Function at 0x140035224
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
rcl ebp, 0xf0
shr ax, cl
cmp r11w, 0x67d2
push rsi
push rdi
push r12
bts ebx, r15d
shld si, r12w, 0xfd
inc r11b
push r13
sal rax, 0xc7
xor eax, 0x6a780334
sar sil, 0x50
push r14
push r15
sar bh, 0xbf
movsx r15w, al
lea rbp, [rsp - 0x240]
sub r8b, 0xb8
sub rsp, 0x340
mov rax, qword [0x14002b010]
xor rax, rsp
mov qword [rbp + 0x230], rax
dec si
mov rsi, rdx
adc bl, 0x98
sub r15w, r12w
mov r15, rcx
cmp qword [0x14002be18], 0x10
setae r11b
mov r8b, 0x99
lea rbx, [0x14002be00]
movsxd r8, ecx
movsx r8w, dl
movsx r8, ax
mov r8, qword [0x14002be00]
jmp 0x1400352c4
jb 0x1400352db
movzx eax, byte [r8]
mov r9, r8
jmp 0x1400352d6
jmp 0x1400352f3
movzx eax, r8b
bsf cx, si
sar r9b, cl
mov r9, rbx
dec cl
movzx r10d, r9w
rol r10b, 0x53
xor al, 0x5c
rcl ecx, cl
movzx cx, r11b
and cl, 0xc
movsx ecx, al
shld rax, r11, 0x27
xor r10, rcx
mov word [rsp + 0x30], cx
not r10b
bsf r10, r9
xor edx, edx
sbb ax, 0x651
inc ax
or ax, dx
mov eax, 1
shr r10w, 0x42
sbb r10b, dil
mov r10, qword [0x14002be10]
div r10
shl ah, 0x51
movsx r9d, byte [rdx + r9]
jmp 0x140035346
movzx eax, r9w
stc
test dil, r15b
xor ax, 0x2a
cmc
test r11, r8
cmp r9w, 0x670c
mov word [rsp + 0x32], ax
xor r12d, r12d
jmp 0x140035369
mov word [rsp + 0x34], r12w
test r15b, dil
jmp 0x140035377
test r11b, r11b
je 0x14003538e
movsx eax, byte [r8]
jmp 0x140035389
jmp 0x1400353a6
movsx eax, r8b
shl r8b, 0x55
or r8b, r13b
xor r8d, 0x536a92
mov r8, rbx
test r11d, r15d
xor ax, cx
sar rcx, cl
sar ch, 0xad
xor cx, 0x1f7a
mov word [rsp + 0x30], ax
sub edx, edx
xor eax, r10d
shrd rax, rdx, 0x5a
dec ax
mov eax, 1
div r10
movzx cx, sil
ror ax, 0xfb
adc rcx, 0x5e0e488f
movzx eax, byte [rdx + r8]
cmp r10b, sil
bts rcx, rcx
dec ch
xor al, 0x2a
movzx r8w, dil
cwd
adc dl, 0xfa
movsx ecx, al
shl r8w, cl
clc
xor cx, r9w
movsxd r8, esp
cdq
mov word [rsp + 0x32], cx
movzx r8, r8w
movsx edx, ax
cdq
mov byte [rsp + 0x36], r12b
cqo
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x38], r12
movsx rcx, r9w
bswap rcx
not cl
mov qword [rbp - 0x30], 7
sete r8b
mov word [rbp - 0x48], r12w
movsx ecx, r12w
jmp 0x140035447
mov r8d, 2
xchg dx, dx
cdq
lea rdx, [rsp + 0x30]
bswap cx
movsx cx, bpl
lea rcx, [rbp - 0x48]
jmp 0x140035467
call fcn.14001dba0
nop
lea r8, [rbp - 0x48]
cmovae dx, r10w
mov rdx, r15
setge ch
lea rcx, [rbp - 0x68]
call fcn.14001e140
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jmp 0x140035493
jb 0x1400354f7
lea rdx, [rdx*2 + 2]
add ax, 0x5c73
cmc
btr cx, 0x3b
mov rcx, qword [rbp - 0x48]
bts eax, r13d
btc eax, edx
rol eax, cl
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400354f2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jmp 0x1400354e0
jbe 0x1400354f2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140020c34
lea rcx, [rbp - 0x68]
sbb rdx, 0x69e50f3b
bswap edx
or dx, r15w
cmp qword [rbp - 0x50], 8
cdq
movsxd rdx, r10d
cmovae rcx, qword [rbp - 0x68]
cwd
mov edx, 0x202224b1
lea rdx, [rbp - 0x20]
jmp 0x140035526
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r14, rax
shl dx, cl
clc
mov rdx, qword [rbp - 0x50]
cmp di, r12w
cmp rdx, 8
jb 0x1400355c8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
xor rax, 0x545b2c37
bsr ax, r13w
bts ax, r13w
mov rax, rcx
test r14w, r13w
cmp r15, 0x180965a1
cmp dl, r14b
cmp rdx, 0x1000
jmp 0x14003557f
jb 0x1400355c3
add rdx, 0x27
jmp 0x14003558e
mov rcx, qword [rcx - 8]
sub rax, rcx
clc
cmp r12b, 0x68
add rax, 0xfffffffffffffff8
jmp 0x1400355a8
cmp rax, 0x1f
jmp 0x1400355b1
jbe 0x1400355c3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140020c34
mov qword [rbp - 0x58], r12
cmc
jmp 0x1400355d8
mov qword [rbp - 0x50], 7
jmp 0x1400355e5
mov word [rbp - 0x68], r12w
test rsp, rdx
cmp r14, 0xffffffffffffffff
jmp 0x1400355f6
je 0x140035d8f
mov r13d, 0x11b
btr r10, r13
lea r10, [0x14002be20]
test byte [rbp - 0x20], 0x10
jmp 0x140035616
je 0x140035cbd
mov ecx, 0x2e
jmp 0x140035626
sub edx, edx
jmp 0x14003562d
call fcn.140001880
movzx r9d, ax
mov word [rsp + 0x38], ax
sbb dx, dx
xor ecx, ecx
mov dh, 0x22
not dl
lea edx, [rcx + 1]
jmp 0x14003564d
call fcn.140001880
mov word [rsp + 0x3a], ax
movsx edx, si
lea edx, [rcx + 2]
jmp 0x140035667
movzx ecx, word [0x140024a58]
jmp 0x140035673
call fcn.140001880
mov word [rsp + 0x3c], ax
add edx, ebx
xor eax, eax
xor rcx, rcx
cmp bl, 0x9e
mov word [rsp + 0x3e], ax
rcr dh, 0x23
mov edx, r12d
cdqe
and ch, ch
nop dword [rax]
shld cx, r14w, 0x16
rcr al, cl
nop dword [rax + rax]
shrd ecx, r11d, 0x1c
rcl eax, cl
movsxd rax, edx
mov cx, 0x1165
and cl, 4
rol ch, cl
lea rcx, [rsp + 0x38]
lea rcx, [rcx + rax*2]
rol ax, cl
or ah, ch
lea eax, [rdx + r13]
xor word [rcx], ax
inc edx
stc
cmp edx, 3
jmp 0x1400356dd
jb 0x1400356b1
mov word [rsp + 0x3e], r12w
movzx edx, r10w
movsx r8w, r10b
shl dh, 0x75
lea rax, [rbp + 0xc]
lea r8, [rsp + 0x38]
sar dx, cl
xchg ecx, ecx
rcl dh, cl
sub r8, rax
xor edx, r11d
or dx, 0x6d3c
nop dword [rax]
cmp r8w, r12w
test bx, 0x35bf
movzx edx, word [rax]
btr cx, r13w
btc cx, r12w
movzx ecx, word [rax + r8]
sub edx, ecx
jmp 0x140035736
jne 0x140035748
add rax, 2
test ecx, ecx
jne 0x14003571d
test edx, edx
je 0x140035d5c
mov word [rsp + 0x48], r9w
xchg dx, dx
mov ecx, 0x2e
lea edx, [rcx - 0x2d]
call fcn.140001880
mov word [rsp + 0x4a], ax
bsf dx, bx
movsxd rdx, r14d
sub ecx, ecx
cdq
bswap edx
lea edx, [rcx + 2]
jmp 0x14003577f
call fcn.140001880
mov word [rsp + 0x4c], ax
movzx dx, r15b
movzx edx, ax
cdq
lea edx, [rcx + 3]
cmove ecx, ecx
movzx ecx, dx
movzx rcx, r10w
movzx ecx, word [0x140024a5e]
call fcn.140001880
mov word [rsp + 0x4e], ax
cdq
mov edx, 4
not ch
movsx rcx, sp
movzx ecx, word [0x140024a60]
call fcn.140001880
mov word [rsp + 0x50], ax
sub ch, ah
sub eax, eax
mov word [rsp + 0x52], ax
movsx ax, bl
cmp cx, 0x428a
mov edx, r12d
nop word [rax + rax]
bts ax, cx
movsxd rax, edx
jmp 0x1400357ff
lea rcx, [rsp + 0x48]
lea rcx, [rcx + rax*2]
movzx ax, r13b
cmovb ax, di
lea eax, [rdx + r13]
xor word [rcx], ax
jmp 0x14003581d
inc edx
test spl, r12b
cmp edx, 5
jmp 0x14003582a
jb 0x1400357ef
mov word [rsp + 0x52], r12w
adc dx, 0x2063
cmp r15d, ebp
test dil, 0x6b
lea rax, [rbp + 0xc]
sbb cl, sil
mov r8d, r13d
xadd dl, ch
lea r8, [rsp + 0x48]
rol cx, cl
setne ch
sub r8, rax
sbb dl, 0x1c
inc ecx
nop dword [rax]
ror dh, 0x90
movzx edx, r8w
movsx cx, r8b
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140035898
add rax, 2
jmp 0x14003588b
test ecx, ecx
jmp 0x140035892
jne 0x140035872
test edx, edx
jmp 0x14003589f
je 0x140035d5c
cmp qword [0x14002be38], 0x10
setae r9b
mov rcx, r10
cdq
cmovae rcx, qword [0x14002be20]
shrd ax, cx, 0x68
movsx r8d, byte [rcx]
or al, 0x73
shrd cx, cx, 0xe0
btr rdx, rcx
movzx eax, r8w
rcl ch, cl
xor ax, 0x5c
btc cx, 0xb3
inc ecx
cwd
mov word [rsp + 0x40], ax
mov word [rsp + 0x42], r12w
sub ax, di
mov rax, r10
test r9b, r9b
movzx rcx, bx
cmovne rax, qword [0x14002be20]
xor dx, r10w
movzx edx, bp
movzx eax, byte [rax]
bsf cx, ax
ror dx, cl
xor al, 0x5c
neg dx
rcl ecx, cl
movsx ecx, al
or dx, 0x4689
movzx rdx, sp
xor cx, r8w
cdq
cqo
mov word [rsp + 0x40], cx
mov r8w, 0x1299
mov dx, bx
movzx dx, r8b
mov byte [rsp + 0x44], 0
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x78], r12
cmovb ecx, edx
mov qword [rbp - 0x70], 7
cdq
mov word [rsp + 0x78], r12w
cmovl r8d, ebx
mov r8d, 1
movsxd rcx, r8d
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x78]
jmp 0x14003597d
call fcn.14001dba0
nop
cwd
movsx r8, r9w
lea r8, [rsp + 0x78]
mov dl, r8b
movsx rcx, si
jmp 0x14003599a
mov rdx, r15
xchg ecx, ecx
lea rcx, [rsp + 0x58]
call fcn.14001e140
nop
neg dh
mov rdx, qword [rbp - 0x70]
test r14, 0x77321e17
cmp rdx, 8
jmp 0x1400359c0
jb 0x140035a34
lea rdx, [rdx*2 + 2]
adc rcx, rsi
mov ax, 0x1646
sar ah, cl
mov rcx, qword [rsp + 0x78]
movzx rax, si
sbb al, 0x72
mov rax, rcx
cmc
cmp sp, bp
clc
cmp rdx, 0x1000
jmp 0x1400359f6
jb 0x140035a2f
add rdx, 0x27
test spl, al
mov rcx, qword [rcx - 8]
sub rax, rcx
test rsp, 0x79640b8b
stc
cmp r9, rdi
add rax, 0xfffffffffffffff8
cmp dx, sp
cmc
test r14b, r10b
cmp rax, 0x1f
jmp 0x140035a29
ja 0x140035deb
call fcn.140020c34
mov qword [rbp - 0x78], r12
inc dh
bswap dx
movsx eax, r14w
mov qword [rbp - 0x70], 7
rdtsc
mov word [rsp + 0x78], r12w
cdqe
xchg ah, dh
lea rax, [rbp + 0xc]
xchg edx, edx
movzx dx, r9b
cqo
mov rdx, 0xffffffffffffffff
nop dword [rax]
jmp 0x140035a72
inc rdx
cmp word [rax + rdx*2], 0
jmp 0x140035a7f
jne 0x140035a72
mov rcx, qword [rsp + 0x68]
test r13d, 0x1e836de
sbb al, sil
setp r8b
mov r8, qword [rsp + 0x70]
sub al, bh
test r12b, 0x3d
rcl ax, 0x8e
mov rax, r8
clc
stc
sub rax, rcx
cmp rdx, rax
jmp 0x140035ab7
ja 0x140035b24
lea rdi, [rcx + rdx]
movzx ebx, ax
shl bx, 0x8b
shr bx, 0x7f
mov qword [rsp + 0x68], rdi
movsx ebx, di
shl ebx, 0x22
lea rbx, [rsp + 0x58]
cmp r8, 8
cmovae rbx, qword [rsp + 0x58]
movsxd r8, ebx
seto r8b
lea rcx, [rbx + rcx*2]
movsxd r8, ebx
lea r8, [rdx + rdx]
movzx rdx, r12w
lea rdx, [rbp + 0xc]
jmp 0x140035b05
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi*2], r12w
movzx eax, di
cwde
cdqe
lea rax, [rsp + 0x58]
jmp 0x140035b1f
jmp 0x140035b3f
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0xc]
setae cl
lea rcx, [rsp + 0x58]
jmp 0x140035b3a
call fcn.14001fa50
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], r12
movsx edx, si
dec dl
movups xmm0, xmmword [rax]
xor dh, 0xf9
btc dx, 0xdc
rol rdx, cl
movups xmmword [rbp - 0x48], xmm0
shld dx, sp, 0xa9
movups xmm1, xmmword [rax + 0x10]
movzx rdx, dx
bts edx, ecx
movups xmmword [rbp - 0x38], xmm1
movsx dx, r11b
sar dh, cl
mov qword [rax + 0x10], r12
sar dl, 0x36
mov qword [rax + 0x18], 7
sar rdx, cl
movsxd rdx, esi
bts edx, r8d
mov word [rax], r12w
bt dx, 0x84
mov rdx, qword [rsp + 0x70]
cmp sil, r8b
cmc
cmp rdx, 8
jmp 0x140035bb1
jb 0x140035c18
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
rcr al, 0x8e
bt rax, 0x39
mov rax, rcx
jmp 0x140035bd4
cmp rdx, 0x1000
jmp 0x140035be0
jb 0x140035c13
add rdx, 0x27
clc
cmc
mov rcx, qword [rcx - 8]
sub rax, rcx
cmp dil, 0xce
add rax, 0xfffffffffffffff8
jmp 0x140035c04
cmp rax, 0x1f
jmp 0x140035c0d
ja 0x140035df7
call fcn.140020c34
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], 7
cqo
not dx
movzx edx, dx
mov word [rsp + 0x58], r12w
movzx ecx, r8w
mov rdx, rsi
movzx rcx, bp
cmova cx, bx
lea rcx, [rbp - 0x48]
call fcn.140035224
test al, al
jmp 0x140035c53
jne 0x140035dfe
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jmp 0x140035c66
jb 0x140035d5c
lea rdx, [rdx*2 + 2]
and rax, 0x65f35c1d
mov rcx, qword [rbp - 0x48]
cmc
mov rax, rcx
stc
cmp rdx, 0x1000
jmp 0x140035c90
jb 0x140035cb3
add rdx, 0x27
stc
mov rcx, qword [rcx - 8]
sub rax, rcx
test cl, r8b
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035e7c
call fcn.140020c34
jmp 0x140035d5c
mov r9, qword [rsi]
rcr r10b, cl
mov r10, qword [rsi + 8]
cmp r9, r10
je 0x140035d5c
nop
or r8, 0x141f07b2
mov r8, r9
stc
cmp r9b, r14b
test r8w, r15w
cmp qword [r9 + 0x18], 8
jmp 0x140035cee
jb 0x140035cf7
mov r8, qword [r9]
lea rax, [rbp + 0xc]
sub r8, rax
shr cx, cl
btc cx, ax
movzx edx, word [rax]
rcl rcx, 0x19
bts ecx, r15d
sbb ecx, r13d
movzx ecx, word [rax + r8]
sub edx, ecx
jmp 0x140035d1f
jne 0x140035d38
add rax, 2
test r13b, r10b
cmp r9b, bpl
cmc
test ecx, ecx
jne 0x140035d05
test edx, edx
jmp 0x140035d3f
je 0x140035e99
add r9, 0x20
jmp 0x140035d4e
cmp r9, r10
jmp 0x140035d56
jne 0x140035cd9
lea rdx, [rbp - 0x20]
xchg ecx, ecx
movsx cx, dh
mov rcx, r14
jmp 0x140035d6e
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jmp 0x140035d7b
jne 0x140035606
mov rcx, r14
jmp 0x140035d89
call qword [sym.imp.KERNEL32.dll_FindClose]
sub al, al
adc ecx, r15d
mov ch, 0xcd
mov rcx, qword [rbp + 0x230]
xor rcx, rsp
call fcn.14004f3c9
mov rbx, qword [rsp + 0x390]
sal r12b, cl
cmp spl, dl
add rsp, 0x340
movzx r14d, r9w
not r12b
pop r15
movsx r14w, r12b
movsxd rbp, r13d
pop r14
setns r13b
movzx ebp, bx
cmovne rdi, rcx
pop r13
movsx rdi, dx
pop r12
xchg dil, bpl
not si
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
jmp 0x140035df7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov dx, sp
sal dl, 0x96
mov rdx, qword [rbp - 0x30]
cmp ebp, eax
cmp rdx, 8
jmp 0x140035e1d
jb 0x140035e8d
lea rdx, [rdx*2 + 2]
shr eax, 0xf8
sal ecx, 0x2e
xadd ah, al
mov rcx, qword [rbp - 0x48]
cmovp ax, r12w
bt ax, r9w
adc al, r10b
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035e88
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
cmp r15w, bx
add rax, 0xfffffffffffffff8
cmp r9d, esp
cmc
stc
cmp rax, 0x1f
jmp 0x140035e76
jbe 0x140035e88
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140020c34
mov al, 1
jmp 0x140035e94
jmp 0x140035d97
mov rcx, r14
jmp 0x140035ea1
call qword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
jmp 0x140035d97