Function at 0x140160b51
Capabilities:
Authenticate hmac

Disassembly:
push rax
pushf
mov eax, 0xdce13d4d
pushf
not eax
add eax, 0x8e04c1e3
xor eax, 0xc49baafc
rol eax, 0xdb
popf
pushf
not eax
add eax, 0x8265dc0f
xor eax, 0xf0413161
rol eax, 0x5c
popf
pushf
not eax
add eax, 0xb0730629
xor eax, 0xd3cf864d
rol eax, 0x65
popf
pushf
not eax
add eax, 0xdecd28ea
xor eax, 0xe52e844f
rol eax, 0x1b
popf
cmp eax, 4
jne 0x140160bb4
popf
pop rax
jmp 0x140161004
cmp eax, 0
jne 0x140160bc3
popf
pop rax
jmp 0x140160d67
cmp eax, 3
jne 0x140160bd2
popf
pop rax
jmp 0x140160fa4
cmp eax, 1
jne 0x140160be1
popf
pop rax
jmp 0x140160e1a
cmp eax, 0xd
jne 0x140160bf0
popf
pop rax
jmp 0x1401614c6
cmp eax, 0x1a
jne 0x140160bff
popf
pop rax
jmp 0x14016192d
cmp eax, 0xe
jne 0x140160c0e
popf
pop rax
jmp 0x14016150a
cmp eax, 0xb
jne 0x140160c1d
popf
pop rax
jmp 0x1401613ca
cmp eax, 0x19
jne 0x140160c2c
popf
pop rax
jmp 0x1401618f2
cmp eax, 8
jne 0x140160c3b
popf
pop rax
jmp 0x140161282
cmp eax, 0x1d
jne 0x140160c4a
popf
pop rax
jmp 0x140161a7c
cmp eax, 0x17
jne 0x140160c59
popf
pop rax
jmp 0x14016180b
cmp eax, 0x1c
jne 0x140160c68
popf
pop rax
jmp 0x1401619ed
cmp eax, 0x12
jne 0x140160c77
popf
pop rax
jmp 0x140161638
cmp eax, 0x18
jne 0x140160c86
popf
pop rax
jmp 0x1401618b2
cmp eax, 0x11
jne 0x140160c95
popf
pop rax
jmp 0x1401615f4
cmp eax, 0x1b
jne 0x140160ca4
popf
pop rax
jmp 0x140161992
cmp eax, 0x16
jne 0x140160cb3
popf
pop rax
jmp 0x1401617ac
cmp eax, 0xa
jne 0x140160cc2
popf
pop rax
jmp 0x140161347
cmp eax, 0x14
jne 0x140160cd1
popf
pop rax
jmp 0x1401616f8
cmp eax, 0xf
jne 0x140160ce0
popf
pop rax
jmp 0x1401615ae
cmp eax, 0x13
jne 0x140160cef
popf
pop rax
jmp 0x1401616b5
cmp eax, 0x15
jne 0x140160cfe
popf
pop rax
jmp 0x140161759
cmp eax, 2
jne 0x140160d0d
popf
pop rax
jmp 0x140160ee4
cmp eax, 6
jne 0x140160d1c
popf
pop rax
jmp 0x14016112d
cmp eax, 0xc
jne 0x140160d2b
popf
pop rax
jmp 0x14016140e
cmp eax, 7
jne 0x140160d3a
popf
pop rax
jmp 0x1401611ce
cmp eax, 5
jne 0x140160d49
popf
pop rax
jmp 0x140161086
cmp eax, 9
jne 0x140160d58
popf
pop rax
jmp 0x1401612d2
cmp eax, 0x10
jne 0x140160d67
popf
pop rax
jmp 0x1401615ee
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
lea rdi, [rcx + 0x68]
mov rax, qword [rdi]
cmp dword [rax - 0x10], 0
jne 0x140160dc1
push rax
pushf
mov eax, 0x3af822e1
pushf
not eax
add eax, 0x8ca1577b
xor eax, 0xa3cc9d6c
rol eax, 0x5a
popf
pushf
not eax
add eax, 0xb7532f0f
xor eax, 0xdf899847
rol eax, 0x9b
popf
jmp 0x140160ba5
push rax
pushf
mov eax, 0xcc1dc70
pushf
not eax
add eax, 0xec4ef8eb
xor eax, 0x9a8e2444
rol eax, 0x14
popf
pushf
not eax
add eax, 0xd21628cf
xor eax, 0x9c64b9da
rol eax, 0xc0
popf
pushf
not eax
add eax, 0xa86742c6
xor eax, 0xfecd766c
rol eax, 0xff
popf
pushf
not eax
add eax, 0xc3daf9d9
xor eax, 0xaf6c75e4
rol eax, 0xf5
popf
jmp 0x140160ba5
add rcx, 8
lea rdx, [rsp + 0x58]
jmp 0x140160e24
call qword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidA]
test eax, eax
je 0x140160e8b
push rax
pushf
mov eax, 0xb1c38715
pushf
not eax
add eax, 0x8eb83724
xor eax, 0x9bf00c00
rol eax, 0xbc
popf
pushf
not eax
add eax, 0xdf8e6a43
xor eax, 0xcae94f0b
rol eax, 0xcf
popf
pushf
not eax
add eax, 0xb6cd3ba5
xor eax, 0xc80d2ab3
rol eax, 9
popf
pushf
not eax
add eax, 0xcb3881fc
xor eax, 0xe0284c6f
rol eax, 0xe4
popf
jmp 0x140160ba5
push rax
pushf
mov eax, 0x740e4589
pushf
not eax
add eax, 0x84c857a7
xor eax, 0xa15f890e
rol eax, 0xed
popf
pushf
not eax
add eax, 0xfe883b21
xor eax, 0xd5782754
rol eax, 0x58
popf
pushf
not eax
add eax, 0xdc1f5807
xor eax, 0x9a41b714
rol eax, 0x46
popf
pushf
not eax
add eax, 0xa20e8afd
xor eax, 0xe9bb3d10
rol eax, 0xa5
popf
jmp 0x140160ba5
mov rsi, qword [rsp + 0x58]
test rsi, rsi
je 0x140160f4b
push rax
pushf
mov eax, 0x84c6cf99
pushf
not eax
add eax, 0xd0bfacab
xor eax, 0xc6b352fb
rol eax, 0x32
popf
pushf
not eax
add eax, 0xe1e3a42c
xor eax, 0xd37a5f45
rol eax, 0x2f
popf
pushf
not eax
add eax, 0xf98bc691
xor eax, 0xdd6b8de5
rol eax, 0x5d
popf
pushf
not eax
add eax, 0xe1a8f78c
xor eax, 0x8930778a
rol eax, 0x8a
popf
jmp 0x140160ba5
push rax
pushf
mov eax, 0x285b0d86
pushf
not eax
add eax, 0x8a89441b
xor eax, 0xa7113f43
rol eax, 0xe8
popf
pushf
not eax
add eax, 0x9c0d0fef
xor eax, 0xf68c44be
rol eax, 0xe0
popf
pushf
not eax
add eax, 0xa403dcbd
xor eax, 0xfcd7b94a
rol eax, 0xe8
popf
pushf
not eax
add eax, 0xe080d23a
xor eax, 0xf4a76335
rol eax, 0xe5
popf
jmp 0x140160ba5
mov rbx, 0xffffffffffffffff
push rax
pushf
mov eax, 0xdfd81f92
pushf
not eax
add eax, 0xedc93250
xor eax, 0xbf5f81a0
rol eax, 0x62
popf
pushf
not eax
add eax, 0x8082e064
xor eax, 0x8e548695
rol eax, 0x56
popf
pushf
not eax
add eax, 0xfbe0ace8
xor eax, 0xba31f3c9
rol eax, 0x61
popf
pushf
not eax
add eax, 0xd3f53a41
xor eax, 0x8434ccea
rol eax, 0x9a
popf
jmp 0x140160ba5
inc rbx
cmp byte [rsi + rbx], 0
jne 0x140161053
push rax
pushf
mov eax, 0xbe4e2b9c
pushf
not eax
add eax, 0xd36f91fd
xor eax, 0xf90de9c9
rol eax, 0xd
popf
pushf
not eax
add eax, 0x9b980d3f
xor eax, 0xd57d3865
rol eax, 0xfe
popf
pushf
not eax
add eax, 0xd2e181e4
xor eax, 0x9ba9d3ec
rol eax, 0xf4
popf
jmp 0x140160ba5
push rax
pushf
mov eax, 0xbb816df9
pushf
not eax
add eax, 0xc90ac9b7
xor eax, 0xadd648cc
rol eax, 0x2b
popf
pushf
not eax
add eax, 0xc253a58e
xor eax, 0xc9ba188b
rol eax, 0x91
popf
jmp 0x140160ba5
test ebx, ebx
je 0x1401610e7
push rax
pushf
mov eax, 0xb76d5eb8
pushf
not eax
add eax, 0xc00b676c
xor eax, 0xeec297ea
rol eax, 0xe4
popf
pushf
not eax
add eax, 0x9d338da0
xor eax, 0x84567f4e
rol eax, 0x7c
popf
pushf
not eax
add eax, 0xfa1a27bb
xor eax, 0xb9e3bd1e
rol eax, 0x66
popf
pushf
not eax
add eax, 0xa9cdc3c5
xor eax, 0xe868adb5
rol eax, 0xc0
popf
jmp 0x140160ba5
push rax
pushf
mov eax, 0xede22689
pushf
not eax
add eax, 0xa1cdc804
xor eax, 0xcdc90ec1
rol eax, 0x60
popf
pushf
not eax
add eax, 0x9c50fce9
xor eax, 0xe4a89d3c
rol eax, 0x55
popf
pushf
not eax
add eax, 0x8fd22637
xor eax, 0x8d91f55c
rol eax, 0xf3
popf
jmp 0x140160ba5
mov rax, qword [rdi]
mov r12d, dword [rax - 0x10]
mov r15, rsi
sub r15, rax
test ebx, ebx
js 0x14016119b
push rax
pushf
mov eax, 0xcb73b669
pushf
not eax
add eax, 0x9039a32e
xor eax, 0x9ce2764d
rol eax, 0x4e
popf
pushf
not eax
add eax, 0xf5a4a2b2
xor eax, 0xb119b763
rol eax, 0x4f
popf
pushf
not eax
add eax, 0xed563360
xor eax, 0xe8ad9dd6
rol eax, 0x56
popf
pushf
not eax
add eax, 0xf004c166
xor eax, 0xff02c9f3
rol eax, 0xe4
popf
jmp 0x140160ba5
push rax
pushf
mov eax, 0x9858b7a5
pushf
not eax
add eax, 0xe81d7cf7
xor eax, 0xfa2f6998
rol eax, 0x86
popf
pushf
not eax
add eax, 0x970a280d
xor eax, 0x9c1ef59c
rol eax, 0xe3
popf
jmp 0x140160ba5
mov ecx, 0x97f24b27
pushf
not ecx
add ecx, 0xd0b988d4
xor ecx, 0xee09ed39
rol ecx, 0x56
popf
pushf
not ecx
add ecx, 0xbb6a70df
xor ecx, 0x9574bd2a
rol ecx, 0x49
popf
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or eax, ecx
jge 0x14016123c
push rax
pushf
mov eax, 0xc0f33246
pushf
not eax
add eax, 0xcb156f37
xor eax, 0xd1094aeb
rol eax, 0xc3
popf
pushf
not eax
add eax, 0x9196978a
xor eax, 0xb83aeeab
rol eax, 0x78
popf
jmp 0x140160ba5
push rax
pushf
mov eax, 0x73017fb9
pushf
not eax
add eax, 0xa4facf0a
xor eax, 0x89de2ece
rol eax, 0x48
popf
pushf
not eax
add eax, 0x94fa4d66
xor eax, 0xd5e15e92
rol eax, 0x1a
popf
pushf
not eax
add eax, 0xdb141dd2
xor eax, 0xdc307611
rol eax, 0x72
popf
jmp 0x140160ba5
mov edx, ebx
mov rcx, rdi
call fcn.140167504
push rax
pushf
mov eax, 0x9994fa73
pushf
not eax
add eax, 0x973e20d3
xor eax, 0xf93f98d2
rol eax, 0x5e
popf
pushf
not eax
add eax, 0xc0cd577d
xor eax, 0xeb36a979
rol eax, 0xbb
popf
pushf
not eax
add eax, 0x9f280396
xor eax, 0x9a833320
rol eax, 0x95
popf
jmp 0x140160ba5
mov rcx, qword [rdi]
movsxd r14, ebx
movsxd r8, dword [rcx - 0xc]
cmp r15, r12
ja 0x140161314
push rax
pushf
mov eax, 0xf386c002
pushf
not eax
add eax, 0xf070176b
xor eax, 0xf3601717
rol eax, 0xe6
popf
pushf
not eax
add eax, 0x9b66e0d6
xor eax, 0xb91cc112
rol eax, 0x50
popf
jmp 0x140160ba5
push rax
pushf
mov eax, 0xe8268ed
pushf
not eax
add eax, 0xe469d46b
xor eax, 0xb0c5637a
rol eax, 0x6d
popf
pushf
not eax
add eax, 0xf51bfb4e
xor eax, 0xb40b0ea9
rol eax, 0x30
popf
jmp 0x140160ba5
lea rdx, [rcx + r15]
test rcx, rcx
jne 0x140161396
push rax
pushf
mov eax, 0x362ca6cc
pushf
not eax
add eax, 0xcbbcf147
xor eax, 0x9cb311f3
rol eax, 0x14
popf
pushf
not eax
add eax, 0xb25def8e
xor eax, 0xdc5e2464
rol eax, 0x36
popf
pushf
not eax
add eax, 0xcfe5e9ee
xor eax, 0x80dc85bf
rol eax, 0x1c
popf
jmp 0x140160ba5
push rax
pushf
mov eax, 0x3baba4c0
pushf
not eax
add eax, 0xb1d8a7bb
xor eax, 0xc3e9dbbf
rol eax, 0x62
popf
pushf
not eax
add eax, 0xd3ed7f05
xor eax, 0xccda19ee
rol eax, 0x46
popf
jmp 0x140160ba5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x16
jmp 0x1401617ac
test rdx, rdx
jne 0x14016146c
push rax
pushf
mov eax, 0x31e9b95c
pushf
not eax
add eax, 0xa039abb8
xor eax, 0xdf189a70
rol eax, 0x42
popf
pushf
not eax
add eax, 0xc8a238e5
xor eax, 0xf9cafb2e
rol eax, 0xc8
popf
pushf
not eax
add eax, 0xfa2fc209
xor eax, 0xc9c0bfda
rol eax, 0xe5
popf
pushf
not eax
add eax, 0xf8c59189
xor eax, 0xb742b6ee
rol eax, 0x5f
popf
jmp 0x140160ba5
push rax
pushf
mov eax, 0x5368f9f
pushf
not eax
add eax, 0x9c69f37a
xor eax, 0xfe447b0c
rol eax, 0xd2
popf
pushf
not eax
add eax, 0x8dad884b
xor eax, 0xa4684a4c
rol eax, 0xe5
popf
pushf
not eax
add eax, 0xde8d8e9c
xor eax, 0xd73d7213
rol eax, 0xe8
popf
pushf
not eax
add eax, 0xb92b2161
xor eax, 0x9332c7bc
rol eax, 0x5f
popf
jmp 0x140160ba5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x16
jmp 0x1401617ac
cmp r8, r14
jb 0x140161568
push rax
pushf
mov eax, 0xce9f205
pushf
not eax
add eax, 0xeb2f7211
xor eax, 0xf711583f
rol eax, 0xc7
popf
pushf
not eax
add eax, 0xcef992b1
xor eax, 0xed2e7e32
rol eax, 0x4e
popf
pushf
not eax
add eax, 0xf4bc061a
xor eax, 0x8dfc6181
rol eax, 0x55
popf
pushf
not eax
add eax, 0xd384e3db
xor eax, 0xf56d0654
rol eax, 5
popf
jmp 0x140160ba5
push rax
pushf
mov eax, 0x31f6771
pushf
not eax
add eax, 0xb88437cb
xor eax, 0xfb23ab7e
rol eax, 0xbb
popf
pushf
not eax
add eax, 0xab7778a9
xor eax, 0xa8fdb61b
rol eax, 0x25
popf
pushf
not eax
add eax, 0xa2d319a6
xor eax, 0xe3c1bf00
rol eax, 0xa1
popf
jmp 0x140160ba5
mov r8, r14
call sub.VCRUNTIME140.dll_memmove
jmp 0x14016180b
test rcx, rcx
jne 0x140161638
jmp 0x1401615f4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x16
jmp 0x1401617ac
cmp r8, r14
jb 0x14016166f
push rax
pushf
mov eax, 0x85211d52
pushf
not eax
add eax, 0xc2c7e989
xor eax, 0xaa8010ef
rol eax, 0x16
popf
pushf
not eax
add eax, 0x8c6bab6d
xor eax, 0xd605e1bc
rol eax, 1
popf
jmp 0x140160ba5
push rax
pushf
mov eax, 0x79e0902c
pushf
not eax
add eax, 0xfada12b1
xor eax, 0xb95bf710
rol eax, 0xe
popf
pushf
not eax
add eax, 0xf67f1bab
xor eax, 0xbb775c05
rol eax, 0x59
popf
pushf
not eax
add eax, 0x9cf34bac
xor eax, 0x8d2e710b
rol eax, 0x43
popf
jmp 0x140160ba5
mov r8, r14
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
jmp 0x14016180b
xor edx, edx
call sub.VCRUNTIME140.dll_memset
push rax
pushf
mov eax, 0x863b26a6
pushf
not eax
add eax, 0x8e46ebc7
xor eax, 0xd75dbbab
rol eax, 0x6a
popf
pushf
not eax
add eax, 0x8f379231
xor eax, 0xcf4498e6
rol eax, 0x49
popf
pushf
not eax
add eax, 0xe769bcdb
xor eax, 0x9d302203
rol eax, 0xae
popf
pushf
not eax
add eax, 0xe17bd019
xor eax, 0x94c0d487
rol eax, 0x33
popf
jmp 0x140160ba5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x22
push rax
pushf
mov eax, 0xf0823fe4
pushf
not eax
add eax, 0x8781d7e9
xor eax, 0x81afc033
rol eax, 0x3a
popf
pushf
not eax
add eax, 0xe1d098e7
xor eax, 0xa560797f
rol eax, 0x16
popf
pushf
not eax
add eax, 0xb91dca54
xor eax, 0xfa05c588
rol eax, 0xad
popf
jmp 0x140160ba5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
push rax
pushf
mov eax, 0xce5ca8d9
pushf
not eax
add eax, 0xcc773ad0
xor eax, 0xfc8ef34d
rol eax, 0xf1
popf
pushf
not eax
add eax, 0xc48cdbbd
xor eax, 0xad1d5288
rol eax, 0xa9
popf
pushf
not eax
add eax, 0xbedf1df4
xor eax, 0x83a7944d
rol eax, 0x80
popf
pushf
not eax
add eax, 0xcdf89b8d
xor eax, 0xd9872a8b
rol eax, 0xe4
popf
jmp 0x140160ba5
mov rax, qword [rdi]
cmp ebx, dword [rax - 0xc]
jg 0x14016186c
push rax
pushf
mov eax, 0x166408e9
pushf
not eax
add eax, 0xb421a40b
xor eax, 0xe317e602
rol eax, 0x12
popf
pushf
not eax
add eax, 0xfbc277fb
xor eax, 0xe2765278
rol eax, 0x64
popf
pushf
not eax
add eax, 0xa57248ca
xor eax, 0x8fcd71d8
rol eax, 0xe2
popf
pushf
not eax
add eax, 0xf4a32cf0
xor eax, 0xba9a8d20
rol eax, 0xe5
popf
jmp 0x140160ba5
push rax
pushf
mov eax, 0xcd686ffd
pushf
not eax
add eax, 0xa736c8bd
xor eax, 0xad13da6d
rol eax, 0x91
popf
pushf
not eax
add eax, 0x8dfaef62
xor eax, 0x9b1b45dd
rol eax, 0x14
popf
pushf
not eax
add eax, 0xebf84688
xor eax, 0xe44991b3
rol eax, 0x71
popf
jmp 0x140160ba5
mov dword [rax - 0x10], ebx
mov rax, qword [rdi]
mov byte [r14 + rax], 0
jmp 0x14016192d
mov rcx, rdi
call fcn.1400d8e21
push rax
pushf
mov eax, 0xd1932b3d
pushf
not eax
add eax, 0x994a6813
xor eax, 0xd66b96a5
rol eax, 0xdd
popf
pushf
not eax
add eax, 0xbe0747d1
xor eax, 0xb6cbb282
rol eax, 0xe9
popf
jmp 0x140160ba5
mov rcx, qword [rsp + 0x58]
jmp 0x140161933
call qword [sym.imp.KERNEL32.dll_LocalFree]
push rax
pushf
mov eax, 0xf8d565a0
pushf
not eax
add eax, 0xcfe7c2a0
xor eax, 0x9da49a45
rol eax, 0xc5
popf
pushf
not eax
add eax, 0x9cefde32
xor eax, 0xd9256422
rol eax, 0x17
popf
pushf
not eax
add eax, 0x94d5ff5f
xor eax, 0xd78d68e6
rol eax, 0x63
popf
pushf
not eax
add eax, 0xb37ccba4
xor eax, 0xf324559c
rol eax, 0xbd
popf
jmp 0x140160ba5
mov rax, qword [rdi]
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov ecx, 0xe521c091
pushf
not ecx
add ecx, 0xd41ed67c
xor ecx, 0x9417bb40
rol ecx, 0x50
popf
pushf
not ecx
add ecx, 0xf6b60660
xor ecx, 0xf97a17f4
rol ecx, 0x2f
popf
pushf
not ecx
add ecx, 0xccf3370a
xor ecx, 0xfbca5e21
rol ecx, 0xc
popf
call fcn.140109b9c
push rax
pushf
mov eax, 0x72b83503
pushf
not eax
add eax, 0xe307d8b5
xor eax, 0x83cf3298
rol eax, 0x65
popf
pushf
not eax
add eax, 0xd1a670a8
xor eax, 0xe6b24623
rol eax, 0x98
popf
pushf
not eax
add eax, 0xfda44e87
xor eax, 0xb2cd2879
rol eax, 0xec
popf
jmp 0x140160ba5
mov ecx, 0xec96ac3a
pushf
not ecx
add ecx, 0xddb36cb4
xor ecx, 0xbe0ee629
rol ecx, 0xb9
popf
pushf
not ecx
add ecx, 0x943ddaa3
xor ecx, 0xfd9f1956
rol ecx, 0x37
popf
call fcn.140109b9c
int3