Function at 0x140067ce6
Capabilities:
Authenticate hmac
Enumerate processes

Disassembly:
push rax
pushf
mov eax, 0x11c2cbc4
pushf
not eax
add eax, 0xee9ba938
xor eax, 0xb727c34d
rol eax, 0xc7
popf
pushf
not eax
add eax, 0xa5007697
xor eax, 0xbea51069
rol eax, 0x94
popf
pushf
not eax
add eax, 0xc22d2577
xor eax, 0xe2d59a18
rol eax, 0x5c
popf
pushf
not eax
add eax, 0x9c215009
xor eax, 0xf0e960e6
rol eax, 0xdf
popf
cmp eax, 4
jne 0x140067d49
popf
pop rax
jmp 0x140068212
cmp eax, 0
jne 0x140067d58
popf
pop rax
jmp 0x140067ecf
cmp eax, 3
jne 0x140067d67
popf
pop rax
jmp 0x14006811b
cmp eax, 1
jne 0x140067d76
popf
pop rax
jmp 0x140067f85
cmp eax, 0xd
jne 0x140067d85
popf
pop rax
jmp 0x1400686f2
cmp eax, 0x1a
jne 0x140067d94
popf
pop rax
jmp 0x140068cc6
cmp eax, 0xe
jne 0x140067da3
popf
pop rax
jmp 0x140068749
cmp eax, 0xb
jne 0x140067db2
popf
pop rax
jmp 0x1400685a9
cmp eax, 0x19
jne 0x140067dc1
popf
pop rax
jmp 0x140068c8d
cmp eax, 8
jne 0x140067dd0
popf
pop rax
jmp 0x14006841e
cmp eax, 0x10
jne 0x140067ddf
popf
pop rax
jmp 0x14006881a
cmp eax, 0x17
jne 0x140067dee
popf
pop rax
jmp 0x140068bd8
cmp eax, 9
jne 0x140067dfd
popf
pop rax
jmp 0x1400684c9
cmp eax, 0x12
jne 0x140067e0c
popf
pop rax
jmp 0x140068946
cmp eax, 0x18
jne 0x140067e1b
popf
pop rax
jmp 0x140068c53
cmp eax, 0x11
jne 0x140067e2a
popf
pop rax
jmp 0x140068876
cmp eax, 5
jne 0x140067e39
popf
pop rax
jmp 0x1400682ba
cmp eax, 0x16
jne 0x140067e48
popf
pop rax
jmp 0x140068b43
cmp eax, 0xa
jne 0x140067e57
popf
pop rax
jmp 0x14006851b
cmp eax, 0x14
jne 0x140067e66
popf
pop rax
jmp 0x140068a60
cmp eax, 0xf
jne 0x140067e75
popf
pop rax
jmp 0x1400687da
cmp eax, 0x13
jne 0x140067e84
popf
pop rax
jmp 0x1400689d6
cmp eax, 0x15
jne 0x140067e93
popf
pop rax
jmp 0x140068a9a
cmp eax, 2
jne 0x140067ea2
popf
pop rax
jmp 0x140068030
cmp eax, 6
jne 0x140067eb1
popf
pop rax
jmp 0x14006834f
cmp eax, 0xc
jne 0x140067ec0
popf
pop rax
jmp 0x140068668
cmp eax, 7
jne 0x140067ecf
popf
pop rax
jmp 0x1400683fd
push rbp
push r15
lea rbp, [rsp - 0xa8]
sub rsp, 0x1a8
mov rax, qword [0x14000a230]
xor rax, rsp
mov qword [rbp + 0x80], rax
xor edx, edx
lea ecx, [rdx + 2]
jmp 0x140067ef9
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x140067f3f
push rax
pushf
mov eax, 0x5bc2e37c
pushf
not eax
add eax, 0xe17a2da7
xor eax, 0x86d0c237
rol eax, 0xf2
popf
pushf
not eax
add eax, 0xfecdb85e
xor eax, 0xde19aabf
rol eax, 0xca
popf
jmp 0x140067d3a
push rax
pushf
mov eax, 0x540068c2
pushf
not eax
add eax, 0x877bce03
xor eax, 0xfbc7f279
rol eax, 0x29
popf
pushf
not eax
add eax, 0xb72958a9
xor eax, 0xbcf0bcaf
rol eax, 0x5a
popf
pushf
not eax
add eax, 0x8ad8c877
xor eax, 0xa8d4af10
rol eax, 0x97
popf
jmp 0x140067d3a
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x130
mov rcx, rax
jmp 0x140067f96
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140067fd7
push rax
pushf
mov eax, 0x6fc3955b
pushf
not eax
add eax, 0xae49caca
xor eax, 0xc661f9d7
rol eax, 0x8a
popf
pushf
not eax
add eax, 0x9b552744
xor eax, 0xbc223f60
rol eax, 0x63
popf
jmp 0x140067d3a
push rax
pushf
mov eax, 0x31b8608d
pushf
not eax
add eax, 0x96d62e0c
xor eax, 0xb50e6ff5
rol eax, 0x9d
popf
pushf
not eax
add eax, 0xb7933c38
xor eax, 0xf67f40e9
rol eax, 0x6d
popf
pushf
not eax
add eax, 0x934715fd
xor eax, 0xbc87e383
rol eax, 0x36
popf
pushf
not eax
add eax, 0xf03237eb
xor eax, 0xf12a732b
rol eax, 0x39
popf
jmp 0x140067d3a
mov qword [rsp + 0x1c0], rbx
mov qword [rsp + 0x1a0], r12
movabs r12, 0xb208350bcfdc35ec
pushf
not r12
add r12, 0x4797dafd
xor r12, 0x7adce534
rol r12, 0xa8
popf
pushf
not r12
add r12, 0x666054ce
xor r12, 0x716c9712
rol r12, 0x63
popf
pushf
not r12
add r12, 0x595fe2dd
xor r12, 0x6321054c
rol r12, 0xea
popf
pushf
not r12
add r12, 0x67af9e07
xor r12, 0x595411ba
rol r12, 0xee
popf
mov qword [rsp + 0x198], r13
xor r13d, r13d
mov qword [rsp + 0x190], r14
mov qword [rsp + 0x1c8], rsi
mov qword [rsp + 0x1d0], rdi
lea r14, [r13 - 1]
push rax
pushf
mov eax, 0x4377f62b
pushf
not eax
add eax, 0xf99b255b
xor eax, 0xdac85815
rol eax, 0xfe
popf
pushf
not eax
add eax, 0x9a1a7ac2
xor eax, 0xdf001f56
rol eax, 0xa1
popf
pushf
not eax
add eax, 0xd52fa362
xor eax, 0x91689c17
rol eax, 0x2d
popf
jmp 0x140067d3a
xorps xmm0, xmm0
mov qword [rsp + 0x40], r13
movups xmmword [rsp + 0x30], xmm0
mov edx, 0x46a857c
pushf
not edx
add edx, 0xa7773869
xor edx, 0xd28502f5
rol edx, 0x8b
popf
pushf
not edx
add edx, 0xd77f0350
xor edx, 0x89fe87c3
rol edx, 0xb5
popf
mov qword [rsp + 0x48], r13
movabs rcx, 0x344000a87d72f545
pushf
not rcx
add rcx, 0x55efc95c
xor rcx, 0x493c8fa6
rol rcx, 0xb
popf
pushf
not rcx
add rcx, 0x4049123d
xor rcx, 0x4b958bdf
rol rcx, 0xa9
popf
pushf
not rcx
add rcx, 0x7110ecf9
xor rcx, 0x668a000b
rol rcx, 5
popf
lea rax, [rsp + 0x7c]
mov rbx, r14
push rax
pushf
mov eax, 0x2da1aef6
pushf
not eax
add eax, 0xc60ee528
xor eax, 0xd9ec51d5
rol eax, 0xd4
popf
pushf
not eax
add eax, 0xf8dd6a81
xor eax, 0xf06efacb
rol eax, 0xc1
popf
pushf
not eax
add eax, 0x9b60a982
xor eax, 0xd8041c32
rol eax, 0xd2
popf
pushf
not eax
add eax, 0xffc3758b
xor eax, 0xef91ffb1
rol eax, 0xc0
popf
jmp 0x140067d3a
inc rbx
cmp byte [rax + rbx], r13b
jne 0x140068274
push rax
pushf
mov eax, 0x4464c885
pushf
not eax
add eax, 0xfa614b5e
xor eax, 0xba4acd2f
rol eax, 0xe
popf
pushf
not eax
add eax, 0xac0755f1
xor eax, 0x86746804
rol eax, 0xdd
popf
pushf
not eax
add eax, 0xdfbe3ceb
xor eax, 0xd792d463
rol eax, 0x2c
popf
pushf
not eax
add eax, 0xbe20e4c6
xor eax, 0xf38450f4
rol eax, 0xff
popf
jmp 0x140067d3a
push rax
pushf
mov eax, 0x6a534c2e
pushf
not eax
add eax, 0xd94a6596
xor eax, 0xc05d10cb
rol eax, 0xc2
popf
pushf
not eax
add eax, 0xbbe38cc1
xor eax, 0x80b3e0cc
rol eax, 0xa9
popf
pushf
not eax
add eax, 0xdaac8d82
xor eax, 0xc9bf087e
rol eax, 0xcd
popf
jmp 0x140067d3a
cmp rbx, r12
ja 0x1400682f6
push rax
pushf
mov eax, 0x33ca8fec
pushf
not eax
add eax, 0xa1a703d5
xor eax, 0xf51244b4
rol eax, 0x73
popf
pushf
not eax
add eax, 0x8a402709
xor eax, 0xcf5d6097
rol eax, 0x70
popf
jmp 0x140067d3a
push rax
pushf
mov eax, 0xb20465f8
pushf
not eax
add eax, 0xe35c3b7d
xor eax, 0xb630dee5
rol eax, 0
popf
pushf
not eax
add eax, 0xd32fa27c
xor eax, 0xee42944b
rol eax, 0x8f
popf
pushf
not eax
add eax, 0x82bbbf4e
xor eax, 0xd7d6eba3
rol eax, 0x64
popf
pushf
not eax
add eax, 0xeffa2125
xor eax, 0x83b9ae0b
rol eax, 0x3e
popf
jmp 0x140067d3a
mov qword [rsp + 0x48], 0xf
cmp rbx, 0x10
jae 0x1400683a4
push rax
pushf
mov eax, 0xb5bf581a
pushf
not eax
add eax, 0xb325b73c
xor eax, 0xa8a9e223
rol eax, 0xa2
popf
pushf
not eax
add eax, 0x9a1f42fa
xor eax, 0xde0de57d
rol eax, 0x36
popf
pushf
not eax
add eax, 0xb2e380c9
xor eax, 0xcf7c595e
rol eax, 0x76
popf
jmp 0x140067d3a
push rax
pushf
mov eax, 0x9757add5
pushf
not eax
add eax, 0xac366643
xor eax, 0xd3d503ee
rol eax, 0x24
popf
pushf
not eax
add eax, 0xd54a61de
xor eax, 0xc225bf0f
rol eax, 0x16
popf
pushf
not eax
add eax, 0xa475342c
xor eax, 0xfa763894
rol eax, 0xec
popf
pushf
not eax
add eax, 0xa2de99d1
xor eax, 0xc7bf71a5
rol eax, 0x78
popf
jmp 0x140067d3a
mov r8, rbx
mov qword [rsp + 0x40], rbx
lea rdx, [rsp + 0x7c]
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x30], r13b
jmp 0x140068899
mov rdi, rbx
or rdi, 0xf
cmp rdi, r12
jbe 0x140068470
push rax
pushf
mov eax, 0x403d00ee
pushf
not eax
add eax, 0xeec8d05f
xor eax, 0xe7273cc3
rol eax, 0xd1
popf
pushf
not eax
add eax, 0xdff6c484
xor eax, 0xcf279836
rol eax, 0xe2
popf
pushf
not eax
add eax, 0xcb6511f0
xor eax, 0xe8066d7f
rol eax, 0xe9
popf
jmp 0x140067d3a
push rax
pushf
mov eax, 0xfa43b3e5
pushf
not eax
add eax, 0x97764585
xor eax, 0xe2eb6dfb
rol eax, 0x2e
popf
pushf
not eax
add eax, 0xfb0a4fa4
xor eax, 0x90e09d6e
rol eax, 0xe9
popf
pushf
not eax
add eax, 0xc4ba4e9b
xor eax, 0xa97364e9
rol eax, 0xb3
popf
pushf
not eax
add eax, 0xe95511e5
xor eax, 0xd7f8d0a7
rol eax, 0xef
popf
jmp 0x140067d3a
mov rdi, r12
lea rax, [rcx + 0x27]
jmp 0x140068668
cmp rdi, 0x16
cmovb rdi, rdx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140068563
push rax
pushf
mov eax, 0xce90dc66
pushf
not eax
add eax, 0xfd8e900d
xor eax, 0xf49e26fa
rol eax, 0xeb
popf
pushf
not eax
add eax, 0xd21c7a76
xor eax, 0xb5719162
rol eax, 0xfa
popf
jmp 0x140067d3a
push rax
pushf
mov eax, 0x47e52f02
pushf
not eax
add eax, 0xc1bc250a
xor eax, 0xd5d5f55c
rol eax, 0xa8
popf
pushf
not eax
add eax, 0xe45705db
xor eax, 0xcef47b86
rol eax, 0xaf
popf
pushf
not eax
add eax, 0xc42fd67e
xor eax, 0xd55bbeaa
rol eax, 0x28
popf
jmp 0x140067d3a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14006860f
push rax
pushf
mov eax, 0x1a4a0e1f
pushf
not eax
add eax, 0xe3e72ca9
xor eax, 0xf3f2a305
rol eax, 0x60
popf
pushf
not eax
add eax, 0xa6fc3422
xor eax, 0xe9c98201
rol eax, 0xaa
popf
pushf
not eax
add eax, 0xdfef3f3f
xor eax, 0x8ebdbf84
rol eax, 0xa0
popf
pushf
not eax
add eax, 0xd75fd8b9
xor eax, 0xf0be860b
rol eax, 0xc5
popf
jmp 0x140067d3a
push rax
pushf
mov eax, 0xa206e87c
pushf
not eax
add eax, 0xea095795
xor eax, 0xe6ec4591
rol eax, 0x3f
popf
pushf
not eax
add eax, 0xa4f1a4c0
xor eax, 0xf4a40aff
rol eax, 0xd1
popf
pushf
not eax
add eax, 0xbcdb5ae7
xor eax, 0x9f89f227
rol eax, 0x62
popf
pushf
not eax
add eax, 0xe1389b60
xor eax, 0xa7cc4721
rol eax, 0xa2
popf
jmp 0x140067d3a
mov rcx, rax
call fcn.140057363
test rax, rax
je 0x1400686bf
push rax
pushf
mov eax, 0x8d0c6610
pushf
not eax
add eax, 0xf8e70a0e
xor eax, 0xb7737d81
rol eax, 0x60
popf
pushf
not eax
add eax, 0xac614e7a
xor eax, 0xe488d2ad
rol eax, 0x7a
popf
pushf
not eax
add eax, 0xc3fd864b
xor eax, 0x835d8755
rol eax, 0x30
popf
jmp 0x140067d3a
push rax
pushf
mov eax, 0x895d40bd
pushf
not eax
add eax, 0xa6e88339
xor eax, 0xd2631bd7
rol eax, 0x11
popf
pushf
not eax
add eax, 0xa83bc0f6
xor eax, 0xf4ca2125
rol eax, 0xf
popf
jmp 0x140067d3a
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140068876
test rcx, rcx
je 0x1400687a7
push rax
pushf
mov eax, 0x37c0832a
pushf
not eax
add eax, 0xf1413840
xor eax, 0xb089bcd4
rol eax, 0xd2
popf
pushf
not eax
add eax, 0xbca268b0
xor eax, 0xe944325f
rol eax, 0x9c
popf
pushf
not eax
add eax, 0x8113a76b
xor eax, 0xa4abc0a2
rol eax, 0xd6
popf
pushf
not eax
add eax, 0x8b5df36b
xor eax, 0xb37797db
rol eax, 0x33
popf
jmp 0x140067d3a
push rax
pushf
mov eax, 0x2fc061a6
pushf
not eax
add eax, 0xd6760abb
xor eax, 0xa02894d3
rol eax, 0xa9
popf
pushf
not eax
add eax, 0xc25b8473
xor eax, 0x87dff664
rol eax, 0x84
popf
jmp 0x140067d3a
call fcn.140057363
mov rsi, rax
jmp 0x140068876
mov rsi, r13
push rax
pushf
mov eax, 0x6b0ae573
pushf
not eax
add eax, 0x8ed30b6a
xor eax, 0x8313ea16
rol eax, 0x83
popf
pushf
not eax
add eax, 0x9711a3fb
xor eax, 0xeb87585e
rol eax, 0x1f
popf
pushf
not eax
add eax, 0x9aefc777
xor eax, 0xf04df84d
rol eax, 0x84
popf
pushf
not eax
add eax, 0xa510b336
xor eax, 0xcbc99c73
rol eax, 0x2a
popf
jmp 0x140067d3a
mov r8, rbx
mov qword [rsp + 0x30], rsi
lea rdx, [rsp + 0x7c]
mov qword [rsp + 0x40], rbx
mov rcx, rsi
mov qword [rsp + 0x48], rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], r13b
lea rcx, [rsp + 0x30]
call fcn.1400541c9
test al, al
jne 0x1400688ed
push rax
pushf
mov eax, 0x887c0732
pushf
not eax
add eax, 0xd4c2cf2b
xor eax, 0xf8de7bc1
rol eax, 0x40
popf
pushf
not eax
add eax, 0xe9985c9a
xor eax, 0xce29e032
rol eax, 0xad
popf
pushf
not eax
add eax, 0x92465fe8
xor eax, 0xca3c009f
rol eax, 0x40
popf
jmp 0x140067d3a
push rax
pushf
mov eax, 0xfe17dcfa
pushf
not eax
add eax, 0xd667e0aa
xor eax, 0x8a5a92c7
rol eax, 0x2b
popf
pushf
not eax
add eax, 0xba62f767
xor eax, 0xd5e9cad0
rol eax, 0xb
popf
pushf
not eax
add eax, 0xdbfc1eff
xor eax, 0xb20667af
rol eax, 0xf2
popf
pushf
not eax
add eax, 0xbbf6ab7e
xor eax, 0x95ad4347
rol eax, 0x48
popf
jmp 0x140067d3a
lea rdx, [rsp + 0x50]
mov rcx, r15
jmp 0x14006894f
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400689a3
push rax
pushf
mov eax, 0x5528cd42
pushf
not eax
add eax, 0x83249891
xor eax, 0xd863fecf
rol eax, 0x95
popf
pushf
not eax
add eax, 0xc5e4a2e6
xor eax, 0x8a0174bb
rol eax, 0xb8
popf
pushf
not eax
add eax, 0xaf567aaf
xor eax, 0x8ab6d617
rol eax, 0xa2
popf
jmp 0x140067d3a
push rax
pushf
mov eax, 0x90dc6eed
pushf
not eax
add eax, 0xacb8d591
xor eax, 0xfb90f36e
rol eax, 0xc9
popf
pushf
not eax
add eax, 0x81cc1075
xor eax, 0xe8a074b7
rol eax, 0xe0
popf
jmp 0x140067d3a
mov rcx, r15
jmp 0x1400689da
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rdi, qword [rsp + 0x1d0]
mov rsi, qword [rsp + 0x1c8]
mov r12, qword [rsp + 0x1a0]
mov r13, qword [rsp + 0x198]
mov rbx, qword [rsp + 0x1c0]
mov r14, qword [rsp + 0x190]
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.140060848
add rsp, 0x1a8
pop r15
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
movdqa xmm1, xmmword [0x1400074c0]
movdqu xmmword [rsp + 0x20], xmm1
mov byte [rsp + 0x2f], r13b
movd ecx, xmm1
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
xor byte [rsp + 0x22], cl
xor byte [rsp + 0x23], cl
xor byte [rsp + 0x24], cl
xor al, cl
xor byte [rsp + 0x25], cl
xor byte [rsp + 0x26], cl
xor byte [rsp + 0x27], cl
xor byte [rsp + 0x28], cl
xor byte [rsp + 0x29], cl
xor byte [rsp + 0x2a], cl
xor byte [rsp + 0x2b], cl
xor byte [rsp + 0x2c], cl
xor byte [rsp + 0x2d], cl
xor byte [rsp + 0x2e], cl
mov byte [rsp + 0x21], al
lea rax, [rsp + 0x21]
push rax
pushf
mov eax, 0x2a262ffb
pushf
not eax
add eax, 0xac46d8b2
xor eax, 0xb1d8b152
rol eax, 0x2d
popf
pushf
not eax
add eax, 0xea253b27
xor eax, 0xa5daa981
rol eax, 0x60
popf
pushf
not eax
add eax, 0xf0112321
xor eax, 0xacdf5dfa
rol eax, 0xd6
popf
jmp 0x140067d3a
inc r14
cmp byte [rax + r14], r13b
jne 0x140068ba5
push rax
pushf
mov eax, 0x87555ff8
pushf
not eax
add eax, 0xfb118e3d
xor eax, 0xc13b9e14
rol eax, 0x12
popf
pushf
not eax
add eax, 0xa4f2f4be
xor eax, 0xcbce4563
rol eax, 0x9e
popf
pushf
not eax
add eax, 0xaf0c72dc
xor eax, 0x8991c3e9
rol eax, 0xee
popf
pushf
not eax
add eax, 0xc6b1c236
xor eax, 0x8161b6d6
rol eax, 0x32
popf
jmp 0x140067d3a
push rax
pushf
mov eax, 0xb9b4e794
pushf
not eax
add eax, 0xaaf19d28
xor eax, 0xb68c64a6
rol eax, 3
popf
pushf
not eax
add eax, 0xfee95211
xor eax, 0xc174c866
rol eax, 0xd0
popf
jmp 0x140067d3a
mov r8, r14
lea rdx, [rsp + 0x21]
call fcn.14006ce8c
mov al, 0x99
pushf
not al
add al, 0x58
xor al, 0x43
rol al, 0xaf
popf
pushf
not al
add al, 0x79
xor al, 0x78
rol al, 0xcf
popf
mov byte [0x14000a930], 1
jmp 0x1400689e2
xor al, al
jmp 0x140068a12
call fcn.140060a63
int3
call fcn.1400577ae
int3