Function at 0x1400b3cc0
Capabilities:
Authenticate hmac
Generate random numbers using a mersenne twister
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
mov eax, 0x1430
call fcn.140128020
sub rsp, rax
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x13a8], 0xfffffffffffffffe
mov rdi, rdx
mov rsi, rcx
mov byte [rbp + 0x136c], reloc.WS2_32.dll_gethostname
mov dword [rbp + 0x1368], 0x687a7361
mov word [rbp + 0x13a0], 0x3618
mov word [rbp + 0x1398], 0x3669
xorps xmm0, xmm0
movaps xmmword [rbp + 0x1370], xmm0
mov qword [rbp + 0x1380], 0
mov qword [rbp + 0x1388], reloc.WS2_32.dll_ntohs
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov dword [rbp + 0x1334], 0xffffffff
mov dword [rbp - 0x4c], eax
mov ecx, 3
nop word [rax + rax]
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add rax, rcx
add rax, 0xfffffffffffffffe
mov dword [rbp + rcx*4 - 0x54], eax
cmp rcx, 0x271
je 0x1400b3d8c
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
dec eax
mov dword [rbp + rcx*4 - 0x50], eax
add rcx, 2
jmp 0x1400b3d50
mov dword [rbp - 0x50], 0x270
lea rcx, [rbp - 0x50]
call fcn.1400d9930
mov eax, eax
imul rdx, rax, 0x11d1ae39
cmp edx, 0x68878e1
ja 0x1400b3dd9
lea rbx, [rbp - 0x50]
nop word cs:[rax + rax]
mov rcx, rbx
call fcn.1400d9930
mov eax, eax
imul rdx, rax, 0x11d1ae39
cmp edx, 0x68878e2
jb 0x1400b3dc0
shr rdx, 0x20
add edx, 0x423a35c7
lea rbx, [rbp - 0x50]
mov rcx, rbx
call fcn.14000acc0
mov r8, qword [rbp - 0x40]
cmp qword [rbp - 0x38], 0x10
jb 0x1400b3dfe
mov rbx, qword [rbp - 0x50]
mov rcx, qword [rbp + 0x1380]
mov rax, qword [rbp + 0x1388]
mov rdx, rax
sub rdx, rcx
cmp rdx, r8
jae 0x1400b3e30
mov qword [rsp + 0x20], r8
lea rcx, [rbp + 0x1370]
mov rdx, r8
mov r9, rbx
call fcn.140008fd0
jmp 0x1400b3e61
lea r14, [rcx + r8]
mov qword [rbp + 0x1380], r14
cmp rax, 0x10
jb 0x1400b3e4a
mov r15, qword [rbp + 0x1370]
jmp 0x1400b3e51
lea r15, [rbp + 0x1370]
add rcx, r15
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [r15 + r14], 0
mov rax, qword [rbp - 0x38]
cmp rax, 0x10
jb 0x1400b3ea0
mov rcx, qword [rbp - 0x50]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400b3e9b
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x1400b491c
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140127e30
movzx eax, byte [rbp + 0x13a1]
test al, al
je 0x1400b3eba
xor byte [rbp + 0x13a0], 0x35
xor al, 0x36
mov byte [rbp + 0x13a1], al
lea rcx, [rbp + 0x13a0]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rcx, qword [rbp + 0x1380]
mov rdx, qword [rbp + 0x1388]
mov r8, rdx
sub r8, rcx
cmp r8, rax
jae 0x1400b4013
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x1370]
lea r9, [rbp + 0x13a0]
mov rdx, rax
call fcn.140008fd0
cmp byte [rbp + 0x13a1], 0
je 0x1400b4074
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov dword [rbp + 0x1334], 0xffffffff
mov dword [rbp - 0x4c], eax
mov ecx, 3
nop word cs:[rax + rax]
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add rax, rcx
add rax, 0xfffffffffffffffe
mov dword [rbp + rcx*4 - 0x54], eax
cmp rcx, 0x271
je 0x1400b3f6c
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
dec eax
mov dword [rbp + rcx*4 - 0x50], eax
add rcx, 2
jmp 0x1400b3f30
mov dword [rbp - 0x50], 0x270
lea rcx, [rbp - 0x50]
call fcn.1400d9930
mov eax, eax
imul rdx, rax, 0x11d1ae39
cmp edx, 0x68878e1
ja 0x1400b3fb9
lea rbx, [rbp - 0x50]
nop word cs:[rax + rax]
mov rcx, rbx
call fcn.1400d9930
mov eax, eax
imul rdx, rax, 0x11d1ae39
cmp edx, 0x68878e2
jb 0x1400b3fa0
shr rdx, 0x20
add edx, 0x423a35c7
lea rbx, [rbp - 0x50]
mov rcx, rbx
call fcn.14000acc0
mov r8, qword [rbp - 0x40]
cmp qword [rbp - 0x38], 0x10
jb 0x1400b3fde
mov rbx, qword [rbp - 0x50]
mov rcx, qword [rbp + 0x1380]
mov rax, qword [rbp + 0x1388]
mov rdx, rax
sub rdx, rcx
cmp rdx, r8
jae 0x1400b402f
mov qword [rsp + 0x20], r8
lea rcx, [rbp + 0x1370]
mov rdx, r8
mov r9, rbx
call fcn.140008fd0
jmp 0x1400b409e
mov rbx, rax
add rbx, rcx
mov qword [rbp + 0x1380], rbx
cmp rdx, 0x10
jb 0x1400b4049
mov r14, qword [rbp + 0x1370]
jmp 0x1400b4050
lea r14, [rcx + r8]
mov qword [rbp + 0x1380], r14
cmp rax, 0x10
jb 0x1400b4087
mov r15, qword [rbp + 0x1370]
jmp 0x1400b408e
lea r14, [rbp + 0x1370]
add rcx, r14
lea rdx, [rbp + 0x13a0]
mov r8, rax
call sub.VCRUNTIME140.dll_memmove
mov byte [r14 + rbx], 0
cmp byte [rbp + 0x13a1], 0
jne 0x1400b3f0b
xor byte [rbp + 0x13a0], 0x35
mov byte [rbp + 0x13a1], gethostname
jmp 0x1400b3f0b
lea r15, [rbp + 0x1370]
add rcx, r15
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [r15 + r14], 0
mov rax, qword [rbp - 0x38]
cmp rax, 0x10
jb 0x1400b40dd
mov rcx, qword [rbp - 0x50]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400b40d8
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x1400b491c
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140127e30
movzx eax, byte [rbp + 0x13a1]
test al, al
je 0x1400b40f7
xor byte [rbp + 0x13a0], 0x35
xor al, 0x36
mov byte [rbp + 0x13a1], al
lea rcx, [rbp + 0x13a0]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rcx, qword [rbp + 0x1380]
mov rdx, qword [rbp + 0x1388]
mov r8, rdx
sub r8, rcx
cmp r8, rax
jae 0x1400b4243
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x1370]
lea r9, [rbp + 0x13a0]
mov rdx, rax
call fcn.140008fd0
cmp byte [rbp + 0x13a1], 0
je 0x1400b42a4
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov dword [rbp + 0x1334], 0xffffffff
mov dword [rbp - 0x4c], eax
mov ecx, 3
nop
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add rax, rcx
add rax, 0xfffffffffffffffe
mov dword [rbp + rcx*4 - 0x54], eax
cmp rcx, 0x271
je 0x1400b419c
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
dec eax
mov dword [rbp + rcx*4 - 0x50], eax
add rcx, 2
jmp 0x1400b4160
mov dword [rbp - 0x50], 0x270
lea rcx, [rbp - 0x50]
call fcn.1400d9930
mov eax, eax
imul rdx, rax, 0x54c5639
cmp edx, 0x1afd54f
ja 0x1400b41e9
lea rbx, [rbp - 0x50]
nop word cs:[rax + rax]
mov rcx, rbx
call fcn.1400d9930
mov eax, eax
imul rdx, rax, 0x54c5639
cmp edx, 0x1afd550
jb 0x1400b41d0
shr rdx, 0x20
add edx, 0xa98ac7
lea rbx, [rbp - 0x50]
mov rcx, rbx
call fcn.14000acc0
mov r8, qword [rbp - 0x40]
cmp qword [rbp - 0x38], 0x10
jb 0x1400b420e
mov rbx, qword [rbp - 0x50]
mov rcx, qword [rbp + 0x1380]
mov rax, qword [rbp + 0x1388]
mov rdx, rax
sub rdx, rcx
cmp rdx, r8
jae 0x1400b425f
mov qword [rsp + 0x20], r8
lea rcx, [rbp + 0x1370]
mov rdx, r8
mov r9, rbx
call fcn.140008fd0
jmp 0x1400b42ce
mov rbx, rax
add rbx, rcx
mov qword [rbp + 0x1380], rbx
cmp rdx, 0x10
jb 0x1400b4279
mov r14, qword [rbp + 0x1370]
jmp 0x1400b4280
lea r14, [rcx + r8]
mov qword [rbp + 0x1380], r14
cmp rax, 0x10
jb 0x1400b42b7
mov r15, qword [rbp + 0x1370]
jmp 0x1400b42be
lea r14, [rbp + 0x1370]
add rcx, r14
lea rdx, [rbp + 0x13a0]
mov r8, rax
call sub.VCRUNTIME140.dll_memmove
mov byte [r14 + rbx], 0
cmp byte [rbp + 0x13a1], 0
jne 0x1400b4148
xor byte [rbp + 0x13a0], 0x35
mov byte [rbp + 0x13a1], gethostname
jmp 0x1400b4148
lea r15, [rbp + 0x1370]
add rcx, r15
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [r15 + r14], 0
mov rax, qword [rbp - 0x38]
cmp rax, 0x10
jb 0x1400b430d
mov rcx, qword [rbp - 0x50]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400b4308
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x1400b491c
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140127e30
movzx eax, byte [rbp + 0x13a1]
test al, al
je 0x1400b4327
xor byte [rbp + 0x13a0], 0x35
xor al, 0x36
mov byte [rbp + 0x13a1], al
lea rcx, [rbp + 0x13a0]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rcx, qword [rbp + 0x1380]
mov rdx, qword [rbp + 0x1388]
mov r8, rdx
sub r8, rcx
cmp r8, rax
jae 0x1400b4473
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x1370]
lea r9, [rbp + 0x13a0]
mov rdx, rax
call fcn.140008fd0
cmp byte [rbp + 0x13a1], 0
je 0x1400b44d4
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov dword [rbp + 0x1334], 0xffffffff
mov dword [rbp - 0x4c], eax
mov ecx, 3
nop
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add rax, rcx
add rax, 0xfffffffffffffffe
mov dword [rbp + rcx*4 - 0x54], eax
cmp rcx, 0x271
je 0x1400b43cc
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
dec eax
mov dword [rbp + rcx*4 - 0x50], eax
add rcx, 2
jmp 0x1400b4390
mov dword [rbp - 0x50], 0x270
lea rcx, [rbp - 0x50]
call fcn.1400d9930
mov eax, eax
imul rdx, rax, 0x11d1ae39
cmp edx, 0x68878e1
ja 0x1400b4419
lea rbx, [rbp - 0x50]
nop word cs:[rax + rax]
mov rcx, rbx
call fcn.1400d9930
mov eax, eax
imul rdx, rax, 0x11d1ae39
cmp edx, 0x68878e2
jb 0x1400b4400
shr rdx, 0x20
add edx, 0x423a35c7
lea rbx, [rbp - 0x50]
mov rcx, rbx
call fcn.14000acc0
mov r8, qword [rbp - 0x40]
cmp qword [rbp - 0x38], 0x10
jb 0x1400b443e
mov rbx, qword [rbp - 0x50]
mov rcx, qword [rbp + 0x1380]
mov rax, qword [rbp + 0x1388]
mov rdx, rax
sub rdx, rcx
cmp rdx, r8
jae 0x1400b448f
mov qword [rsp + 0x20], r8
lea rcx, [rbp + 0x1370]
mov rdx, r8
mov r9, rbx
call fcn.140008fd0
jmp 0x1400b44fe
mov rbx, rax
add rbx, rcx
mov qword [rbp + 0x1380], rbx
cmp rdx, 0x10
jb 0x1400b44a9
mov r14, qword [rbp + 0x1370]
jmp 0x1400b44b0
lea r14, [rcx + r8]
mov qword [rbp + 0x1380], r14
cmp rax, 0x10
jb 0x1400b44e7
mov r15, qword [rbp + 0x1370]
jmp 0x1400b44ee
lea r14, [rbp + 0x1370]
add rcx, r14
lea rdx, [rbp + 0x13a0]
mov r8, rax
call sub.VCRUNTIME140.dll_memmove
mov byte [r14 + rbx], 0
cmp byte [rbp + 0x13a1], 0
jne 0x1400b4378
xor byte [rbp + 0x13a0], 0x35
mov byte [rbp + 0x13a1], gethostname
jmp 0x1400b4378
lea r15, [rbp + 0x1370]
add rcx, r15
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [r15 + r14], 0
mov rax, qword [rbp - 0x38]
cmp rax, 0x10
jb 0x1400b453d
mov rcx, qword [rbp - 0x50]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400b4538
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x1400b491c
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140127e30
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rcx, qword [rbp + 0x1380]
mov rdx, qword [rbp + 0x1388]
mov r8, rdx
sub r8, rcx
cmp r8, rax
jae 0x1400b4577
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x1370]
mov rdx, rax
mov r9, rdi
call fcn.140008fd0
jmp 0x1400b45ad
mov rbx, rax
add rbx, rcx
mov qword [rbp + 0x1380], rbx
cmp rdx, 0x10
jb 0x1400b4593
mov r14, qword [rbp + 0x1370]
jmp 0x1400b459a
lea r14, [rbp + 0x1370]
add rcx, r14
mov rdx, rdi
mov r8, rax
call sub.VCRUNTIME140.dll_memmove
mov byte [r14 + rbx], 0
mov word [rbp + 0x1398], 0x5c
xorps xmm0, xmm0
movaps xmmword [rbp + 0x1340], xmm0
movaps xmmword [rbp + 0x1350], xmm0
lea rcx, [rbp + 0x1398]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
test rax, rax
js 0x1400b4922
mov rdi, rax
cmp rax, 0xf
ja 0x1400b4619
mov qword [rbp + 0x1350], rdi
mov qword [rbp + 0x1358], reloc.WS2_32.dll_ntohs
lea rcx, [rbp + 0x1340]
lea rdx, [rbp + 0x1398]
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
add rdi, rbp
add rdi, 0x1340
jmp 0x1400b4692
mov qword [rbp + 0x1358], reloc.WS2_32.dll_ntohs
mov rax, rdi
or rax, 0xf
cmp rax, 0x17
mov r14d, reloc.WLDAP32.dll_Ordinal_22
cmovae r14, rax
cmp r14, 0xfff
jb 0x1400b465c
lea rcx, [r14 + 0x28]
call fcn.140127dec
mov rbx, rax
add rbx, 0x27
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x1400b4668
lea rcx, [r14 + 1]
call fcn.140127dec
mov rbx, rax
mov qword [rbp + 0x1340], rbx
mov qword [rbp + 0x1350], rdi
mov qword [rbp + 0x1358], r14
lea rdx, [rbp + 0x1398]
mov rcx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
add rdi, rbx
mov byte [rdi], 0
mov dword [rbp + 0x1368], 0x504d4554
mov byte [rbp + 0x136c], 0
lea rcx, [rbp + 0x1368]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rbx, rax
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rdi, rax
mov r8, qword [rbp + 0x1350]
mov rax, qword [rbp + 0x1358]
mov rcx, rax
sub rcx, r8
cmp rcx, rdi
jae 0x1400b46fb
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
lea rcx, [rbp + 0x1340]
mov rdx, rdi
xor r9d, r9d
call fcn.14000ab10
jmp 0x1400b477c
lea rcx, [r8 + rdi]
mov qword [rbp + 0x1350], rcx
cmp rax, 0x10
jb 0x1400b4715
mov r14, qword [rbp + 0x1340]
jmp 0x1400b471c
lea r14, [rbp + 0x1340]
lea r15, [rbx + rdi]
cmp r15, r14
jbe 0x1400b473e
lea rax, [r14 + r8]
mov r12, rdi
cmp rax, rbx
jb 0x1400b4741
mov r12, r14
sub r12, rbx
ja 0x1400b4741
xor r12d, r12d
jmp 0x1400b4741
mov r12, rdi
inc r8
lea rcx, [r14 + rdi]
mov rdx, r14
call sub.VCRUNTIME140.dll_memmove
mov rcx, r14
mov rdx, rbx
mov r8, r12
call sub.VCRUNTIME140.dll_memcpy
sub rdi, r12
add r15, r12
add r14, r12
mov rcx, r14
mov rdx, r15
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp + 0x1340]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rbp - 0x40], xmm1
movaps xmmword [rbp - 0x50], xmm0
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r8, qword [rbp + 0x1380]
cmp qword [rbp + 0x1388], 0x10
jb 0x1400b47b8
mov r9, qword [rbp + 0x1370]
jmp 0x1400b47bf
lea r9, [rbp + 0x1370]
mov rcx, qword [rbp - 0x40]
mov rax, qword [rbp - 0x38]
mov rdx, rax
sub rdx, rcx
cmp rdx, r8
jae 0x1400b47e8
mov qword [rsp + 0x20], r8
lea rcx, [rbp - 0x50]
mov rdx, r8
call fcn.140008fd0
mov rdi, rax
jmp 0x1400b4811
lea rbx, [rcx + r8]
mov qword [rbp - 0x40], rbx
lea rdi, [rbp - 0x50]
mov r14, rdi
cmp rax, 0x10
jb 0x1400b4801
mov r14, qword [rbp - 0x50]
add rcx, r14
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
mov byte [r14 + rbx], 0
movups xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov rax, qword [rbp - 0x38]
cmp rax, 0x10
jb 0x1400b4871
mov rcx, qword [rbp - 0x50]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400b486c
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x1400b491c
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140127e30
mov qword [rbp - 0x40], 0
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x50], 0
mov rax, qword [rbp + 0x1358]
cmp rax, 0x10
jb 0x1400b48c6
mov rcx, qword [rbp + 0x1340]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400b48c1
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x1400b491c
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140127e30
mov rax, qword [rbp + 0x1388]
cmp rax, 0x10
jb 0x1400b4907
mov rcx, qword [rbp + 0x1370]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400b4902
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x1400b491c
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140127e30
mov rax, rsi
add rsp, 0x1430
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
call fcn.140008e60
int3