Function at 0x14000358c
Capabilities:
Authenticate hmac
Encode data using xor
Get disk size
Get memory capacity
Get session user name
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x190]
sub rsp, 0x290
xor edi, edi
mov r14d, 0x4ec4ec4f
mov r15b, 0x36
sub ecx, 1
je 0x140003609
sub ecx, 1
je 0x140003d69
sub ecx, 1
je 0x140003628
sub ecx, 1
je 0x140003959
sub ecx, 1
je 0x140003b4e
sub ecx, 1
je 0x140003cdf
sub ecx, 1
je 0x140003db8
sub ecx, 1
je 0x140003d9a
cmp ecx, 1
je 0x140003e5e
or eax, 0xffffffff
jmp 0x140003e71
call fcn.140004900
mov ebx, 3
test eax, eax
je 0x140003621
lea edi, [rbx - 2]
mov ecx, ebx
call fcn.14000358c
mov ecx, ebx
call fcn.14000358c
movsd xmm0, qword [0x140223668]
movsd qword [rsp + 0x20], xmm0
mov eax, dword [0x140223670]
mov dword [rsp + 0x28], eax
movzx eax, word [0x140223674]
mov word [rsp + 0x2c], ax
cmp byte [0x140223675], 0
je 0x140003683
xor r8d, r8d
lea r9, [rsp + 0x20]
mov eax, r14d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x34
mov al, r8b
sub al, cl
add al, r15b
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 0xe
jl 0x14000365d
lea rax, [rsp + 0x20]
mov qword [rsp + 0x60], rax
movsd xmm0, qword [0x140223618]
movsd qword [rsp + 0x20], xmm0
movzx eax, word [0x140223620]
mov word [rsp + 0x28], ax
mov al, byte [0x140223622]
mov byte [rsp + 0x2a], al
xor r8d, r8d
lea r9, [rsp + 0x20]
mov eax, r14d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x34
mov al, r8b
sub al, cl
add al, r15b
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 0xb
jl 0x1400036b9
lea rax, [rsp + 0x20]
mov qword [rsp + 0x68], rax
movsd xmm0, qword [str._Z_P]
movsd qword [rsp + 0x20], xmm0
mov al, byte [0x140223630]
mov byte [rsp + 0x28], al
xor r8d, r8d
lea r9, [rsp + 0x20]
mov eax, r14d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x34
mov al, r8b
sub al, cl
add al, r15b
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 9
jl 0x140003709
lea rax, [rsp + 0x20]
mov qword [rsp + 0x70], rax
movsd xmm0, qword [str._ZUVOHY]
movsd qword [rsp + 0x20], xmm0
mov eax, dword [str.MF3A_jli_]
mov dword [rsp + 0x28], eax
cmp byte [0x140223643], 0
je 0x140003788
xor r8d, r8d
lea r9, [rsp + 0x20]
mov eax, r14d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x34
mov al, r8b
sub al, cl
add al, r15b
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 0xc
jl 0x140003762
lea rax, [rsp + 0x20]
mov qword [rsp + 0x78], rax
movsd xmm0, qword [str._Z_v_WK]
movsd qword [rsp + 0x20], xmm0
movzx eax, word [0x140223680]
mov word [rsp + 0x28], ax
mov al, byte [0x140223682]
mov byte [rsp + 0x2a], al
xor r8d, r8d
lea r9, [rsp + 0x20]
mov eax, r14d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x34
mov al, r8b
sub al, cl
add al, r15b
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 0xb
jl 0x1400037be
lea rax, [rsp + 0x20]
mov qword [rbp - 0x80], rax
lea r12, [rsp + 0x60]
and dword [rbp + 0x1c0], 0
mov rax, qword [0x140232460]
mov r10, qword [rax + 0x70]
lea r9, [rbp + 0x1c0]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xb]
call r10
cmp eax, 0xc0000004
jne 0x14000393f
mov r8d, dword [rbp + 0x1c0]
mov r14d, r8d
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
xor esi, esi
mov qword [rsp + 0x30], rsi
test r8d, r8d
je 0x140003884
mov ecx, r8d
cmp r8, 0x1000
jb 0x140003853
call fcn.1400032bc
jmp 0x140003858
call fcn.14003ecc4
mov rbx, rax
mov qword [rsp + 0x20], rax
lea rsi, [rax + r14]
mov qword [rsp + 0x30], rsi
mov r8, r14
xor edx, edx
mov rcx, rax
call fcn.140067900
mov qword [rsp + 0x28], rsi
mov r8d, dword [rbp + 0x1c0]
jmp 0x140003889
mov rbx, qword [rsp + 0x20]
mov rax, qword [0x140232460]
mov r10, qword [rax + 0x70]
lea r9, [rbp + 0x1c0]
mov rdx, rbx
mov ecx, 0xb
call r10
test eax, eax
js 0x140003907
mov ecx, dword [rbp + 0x1c0]
movabs rax, 0xe38e38e38e38e38f
mul rcx
mov r15, rdx
shr r15, 8
xor r14d, r14d
test r15d, r15d
je 0x140003907
lea rcx, [r14 + r14*8]
shl rcx, 5
add rcx, 0x20
add rcx, rbx
mov edx, 0x5c
call fcn.140040f4c
test rax, rax
je 0x1400038ff
lea rcx, [rax + 1]
mov rdx, qword [r12]
call fcn.14004d168
test eax, eax
je 0x140003ddf
inc r14d
cmp r14d, r15d
jb 0x1400038cc
test rbx, rbx
je 0x14000393f
sub rsi, rbx
cmp rsi, 0x1000
mov rax, rbx
jb 0x140003934
mov rbx, qword [rbx - 8]
sub rax, rbx
add rsi, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e8d
mov rdx, rsi
mov rcx, rbx
call fcn.14003ef48
add r12, 8
lea rax, [rbp - 0x78]
cmp r12, rax
jne 0x1400037f2
mov r14d, 0x4ec4ec4f
mov r15b, 0x36
mov dword [rbp + 0x1c0], 0xc8
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
xor ebx, ebx
lea rcx, [rbp - 0x70]
call fcn.1400452b0
test rax, rax
je 0x1400039a3
movsx ecx, byte [rbp + rbx - 0x70]
call fcn.140045274
mov byte [rbp + rbx - 0x70], al
inc rbx
lea rcx, [rbp - 0x70]
call fcn.1400452b0
cmp rbx, rax
jb 0x140003984
mov rax, qword [str.evvxtd_UWA_NYNJ]
mov qword [rbp + 0x1c8], rax
cmp byte [0x140223667], 0
je 0x1400039ea
xor r8d, r8d
lea r9, [rbp + 0x1c8]
mov eax, r14d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x34
mov al, r8b
sub al, cl
add al, r15b
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 8
jl 0x1400039c4
lea rdx, [rbp + 0x1c8]
lea rcx, [rbp - 0x70]
call fcn.140040d64
mov esi, 5
test rax, rax
je 0x140003a0d
inc edi
mov ecx, esi
call fcn.14000358c
mov eax, dword [0x140223654]
mov dword [rbp + 0x1c8], eax
movzx eax, word [0x140223658]
mov word [rbp + 0x1cc], ax
mov al, byte [0x14022365a]
mov byte [rbp + 0x1ce], al
xor r8d, r8d
lea r9, [rbp + 0x1c8]
mov eax, r14d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x34
mov al, r8b
sub al, cl
add al, r15b
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 7
jl 0x140003a3d
lea rdx, [rbp + 0x1c8]
lea rcx, [rbp - 0x70]
call fcn.140040d64
test rax, rax
je 0x140003a81
inc edi
mov ecx, esi
call fcn.14000358c
mov eax, dword [0x140223644]
mov dword [rbp + 0x1c8], eax
movzx eax, word [0x140223648]
mov word [rbp + 0x1cc], ax
xor r8d, r8d
lea r9, [rbp + 0x1c8]
mov eax, r14d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x34
mov al, r8b
sub al, cl
add al, r15b
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 6
jl 0x140003aa5
lea rdx, [rbp + 0x1c8]
lea rcx, [rbp - 0x70]
call fcn.140040d64
test rax, rax
je 0x140003ae9
inc edi
mov ecx, esi
call fcn.14000358c
mov rax, qword [0x140223608]
mov qword [rbp + 0x1c8], rax
cmp byte [0x14022360f], 0
je 0x140003b30
xor r8d, r8d
lea r9, [rbp + 0x1c8]
mov eax, r14d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x34
mov al, r8b
sub al, cl
add al, r15b
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 8
jl 0x140003b0a
lea rdx, [rbp + 0x1c8]
lea rcx, [rbp - 0x70]
call fcn.140040d64
test rax, rax
je 0x140003b4e
inc edi
mov ecx, esi
call fcn.14000358c
mov r8d, 0x1f4
lea rdx, [rbp - 0x70]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rbp - 0x70]
call fcn.140003300
xor ebx, ebx
lea rcx, [rbp - 0x70]
call fcn.1400452b0
test rax, rax
je 0x140003b98
movsx ecx, byte [rbp + rbx - 0x70]
call fcn.140045274
mov byte [rbp + rbx - 0x70], al
inc rbx
lea rcx, [rbp - 0x70]
call fcn.1400452b0
cmp rbx, rax
jb 0x140003b79
mov rax, qword [0x140223610]
mov qword [rbp + 0x1c8], rax
cmp byte [0x140223617], 0
je 0x140003bdf
xor r8d, r8d
lea r9, [rbp + 0x1c8]
mov eax, r14d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x34
mov al, r8b
sub al, cl
add al, r15b
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 8
jl 0x140003bb9
lea rdx, [rbp + 0x1c8]
lea rcx, [rbp - 0x70]
call fcn.140040d64
test rax, rax
je 0x140003c00
inc edi
mov ecx, 6
call fcn.14000358c
mov eax, dword [str.jaqkoh_]
mov dword [rbp + 0x1c8], eax
movzx eax, word [0x140223650]
mov word [rbp + 0x1cc], ax
mov al, byte [0x140223652]
mov byte [rbp + 0x1ce], al
xor r8d, r8d
lea r9, [rbp + 0x1c8]
mov eax, r14d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x34
mov al, r8b
sub al, cl
add al, r15b
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 7
jl 0x140003c30
lea rdx, [rbp + 0x1c8]
lea rcx, [rbp - 0x70]
call fcn.140040d64
test rax, rax
je 0x140003c77
inc edi
mov ecx, 6
call fcn.14000358c
mov rax, qword [str.evvxtd_UWA_NYNJ]
mov qword [rbp + 0x1c8], rax
cmp byte [0x140223667], 0
je 0x140003cbe
xor r8d, r8d
lea r9, [rbp + 0x1c8]
mov eax, r14d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x34
mov al, r8b
sub al, cl
add al, r15b
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 8
jl 0x140003c98
lea rdx, [rbp + 0x1c8]
lea rcx, [rbp - 0x70]
call fcn.140040d64
test rax, rax
je 0x140003cdf
inc edi
mov ecx, 6
call fcn.14000358c
mov eax, dword [str.u_rd9vtniyjdytjwy_ZPH]
mov dword [rbp + 0x1c0], eax
cmp byte [0x140223607], 0
je 0x140003d24
xor r8d, r8d
lea r9, [rbp + 0x1c0]
mov eax, r14d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x34
mov al, r8b
sub al, cl
add al, r15b
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 4
jl 0x140003cfe
xor r9d, r9d
lea r8, [rbp + 0x1c8]
xor edx, edx
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x140003d69
mov rax, qword [rbp + 0x1c8]
and rax, 0xffffffffc0000000
movabs rdx, 0xf00000000
cmp rax, rdx
ja 0x140003d69
inc edi
mov ecx, 2
call fcn.14000358c
call fcn.140004966
mov rbx, rax
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140004966
mov edx, ebx
sub rax, rdx
cmp rax, 0x1c2
jbe 0x140003d9a
inc edi
mov ecx, 8
call fcn.14000358c
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsp + 0x40], 4
jae 0x140003db8
inc edi
mov ecx, 7
call fcn.14000358c
mov dword [rsp + 0x20], 0x40
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rcx, qword [rsp + 0x28]
xorps xmm1, xmm1
test rcx, rcx
js 0x140003e28
cvtsi2ss xmm1, rcx
jmp 0x140003e3d
test rbx, rbx
je 0x140003e17
sub rsi, rbx
mov rax, rbx
cmp rsi, 0x1000
jb 0x140003e0c
add rsi, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e8d
mov rdx, rsi
mov rcx, rbx
call fcn.14003ef48
inc edi
mov ecx, 4
call fcn.14000358c
jmp 0x14000393f
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
mulss xmm1, dword [0x140223758]
movss xmm0, dword [0x14022375c]
comiss xmm0, xmm1
jbe 0x140003e5e
inc edi
mov ecx, 9
call fcn.14000358c
call fcn.140004966
lea ecx, [rdi + 1]
cmp rax, 0xafe74
cmovae ecx, edi
mov eax, ecx
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.140046454
int3