Function at 0x140068858
Capabilities:
Authenticate hmac
Enumerate processes

Disassembly:
push rax
pushf
mov eax, 0x998bdf6a
pushf
not eax
add eax, 0xe6618b49
xor eax, 0x934f4c10
rol eax, 0xe0
popf
pushf
not eax
add eax, 0xc92ce99d
xor eax, 0xe99201ce
rol eax, 0x90
popf
cmp eax, 4
jne 0x140068895
popf
pop rax
jmp 0x140068ccb
cmp eax, 0
jne 0x1400688a4
popf
pop rax
jmp 0x140068a2a
cmp eax, 3
jne 0x1400688b3
popf
pop rax
jmp 0x140068c37
cmp eax, 1
jne 0x1400688c2
popf
pop rax
jmp 0x140068acd
cmp eax, 0xd
jne 0x1400688d1
popf
pop rax
jmp 0x1400690b2
cmp eax, 0x1a
jne 0x1400688e0
popf
pop rax
jmp 0x14006977f
cmp eax, 0xe
jne 0x1400688ef
popf
pop rax
jmp 0x14006914f
cmp eax, 0xb
jne 0x1400688fe
popf
pop rax
jmp 0x140068f8c
cmp eax, 0x19
jne 0x14006890d
popf
pop rax
jmp 0x14006971f
cmp eax, 8
jne 0x14006891c
popf
pop rax
jmp 0x140068e45
cmp eax, 0x10
jne 0x14006892b
popf
pop rax
jmp 0x140069224
cmp eax, 0x17
jne 0x14006893a
popf
pop rax
jmp 0x1400695e9
cmp eax, 9
jne 0x140068949
popf
pop rax
jmp 0x140068ef0
cmp eax, 0x12
jne 0x140068958
popf
pop rax
jmp 0x1400692aa
cmp eax, 0x18
jne 0x140068967
popf
pop rax
jmp 0x140069691
cmp eax, 0x11
jne 0x140068976
popf
pop rax
jmp 0x140069261
cmp eax, 0x1b
jne 0x140068985
popf
pop rax
jmp 0x1400697de
cmp eax, 0x16
jne 0x140068994
popf
pop rax
jmp 0x14006952d
cmp eax, 0xa
jne 0x1400689a3
popf
pop rax
jmp 0x140068f3e
cmp eax, 0x14
jne 0x1400689b2
popf
pop rax
jmp 0x140069430
cmp eax, 0xf
jne 0x1400689c1
popf
pop rax
jmp 0x1400691a6
cmp eax, 0x13
jne 0x1400689d0
popf
pop rax
jmp 0x14006937a
cmp eax, 0x15
jne 0x1400689df
popf
pop rax
jmp 0x1400694e0
cmp eax, 2
jne 0x1400689ee
popf
pop rax
jmp 0x140068b78
cmp eax, 6
jne 0x1400689fd
popf
pop rax
jmp 0x140068d69
cmp eax, 0xc
jne 0x140068a0c
popf
pop rax
jmp 0x14006902c
cmp eax, 7
jne 0x140068a1b
popf
pop rax
jmp 0x140068dde
cmp eax, 5
jne 0x140068a2a
popf
pop rax
jmp 0x140068d60
push rbp
push r15
lea rbp, [rsp - 0xa8]
sub rsp, 0x1a8
mov rax, qword [0x14000a230]
xor rax, rsp
mov qword [rbp + 0x80], rax
xor edx, edx
lea ecx, [rdx + 2]
jmp 0x140068a54
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x140068a9a
push rax
pushf
mov eax, 0x6efb6dd1
pushf
not eax
add eax, 0xd73eba0e
xor eax, 0xd32e0660
rol eax, 0x2f
popf
pushf
not eax
add eax, 0x9006e930
xor eax, 0xead89b79
rol eax, 0x54
popf
jmp 0x140068886
push rax
pushf
mov eax, 0x5bd0ad0
pushf
not eax
add eax, 0xaf456c27
xor eax, 0xaf2cc30e
rol eax, 0x25
popf
pushf
not eax
add eax, 0xb7e276c2
xor eax, 0xe2de2bc1
rol eax, 0x2c
popf
jmp 0x140068886
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x130
mov rcx, rax
jmp 0x140068ade
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140068b45
push rax
pushf
mov eax, 0xcaed8af0
pushf
not eax
add eax, 0xab509379
xor eax, 0xd97cd3cc
rol eax, 0x71
popf
pushf
not eax
add eax, 0xf2351c2c
xor eax, 0xba992e6e
rol eax, 0xb2
popf
pushf
not eax
add eax, 0xfe99036e
xor eax, 0x85a2f02b
rol eax, 0x4f
popf
pushf
not eax
add eax, 0xc5850da1
xor eax, 0xbe269b0a
rol eax, 0x73
popf
jmp 0x140068886
push rax
pushf
mov eax, 0x5d5d59a1
pushf
not eax
add eax, 0xc5a56a2b
xor eax, 0xde81f3f3
rol eax, 0x8e
popf
pushf
not eax
add eax, 0xfad4ce07
xor eax, 0x8d762054
rol eax, 0xa9
popf
jmp 0x140068886
mov qword [rsp + 0x1c0], rbx
mov qword [rsp + 0x1a0], r12
movabs r12, 0x7dc6dd00de169531
pushf
not r12
add r12, 0x7eab7494
xor r12, 0x5f273bd4
rol r12, 0x86
popf
pushf
not r12
add r12, 0x49743615
xor r12, 0x5c7b2219
rol r12, 0x92
popf
pushf
not r12
add r12, 0x631f39fb
xor r12, 0x4696ace2
rol r12, 0x32
popf
mov qword [rsp + 0x198], r13
xor r13d, r13d
mov qword [rsp + 0x190], r14
mov qword [rsp + 0x1c8], rsi
mov qword [rsp + 0x1d0], rdi
lea r14, [r13 - 1]
push rax
pushf
mov eax, 0xfd52b5e0
pushf
not eax
add eax, 0xd329f347
xor eax, 0xf0ab0599
rol eax, 0xa3
popf
pushf
not eax
add eax, 0xee3a0663
xor eax, 0xc2683e69
rol eax, 0x4c
popf
jmp 0x140068886
xorps xmm0, xmm0
mov qword [rsp + 0x40], r13
movups xmmword [rsp + 0x30], xmm0
mov ecx, 0x3824f06d
pushf
not ecx
add ecx, 0xc8ca9a52
xor ecx, 0xa80834f5
rol ecx, 0x7c
popf
pushf
not ecx
add ecx, 0xb10633f2
xor ecx, 0x9d799a20
rol ecx, 0xb3
popf
mov qword [rsp + 0x48], r13
lea rax, [rsp + 0x7c]
mov rbx, r14
nop word [rax + rax]
push rax
pushf
mov eax, 0x498cc2d5
pushf
not eax
add eax, 0xc014a4e6
xor eax, 0xa8a7dbe9
rol eax, 0xb1
popf
pushf
not eax
add eax, 0xdc666717
xor eax, 0x91da6177
rol eax, 0x36
popf
pushf
not eax
add eax, 0xca3003cf
xor eax, 0xe1b1999e
rol eax, 1
popf
jmp 0x140068886
inc rbx
cmp byte [rax + rbx], r13b
jne 0x140068d07
push rax
pushf
mov eax, 0xf6c5fc10
pushf
not eax
add eax, 0xfb16df98
xor eax, 0x99af11ed
rol eax, 0x9c
popf
pushf
not eax
add eax, 0x8989ca8b
xor eax, 0xdfa9ce64
rol eax, 0xb8
popf
jmp 0x140068886
push rax
pushf
mov eax, 0x972a45fa
pushf
not eax
add eax, 0x8361f73d
xor eax, 0xdb9a93d8
rol eax, 0x8c
popf
pushf
not eax
add eax, 0xa03c9b13
xor eax, 0xdc47ed2e
rol eax, 0x95
popf
pushf
not eax
add eax, 0xb3649f28
xor eax, 0xc6ef4bb8
rol eax, 0x5b
popf
pushf
not eax
add eax, 0xd0986f36
xor eax, 0xefc6063c
rol eax, 8
popf
jmp 0x140068886
cmp rbx, r12
ja 0x14006977f
mov qword [rsp + 0x48], 0xf
cmp rbx, 0x10
jae 0x140068dab
push rax
pushf
mov eax, 0x5c778af
pushf
not eax
add eax, 0x82f24e7f
xor eax, 0xd8e78055
rol eax, 0x89
popf
pushf
not eax
add eax, 0x897ce2d1
xor eax, 0xef11ad85
rol eax, 0x6a
popf
jmp 0x140068886
push rax
pushf
mov eax, 0x772c041f
pushf
not eax
add eax, 0xb5786ee8
xor eax, 0xf02e92b5
rol eax, 0x31
popf
pushf
not eax
add eax, 0xd8143d31
xor eax, 0xe718a86b
rol eax, 0x18
popf
jmp 0x140068886
mov r8, rbx
mov qword [rsp + 0x40], rbx
lea rdx, [rsp + 0x7c]
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x30], r13b
jmp 0x1400692cd
mov rdi, rbx
or rdi, 0xf
cmp rdi, r12
jbe 0x140068eaa
push rax
pushf
mov eax, 0x212b1f9a
pushf
not eax
add eax, 0xdc352258
xor eax, 0xbb3aec20
rol eax, 0xee
popf
pushf
not eax
add eax, 0xdcc83812
xor eax, 0xad2e2e30
rol eax, 0x9f
popf
pushf
not eax
add eax, 0xe87c7c5b
xor eax, 0x8a42cf47
rol eax, 0x91
popf
pushf
not eax
add eax, 0x9a8d4a5d
xor eax, 0xdc3d79ed
rol eax, 0x2a
popf
jmp 0x140068886
push rax
pushf
mov eax, 0x2c5d724e
pushf
not eax
add eax, 0xba7e63c1
xor eax, 0xa1950f09
rol eax, 0x7e
popf
pushf
not eax
add eax, 0xbe5de63e
xor eax, 0xbd48bae3
rol eax, 0xc4
popf
pushf
not eax
add eax, 0xd422f45e
xor eax, 0xb0952c99
rol eax, 0xa5
popf
jmp 0x140068886
mov rdi, r12
jmp 0x140068f8c
cmp rdi, 0x16
cmovb rdi, rcx
push rax
pushf
mov eax, 0x93ff51ce
pushf
not eax
add eax, 0xe38134e5
xor eax, 0x955da6be
rol eax, 0x96
popf
pushf
not eax
add eax, 0xee48685a
xor eax, 0xf70003e2
rol eax, 0x88
popf
pushf
not eax
add eax, 0xf82ea043
xor eax, 0xe67badcf
rol eax, 0xd5
popf
jmp 0x140068886
mov rcx, rdi
add rcx, 1
cmovb rcx, r14
cmp rcx, 0x1000
jb 0x140068ff9
push rax
pushf
mov eax, 0xff3966a8
pushf
not eax
add eax, 0xac5c12e5
xor eax, 0xe50ff091
rol eax, 0x5b
popf
pushf
not eax
add eax, 0xa3be469f
xor eax, 0x82e2ec64
rol eax, 0x85
popf
pushf
not eax
add eax, 0xb001a0cb
xor eax, 0x8f174fe9
rol eax, 0x71
popf
pushf
not eax
add eax, 0xe595783d
xor eax, 0x8fa011e0
rol eax, 0x43
popf
jmp 0x140068886
push rax
pushf
mov eax, 0x6ccaaa25
pushf
not eax
add eax, 0xfed75859
xor eax, 0x8e2b659a
rol eax, 0x20
popf
pushf
not eax
add eax, 0xc3bbe6c9
xor eax, 0xa79418df
rol eax, 0x9a
popf
jmp 0x140068886
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14006907f
push rax
pushf
mov eax, 0xe0a84878
pushf
not eax
add eax, 0x969224dc
xor eax, 0xf6199e40
rol eax, 0x52
popf
pushf
not eax
add eax, 0xf776e6b4
xor eax, 0xa4033c88
rol eax, 7
popf
pushf
not eax
add eax, 0xfce8ad91
xor eax, 0x8773446b
rol eax, 0xf6
popf
jmp 0x140068886
push rax
pushf
mov eax, 0x2ea49154
pushf
not eax
add eax, 0xbdadba00
xor eax, 0xe9d15ce6
rol eax, 0x25
popf
pushf
not eax
add eax, 0xd6bfa66d
xor eax, 0xfbb0acc0
rol eax, 0x74
popf
jmp 0x140068886
mov rcx, rax
call fcn.140052ba7
test rax, rax
je 0x1400690f6
push rax
pushf
mov eax, 0x813905b6
pushf
not eax
add eax, 0xf7f6afb7
xor eax, 0xae5e9c27
rol eax, 0xaa
popf
pushf
not eax
add eax, 0xfb4ce5bd
xor eax, 0xae744658
rol eax, 0xa3
popf
jmp 0x140068886
push rax
pushf
mov eax, 0x78abddb2
pushf
not eax
add eax, 0x89fd56bb
xor eax, 0xff14b3c8
rol eax, 0x91
popf
pushf
not eax
add eax, 0x8518d112
xor eax, 0xbdcc11a7
rol eax, 0x81
popf
pushf
not eax
add eax, 0xf4f95525
xor eax, 0xd2814b8d
rol eax, 0x83
popf
pushf
not eax
add eax, 0xce47324a
xor eax, 0xb96126cd
rol eax, 0xec
popf
jmp 0x140068886
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400692aa
test rcx, rcx
je 0x1400691de
push rax
pushf
mov eax, 0x848d8a83
pushf
not eax
add eax, 0x9d1e29a1
xor eax, 0xd475f0ed
rol eax, 0x38
popf
pushf
not eax
add eax, 0xea96012a
xor eax, 0xf9c91bb8
rol eax, 0x23
popf
jmp 0x140068886
push rax
pushf
mov eax, 0xc8aff9d2
pushf
not eax
add eax, 0xd7ed301e
xor eax, 0xc67010ca
rol eax, 0xcc
popf
pushf
not eax
add eax, 0xd4026d12
xor eax, 0xaa4da5e3
rol eax, 0x28
popf
pushf
not eax
add eax, 0x9d2bdc55
xor eax, 0xd4363da9
rol eax, 0xc8
popf
jmp 0x140068886
call fcn.140052ba7
mov rsi, rax
jmp 0x1400692aa
mov rsi, r13
push rax
pushf
mov eax, 0xc3e85889
pushf
not eax
add eax, 0x864d9244
xor eax, 0x9f0d1e62
rol eax, 0x58
popf
pushf
not eax
add eax, 0xf4be5f4f
xor eax, 0xb060df45
rol eax, 0xed
popf
pushf
not eax
add eax, 0xf5d48bd7
xor eax, 0xf0803656
rol eax, 0x8e
popf
jmp 0x140068886
mov r8, rbx
mov qword [rsp + 0x30], rsi
lea rdx, [rsp + 0x7c]
mov qword [rsp + 0x40], rbx
mov rcx, rsi
mov qword [rsp + 0x48], rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], r13b
lea rcx, [rsp + 0x30]
call fcn.14005e872
test al, al
jne 0x140069334
push rax
pushf
mov eax, 0x97ab3e1
pushf
not eax
add eax, 0xdad1a315
xor eax, 0xb7d6ce94
rol eax, 0xba
popf
pushf
not eax
add eax, 0xfe3f102d
xor eax, 0xfd75ba33
rol eax, 0x34
popf
pushf
not eax
add eax, 0x940325ad
xor eax, 0xf8c7eab1
rol eax, 0x7f
popf
pushf
not eax
add eax, 0xe94f94ea
xor eax, 0x8cd843e1
rol eax, 0xea
popf
jmp 0x140068886
push rax
pushf
mov eax, 0xd2c3b581
pushf
not eax
add eax, 0xdba98da5
xor eax, 0x824a6e0d
rol eax, 0xd0
popf
pushf
not eax
add eax, 0x9f9547d7
xor eax, 0xb22a2d37
rol eax, 0x99
popf
pushf
not eax
add eax, 0xf587bea1
xor eax, 0xdfd12580
rol eax, 9
popf
jmp 0x140068886
lea rdx, [rsp + 0x50]
mov rcx, r15
jmp 0x140069383
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400693ea
push rax
pushf
mov eax, 0x1529f018
pushf
not eax
add eax, 0xa715293f
xor eax, 0xc982b2eb
rol eax, 0xa9
popf
pushf
not eax
add eax, 0xfbacdb83
xor eax, 0xa0694ffb
rol eax, 0xfb
popf
pushf
not eax
add eax, 0xc43709ce
xor eax, 0xd3872b36
rol eax, 0x85
popf
pushf
not eax
add eax, 0xdcf2c0e8
xor eax, 0xeff27493
rol eax, 0x65
popf
jmp 0x140068886
push rax
pushf
mov eax, 0xd25f49fc
pushf
not eax
add eax, 0xbdf9294a
xor eax, 0x8ed3a2a7
rol eax, 0xa0
popf
pushf
not eax
add eax, 0x81423f90
xor eax, 0x956fca6e
rol eax, 0xf6
popf
pushf
not eax
add eax, 0xb54f5a0a
xor eax, 0xc16bb407
rol eax, 0xe8
popf
jmp 0x140068886
mov rcx, r15
jmp 0x140069434
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rdi, qword [rsp + 0x1d0]
mov rsi, qword [rsp + 0x1c8]
mov r12, qword [rsp + 0x1a0]
mov r13, qword [rsp + 0x198]
mov rbx, qword [rsp + 0x1c0]
mov r14, qword [rsp + 0x190]
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.140061636
add rsp, 0x1a8
pop r15
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
movdqa xmm1, xmmword [str._WZK]
movdqu xmmword [rsp + 0x20], xmm1
mov byte [rsp + 0x2f], r13b
movd ecx, xmm1
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
xor byte [rsp + 0x22], cl
xor byte [rsp + 0x23], cl
xor byte [rsp + 0x24], cl
xor al, cl
xor byte [rsp + 0x25], cl
xor byte [rsp + 0x26], cl
xor byte [rsp + 0x27], cl
xor byte [rsp + 0x28], cl
xor byte [rsp + 0x29], cl
xor byte [rsp + 0x2a], cl
xor byte [rsp + 0x2b], cl
xor byte [rsp + 0x2c], cl
xor byte [rsp + 0x2d], cl
xor byte [rsp + 0x2e], cl
mov byte [rsp + 0x21], al
lea rax, [rsp + 0x21]
push rax
pushf
mov eax, 0x33b79921
pushf
not eax
add eax, 0x956bc87d
xor eax, 0xa39c6da2
rol eax, 0xda
popf
pushf
not eax
add eax, 0xb8942f6a
xor eax, 0xd198bbd3
rol eax, 0x75
popf
pushf
not eax
add eax, 0xaf1282b3
xor eax, 0x9c2d0488
rol eax, 0x9b
popf
pushf
not eax
add eax, 0xeab9394a
xor eax, 0xd0ae3d23
rol eax, 0xc8
popf
jmp 0x140068886
inc r14
cmp byte [rax + r14], r13b
jne 0x140069638
push rax
pushf
mov eax, 0xfb8dea1b
pushf
not eax
add eax, 0x80d32da8
xor eax, 0xf888b321
rol eax, 0x5c
popf
pushf
not eax
add eax, 0x8d005c18
xor eax, 0xc924a092
rol eax, 0x88
popf
pushf
not eax
add eax, 0xb9f9a995
xor eax, 0xbe1c0a18
rol eax, 0xe9
popf
jmp 0x140068886
push rax
pushf
mov eax, 0xeeeb70d6
pushf
not eax
add eax, 0xaafb4d24
xor eax, 0xecd72a28
rol eax, 0xce
popf
pushf
not eax
add eax, 0xbb0aa98e
xor eax, 0xa70025b8
rol eax, 0x51
popf
pushf
not eax
add eax, 0x9faffa5d
xor eax, 0xc6ac7578
rol eax, 0xd4
popf
pushf
not eax
add eax, 0xe805255e
xor eax, 0xe7656d9a
rol eax, 0xcd
popf
jmp 0x140068886
mov r8, r14
lea rdx, [rsp + 0x21]
call fcn.14006dc18
mov al, 0xa1
pushf
not al
add al, 0xe4
xor al, 0xc7
rol al, 0x85
popf
pushf
not al
add al, 0x22
xor al, 0x51
rol al, 0x93
popf
mov byte [0x14000a940], 1
jmp 0x14006943c
xor al, al
jmp 0x14006946c
call fcn.14006182a
int3
call fcn.14005360d
int3