
lea rax, [rbp + 0x90]
mov qword [rbp - 0x18], rax
mov dword [rsp + 0x50], 2
mov byte [rsp + 0x54], 0x52
mov byte [rsp + 0x55], 0x70
mov byte [rsp + 0x56], 0x6d
mov byte [rsp + 0x57], 0x61
mov byte [rsp + 0x58], 0x67
mov byte [rsp + 0x59], 0x71
mov byte [rsp + 0x5a], 0x71
mov byte [rsp + 0x5b], 0x31
mov byte [rsp + 0x5c], 0x30
mov byte [rsp + 0x5d], 0x44
mov byte [rsp + 0x5e], 0x6b
mov byte [rsp + 0x5f], 0x70
mov byte [rsp + 0x60], 0x71
mov byte [rsp + 0x61], 0x76
mov byte [rsp + 0x62], 0x55
xor eax, eax
mov byte [rsp + 0x63], al
mov al, byte [rsp + 0x54]
mov rdx, r12
mov al, byte [rsp + rdx + 0x54]
mov ecx, dword [rsp + 0x50]
xor cl, al
mov byte [rsp + rdx + 0x54], cl
inc rdx
cmp rdx, 0xf
jb 0x180195e19
mov byte [rsp + 0x63], r12b
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], r12
mov qword [rbp + 0xa8], r12
lea rax, [rsp + 0x54]
mov r8, r15
inc r8
cmp byte [rax + r8], r12b
jne 0x180195e55
lea rdx, [rsp + 0x54]
lea rcx, [rbp + 0x90]
call fcn.18007b70c
nop
mov byte [rsp + 0x44], 0x6c
mov byte [rsp + 0x45], 0x66
mov byte [rsp + 0x46], 0x73
mov byte [rsp + 0x47], 0x6f
mov byte [rsp + 0x48], 0x66
mov byte [rsp + 0x49], 0x6d
mov byte [rsp + 0x4a], 0x34
mov byte [rsp + 0x4b], 0x33
mov byte [rsp + 0x4c], r12b
mov al, byte [rsp + 0x44]
mov rcx, r12
mov al, byte [rsp + rcx + 0x44]
dec al
mov byte [rsp + rcx + 0x44], al
inc rcx
cmp rcx, 8
jb 0x180195ea4
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x20], xmm1
lea rax, [rsp + 0x44]
mov r8, r15
inc r8
cmp byte [rax + r8], r12b
jne 0x180195ece
lea rdx, [rsp + 0x44]
lea rcx, [rbp + 0x10]
call fcn.18007b70c
nop
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x118]
call fcn.180188b20
nop
mov qword [rsp + 0x20], r12
mov r9b, 1
lea r8, [rbp + 0x90]
mov rdx, rax
lea rcx, [0x1802c70d0]
call fcn.180086d10
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, rsi
jb 0x180195f53
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180195f4e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180195f4e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180269534
movdqa xmm0, xmmword [0x180280de0]
movdqu xmmword [rbp + 0x20], xmm0
mov byte [rbp + 0x10], r12b
mov r8, r13
xor edx, edx
lea rcx, [rsp + 0x44]
call qword [sym.imp.VCRUNTIME140.dll_memset]
nop
mov r8, rsi
xor edx, edx
lea rcx, [rsp + 0x54]
call qword [sym.imp.VCRUNTIME140.dll_memset]
lea rcx, [0x18027e148]
call fcn.18026951c
nop
lea rcx, [0x1802c6d58]
call fcn.180269690
mov eax, dword [rbx + rdi]
cmp dword [0x1802c7840], eax
jle 0x180196225
lea rcx, [0x1802c7840]
call fcn.1802696f0
cmp dword [0x1802c7840], r15d
jne 0x180196225
lea rax, [rbp + 0xb0]
mov qword [rbp - 0x18], rax
mov dword [rsp + 0x30], 0x1d
mov eax, dword [rsp + 0x30]
xor al, 0x50
mov byte [rsp + 0x34], al
mov eax, dword [rsp + 0x30]
inc al
xor al, 0x72
mov byte [rsp + 0x35], al
mov eax, dword [rsp + 0x30]
add al, 2
xor al, 0x6f
mov byte [rsp + 0x36], al
mov eax, dword [rsp + 0x30]
add al, 3
xor al, 0x63
mov byte [rsp + 0x37], al
mov eax, dword [rsp + 0x30]
add al, 4
xor al, 0x65
mov byte [rsp + 0x38], al
mov eax, dword [rsp + 0x30]
add al, 5
xor al, 0x73
mov byte [rsp + 0x39], al
mov eax, dword [rsp + 0x30]
add al, 6
xor al, 0x73
mov byte [rsp + 0x3a], al
mov eax, dword [rsp + 0x30]
add al, 7
xor al, 0x33
mov byte [rsp + 0x3b], al
mov eax, dword [rsp + 0x30]
add al, 8
xor al, 0x32
mov byte [rsp + 0x3c], al
mov eax, dword [rsp + 0x30]
add al, r13b
xor al, 0x4e
mov byte [rsp + 0x3d], al
mov eax, dword [rsp + 0x30]
add al, 0xa
xor al, 0x65
mov byte [rsp + 0x3e], al
mov eax, dword [rsp + 0x30]
add al, 0xb
xor al, 0x78
mov byte [rsp + 0x3f], al
mov eax, dword [rsp + 0x30]
add al, 0xc
xor al, 0x74
mov byte [rsp + 0x40], al
mov eax, dword [rsp + 0x30]
add al, 0xd
xor al, 0x57
mov byte [rsp + 0x41], al
xor eax, eax
mov byte [rsp + 0x42], al
mov al, byte [rsp + 0x34]
mov rdx, r12
mov al, byte [rsp + rdx + 0x34]
mov ecx, dword [rsp + 0x30]
add cl, dl
xor cl, al
mov byte [rsp + rdx + 0x34], cl
inc rdx
cmp rdx, 0xe
jb 0x18019608d
mov byte [rsp + 0x42], r12b
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], r12
mov qword [rbp + 0xc8], r12
lea rax, [rsp + 0x34]
mov r8, r15
inc r8
cmp byte [rax + r8], r12b
jne 0x1801960cb
lea rdx, [rsp + 0x34]
lea rcx, [rbp + 0xb0]
call fcn.18007b70c
nop
mov dword [rsp + 0x74], 0x32
mov byte [rsp + 0x78], 0x59
mov byte [rsp + 0x79], 0x57
mov byte [rsp + 0x7a], 0x40
mov byte [rsp + 0x7b], 0x5c
mov byte [rsp + 0x7c], 0x57
mov byte [rsp + 0x7d], 0x5e
mov byte [rsp + 0x7e], 1
mov byte [rsp + 0x7f], r12b
xor eax, eax
mov byte [rbp - 0x80], al
mov al, byte [rsp + 0x78]
mov rdx, r12
mov al, byte [rsp + rdx + 0x78]
mov ecx, dword [rsp + 0x74]
xor cl, al
mov byte [rsp + rdx + 0x78], cl
inc rdx
cmp rdx, 8
jb 0x180196122
mov byte [rbp - 0x80], r12b
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x40], xmm1
lea rax, [rsp + 0x78]
mov r8, r15
inc r8
cmp byte [rax + r8], r12b
jne 0x180196154
lea rdx, [rsp + 0x78]
lea rcx, [rbp + 0x30]
call fcn.18007b70c
nop
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x138]
call fcn.180188b20
nop
mov qword [rsp + 0x20], r12
mov r9b, 1
lea r8, [rbp + 0xb0]
mov rdx, rax
lea rcx, [0x1802c53e0]
call fcn.180086d10
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, rsi
jb 0x1801961d9
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1801961d4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1801961d4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180269534
movdqa xmm0, xmmword [0x180280de0]
movdqu xmmword [rbp + 0x40], xmm0
mov byte [rbp + 0x30], r12b
mov r8, r13
xor edx, edx
lea rcx, [rsp + 0x78]
call qword [sym.imp.VCRUNTIME140.dll_memset]
nop
xor edx, edx
lea r8d, [rdx + 0xf]
lea rcx, [rsp + 0x34]
call qword [sym.imp.VCRUNTIME140.dll_memset]
lea rcx, [0x18027e13c]
call fcn.18026951c
nop
lea rcx, [0x1802c7840]
call fcn.180269690
xor r8d, r8d
lea edx, [r8 + 2]
lea rcx, [0x1802c5c80]
call fcn.180089bc8
mov rsi, rax
mov qword [rbp - 0x40], rax
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp + 0x184]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x180], 0x238
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x58], xmm0
mov rdi, r12
mov qword [rbp - 0x48], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
lea rcx, [rbp + 0xd0]
call fcn.180194c54
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], 7
mov word [rbp - 0x38], r12w
lea r8, [rbp + 0x180]
mov rdx, rsi
lea rcx, [0x1802c70d0]
call fcn.180087840
mov rbx, qword [rbp - 0x50]
test eax, eax
je 0x1801964d3
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x68], r12
lea rax, [rbp + 0x1ac]
mov r8, r15
inc r8
cmp word [rax + r8*2], r12w
jne 0x1801962d4
lea rdx, [rbp + 0x1ac]
lea rcx, [rbp + 0x50]
call fcn.18007b5dc
mov r11, qword [r14 + 0x10]
mov r10, r14
cmp qword [r14 + 0x18], 8
jb 0x1801962ff
mov r10, qword [r14]
lea rdx, [rbp + 0x50]
mov r15, qword [rbp + 0x68]
cmp r15, 8
setae r13b
mov r8, qword [rbp + 0x50]
cmovae rdx, r8
test r11, r11
jne 0x180196321
mov rsi, r12
jmp 0x180196376
cmp r11, qword [rbp + 0x60]
ja 0x180196372
mov rsi, rdx
movzx r12d, word [r10]
cmp word [rsi], r12w
jne 0x180196359
mov r14, r11
mov r9, r10
test r11, r11
je 0x180196364
mov rax, r9
sub rax, r10
movzx ecx, word [rax + rsi]
cmp cx, word [r9]
jne 0x180196359
add r9, 2
sub r14, 1
jmp 0x18019633d
cmp rsi, rdx
je 0x18019636f
sub rsi, 2
jmp 0x18019632e
sub rsi, rdx
sar rsi, 1
xor r12d, r12d
jmp 0x180196376
xor r12d, r12d
or rsi, 0xffffffffffffffff
test r13b, r13b
je 0x1801963b0
lea rdx, [r15*2 + 2]
mov rax, r8
cmp rdx, 0x1000
jb 0x1801963a8
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1801964cc
mov rcx, r8
call fcn.180269534
test rsi, rsi
jne 0x18019649e
cmp byte [rbp + 0x418], r12b
je 0x180196463
mov edx, dword [rbp + 0x188]
lea rcx, [rbp + 0x158]
call fcn.180194c54
mov rdx, rax
lea rcx, [rbp - 0x38]
call fcn.18008c67c
lea rcx, [rbp + 0x158]
call fcn.18007a444
lea rcx, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 8
cmovae rcx, qword [rbp + 0xd0]
lea r8, [rbp - 0x38]
cmp qword [rbp - 0x20], 8
cmovae r8, qword [rbp - 0x38]
mov r9, qword [rbp - 0x28]
mov rdx, r9
mov r10, qword [rbp + 0xe0]
cmp r10, r9
cmovb rdx, r10
test rdx, rdx
je 0x180196446
sub r8, rcx
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x18019649e
add rcx, 2
sub rdx, 1
jne 0x180196432
cmp r9, r10
jb 0x18019649e
ja 0x18019649e
cmp rbx, rdi
je 0x18019645a
mov eax, dword [rbp + 0x188]
jmp 0x180196477
lea r8, [rbp + 0x188]
jmp 0x18019648a
cmp byte [rbp + 0x420], r12b
je 0x18019644d
cmp rbx, rdi
je 0x180196483
mov eax, dword [rbp + 0x1a0]
mov dword [rbx], eax
add rbx, 4
mov qword [rbp - 0x50], rbx
jmp 0x18019649e
lea r8, [rbp + 0x1a0]
mov rdx, rbx
lea rcx, [rbp - 0x58]
call fcn.18009816c
mov rdi, qword [rbp - 0x48]
mov rbx, qword [rbp - 0x50]
lea r8, [rbp + 0x180]
mov rsi, qword [rbp - 0x40]
mov rdx, rsi
lea rcx, [0x1802c53e0]
call fcn.180087840
test eax, eax
je 0x1801964d3
mov r14, qword [rbp + 0x410]
or r15, 0xffffffffffffffff
jmp 0x1801962bb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rbp - 0x58]
cmp rsi, rbx
jne 0x1801964ea
or ebx, 0xffffffff
jmp 0x180196522
sub rbx, rsi
sar rbx, 2
lea eax, [rbx - 1]
test eax, eax
jne 0x1801964fd
mov eax, r12d
jmp 0x18019651d
mov dword [rbp + 0x428], r12d
mov dword [rbp + 0x42c], eax
lea rdx, [0x1802be2d0]
lea rcx, [rbp + 0x428]
call fcn.18014c514
cdqe
mov ebx, dword [rsi + rax*4]
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
jb 0x180196565
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180196560
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180196560
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180269534
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], 7
mov word [rbp - 0x38], r12w
lea rcx, [rbp + 0xd0]
call fcn.18007a444
nop
test rsi, rsi
je 0x1801965c2
sub rdi, rsi
and rdi, 0xfffffffffffffffc
mov rax, rsi
cmp rdi, 0x1000
jb 0x1801965b7
add rdi, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1801965b7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, rdi
mov rcx, rsi
call fcn.180269534
mov eax, ebx
add rsp, 0x4c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret