Function at 0x140156c60
Capabilities:
Authenticate hmac
Create process on windows
Encode data using xor
Terminate process

Disassembly:
xchg rdx, rbx
mov qword [rsp + 8], rdx
xchg rdx, rbx
xchg rsi, r15
mov qword [rsp + 0x10], r15
xchg r15, rsi
nop
push 0x3df3323
mov qword [rsp], rbp
nop
push 0x38224017
mov qword [rsp], rdi
push r11
mov qword [rsp], r12
push r14
nop
push 0x1b25e1d4
mov qword [rsp], r15
lea rbp, [rsp - 0x2070]
mov eax, 0x4f77258f
sub eax, 0x471be64
add eax, 0x2e8a081a
add eax, 0x769a5c
sub eax, 0x361e8afe
xor eax, 0x44c068fe
add eax, 0x3d8f067a
sub eax, 0x44b5fb67
call fcn.1401fcf00
sub rsp, rax
xchg rsi, rdx
mov r15, rsi
xchg rsi, rdx
xchg rdi, r12
mov rdi, rcx
xchg r12, rdi
xor esi, esi
mov r14d, esi
mov dword [rbp + 0x20b0], esi
test r8b, r8b
je 0x140157618
xchg r9, rdx
mov rcx, r9
xchg r9, rdx
call fcn.1400701d0
cmp rax, 3
jb 0x140157494
lea edx, [rsi + 1]
xchg r15, rcx
mov r15, rcx
xchg rcx, r15
call fcn.14004e040
mov dl, 0x4c
xor dl, 0x43
add dl, 0x5a
xor dl, 0xe
sub dl, 0x26
add dl, 0x24
sub dl, 0x24
add dl, 0x37
sub dl, 0x77
mov rcx, rax
call fcn.14007dc10
test al, al
je 0x140157494
lea r9d, [rsi - 1]
lea r8d, [rsi + 0x1b]
lea rdx, [rbp - 0x20]
mov rcx, qword [r12]
call fcn.140163520
nop
mov rdi, qword [r12]
lea rcx, [rdi + 0x308]
call fcn.14007e7b0
mov rbx, rax
lea edx, [rsi + 2]
xchg rcx, rsi
mov rsi, r15
xchg rsi, rcx
call fcn.14004e040
lea rdx, [rbp - 0x80]
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.14007e200
nop
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x28]
xchg r15, rbx
mov rcx, r15
xchg rbx, r15
call fcn.140052640
nop
mov rcx, rax
call fcn.140175c10
xchg r9, rbx
mov r9, rax
xchg r9, rbx
lea rcx, [rbp - 0x20]
call fcn.14007b1a0
xchg r11, rbx
mov r9, r11
xchg rbx, r11
mov r8, rax
lea edx, [rsi + 0x40]
mov rcx, rdi
call fcn.14016de00
nop
lea rcx, [rbp + 0x28]
call fcn.140029b90
nop
lea rcx, [rbp - 0x80]
call fcn.14004c550
xchg r15, r11
mov rcx, r11
xchg r11, r15
call fcn.1400701d0
cmp rax, 4
jb 0x14015748b
xchg rsi, rcx
mov rsi, qword [r12]
xchg rsi, rcx
neg rcx
add rcx, 0xfffffffffffffcf8
neg rcx
call fcn.14007e7b0
xchg r15, rbx
mov r15, rax
xchg r15, rbx
lea edx, [rsi + 3]
xchg r15, rdx
mov rcx, rdx
xchg r15, rdx
call fcn.14004e040
lea rdx, [rsp + 0x60]
xchg r11, rax
mov rcx, r11
xchg r11, rax
call fcn.14007e200
nop
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x60]
xchg rbp, rcx
mov rbp, rbx
xchg rcx, rbp
call fcn.140052640
nop
lea rcx, [rsp + 0x60]
call fcn.14004c550
lea rcx, [rbp - 0x60]
call fcn.140178b10
cmp rax, 8
jb 0x14015720a
lea r9d, [rsi + 8]
xor r8d, r8d
lea rdx, [rbp + 0x48]
lea rcx, [rbp - 0x60]
call 0x140178b30
nop
mov dword [rbp + 0x20b0], 0x4105b788
sub dword [rbp + 0x20b0], 0x2412117b
add dword [rbp + 0x20b0], 0xcad197b
xor dword [rbp + 0x20b0], 0x52562d01
sub dword [rbp + 0x20b0], 0x752161b3
xor dword [rbp + 0x20b0], 0x418b1330
xor dword [rbp + 0x20b0], 0x4945ab63
sub dword [rbp + 0x20b0], 0xe1b8884
mov rcx, rax
call fcn.140175c10
xchg rdx, rbp
mov rbp, rax
xchg rbp, rdx
lea rcx, [rbp + 0x10]
call fcn.14007aa60
xchg rbx, rax
mov rax, rbx
xchg rbx, rax
mov dword [rbp + 0x20b0], 0x79b25381
sub dword [rbp + 0x20b0], 0x23e777c6
xor dword [rbp + 0x20b0], 0x4614a9a9
xor dword [rbp + 0x20b0], 0xef6578c
sub dword [rbp + 0x20b0], 0x18b52fa5
sub dword [rbp + 0x20b0], 0x472f5f6
mov dword [rsp + 0x40], 0x3d652372
xor dword [rsp + 0x40], 0x34ad0026
sub dword [rsp + 0x40], 0x36ba859
xor dword [rsp + 0x40], 0x107aae62
add dword [rsp + 0x40], 0x3f990d02
sub dword [rsp + 0x40], 0x2a8ba432
add dword [rsp + 0x40], 0x49ab5cca
sub dword [rsp + 0x40], 0x126a15a8
add dword [rsp + 0x40], 0x9481726b
mov dword [rsp + 0x4a], 0x454956f2
add dword [rsp + 0x4a], 0x20a0d14
sub dword [rsp + 0x4a], 0x3c5e8881
xor dword [rsp + 0x4a], 0x4eeea8aa
add dword [rsp + 0x4a], 0x2d548b63
sub dword [rsp + 0x4a], 0x3a2abe34
add dword [rsp + 0x4a], 0x3c156596
sub dword [rsp + 0x4a], 0x1944bc02
add dword [rsp + 0x4a], 0xa56a1580
mov dword [rsp + 0x4e], 0x68c29168
sub dword [rsp + 0x4e], 0x13401547
add dword [rsp + 0x4e], 0x82ea8d6
sub dword [rsp + 0x4e], 0x4f0f8cfd
xor dword [rsp + 0x4e], 0x313594c1
xor dword [rsp + 0x4e], 0x7519ca7f
xor dword [rsp + 0x4e], 0xb5f7363a
mov dword [rsp + 0x44], 0x4c8b0e0b
sub dword [rsp + 0x44], 0x3646c72d
add dword [rsp + 0x44], 0x45a6546e
add dword [rsp + 0x44], 0x13e6d56f
sub dword [rsp + 0x44], 0xdc9052b
xor dword [rsp + 0x44], 0x94fe9d66
mov dword [rsp + 0x52], 0x35a615e8
xor dword [rsp + 0x52], 0x6eda8f6b
sub dword [rsp + 0x52], 0x29381068
xor dword [rsp + 0x52], 0x558e40eb
sub dword [rsp + 0x52], 0x207f6d2
sub dword [rsp + 0x52], 0x65012787
xor dword [rsp + 0x52], 0x351730c6
xor dword [rsp + 0x52], 0x4d63399a
xor dword [rsp + 0x52], 0x87f15ab6
mov dword [rsp + 0x56], 0x800b26a
add dword [rsp + 0x56], 0x41368d00
add dword [rsp + 0x56], 0x363e368
sub dword [rsp + 0x56], 0xa916abf
sub dword [rsp + 0x56], 0x39924b88
xor dword [rsp + 0x56], 0x42e2ed75
sub dword [rsp + 0x56], 0x65a845e
xor dword [rsp + 0x56], 0xbd416bf
add dword [rsp + 0x56], 0xaf4b141a
xor eax, eax
mov word [rsp + 0x5a], ax
mov edx, esi
movzx eax, word [rsp + rdx*2 + 0x4a]
movzx ecx, byte [rsp + rdx + 0x40]
add cx, ax
mov word [rsp + rdx*2 + 0x4a], cx
mov byte [rsp + rdx + 0x40], 0x22
xor byte [rsp + rdx + 0x40], 0x36
add byte [rsp + rdx + 0x40], 0x59
sub byte [rsp + rdx + 0x40], 0x12
sub byte [rsp + rdx + 0x40], 0x51
add byte [rsp + rdx + 0x40], 8
sub byte [rsp + rdx + 0x40], 0x12
inc rdx
cmp rdx, 8
jb 0x1401570dc
mov dword [rbp + 0x20b0], 0x3eae1371
add dword [rbp + 0x20b0], 0x136f5a68
xor dword [rbp + 0x20b0], 0x390dfe30
sub dword [rbp + 0x20b0], 0x43a1240a
xor dword [rbp + 0x20b0], 0x7d0a1f07
sub dword [rbp + 0x20b0], 0x5a6570d1
movups xmm0, xmmword [rsp + 0x40]
movaps xmmword [rbp - 0x40], xmm0
movsd xmm1, qword [rsp + 0x50]
xchg r11, rbp
movsd qword [r11 - 0x30], xmm1
xchg r11, rbp
mov eax, dword [rsp + 0x58]
mov dword [rbp - 0x28], eax
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 8]
call fcn.14007c070
nop
mov r14d, 0x77d7ed81
sub r14d, 0x356f625e
sub r14d, 0x12e12988
xor r14d, 0x58b892f7
sub r14d, 0x6b5884df
add r14d, 0x63635ffe
xor r14d, 0x1cb8aea2
add r14d, 0xa4ceb9
sub r14d, 0x74972ed3
mov dword [rbp + 0x20b0], r14d
xchg r8, rdx
mov r8, rax
xchg r8, rdx
xchg rcx, rbx
mov rbx, rcx
xchg rbx, rcx
call fcn.14007b110
test al, al
je 0x14015720a
mov bl, 0xa
add bl, 0x1b
add bl, 0x3b
add bl, 0xf
xor bl, 0x35
add bl, 4
sub bl, 0x27
xor bl, 0x36
jmp 0x14015720c
xor bl, bl
test r14b, 8
je 0x14015722b
and r14d, 0xfffffff7
mov dword [rbp + 0x20b0], r14d
lea rcx, [rbp - 8]
call fcn.14007ae50
nop
test r14b, 4
je 0x140157289
and r14d, 0xfffffffb
mov dword [rbp + 0x20b0], r14d
xchg r9, rsi
mov rax, r9
xchg r9, rsi
nop word [rax + rax]
mov byte [rsp + rax + 0x4a], 9
xor byte [rsp + rax + 0x4a], 0x20
add byte [rsp + rax + 0x4a], 0x33
sub byte [rsp + rax + 0x4a], 0x29
add byte [rsp + rax + 0x4a], 0x28
xor byte [rsp + rax + 0x4a], 0x19
xor byte [rsp + rax + 0x4a], 0x42
add byte [rsp + rax + 0x4a], 0
inc rax
cmp rax, 0x10
jb 0x140157254
test r14b, 2
je 0x1401572a8
and r14d, 0xfffffffd
mov dword [rbp + 0x20b0], r14d
lea rcx, [rbp + 0x10]
call fcn.14007ae50
nop
test r14b, 1
je 0x1401572c6
and r14d, 0xfffffffe
mov dword [rbp + 0x20b0], r14d
lea rcx, [rbp + 0x48]
call fcn.140029b90
test bl, bl
je 0x140157481
lea rcx, [rbp - 0x60]
call fcn.140175c10
xchg r8, rax
mov rax, r8
xchg r8, rax
mov dword [rsp + 0x30], 0xa0f632c
add dword [rsp + 0x30], 0x7551ebbc
sub dword [rsp + 0x30], 0x566a850
xor dword [rsp + 0x30], 0x79bbef5e
add dword [rsp + 0x30], 0x38a6f3b4
xor dword [rsp + 0x30], 0xf373817
sub dword [rsp + 0x30], 0xb086106
add dword [rsp + 0x30], 0x39e12a44
add dword [rsp + 0x30], 0x903f284b
mov dword [rsp + 0x36], 0x5702d2c4
xor dword [rsp + 0x36], 0x25012a7d
xor dword [rsp + 0x36], 0x1fb0b03e
xor dword [rsp + 0x36], 0x41c43272
xor dword [rsp + 0x36], 0xd6de333
add dword [rsp + 0x36], 0x3e4467ca
sub dword [rsp + 0x36], 0x3f74595b
add dword [rsp + 0x36], 0xdf905744
mov dword [rsp + 0x3a], 0x7161ee64
sub dword [rsp + 0x3a], 0x4b7e34e5
add dword [rsp + 0x3a], 0x1e48fd7c
add dword [rsp + 0x3a], 0xd6ea7d
add dword [rsp + 0x3a], 0x54c936c
add dword [rsp + 0x3a], 0xb528ca8b
xor eax, eax
mov word [rsp + 0x3e], ax
xchg rdx, rsi
mov rax, rdx
xchg rsi, rdx
nop dword [rax]
movzx ecx, word [rsp + rax*2 + 0x36]
movzx edx, byte [rsp + rax + 0x30]
add dx, cx
mov word [rsp + rax*2 + 0x36], dx
mov byte [rsp + rax + 0x30], 1
xor byte [rsp + rax + 0x30], 0x47
xor byte [rsp + rax + 0x30], 0x6c
sub byte [rsp + rax + 0x30], 5
xor byte [rsp + rax + 0x30], 0x5c
sub byte [rsp + rax + 0x30], 6
xor byte [rsp + rax + 0x30], 0x7c
xor byte [rsp + rax + 0x30], 0x48
sub byte [rsp + rax + 0x30], 0x47
inc rax
cmp rax, 4
jb 0x1401573ad
mov dword [rsp + 0x28], 0x1da8524a
add dword [rsp + 0x28], 0x52f502c5
sub dword [rsp + 0x28], 0x343988ea
add dword [rsp + 0x28], 0x11dcb3b
add dword [rsp + 0x28], 0x3e11fc0b
sub dword [rsp + 0x28], 0x7b93936a
xchg rsi, r12
mov qword [rsp + 0x20], r12
xchg rsi, r12
xor r9d, r9d
lea rdx, [rsp + 0x36]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop dword [rax]
mov byte [rsp + rsi + 0x36], 0x2b
add byte [rsp + rsi + 0x36], 0
add byte [rsp + rsi + 0x36], 0x24
xor byte [rsp + rsi + 0x36], 0x7a
sub byte [rsp + rsi + 0x36], 0x33
add byte [rsp + rsi + 0x36], 0x75
add byte [rsp + rsi + 0x36], 4
xor byte [rsp + rsi + 0x36], 0xd
sub byte [rsp + rsi + 0x36], 0x76
inc rsi
cmp rsi, 8
jb 0x140157447
lea rcx, [rbp - 0x60]
call fcn.140029b90
nop
lea rcx, [rbp - 0x20]
jmp 0x140157613
mov r9d, 0x787086b1
xor r9d, 0x15c0a733
add r9d, 0x3133dad
add r9d, 0x7673802
sub r9d, 0x3a68c6eb
sub r9d, 0x1e3ae3b
add r9d, 0x3ea437c4
xor r9d, 0x1dae9157
add r9d, 0x98d33767
lea r8d, [r9 + 0x1c]
lea rdx, [rbp - 0x80]
xchg rcx, r13
mov r13, qword [r12]
xchg r13, rcx
call fcn.140163520
nop
mov r9d, 0x1bb79f11
xor r9d, 0x24da88c1
xor r9d, 0x7ad8fd0b
add r9d, 0x104f09a7
sub r9d, 0x3d70bdfa
xor r9d, 0x6d4e0e
add r9d, 0x14630285
add r9d, 0xf4019f9
xor r9d, 0xc3636afb
lea r8d, [r9 + 0x1d]
lea rdx, [rsp + 0x60]
mov rcx, qword [r12]
call fcn.140163520
nop
xor edx, edx
mov r8d, 0x272963c3
add r8d, 0x1e9c6ae0
xor r8d, 0xdd33980
xor r8d, 0x472774fe
sub r8d, 0xc8ebeb7
xor r8d, 0x2a2e526
lea rcx, [rbp + 0x70]
call sub.VCRUNTIME140.dll_memset
xchg rcx, rsi
mov rsi, qword [r12]
xchg rcx, rsi
sub rcx, 0x4589159b
add rcx, 0x45891afb
call fcn.14007b590
mov rbx, rax
lea rcx, [rsp + 0x60]
call fcn.14007b590
xchg r8, r15
mov r15, rbx
xchg r8, r15
mov rdx, rax
lea rcx, [rbp + 0x70]
call fcn.140086970
xchg rdx, rbx
mov rdx, qword [r12]
xchg rbx, rdx
lea rcx, [rbp - 0x80]
call fcn.14007b1a0
lea r9, [rbp + 0x70]
xchg r8, rax
mov rax, r8
xchg r8, rax
mov edx, 0x26107b60
xor edx, 0x4fb1a607
xor edx, 0x4d550c5f
sub edx, 0xfa020d5
add edx, 0x2e48a40d
add edx, 0x243608b3
xor edx, 0x67d35d63
xchg rbx, rcx
mov rbx, rcx
xchg rbx, rcx
call fcn.14016de00
nop
lea rcx, [rsp + 0x60]
call fcn.14007ae50
nop
lea rcx, [rbp - 0x80]
call fcn.14007ae50
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3