Function at 0x140003100
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Encode data using xor
Execute command
Set console window title
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x14000c040]
xor rax, rsp
mov qword [rbp + 0xc0], rax
movzx edx, byte [rbp + 0x30]
lea rcx, [rbp + 0xa0]
call fcn.140005d50
lea rcx, [rbp + 0xa0]
call fcn.140005450
nop
mov eax, 0xb9eb
mov word [rbp + 0x38], ax
mov eax, 0xb9db
mov word [rbp + 0x3a], ax
mov eax, 0xb9d1
mov word [rbp + 0x3c], ax
mov eax, 0xb9d7
mov word [rbp + 0x3e], ax
mov ecx, 0xb9dc
mov word [rbp + 0x40], cx
mov eax, 0xb9c0
mov word [rbp + 0x42], ax
mov word [rbp + 0x44], cx
mov edx, 0xb996
mov word [rbp + 0x46], dx
mov eax, 0xb9f5
mov word [rbp + 0x48], ax
mov eax, 0xb9d8
mov word [rbp + 0x4a], ax
mov ecx, 0xb9d9
mov word [rbp + 0x4c], cx
mov eax, 0xb9da
mov word [rbp + 0x4e], ax
mov eax, 0xb9d6
mov word [rbp + 0x50], ax
mov word [rbp + 0x52], cx
mov eax, 0xb99d
mov word [rbp + 0x54], ax
mov eax, 0xb9e7
mov word [rbp + 0x56], ax
mov eax, 0xb99e
mov word [rbp + 0x58], ax
mov eax, 0xb9ad
mov word [rbp + 0x5a], ax
mov ecx, 0xb9af
mov word [rbp + 0x5c], cx
mov eax, 0xb9e6
mov word [rbp + 0x5e], ax
mov eax, 0xb9ae
mov word [rbp + 0x60], ax
mov eax, 0xb9a5
mov word [rbp + 0x62], ax
mov eax, 0xb9a0
mov word [rbp + 0x64], ax
mov eax, 0xb9a8
mov word [rbp + 0x66], ax
mov word [rbp + 0x68], cx
mov eax, 0xb9b0
mov word [rbp + 0x6a], ax
mov eax, 0xb9a9
mov word [rbp + 0x6c], ax
mov word [rbp + 0x6e], dx
mov eax, 0xb9c8
mov word [rbp + 0x70], ax
movzx eax, word [rbp + 0x38]
xor ebx, ebx
mov r9d, ebx
lea esi, [rbx + 0xf]
movabs r10, 0x200315c10c06b9af
mov r11d, 0x4651
nop word [rax + rax]
movzx r8d, word [rbp + r9*2 + 0x38]
mov rcx, r9
and ecx, esi
cmp rcx, rsi
cmovae rcx, rsi
shl cl, 2
mov rdx, r10
shr rdx, cl
and dx, si
movzx eax, r9w
sub ax, r11w
xor dx, ax
xor dx, r8w
mov word [rbp + r9*2 + 0x38], dx
inc r9
cmp r9, 0x1d
jb 0x140003260
lea rcx, [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov r11, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov byte [rsp + 0x78], 0xa
mov byte [rsp + 0x79], 0x24
mov byte [rsp + 0x7a], 0x5f
mov byte [rsp + 0x7b], 0x60
mov byte [rsp + 0x7c], 0x5e
mov byte [rsp + 0x7d], 0x23
mov byte [rsp + 0x7e], 0x4d
mov byte [rsp + 0x7f], 0x6a
mov byte [rbp - 0x80], 0x6b
mov byte [rbp - 0x7f], 0x64
mov byte [rbp - 0x7e], 0x67
mov byte [rbp - 0x7d], 0x7e
mov byte [rbp - 0x7c], 0x62
mov byte [rbp - 0x7b], 0x35
mov byte [rbp - 0x7a], 0x56
mov byte [rbp - 0x79], 0x74
mov byte [rbp - 0x78], 0x75
mov byte [rbp - 0x77], 0x75
mov byte [rbp - 0x76], 0x7a
mov byte [rbp - 0x75], 0x7c
mov byte [rbp - 0x74], 0x33
mov byte [rbp - 0x73], 0x48
mov byte [rbp - 0x72], 0x38
mov byte [rbp - 0x71], 0x7c
mov byte [rbp - 0x70], 0x75
mov byte [rbp - 0x6f], 0x35
mov byte [rbp - 0x6e], 0x75
mov byte [rbp - 0x6d], 0x7b
mov byte [rbp - 0x6c], 0x7e
mov byte [rbp - 0x6b], 0x4b
mov byte [rbp - 0x6a], 0x4c
mov byte [rbp - 0x69], 0x5c
mov byte [rbp - 0x68], 0x45
mov byte [rbp - 0x67], 0x79
mov byte [rbp - 0x66], 0x24
movzx eax, byte [rsp + 0x78]
mov r9, rbx
movabs rdi, 0xa45843691fb4f103
mov r10, rdi
lea rax, [rsp + 0x78]
sub r10, rax
nop
lea rdx, [rsp + 0x78]
add rdx, r9
movsx r8, byte [rdx]
mov rcx, r9
and ecx, esi
cmp rcx, rsi
cmovae rcx, rsi
shl cl, 2
mov rax, rdi
shr rax, cl
and al, sil
add dl, r10b
xor al, dl
xor al, r8b
mov byte [rsp + r9 + 0x78], al
inc r9
cmp r9, 0x23
jb 0x140003360
lea rdx, [rsp + 0x78]
mov rcx, r11
call fcn.1400055c0
mov r11, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov byte [rsp + 0x58], 0x4a
mov byte [rsp + 0x59], 0x68
mov byte [rsp + 0x5a], 0x1c
mov byte [rsp + 0x5b], 0x2f
mov byte [rsp + 0x5c], 0x19
mov byte [rsp + 0x5d], 0x73
mov byte [rsp + 0x5e], 3
mov byte [rsp + 0x5f], 0x36
mov byte [rsp + 0x60], 0x2f
mov byte [rsp + 0x61], 0x26
mov byte [rsp + 0x62], 0x3d
mov byte [rsp + 0x63], 0x36
mov byte [rsp + 0x64], 0x3e
mov byte [rsp + 0x65], 0x72
mov byte [rsp + 0x66], 0x6d
mov byte [rsp + 0x67], 0x77
mov byte [rsp + 0x68], 0x60
mov byte [rsp + 0x69], 0x78
mov byte [rsp + 0x6a], 0x6d
mov byte [rsp + 0x6b], 0x76
mov byte [rsp + 0x6c], 0x61
mov byte [rsp + 0x6d], 0x4c
mov byte [rsp + 0x6e], 0x57
mov byte [rsp + 0x6f], 0x51
mov byte [rsp + 0x70], 0x42
mov byte [rsp + 0x71], 0x57
mov byte [rsp + 0x72], 0x50
mov byte [rsp + 0x73], 0x69
movzx eax, byte [rsp + 0x58]
mov r9, rbx
movabs rdi, 0x35a7f11e143b8a4b
mov r10, rdi
lea rax, [rsp + 0x58]
sub r10, rax
nop word [rax + rax]
lea rdx, [rsp + 0x58]
add rdx, r9
movsx r8, byte [rdx]
mov rcx, r9
and ecx, esi
cmp rcx, rsi
cmovae rcx, rsi
shl cl, 2
mov rax, rdi
shr rax, cl
and al, sil
add dl, r10b
xor al, dl
xor al, r8b
mov byte [rsp + r9 + 0x58], al
inc r9
cmp r9, 0x1c
jb 0x140003460
lea rdx, [rsp + 0x58]
mov rcx, r11
call fcn.1400055c0
mov r11, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov byte [rbp - 0x60], 0xda
mov byte [rbp - 0x5f], 0xdf
mov byte [rbp - 0x5e], 0xfd
mov byte [rbp - 0x5d], 0x81
mov byte [rbp - 0x5c], 0xf9
mov byte [rbp - 0x5b], 0x80
mov byte [rbp - 0x5a], 0xf3
mov byte [rbp - 0x59], 0x84
mov byte [rbp - 0x58], 0xb1
mov byte [rbp - 0x57], 0x9b
mov byte [rbp - 0x56], 0x82
mov byte [rbp - 0x55], 0x8a
mov byte [rbp - 0x54], 0xcd
mov byte [rbp - 0x53], 0x94
mov byte [rbp - 0x52], 0x84
mov byte [rbp - 0x51], 0x9f
mov byte [rbp - 0x50], 0xc0
mov byte [rbp - 0x4f], 0x89
mov byte [rbp - 0x4e], 0x84
mov byte [rbp - 0x4d], 0x81
mov byte [rbp - 0x4c], 0x87
mov byte [rbp - 0x4b], 0xcd
mov byte [rbp - 0x4a], 0x97
mov byte [rbp - 0x49], 0x8c
mov byte [rbp - 0x48], 0xce
mov byte [rbp - 0x47], 0x90
mov byte [rbp - 0x46], 0x9b
mov byte [rbp - 0x45], 0x8a
mov byte [rbp - 0x44], 0x8a
mov byte [rbp - 0x43], 0x92
mov byte [rbp - 0x42], 0x89
mov byte [rbp - 0x41], 0x91
mov byte [rbp - 0x40], 0xd0
mov byte [rbp - 0x3f], 0x96
mov byte [rbp - 0x3e], 0x91
mov byte [rbp - 0x3d], 0x9f
mov byte [rbp - 0x3c], 0x93
mov byte [rbp - 0x3b], 0x93
mov byte [rbp - 0x3a], 0xcc
mov byte [rbp - 0x39], 0xd3
mov byte [rbp - 0x38], 0xfe
movzx eax, byte [rbp - 0x60]
mov r9, rbx
movabs rdi, 0xce9ecfe1de1904d7
mov r10, rdi
lea rax, [rbp - 0x60]
sub r10, rax
nop dword [rax]
lea rdx, [rbp - 0x60]
add rdx, r9
movsx r8, byte [rdx]
mov rcx, r9
and ecx, esi
cmp rcx, rsi
cmovae rcx, rsi
shl cl, 2
mov rax, rdi
shr rax, cl
and al, sil
add dl, r10b
xor al, dl
xor al, r8b
mov byte [rbp + r9 - 0x60], al
inc r9
cmp r9, 0x29
jb 0x140003570
lea rdx, [rbp - 0x60]
mov rcx, r11
call fcn.1400055c0
lea rdx, [rbp + 0xa0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140005a60
lea rdx, [0x140008624]
lea rcx, [rbp + 0xa0]
call fcn.140006200
test al, al
jne 0x140003838
lea rdx, [0x140008628]
lea rcx, [rbp + 0xa0]
call fcn.140006200
test al, al
jne 0x140003838
lea rdx, [0x14000862c]
lea rcx, [rbp + 0xa0]
call fcn.140006200
test al, al
jne 0x140003838
lea rdx, [0x140008630]
lea rcx, [rbp + 0xa0]
call fcn.140006200
test al, al
jne 0x140003838
lea rcx, [0x1400085f8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdi, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov byte [rsp + 0x28], 0x8a
mov byte [rsp + 0x29], 0xa0
mov byte [rsp + 0x2a], 0xd9
mov byte [rsp + 0x2b], 0xa3
mov byte [rsp + 0x2c], 0xd6
mov byte [rsp + 0x2d], 0xa8
mov byte [rsp + 0x2e], 0xce
mov byte [rsp + 0x2f], 0xed
mov byte [rsp + 0x30], 0xed
mov byte [rsp + 0x31], 0xf4
mov byte [rsp + 0x32], 0xf6
mov byte [rsp + 0x33], 0xfb
mov byte [rsp + 0x34], 0xf8
mov byte [rsp + 0x35], 0xf7
mov byte [rsp + 0x36], 0xbe
mov byte [rsp + 0x37], 0xba
mov byte [rsp + 0x38], 0x90
movzx eax, byte [rsp + 0x28]
mov r9, rbx
movabs r10, 0x25450957f0402b87
mov r11, r10
lea rax, [rsp + 0x28]
sub r11, rax
nop word [rax + rax]
lea rdx, [rsp + 0x28]
add rdx, r9
movsx r8, byte [rdx]
mov rcx, r9
and ecx, esi
cmp rcx, rsi
cmovae rcx, rsi
shl cl, 2
mov rax, r10
shr rax, cl
and al, sil
add dl, r11b
xor al, dl
xor al, r8b
mov byte [rsp + r9 + 0x28], al
inc r9
cmp r9, 0x11
jb 0x1400036c0
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.1400055c0
call fcn.1400027a0
mov r11, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov byte [rbp - 0x30], 0xaa
mov byte [rbp - 0x2f], 0x9a
mov byte [rbp - 0x2e], 0xe0
mov byte [rbp - 0x2d], 0x9e
mov byte [rbp - 0x2c], 0xe9
mov byte [rbp - 0x2b], 0x99
mov byte [rbp - 0x2a], 0xe8
mov byte [rbp - 0x29], 0xd2
mov byte [rbp - 0x28], 0xce
mov byte [rbp - 0x27], 0x91
mov byte [rbp - 0x26], 0xd7
mov byte [rbp - 0x25], 0xcd
mov byte [rbp - 0x24], 0xdd
mov byte [rbp - 0x23], 0x96
mov byte [rbp - 0x22], 0xdf
mov byte [rbp - 0x21], 0xd6
mov byte [rbp - 0x20], 0xc7
mov byte [rbp - 0x1f], 0xea
mov byte [rbp - 0x1e], 0xa8
mov byte [rbp - 0x1d], 0xa9
mov byte [rbp - 0x1c], 0xa1
mov byte [rbp - 0x1b], 0xa8
mov byte [rbp - 0x1a], 0xaf
mov byte [rbp - 0x19], 0xa8
mov byte [rbp - 0x18], 0xaf
mov byte [rbp - 0x17], 0xe1
mov byte [rbp - 0x16], 0xa9
mov byte [rbp - 0x15], 0xa9
mov byte [rbp - 0x14], 0xe8
mov byte [rbp - 0x13], 0xa7
mov byte [rbp - 0x12], 0xad
mov byte [rbp - 0x11], 0xa5
mov byte [rbp - 0x10], 0xe0
mov byte [rbp - 0xf], 0xb8
mov byte [rbp - 0xe], 0xba
mov byte [rbp - 0xd], 0xbb
mov byte [rbp - 0xc], 0xf4
mov byte [rbp - 0xb], 0xad
mov byte [rbp - 0xa], 0xa3
mov byte [rbp - 9], 0xbc
mov byte [rbp - 8], 0xb8
mov byte [rbp - 7], 0xb4
mov byte [rbp - 6], 0xa5
mov byte [rbp - 5], 0xfe
mov byte [rbp - 4], 0xd8
movzx eax, byte [rbp - 0x30]
movabs r9, 0x7ca35f9cb4d77aaf
mov r10, r9
lea rax, [rbp - 0x30]
sub r10, rax
nop
lea rdx, [rbp - 0x30]
add rdx, rbx
movzx r8d, byte [rdx]
mov rcx, rbx
and ecx, esi
cmp rcx, rsi
cmovae rcx, rsi
shl cl, 2
mov rax, r9
shr rax, cl
and al, sil
add dl, r10b
xor al, dl
xor al, r8b
mov byte [rbp + rbx - 0x30], al
inc rbx
cmp rbx, 0x2d
jb 0x1400037e0
lea rdx, [rbp - 0x30]
mov rcx, r11
call fcn.1400055c0
mov ecx, 0xdac
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov byte [rsp + 0x20], 0x93
mov byte [rsp + 0x21], 0x9f
mov byte [rsp + 0x22], 0x8f
mov byte [rsp + 0x23], 0xf2
movzx eax, byte [rsp + 0x20]
mov r9, rbx
movabs r11, 0xd5f50ca8ca7cc1fb
mov r10, r11
lea rax, [rsp + 0x20]
sub r10, rax
nop dword [rax]
lea rdx, [rsp + 0x20]
add rdx, r9
movsx r8, byte [rdx]
mov rcx, r9
and ecx, esi
cmp rcx, rsi
cmovae rcx, rsi
shl cl, 2
mov rax, r11
shr rax, cl
and al, sil
add dl, r10b
xor al, dl
xor al, r8b
mov byte [rsp + r9 + 0x20], al
inc r9
cmp r9, 4
jb 0x140003870
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdi, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov byte [rsp + 0x40], 0x8a
mov byte [rsp + 0x41], 0xa0
mov byte [rsp + 0x42], 0xd9
mov byte [rsp + 0x43], 0xa3
mov byte [rsp + 0x44], 0xd6
mov byte [rsp + 0x45], 0xa8
mov byte [rsp + 0x46], 0xce
mov byte [rsp + 0x47], 0xed
mov byte [rsp + 0x48], 0xed
mov byte [rsp + 0x49], 0xf4
mov byte [rsp + 0x4a], 0xf6
mov byte [rsp + 0x4b], 0xfb
mov byte [rsp + 0x4c], 0xf8
mov byte [rsp + 0x4d], 0xf7
mov byte [rsp + 0x4e], 0xbe
mov byte [rsp + 0x4f], 0xba
mov byte [rsp + 0x50], 0x90
movzx eax, byte [rsp + 0x40]
mov r9, rbx
movabs r10, 0x25450957f0402b87
mov r11, r10
lea rax, [rsp + 0x40]
sub r11, rax
nop
lea rdx, [rsp + 0x40]
add rdx, r9
movsx r8, byte [rdx]
mov rcx, r9
and ecx, esi
cmp rcx, rsi
cmovae rcx, rsi
shl cl, 2
mov rax, r10
shr rax, cl
and al, sil
add dl, r11b
xor al, dl
xor al, r8b
mov byte [rsp + r9 + 0x40], al
inc r9
cmp r9, 0x11
jb 0x140003930
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.1400055c0
call fcn.1400027a0
lea rcx, [rbp + 0x80]
call fcn.1400012b0
mov rcx, rax
call fcn.1400015c0
lea rcx, [0x1400085f8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r11, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov byte [rbp], 0xaa
mov byte [rbp + 1], 0x9a
mov byte [rbp + 2], 0xe0
mov byte [rbp + 3], 0x9e
mov byte [rbp + 4], 0xe9
mov byte [rbp + 5], 0x99
mov byte [rbp + 6], 0xe8
mov byte [rbp + 7], 0xd2
mov byte [rbp + 8], 0xce
mov byte [rbp + 9], 0x91
mov byte [rbp + 0xa], 0xd7
mov byte [rbp + 0xb], 0xcd
mov byte [rbp + 0xc], 0xdd
mov byte [rbp + 0xd], 0x96
mov byte [rbp + 0xe], 0xdf
mov byte [rbp + 0xf], 0xd6
mov byte [rbp + 0x10], 0xc7
mov byte [rbp + 0x11], 0xea
mov byte [rbp + 0x12], 0xa8
mov byte [rbp + 0x13], 0xa9
mov byte [rbp + 0x14], 0xa1
mov byte [rbp + 0x15], 0xa8
mov byte [rbp + 0x16], 0xaf
mov byte [rbp + 0x17], 0xa8
mov byte [rbp + 0x18], 0xaf
mov byte [rbp + 0x19], 0xe1
mov byte [rbp + 0x1a], 0xa9
mov byte [rbp + 0x1b], 0xa9
mov byte [rbp + 0x1c], 0xe8
mov byte [rbp + 0x1d], 0xa7
mov byte [rbp + 0x1e], 0xad
mov byte [rbp + 0x1f], 0xa5
mov byte [rbp + 0x20], 0xe0
mov byte [rbp + 0x21], 0xb8
mov byte [rbp + 0x22], 0xba
mov byte [rbp + 0x23], 0xbb
mov byte [rbp + 0x24], 0xf4
mov byte [rbp + 0x25], 0xad
mov byte [rbp + 0x26], 0xa3
mov byte [rbp + 0x27], 0xbc
mov byte [rbp + 0x28], 0xb8
mov byte [rbp + 0x29], 0xb4
mov byte [rbp + 0x2a], 0xa5
mov byte [rbp + 0x2b], 0xfe
mov byte [rbp + 0x2c], 0xd8
movzx eax, byte [rbp]
movabs r9, 0x7ca35f9cb4d77aaf
mov r10, r9
lea rax, [rbp]
sub r10, rax
lea rdx, [rbp]
add rdx, rbx
movzx r8d, byte [rdx]
mov rcx, rbx
and ecx, esi
cmp rcx, rsi
cmovae rcx, rsi
shl cl, 2
mov rax, r9
shr rax, cl
and al, sil
add dl, r10b
xor al, dl
xor al, r8b
mov byte [rbp + rbx], al
inc rbx
cmp rbx, 0x2d
jb 0x140003a70
lea rdx, [rbp]
mov rcx, r11
call fcn.1400055c0
mov ecx, 0xdac
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3