Function at 0x140001b90
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Encode data using xor
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x248
mov dword [rsp + 0x290], ecx
mov rdi, rdx
mov rsi, r8
mov ebp, dword [rsp + 0x2b0]
mov r14d, dword [rsp + 0x2b8]
mov eax, dword [rsp + 0x2c8]
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x2d0]
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x2d8]
mov dword [rsp + 0x64], eax
mov ebx, dword [rsp + 0x2e0]
mov byte [rsp + 0x48], bpl
mov byte [rsp + 0x50], r14b
mov byte [rsp + 0x7e], bl
cmp word [r8], 0x5a4d
jne 0x1400029e2
movsxd r13, dword [r8 + 0x3c]
add r13, r8
cmp word [r13 + 4], 0x8664
jne 0x1400029fd
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8d, dword [r13 + 0x50]
mov edx, 0
mov rcx, rdi
mov rax, qword [0x14021d240]
call qword [rax + 0x238]
mov rcx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140002a04
mov qword [rsp + 0x1f0], 0
mov qword [rsp + 0x1f8], 0
mov qword [rsp + 0x208], 0
mov rax, qword [0x14021d240]
mov rdx, qword [rax + 0x40]
mov qword [rsp + 0x1d0], rdx
mov rdx, qword [rax + 0x50]
mov qword [rsp + 0x1d8], rdx
mov rdx, qword [rax + 0x178]
mov qword [rsp + 0x1e0], rdx
mov qword [rsp + 0x1e8], rcx
mov edx, dword [rsp + 0x2e8]
mov dword [rsp + 0x1f8], edx
mov rdx, qword [rsp + 0x2f0]
mov qword [rsp + 0x200], rdx
movzx ebx, bl
mov dword [rsp + 0x208], ebx
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
mov r8, rsi
mov rdx, rcx
mov rcx, rdi
call qword [rax + 0x258]
test eax, eax
je 0x140001d1d
lea rax, [r13 + 0x18]
mov qword [rsp + 0x70], rax
movzx ebx, word [r13 + 0x14]
add rbx, rax
cmp word [r13 + 6], 0
je 0x140001db7
mov r12d, 0
mov r15, qword [0x14021d240]
jmp 0x140001d5a
mov r9d, 0x8000
mov r8d, 0
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
mov rax, qword [0x14021d240]
call qword [rax + 0x240]
mov ebp, 0
jmp 0x1400029e7
add r12d, 1
add rbx, 0x28
movzx eax, word [r13 + 6]
cmp eax, r12d
je 0x140001db7
mov r9d, dword [rbx + 0x10]
test r9d, r9d
je 0x140001d48
mov eax, dword [rbx + 0x14]
mov edx, dword [rbx + 0xc]
add rdx, qword [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r9d, r9d
lea r8, [rsi + rax]
mov rcx, rdi
call qword [r15 + 0x258]
test eax, eax
jne 0x140001d48
mov r9d, 0x8000
mov r8d, 0
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
mov rax, qword [0x14021d240]
call qword [rax + 0x240]
mov ebp, 0
jmp 0x1400029e7
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8d, 0x40
mov edx, 0
mov rcx, rdi
mov rax, qword [0x14021d240]
call qword [rax + 0x238]
mov r15, rax
test rax, rax
je 0x140001f6d
mov qword [rsp + 0x20], 0
mov r9d, 0x40
lea r8, [rsp + 0x1d0]
mov rdx, rax
mov rcx, rdi
mov rax, qword [0x14021d240]
call qword [rax + 0x258]
test eax, eax
je 0x140001f98
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8d, 0x14f0
mov edx, 0
mov rcx, rdi
mov rax, qword [0x14021d240]
call qword [rax + 0x238]
mov qword [rsp + 0x68], rax
test rax, rax
je 0x140001fdb
mov qword [rsp + 0x20], 0
mov r9d, 0x4f0
lea r8, [0x1402173a0]
mov rdx, qword [rsp + 0x68]
mov rcx, rdi
mov rax, qword [0x14021d240]
call qword [rax + 0x258]
test eax, eax
je 0x14000201e
mov dword [rsp + 0x1cc], 0
mov rbx, qword [0x14021d240]
lea rsi, [rsp + 0x1cc]
mov qword [rsp + 0x20], rsi
mov r9d, 0x40
mov r8d, dword [r13 + 0x50]
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
call qword [rbx + 0x248]
mov qword [rsp + 0x20], rsi
mov r9d, 0x40
mov r8d, 0x4f0
mov rsi, qword [rsp + 0x68]
mov rdx, rsi
mov rcx, rdi
call qword [rbx + 0x248]
call qword [rbx + 0x1e8]
mov dword [rsp + 0x78], eax
test bpl, bpl
jne 0x1400020ed
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], r15
mov r9, rsi
mov r8d, 0
mov edx, 0
mov rcx, rdi
mov rax, qword [0x14021d240]
call qword [rax + 0x1c0]
test rax, rax
je 0x14000207b
cmp qword [rsp + 0x300], 0
je 0x1400020d3
mov rsi, qword [rsp + 0x300]
mov qword [rsi], rax
mov byte [rsp + 0x7f], 1
mov rsi, qword [0x14021d240]
mov r12, rsi
mov r14, rsi
mov qword [rsp + 0x48], r13
movzx r13d, byte [rsp + 0x7f]
jmp 0x1400024ba
mov r9d, 0x8000
mov r8d, 0
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
mov rax, qword [0x14021d240]
call qword [rax + 0x240]
mov ebp, 0
jmp 0x1400029e7
mov rbx, qword [0x14021d240]
mov r9d, 0x8000
mov r8d, 0
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
call qword [rbx + 0x240]
mov r9d, 0x8000
mov r8d, 0
mov rdx, r15
mov rcx, rdi
call qword [rbx + 0x240]
mov ebp, 0
jmp 0x1400029e7
mov rbx, qword [0x14021d240]
mov r9d, 0x8000
mov r8d, 0
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
call qword [rbx + 0x240]
mov r9d, 0x8000
mov r8d, 0
mov rdx, r15
mov rcx, rdi
call qword [rbx + 0x240]
mov ebp, 0
jmp 0x1400029e7
mov rbx, qword [0x14021d240]
mov r9d, 0x8000
mov r8d, 0
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
call qword [rbx + 0x240]
mov r9d, 0x8000
mov r8d, 0
mov rdx, r15
mov rcx, rdi
call qword [rbx + 0x240]
mov r9d, 0x8000
mov r8d, 0
mov rdx, qword [rsp + 0x68]
mov rcx, rdi
call qword [rbx + 0x240]
mov ebp, 0
jmp 0x1400029e7
mov rbx, qword [0x14021d240]
mov r9d, 0x8000
mov r8d, 0
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
call qword [rbx + 0x240]
mov r9d, 0x8000
mov r8d, 0
mov rdx, r15
mov rcx, rdi
call qword [rbx + 0x240]
mov r9d, 0x8000
mov r8d, 0
mov rdx, qword [rsp + 0x68]
mov rcx, rdi
call qword [rbx + 0x240]
jmp 0x1400029e7
mov rcx, rax
mov rax, qword [0x14021d240]
call qword [rax + 0xc0]
mov byte [rsp + 0x7f], 1
jmp 0x140001f50
mov qword [rsp + 0x98], r15
mov rax, qword [rsp + 0x68]
lea rdx, [rax + 9]
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0x98]
mov rcx, rdi
mov rax, qword [0x14021d240]
call qword [rax + 0x258]
test eax, eax
je 0x14000215f
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xb0], 0
mov rbx, qword [0x14021d240]
mov rsi, rbx
mov rbp, rbx
jmp 0x140002208
mov rbx, qword [0x14021d240]
mov r9d, 0x8000
mov r8d, 0
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
call qword [rbx + 0x240]
mov r9d, 0x8000
mov r8d, 0
mov rdx, r15
mov rcx, rdi
call qword [rbx + 0x240]
mov r9d, 0x8000
mov r8d, 0
mov rdx, qword [rsp + 0x68]
mov rcx, rdi
call qword [rbx + 0x240]
mov ebp, 0
jmp 0x1400029e7
mov rax, qword [rsp + 0xa0]
cmp qword [rsp + 0xa8], rax
jne 0x140002240
call qword [rsi + 0x1e8]
sub eax, dword [rsp + 0x78]
cmp eax, dword [rsp + 0x2f8]
jae 0x140002240
mov ecx, dword [rsp + 0x2c0]
call qword [rbp + 0x208]
mov rax, qword [rsp + 0xa0]
cmp rax, qword [rsp + 0xa8]
je 0x140002208
mov qword [rsp + 0xa8], rax
mov eax, dword [rsp + 0x290]
mov dword [rsp + 0xc0], eax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0xc8], rax
lea rdx, [rsp + 0xc0]
lea rcx, [0x140003abe]
call qword [rbx + 0x270]
jmp 0x1400021bc
mov rax, qword [rsp + 0xa0]
cmp qword [rsp + 0xa8], rax
je 0x140002475
mov rax, qword [0x14021d240]
mov r8, qword [rax + 0xf8]
mov byte [rsp + 0x21a], 0x58
mov byte [rsp + 0x21b], 0x43
mov byte [rsp + 0x21c], 0x5c
mov byte [rsp + 0x21d], 0x55
mov byte [rsp + 0x21e], 0x56
mov byte [rsp + 0x21f], 0x15
mov byte [rsp + 0x220], 0x58
mov byte [rsp + 0x221], 0x51
mov byte [rsp + 0x222], 0x52
mov byte [rsp + 0x223], 0x3f
lea rcx, [rsp + 0x21a]
mov edx, 0
movsxd rax, edx
imul rax, rax, 0x94f2095
sar rax, 0x21
mov r9d, edx
sar r9d, 0x1f
sub eax, r9d
imul eax, eax, 0x37
mov r9d, edx
sub r9d, eax
lea eax, [r9 + 0x36]
xor byte [rcx], al
add edx, 1
add rcx, 1
cmp edx, 0xa
jne 0x1400022c1
lea rcx, [rsp + 0x21a]
call r8
mov qword [rsp + 0x88], rax
mov rbx, qword [rsp + 0xa0]
mov r12, qword [rsp + 0xa8]
cmp r12, rbx
je 0x14000247c
mov byte [rsp + 0x7f], 0
mov rbp, qword [0x14021d240]
jmp 0x14000237a
cmp qword [rbx], 0
je 0x14000236d
mov dword [rsp + 0x94], 0
lea rdx, [rsp + 0x94]
mov rcx, qword [rbx]
mov rax, qword [0x14021d240]
call qword [rax + 0x280]
mov esi, eax
test eax, eax
je 0x14000236d
mov eax, dword [rsp + 0x290]
cmp dword [rsp + 0x94], eax
je 0x140002393
add rbx, 8
cmp r12, rbx
je 0x140002435
lea rdx, [rsp + 0xc0]
mov r8d, 0x104
mov rcx, qword [rbx]
call qword [rbp + 0x278]
jmp 0x14000232e
mov r9d, esi
mov r8, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x68]
mov ecx, 3
mov rax, qword [0x14021d240]
call qword [rax + 0x298]
mov qword [rsp + 0x80], rax
test rax, rax
je 0x14000236d
mov r9d, 0
mov r8d, 0
mov edx, 0
mov ecx, esi
mov rax, qword [0x14021d240]
call qword [rax + 0x290]
mov ecx, 0xa
mov rax, qword [0x14021d240]
call qword [rax + 0x208]
mov ecx, 0xa
mov rax, qword [0x14021d240]
call qword [rax + 0x208]
mov rcx, qword [rsp + 0x80]
mov rax, qword [0x14021d240]
call qword [rax + 0x2a0]
cmp byte [rsp + 0x50], 0
jne 0x140002430
movzx eax, byte [rsp + 0x48]
mov byte [rsp + 0x7f], al
jmp 0x14000236d
mov byte [rsp + 0x7f], r14b
mov rax, qword [rsp + 0xa0]
cmp rax, qword [rsp + 0xa8]
je 0x14000244f
mov qword [rsp + 0xa8], rax
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x140001f50
mov rdx, qword [rsp + 0xb0]
sub rdx, rcx
call fcn.1400bb040
jmp 0x140001f50
mov byte [rsp + 0x7f], 0
jmp 0x14000244f
mov byte [rsp + 0x7f], 0
jmp 0x14000244f
cmp rbx, 0x404040
sete bpl
mov edx, r13d
xor edx, 1
or ebp, edx
or bpl, al
jne 0x1400025a1
mov ecx, 0xa
mov rax, qword [0x14021d240]
call qword [rax + 0x208]
test rbx, rbx
jne 0x1400025fe
mov dword [rsp + 0xa0], 0
lea rdx, [rsp + 0xa0]
mov rcx, rdi
call qword [rsi + 0x268]
cmp dword [rsp + 0xa0], 0x103
jne 0x1400025f4
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xe0], 0
mov qword [rsp + 0xe8], 0
mov qword [rsp + 0xf0], 0
mov qword [rsp + 0xf8], 0
mov qword [rsp + 0x20], 0
mov r9d, 0x40
lea r8, [rsp + 0xc0]
mov rdx, r15
mov rcx, rdi
call qword [r12 + 0x260]
mov rbx, qword [rsp + 0xe0]
mov eax, 0
cmp dword [rsp + 0x2f8], 0
je 0x140002483
call qword [r14 + 0x1e8]
sub eax, dword [rsp + 0x78]
cmp eax, dword [rsp + 0x2f8]
setae al
jmp 0x140002483
mov rbx, qword [0x14021d240]
mov r9d, 0x8000
mov r8d, 0
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
call qword [rbx + 0x240]
mov r9d, 0x8000
mov r8d, 0
mov rdx, r15
mov rcx, rdi
call qword [rbx + 0x240]
mov r9d, 0x8000
mov r8d, 0
mov rdx, qword [rsp + 0x68]
mov rcx, rdi
call qword [rbx + 0x240]
mov ebp, 0
jmp 0x1400029e7
mov r13, qword [rsp + 0x48]
mov ecx, 0x1400000
call sub.msvcrt.dll_malloc
mov r14, rax
test rax, rax
je 0x1400029e7
mov r8d, 0x1400000
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
cmp byte [rsp + 0x58], 0
je 0x14000265a
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
mov r8, r14
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
mov rax, qword [0x14021d240]
call qword [rax + 0x258]
cmp dword [rsp + 0x2c0], 0
je 0x140002678
mov ecx, dword [rsp + 0x2c0]
mov rax, qword [0x14021d240]
call qword [rax + 0x208]
cmp byte [rsp + 0x60], 0
je 0x140002946
movzx ebx, word [r13 + 0x14]
add rbx, qword [rsp + 0x70]
cmp word [r13 + 6], 0
je 0x140002a33
mov esi, 0
mov r12, qword [0x14021d240]
lea rax, [rsp + 0x22b]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x231]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], r15
movzx r15d, byte [rsp + 0x7e]
jmp 0x14000278a
mov byte [rsp + 0x22b], 0x18
mov byte [rsp + 0x22c], 0x45
mov byte [rsp + 0x22d], 0x4b
mov byte [rsp + 0x22e], 0x4b
mov byte [rsp + 0x22f], 0x59
mov byte [rsp + 0x230], 0x3b
lea rcx, [rsp + 0x22b]
mov edx, 0
movsxd rax, edx
imul rax, rax, 0x94f2095
sar rax, 0x21
mov r8d, edx
sar r8d, 0x1f
sub eax, r8d
imul eax, eax, 0x37
mov r8d, edx
sub r8d, eax
lea eax, [r8 + 0x36]
xor byte [rcx], al
add edx, 1
add rcx, 1
cmp edx, 6
jne 0x14000270c
mov rdx, qword [rsp + 0x48]
mov rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x14000282f
mov edx, dword [rbx + 0xc]
add rdx, qword [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r9d, ebp
mov r8, r14
mov rcx, rdi
call qword [r12 + 0x258]
add esi, 1
add rbx, 0x28
movzx eax, word [r13 + 6]
cmp eax, esi
je 0x140002941
mov ebp, dword [rbx + 8]
test ebp, ebp
je 0x140002776
test r15b, r15b
jne 0x1400026cf
mov byte [rsp + 0x224], 0x18
mov byte [rsp + 0x225], 0x47
mov byte [rsp + 0x226], 0x5c
mov byte [rsp + 0x227], 0x58
mov byte [rsp + 0x228], 0x4e
mov byte [rsp + 0x229], 0x5a
mov byte [rsp + 0x22a], 0x3c
lea rcx, [rsp + 0x224]
mov edx, 0
movsxd rax, edx
imul rax, rax, 0x94f2095
sar rax, 0x21
mov r8d, edx
sar r8d, 0x1f
sub eax, r8d
imul eax, eax, 0x37
mov r8d, edx
sub r8d, eax
lea eax, [r8 + 0x36]
xor byte [rcx], al
add edx, 1
add rcx, 1
cmp edx, 7
jne 0x1400027df
lea rdx, [rsp + 0x224]
mov rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x140002754
jmp 0x1400026cf
mov byte [rsp + 0x231], 0x18
mov byte [rsp + 0x232], 0x45
mov byte [rsp + 0x233], 0x5d
mov byte [rsp + 0x234], 0x55
mov byte [rsp + 0x235], 0x55
mov byte [rsp + 0x236], 0x58
mov byte [rsp + 0x237], 0x3c
lea rcx, [rsp + 0x231]
mov edx, 0
movsxd rax, edx
imul rax, rax, 0x94f2095
sar rax, 0x21
mov r8d, edx
sar r8d, 0x1f
sub eax, r8d
imul eax, eax, 0x37
mov r8d, edx
sub r8d, eax
lea eax, [r8 + 0x36]
xor byte [rcx], al
add edx, 1
add rcx, 1
cmp edx, 7
jne 0x140002874
mov rdx, qword [rsp + 0x50]
mov rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x140002754
mov byte [rsp + 0x238], 0x18
mov byte [rsp + 0x239], 0x41
mov byte [rsp + 0x23a], 0x54
mov byte [rsp + 0x23b], 0x50
mov byte [rsp + 0x23c], 0x40
mov byte [rsp + 0x23d], 0x5e
mov byte [rsp + 0x23e], 0x4e
mov byte [rsp + 0x23f], 0x3d
lea rcx, [rsp + 0x238]
mov edx, 0
movsxd rax, edx
imul rax, rax, 0x94f2095
sar rax, 0x21
mov r8d, edx
sar r8d, 0x1f
sub eax, r8d
imul eax, eax, 0x37
mov r8d, edx
sub r8d, eax
lea eax, [r8 + 0x36]
xor byte [rcx], al
add edx, 1
add rcx, 1
cmp edx, 8
jne 0x140002909
jmp 0x140002776
mov r15, qword [rsp + 0x58]
cmp byte [rsp + 0x64], 0
je 0x140002a7c
movzx ebx, word [r13 + 0x14]
add rbx, qword [rsp + 0x70]
cmp word [r13 + 6], 0
je 0x140002a3a
mov esi, 0
mov r12, qword [0x14021d240]
lea rbp, [rsp + 0xc0]
jmp 0x1400029ac
mov edx, dword [rbx + 0xc]
add rdx, qword [rsp + 0x40]
mov qword [rsp + 0x20], rbp
mov r8d, r8d
mov rcx, rdi
call qword [r12 + 0x248]
add esi, 1
add rbx, 0x28
movzx eax, word [r13 + 6]
cmp eax, esi
je 0x140002a3a
mov r8d, dword [rbx + 8]
test r8d, r8d
je 0x140002998
mov dword [rsp + 0xc0], 0
mov eax, dword [rbx + 0x24]
mov r9d, 4
test eax, eax
js 0x14000297d
and eax, 0x20000000
cmp eax, 1
sbb r9d, r9d
and r9d, 0xffffffe2
add r9d, 0x20
jmp 0x14000297d
mov ebp, 0
mov eax, ebp
add rsp, 0x248
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov ebp, 0
jmp 0x1400029e7
mov ebp, 0
jmp 0x1400029e7
cmp byte [rsp + 0x64], 0
je 0x140002a7c
mov dword [rsp + 0xc0], 0
movzx eax, word [r13 + 0x14]
mov rsi, qword [rsp + 0x70]
mov r8d, dword [rax + rsi + 0xc]
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
mov r9d, 2
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
mov rax, qword [0x14021d240]
call qword [rax + 0x248]
mov rbx, qword [0x14021d240]
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
mov r8, r14
mov rsi, qword [rsp + 0x68]
mov rdx, rsi
mov rcx, rdi
call qword [rbx + 0x258]
mov r9d, 0x8000
mov r8d, 0
mov rdx, rsi
mov rcx, rdi
call qword [rbx + 0x240]
mov r9d, 0x8000
mov r8d, 0
mov rdx, r15
mov rcx, rdi
call qword [rbx + 0x240]
mov rcx, r14
call fcn.1400228d0
mov ebp, 1
jmp 0x1400029e7