Function at 0x180039c20
Capabilities:
Authenticate hmac
Encode data using xor
Get disk information

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x38]
sub rsp, 0x138
mov ebx, dword [rbp + 0xc0]
mov r10, r8
mov r13d, dword [rbp + 0xc0]
xor r8d, r8d
mov r15d, dword [rbp + 0xc0]
mov edi, ebx
mov r14, qword [rsp + 0x60]
mov r11, rdx
mov r12, qword [rsp + 0x60]
mov rdx, rcx
mov rsi, qword [rsp + 0x60]
imul eax, ebx, 0x396
cmp ebx, eax
mov dword [rsp + 0x68], eax
mov eax, dword [rbp + 0xc0]
mov ebx, dword [rbp + 0xc0]
mov dword [rbp - 0x80], eax
mov dword [rsp + 0x70], ebx
ja 0x180039d56
lea r9d, [r8 + 0x77]
nop word [rax + rax]
cmp edi, 0x20c9
ja 0x18003a0a2
je 0x180039db8
cmp edi, 0xca
ja 0x18003a01f
je 0x180039f3d
mov eax, edi
sub eax, 0x4d
je 0x180039f0b
sub eax, 0x38
je 0x180039e4f
sub eax, 0x14
je 0x180039dd1
cmp eax, 9
jne 0x180039d3c
test r10, r10
jne 0x180039d3c
mov dword [rsp + 0x58], r8d
lea r9, [rsp + 0x58]
mov r8d, 0x8c
lea rdx, [0x18008f048]
lea rcx, str.key___0
call fcn.1800064b0
mov r10, qword [rbp + 0x90]
mov rdx, qword [rbp + 0x80]
mov r11, qword [rbp + 0x88]
mov r9d, 0x77
xor r8d, r8d
imul eax, dword [rbp + 0xc0], 0x36
add edi, eax
cmp edi, dword [rsp + 0x68]
jbe 0x180039cb0
mov r9, qword [rbp + 0x98]
mov eax, dword [rbp + 0xc0]
mov edi, eax
imul eax, eax, 0xab0
cmp edi, eax
ja 0x180039db8
cmp edi, 0x2158f
ja 0x18003a6d6
je 0x18003a687
cmp edi, 0xb233
ja 0x18003a35a
je 0x18003a2a1
mov eax, edi
sub eax, 0x85
je 0x18003a28a
sub eax, 0x14
je 0x180039e2a
sub eax, 0x58c3
je 0x18003a280
cmp eax, 0xd70
jne 0x18003a7f5
mov rax, qword [rsp + 0x60]
add rsp, 0x138
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov qword [rsp + 0x20], r8
lea r9, [rbp - 0x60]
xor r8d, r8d
xor ecx, ecx
lea edx, [r8 + 0xf]
call fcn.180006740
test eax, eax
jne 0x18003a254
mov r8, qword [rbp + 0x90]
xor r9d, r9d
xor edx, edx
mov ecx, 0xce
call fcn.1800377d0
xor r9d, r9d
mov dword [rsp + 0x58], eax
lea r8, [rbp - 0x60]
lea rdx, [rsp + 0x58]
lea ecx, [r9 + 0x4b]
call fcn.1800171e0
mov dword [rbp - 0x80], eax
test eax, eax
je 0x180039d1e
xor r9d, r9d
lea rcx, [rbp - 0x60]
xor edx, edx
mov r8d, 0x11f
mov edi, 0x99
call fcn.180045a00
mov eax, dword [rbp - 0x80]
mov dword [rsp + 0x60], eax
jmp 0x18003a7f5
test r10, r10
jne 0x180039e81
mov dword [rsp + 0x58], r8d
lea r9, [rsp + 0x58]
mov r8d, 0x8c
lea rdx, [0x18008f048]
lea rcx, str.msg___NULL
call fcn.1800064b0
mov r11, qword [rbp + 0x88]
xor r8d, r8d
test r11, r11
jne 0x180039ea9
mov dword [rsp + 0x58], r8d
lea r9, [rsp + 0x58]
mov r8d, 0x8c
lea rdx, [0x18008f048]
lea rcx, str.1addProxy__
call fcn.1800064b0
cmp qword [rbp + 0xa8], 0
jne 0x180039ed9
lea r9, [rsp + 0x58]
mov dword [rsp + 0x58], 0
mov r8d, 0x8c
lea rdx, [0x18008f048]
lea rcx, str.outlen___NULL
call fcn.1800064b0
mov rdx, qword [rbp + 0x80]
test rdx, rdx
jne 0x18003a248
mov dword [rsp + 0x58], edx
lea r9, [rsp + 0x58]
lea rdx, [0x18008f048]
mov r8d, 0x8c
lea rcx, str.dbgbvr1_el1
jmp 0x180039d19
movsxd rax, dword [r10]
cmp eax, 0x1f
ja 0x180039f30
imul rcx, rax, 0xb0
lea rax, [0x180000000]
cmp qword [rcx + rax + 0x9f470], 0
jne 0x180039d3c
mov dword [rsp + 0x60], 0xa
jmp 0x180039db8
cmp byte [r10 + 0x1b8], 0
je 0x180039fe0
mov ecx, 0x111
mov eax, ecx
sub eax, 0x111
je 0x180039fcb
sub eax, 1
je 0x180039fb2
sub eax, 1
je 0x180039fa2
sub eax, 1
je 0x180039f9b
cmp eax, 1
jne 0x180039fd2
lea r8d, [rax + 0x31]
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
je 0x180039f91
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
mov byte [rsp + 0x60], 0
jmp 0x180039db8
mov word [rbp - 0x62], r8w
jmp 0x180039fd2
mov dword [rbp - 0x6a], 0x6e0075
mov dword [rbp - 0x66], 0x580074
jmp 0x180039fd2
mov eax, VarFormatDateTime
mov dword [rbp - 0x74], 0x3a0077
mov word [rbp - 0x70], ax
mov dword [rbp - 0x6e], 0x6f004d
jmp 0x180039fd2
mov dword [rbp - 0x78], 0x610059
inc ecx
cmp ecx, 0x116
jb 0x180039f50
mov r9, qword [r10]
lea rax, [r10 + 0x120]
mov rcx, qword [r10 + 0x110]
lea rdx, [r10 + 0x80]
mov r8d, 0x95
mov qword [rsp + 0x20], rax
call fcn.18004ab30
mov r10, qword [rbp + 0x90]
mov byte [rsp + 0x60], al
mov byte [r10 + 0x1b8], al
jmp 0x180039d25
cmp edi, 0x120
je 0x18003a095
cmp edi, 0x108b
je 0x18003a08b
cmp edi, 0x1c93
jne 0x180039d3c
mov r15, qword [rbp + 0xb8]
lea r9, [rsp + 0x58]
mov dword [rdx], r8d
xor ecx, ecx
xor r8d, r8d
mov dword [rsp + 0x20], 0xc5
xor edx, edx
mov eax, dword [r15]
mov dword [rsp + 0x58], eax
call fcn.18000efe0
mov r13d, eax
test eax, eax
jne 0x18003a254
movsxd rcx, dword [r15]
lea rax, [0x180000000]
shl rcx, 7
mov r15d, dword [rcx + rax + 0xa0ebc]
jmp 0x180039d1e
mov dword [rsp + 0x60], r8d
jmp 0x180039d3c
xor ecx, ecx
call qword [sym.imp.IMM32.dll_ImmGetOpenStatus]
jmp 0x180039d1e
cmp edi, 0x3de0
ja 0x18003a197
je 0x18003a26a
cmp edi, 0x20df
je 0x18003a16a
cmp edi, 0x22ce
je 0x18003a127
cmp edi, 0x2b66
je 0x180039db8
cmp edi, 0x38a1
jne 0x180039d3c
mov rax, qword [rbp + 0xa0]
mov ebx, r8d
mov eax, dword [rax]
test al, 7
setne bl
shr eax, 3
add ebx, eax
lea eax, [r15 + r15]
mov dword [rsp + 0x70], ebx
lea ecx, [rbx - 2]
cmp eax, ecx
jae 0x18003a25d
mov rax, qword [rbp + 0xb0]
cmp dword [rax], ebx
jne 0x18003a25d
mov ecx, ebx
call fcn.18006717c
mov rsi, rax
jmp 0x180039d1e
mov rax, qword [r10 + 0x28]
mov r9, qword [r10 + 0x40]
mov rdx, qword [r10 + 0x10]
mov rcx, qword [r10 + 8]
mov qword [rsp + 0x40], r8
mov r8, qword [r10 + 0x18]
mov qword [rsp + 0x38], rax
mov rax, qword [r10 + 0x20]
mov qword [rsp + 0x30], rax
mov rax, qword [r10 + 0x30]
mov qword [rsp + 0x28], rax
mov rax, qword [r10 + 0x38]
mov qword [rsp + 0x20], rax
call fcn.180034840
jmp 0x180039d1e
mov r9, qword [rbp + 0xb0]
lea rdx, [rbp - 0x60]
mov r8d, SafeArrayGetDim
mov qword [rsp + 0x20], r10
xor ecx, ecx
call fcn.18004ab30
mov dword [rbp - 0x80], eax
test eax, eax
jne 0x180039e2a
jmp 0x180039d1e
cmp edi, 0x54af
je 0x18003a1d2
cmp edi, 0x70bd
je 0x18003a1c0
cmp edi, 0x8ccb
jne 0x180039d3c
mov dword [rsp + 0x50], 1
jmp 0x180039d3c
cmp byte [r10], 0
je 0x180039d3c
mov r13d, r8d
jmp 0x18003a319
mov ecx, ebx
call fcn.18006717c
mov ecx, r15d
mov r14, rax
call fcn.18006717c
mov r12, rax
test rsi, rsi
je 0x18003a1fa
test r14, r14
je 0x18003a1fa
test rax, rax
jne 0x180039d1e
mov ebx, 0x11d
nop
mov eax, ebx
sub eax, 0x11c
je 0x18003a273
cmp eax, 1
jne 0x18003a235
test rsi, rsi
je 0x18003a21b
mov rcx, rsi
call fcn.180065650
test r14, r14
je 0x18003a228
mov rcx, r14
call fcn.180065650
test r12, r12
je 0x18003a235
mov rcx, r12
call fcn.180065650
dec ebx
cmp ebx, 0x11b
ja 0x18003a200
mov ebx, dword [rsp + 0x70]
jmp 0x180039d1e
mov r10, qword [rbp + 0x90]
jmp 0x180039d2c
mov dword [rsp + 0x60], eax
jmp 0x180039db8
mov dword [rsp + 0x60], 0x16
jmp 0x180039db8
lea rax, [r10 + 0x27]
jmp 0x180039dbd
mov dword [rsp + 0x60], SafeArrayGetDim
jmp 0x180039db8
add dword [rsp + 0x50], r15d
jmp 0x18003a7f5
mov edx, dword [rsp + 0x50]
mov rcx, r12
add rdx, r10
mov r8d, r15d
call fcn.18005d880
jmp 0x18003a7f5
mov edx, dword [rsp + 0x50]
sub ebx, r15d
dec ebx
add rdx, r10
mov r8d, ebx
mov rcx, rsi
call fcn.18005d880
mov eax, dword [rsp + 0x50]
lea rdx, [rsp + 0x78]
mov ecx, dword [rsp + 0x70]
dec eax
sub ecx, r15d
mov dword [rsp + 0x58], r15d
add ecx, eax
mov dword [rsp + 0x78], ebx
mov rax, qword [rbp + 0xb8]
mov r9, rsi
mov dword [rsp + 0x50], ecx
mov r8, r14
mov ecx, 0xf8
mov eax, dword [rax]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
call fcn.18004b0a0
mov r13d, eax
test eax, eax
je 0x18003a7f5
mov ebx, dword [rsp + 0x70]
mov eax, ebx
xor r8d, r8d
xor ebx, ebx
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rbx
xor edx, edx
mov qword [rsp + 0x30], rax
xor ecx, ecx
mov qword [rsp + 0x28], rsi
lea r9d, [rbx + 0x12]
mov qword [rsp + 0x20], rbx
mov edi, 0x32014
call fcn.180002540
jmp 0x18003a7f5
cmp edi, 0x10b0a
je 0x18003a547
cmp edi, 0x163e1
je 0x18003a46b
cmp edi, 0x1bcb8
jne 0x18003a7f5
mov dword [rsp + 0x50], ebx
mov rdx, r12
mov dword [rsp + 0x48], 0xeb
lea rcx, [rsp + 0x50]
test r9, r9
je 0x18003a3d1
mov rax, qword [rbp + 0xc8]
mov eax, dword [rax]
mov dword [rsp + 0x68], eax
mov rax, qword [rbp + 0xb8]
mov eax, dword [rax]
mov dword [rsp + 0x78], eax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], r9
jmp 0x18003a401
mov rax, qword [rbp + 0xb8]
mov dword [rsp + 0x68], r8d
mov eax, dword [rax]
mov dword [rsp + 0x78], eax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x68]
xor r8d, r8d
call fcn.18004eed0
mov r13d, eax
test eax, eax
jne 0x18003a319
mov r8d, r15d
mov rdx, rsi
mov rcx, r12
call fcn.18005e380
test eax, eax
je 0x18003a435
xor eax, eax
mov r13d, eax
jmp 0x18003a319
mov edx, ebx
mov dword [rsp + 0x50], r15d
sub edx, r15d
dec edx
cmp r15d, edx
jae 0x18003a7f5
mov ecx, r15d
nop dword [rax]
mov eax, ecx
cmp byte [rax + rsi], 0
jne 0x18003a7f5
inc ecx
mov dword [rsp + 0x50], ecx
cmp ecx, edx
jb 0x18003a450
jmp 0x18003a7f5
xor eax, eax
mov r8d, ebx
sub r8d, r15d
mov edx, eax
sub r8d, 1
je 0x18003a7f5
cmp r8d, 0x40
jb 0x18003a517
lea eax, [r8 - 1]
lea r9, [rax + rsi]
add rax, r14
cmp rsi, rax
ja 0x18003a4a2
cmp r9, r14
jae 0x18003a517
mov r10d, r8d
and r10d, 0xffffffc0
mov r9d, 0x20
nop
movdqu xmm0, xmmword [rdx + rsi]
lea eax, [r9 - 0x10]
movdqu xmm1, xmmword [rdx + r14]
pxor xmm1, xmm0
movdqu xmmword [rdx + rsi], xmm1
add edx, 0x40
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [r14 + rax]
pxor xmm1, xmm0
movdqu xmmword [rsi + rax], xmm1
mov eax, r9d
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [r14 + rax]
pxor xmm1, xmm0
movdqu xmmword [rsi + rax], xmm1
lea eax, [r9 + 0x10]
add r9d, 0x40
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [r14 + rax]
pxor xmm1, xmm0
movdqu xmmword [rsi + rax], xmm1
cmp edx, r10d
jb 0x18003a4b0
cmp edx, r8d
jae 0x18003a7f5
mov ecx, edx
mov r9, r14
add rcx, rsi
sub r9, rsi
sub r8d, edx
mov edx, r8d
movzx eax, byte [r9 + rcx]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x18003a531
jmp 0x18003a7f5
mov edx, r8d
test r15d, r15d
je 0x18003a631
cmp r15d, 0x40
jb 0x18003a5ff
lea eax, [r15 - 1]
lea r8, [rax + r12]
add rax, r14
cmp r12, rax
ja 0x18003a576
cmp r8, r14
jae 0x18003a5ff
mov r9d, r15d
and r9d, 0xffffffc0
mov r8d, 0x20
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [rdx + r12]
lea eax, [r8 - 0x10]
movdqu xmm1, xmmword [rdx + r14]
pxor xmm1, xmm0
movdqu xmmword [rdx + r12], xmm1
add edx, 0x40
movdqu xmm0, xmmword [rax + r12]
movdqu xmm1, xmmword [rax + r14]
pxor xmm1, xmm0
movdqu xmmword [rax + r12], xmm1
mov eax, r8d
movdqu xmm0, xmmword [rax + r12]
movdqu xmm1, xmmword [rax + r14]
pxor xmm1, xmm0
movdqu xmmword [rax + r12], xmm1
lea eax, [r8 + 0x10]
add r8d, 0x40
movdqu xmm0, xmmword [rax + r12]
movdqu xmm1, xmmword [rax + r14]
pxor xmm1, xmm0
movdqu xmmword [rax + r12], xmm1
cmp edx, r9d
jb 0x18003a590
cmp edx, r15d
jae 0x18003a631
mov eax, edx
mov r8, r14
add rax, r12
sub r8, r12
mov ecx, r15d
sub ecx, edx
mov edx, ecx
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x18003a620
mov eax, ebx
mov dword [rsp + 0x58], r15d
sub eax, r15d
lea rdx, [rsp + 0x58]
dec eax
mov r9, r12
mov dword [rsp + 0x68], eax
mov r8, r14
mov rax, qword [rbp + 0xb8]
mov ecx, 0xf8
mov eax, dword [rax]
mov dword [rsp + 0x78], eax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
call fcn.18004b0a0
mov r13d, eax
test eax, eax
jne 0x18003a319
jmp 0x18003a7f5
mov ecx, dword [rsp + 0x50]
mov eax, ebx
sub eax, r15d
dec eax
cmp ecx, eax
je 0x18003a6cb
cmp byte [rcx + rsi], 1
jne 0x18003a6cb
mov ecx, dword [rsp + 0x50]
mov eax, ebx
inc ecx
sub eax, ecx
mov dword [rsp + 0x50], ecx
mov rcx, qword [rbp + 0xa8]
sub eax, r15d
dec eax
cmp eax, dword [rcx]
jbe 0x18003a7f5
mov dword [rcx], eax
mov r13d, 6
jmp 0x18003a319
mov r13d, 7
jmp 0x18003a319
cmp edi, 0x378eb
ja 0x18003a7c0
je 0x18003a74e
cmp edi, 0x26e66
je 0x18003a724
cmp edi, 0x2c73d
je 0x18003a705
cmp edi, 0x32014
jne 0x18003a7f5
jmp 0x18003a319
mov eax, dword [rsp + 0x50]
mov ecx, ebx
sub ecx, r15d
mov dword [rdx], 1
dec eax
mov r13d, r8d
add ecx, eax
mov dword [rsp + 0x50], ecx
jmp 0x18003a7f5
mov ecx, dword [rsp + 0x50]
mov eax, ebx
mov rdx, qword [rbp + 0xa8]
sub eax, ecx
sub eax, r15d
dec eax
mov r8d, eax
mov dword [rdx], eax
lea rdx, [rsi + rcx]
mov rcx, r11
call fcn.18005d880
jmp 0x18003a7f5
mov qword [rsp + 0x40], r8
mov r9d, 0x12
mov qword [rsp + 0x38], r8
xor edx, edx
mov eax, r15d
xor ecx, ecx
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r8
xor r8d, r8d
call fcn.180002540
xor ecx, ecx
mov eax, ebx
mov qword [rsp + 0x40], rcx
xor r8d, r8d
mov qword [rsp + 0x38], rcx
xor edx, edx
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9d, [rcx + 0x12]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rcx
call fcn.180002540
mov rcx, r12
jmp 0x18003a7f0
cmp edi, 0x3d1c2
je 0x18003a7e5
cmp edi, 0x42a99
je 0x18003a7de
cmp edi, 0x48370
je 0x180039db8
jmp 0x18003a7f5
mov dword [rsp + 0x60], r13d
jmp 0x18003a7f5
mov rcx, r14
call fcn.180065650
mov rcx, rsi
call fcn.180065650
imul eax, dword [rbp + 0xc0], 0xab
mov ebx, dword [rsp + 0x70]
mov r10, qword [rbp + 0x90]
mov r9, qword [rbp + 0x98]
mov rdx, qword [rbp + 0x80]
mov r11, qword [rbp + 0x88]
add edi, eax
mov eax, dword [rbp + 0xc0]
xor r8d, r8d
jmp 0x180039d5e