Function at 0x1400025d0
Capabilities:
Acquire debug privileges
Encode data using xor
Link many functions at runtime

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x8d8
movaps xmmword [rsp + 0x8c0], xmm6
mov esi, edx
mov rdi, rcx
mov rax, qword [0x14007b498]
xor rax, rsp
mov qword [rsp + 0x8b8], rax
lea rcx, [rsp + 0x60]
mov r8d, 0x800
xor edx, edx
call fcn.1400399d0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rbx, [rsp + 0x58]
mov rcx, rax
mov edx, 0x28
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400026d0
lea rax, [0x1400620e0]
mov qword [rsp + 0x870], rax
mov qword [rsp + 0x878], rbx
lea rbx, [rsp + 0x870]
mov qword [rsp + 0x8a8], rbx
lea rdx, str.SeDebugPrivilege
lea r8, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x1400026e6
mov dword [rsp + 0x860], 1
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x864], rax
mov dword [rsp + 0x86c], 2
mov rcx, qword [rsp + 0x58]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
lea r8, [rsp + 0x860]
xor edx, edx
mov r9d, 0x10
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x1400026fa
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.LoadDebugPrivilege:_AdjustTokenPrivileges_failed__x
jmp 0x1400026f3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.LoadDebugPrivilege:_OpenProcessToken_failed__x
mov edx, eax
call fcn.140001be0
jmp 0x140002734
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.LoadDebugPrivilege:_LookupPrivilegeValue_failed__x
mov edx, eax
call fcn.140001be0
mov rcx, qword [rsp + 0x8a8]
test rcx, rcx
je 0x140002734
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140084008]
mov rcx, qword [rsp + 0x8a8]
test rcx, rcx
je 0x140002734
cmp rcx, rbx
setne dl
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [0x140084008]
cmp esi, 2
jg 0x140002751
lea rcx, str.Missing_argument_s__for_inject__required_3__supplied__d
mov edx, esi
call fcn.140001be0
mov esi, pe_nt_image_headers64
jmp 0x140003026
lea rdx, [rsp + 0x60]
xor ecx, ecx
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1400028bc
lea r15, [rsp + 0x60]
mov rcx, r15
mov dx, 0x5c
call fcn.140039b60
test rax, rax
je 0x1400028d2
mov rcx, rax
add rcx, 2
mov word [rax + 2], 0
mov rdx, qword [rdi]
call fcn.14004ca84
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov rcx, r15
xor edx, edx
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x1400027fa
lea rdx, [rsp + 0x60]
mov rcx, rax
mov r8d, 0x3ff
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
add eax, 0xffffffff
xor ecx, ecx
cmp eax, 0x3ff
setb cl
lea r15, [rsp + rcx*8]
add r15, 0x60
lea rbx, [rsp + 0x870]
mov rcx, rbx
mov rdx, r15
call fcn.1400072a0
mov rcx, rbx
call fcn.14000c7a0
mov r14d, eax
mov rax, qword [rsp + 0x888]
cmp rax, 0x10
jb 0x14000285f
mov rcx, qword [rsp + 0x870]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14000285a
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14000308e
add rax, 0x28
mov rdx, rax
mov rcx, rbp
call fcn.14000e8e0
mov esi, 0x56
test r14b, r14b
je 0x140003026
mov rsi, qword [rdi + 8]
mov qword [rsp + 0x870], 0
movaps xmm6, xmmword [0x1400620b0]
movups xmmword [rsp + 0x880], xmm6
mov word [rsp + 0x870], 0
mov rcx, rsi
call fcn.14004caa0
mov rbp, rax
cmp rax, 7
jbe 0x1400028ef
lea rcx, [rsp + 0x870]
mov rdx, rbp
mov r9, rsi
call fcn.140002290
jmp 0x140002917
lea rcx, str.InjectHook:_GetModuleFileNameW_failed
call fcn.140001be0
mov esi, 0x79
jmp 0x140003026
lea rcx, str.InjectHook:_wcsrchr_failed:__p___ls_
lea r8, [rsp + 0x60]
xor edx, edx
call fcn.140001be0
mov esi, 0x7a
jmp 0x140003026
mov qword [rsp + 0x880], rbp
mov r8, rbp
add r8, rbp
lea rcx, [rsp + 0x870]
mov rdx, rsi
call fcn.140039320
mov word [rsp + rbp*2 + 0x870], 0
call fcn.140043038
mov rsi, rax
cmp qword [rsp + 0x888], 8
jb 0x140002932
mov rbx, qword [rsp + 0x870]
mov dword [rsi], 0
lea rdx, [rsp + 0x860]
mov rcx, rbx
mov r8d, 0xa
call fcn.14004b8ec
cmp rbx, qword [rsp + 0x860]
je 0x14000305e
cmp dword [rsi], 0x22
je 0x14000306a
mov r14, rax
mov rax, qword [rsp + 0x888]
cmp rax, 8
jb 0x1400029b6
mov rcx, qword [rsp + 0x870]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x1400029b1
mov rdx, rcx
add rdx, 0xfffffffffffffff8
mov rcx, qword [rcx - 8]
sub rdx, rcx
cmp rdx, 0x20
jae 0x14000308e
add rax, rax
add rax, 0x29
mov rdx, rax
call fcn.14000e8e0
mov rsi, qword [rdi + 0x10]
mov qword [rsp + 0x870], 0
movups xmmword [rsp + 0x880], xmm6
mov word [rsp + 0x870], 0
mov rcx, rsi
call fcn.14004caa0
mov rdi, rax
cmp rax, 7
jbe 0x1400029fe
lea rcx, [rsp + 0x870]
mov rdx, rdi
mov r9, rsi
call fcn.140002290
jmp 0x140002a26
mov qword [rsp + 0x880], rdi
mov r8, rdi
add r8, rdi
lea rcx, [rsp + 0x870]
mov rdx, rsi
call fcn.140039320
mov word [rsp + rdi*2 + 0x870], 0
call fcn.140043038
mov rsi, rax
cmp qword [rsp + 0x888], 8
jb 0x140002a43
mov rbx, qword [rsp + 0x870]
jmp 0x140002a4b
lea rbx, [rsp + 0x870]
mov dword [rsi], 0
lea rdx, [rsp + 0x860]
mov rcx, rbx
mov r8d, 0xa
call fcn.14004b838
cmp rbx, qword [rsp + 0x860]
je 0x140003076
cmp dword [rsi], 0x22
je 0x140003082
mov r12d, eax
mov rax, qword [rsp + 0x888]
cmp rax, 8
jb 0x140002acf
mov rcx, qword [rsp + 0x870]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x140002aca
mov rdx, rcx
add rdx, 0xfffffffffffffff8
mov rcx, qword [rcx - 8]
sub rdx, rcx
cmp rdx, 0x20
jae 0x14000308e
add rax, rax
add rax, 0x29
mov rdx, rax
call fcn.14000e8e0
test r14, r14
jne 0x140002f73
lea rcx, str.KERNEL32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movabs rcx, 0x6b6d7251636a7848
mov qword [rsp + 0x870], rcx
mov dword [rsp + 0x878], 0x7e7c62
movabs rcx, 0xc82efdf78201df87
mov qword [rsp + 0x860], rcx
lea rcx, [rsp + 0x871]
xor edi, edi
mov r8b, 0x48
xor esi, esi
nop word cs:[rax + rax]
nop dword [rax]
mov ebp, esi
shr ebp, 0x1f
add ebp, esi
sar ebp, 1
movsxd rbp, ebp
movzx edx, byte [rsp + rbp + 0x860]
mov ebx, edx
and bl, 0xf
shr dl, 4
test sil, 1
movzx ebp, bl
movzx edx, dl
cmove edx, ebp
xor dl, r8b
add esi, 1
cmp esi, 0x10
cmove esi, edi
mov byte [rcx - 1], dl
movzx r8d, byte [rcx]
add rcx, 1
test r8b, r8b
jne 0x140002b30
lea rdx, [rsp + 0x870]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140002f16
mov ecx, 0x1fffff
xor edx, edx
mov r8d, r12d
call qword [0x140084008]
test rax, rax
je 0x140002f22
mov rbp, rax
xor esi, esi
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140003054
lea rcx, str.KERNEL32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r14, rax
movabs rax, 0x58737e6c7d6a68
mov qword [rsp + 0x875], rax
movabs rax, 0x7d6a684766616e44
mov qword [rsp + 0x870], rax
movabs rax, 0x350bfacdf81b2018
mov qword [rsp + 0x860], rax
lea rax, [rsp + 0x871]
mov r8b, 0x44
xor ebx, ebx
nop word cs:[rax + rax]
nop dword [rax]
mov ecx, ebx
shr ecx, 0x1f
add ecx, ebx
sar ecx, 1
movsxd rcx, ecx
movzx ecx, byte [rsp + rcx + 0x860]
mov edx, ecx
and dl, 0xf
shr cl, 4
test bl, 1
movzx edx, dl
movzx ecx, cl
cmove ecx, edx
xor cl, r8b
add ebx, 1
cmp ebx, 0x10
cmove ebx, esi
mov byte [rax - 1], cl
movzx r8d, byte [rax]
add rax, 1
test r8b, r8b
jne 0x140002c20
lea rdx, [rsp + 0x870]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x48], rax
movabs rax, 0x7b4064667a4867
mov qword [rsp + 0x876], rax
movabs rax, 0x4867617d7b7d685a
mov qword [rsp + 0x870], rax
movabs rax, 0x57135138eb08ff1c
mov qword [rsp + 0x860], rax
lea rax, [rsp + 0x871]
xor esi, esi
mov bl, 0x5a
xor edi, edi
nop
mov edx, edi
shr edx, 0x1f
add edx, edi
sar edx, 1
movsxd rdx, edx
movzx edx, byte [rsp + rdx + 0x860]
mov ecx, edx
and cl, 0xf
shr dl, 4
test dil, 1
movzx ecx, cl
movzx edx, dl
cmove edx, ecx
xor dl, bl
add edi, 1
cmp edi, 0x10
cmove edi, esi
mov byte [rax - 1], dl
movzx ebx, byte [rax]
add rax, 1
test bl, bl
jne 0x140002cc0
lea rdx, [rsp + 0x870]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x40], rax
movabs rax, 0x7443696867654b
mov qword [rsp + 0x877], rax
movabs rax, 0x4b606c72777e605d
mov qword [rsp + 0x870], rax
movabs rax, 0xadc6a7b9acd73c9b
mov qword [rsp + 0x860], rax
lea rax, [rsp + 0x871]
xor edi, edi
mov bl, 0x5d
xor esi, esi
nop dword [rax]
mov edx, esi
shr edx, 0x1f
add edx, esi
sar edx, 1
movsxd rdx, edx
movzx edx, byte [rsp + rdx + 0x860]
mov ecx, edx
and cl, 0xf
shr dl, 4
test sil, 1
movzx ecx, cl
movzx edx, dl
cmove edx, ecx
xor dl, bl
add esi, 1
cmp esi, 0x10
cmove esi, edi
mov byte [rax - 1], dl
movzx ebx, byte [rax]
add rax, 1
test bl, bl
jne 0x140002d60
lea rdx, [rsp + 0x870]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [str.Rqbr_TcnorBnlgwz]
movaps xmmword [rsp + 0x870], xmm0
mov dword [rsp + 0x87f], 0x7a7767
movabs rax, 0x81bf81adc9456b35
mov qword [rsp + 0x860], rax
lea rax, [rsp + 0x871]
xor esi, esi
mov bl, 0x52
xor edi, edi
nop word cs:[rax + rax]
nop dword [rax]
mov edx, edi
shr edx, 0x1f
add edx, edi
sar edx, 1
movsxd rdx, edx
movzx edx, byte [rsp + rdx + 0x860]
mov ecx, edx
and cl, 0xf
shr dl, 4
test dil, 1
movzx ecx, cl
movzx edx, dl
cmove edx, ecx
xor dl, bl
add edi, 1
cmp edi, 0x10
cmove edi, esi
mov byte [rax - 1], dl
movzx ebx, byte [rax]
add rax, 1
test bl, bl
jne 0x140002e00
lea rdx, [rsp + 0x870]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
movups xmm0, xmmword [str.Emod_cefubWkbgk]
movaps xmmword [rsp + 0x870], xmm0
mov dword [rsp + 0x87f], 0x6b6762
movabs rax, 0x7c3371986918e8f6
mov qword [rsp + 0x860], rax
lea rax, [rsp + 0x871]
xor esi, esi
mov bl, 0x45
xor edi, edi
mov edx, edi
shr edx, 0x1f
add edx, edi
sar edx, 1
movsxd rdx, edx
movzx edx, byte [rsp + rdx + 0x860]
mov ecx, edx
and cl, 0xf
shr dl, 4
test dil, 1
movzx ecx, cl
movzx edx, dl
cmove edx, ecx
xor dl, bl
add edi, 1
cmp edi, 0x10
cmove edi, esi
mov byte [rax - 1], dl
movzx ebx, byte [rax]
add rax, 1
test bl, bl
jne 0x140002e90
lea rdx, [rsp + 0x870]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x30], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x20], rcx
mov rcx, rbp
mov rdx, r15
mov r8, rax
mov r9, r13
call fcn.140003fa0
mov esi, eax
jmp 0x140002f46
lea rcx, str.SafeOpenProcess_failed_to_load_open_process
call fcn.140001be0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rcx, str.DeobfuscateInjectLibraryNormal:_SafeOpenProcess_failed__x
mov edx, eax
call fcn.140001be0
xor esi, esi
cmp ebx, 5
sete sil
xor esi, 0x65
xor ebp, ebp
lea rax, [rbp + 1]
cmp rax, 2
jb 0x140002f59
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [rsi - 0x65]
cmp eax, 7
ja 0x140003026
mov ecx, 0xa9
bt ecx, eax
jae 0x140003026
lea rcx, str.USER32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movups xmm0, xmmword [str._bsfbkmwuKfmfOvI]
movaps xmmword [rsp + 0x870], xmm0
mov word [rsp + 0x880], 0x49
movabs rcx, 0xead293602fcf9778
mov qword [rsp + 0x860], rcx
lea rcx, [rsp + 0x871]
xor esi, esi
mov r8b, 0x5b
xor edi, edi
nop word [rax + rax]
mov ebp, edi
shr ebp, 0x1f
add ebp, edi
sar ebp, 1
movsxd rbp, ebp
movzx edx, byte [rsp + rbp + 0x860]
mov ebx, edx
and bl, 0xf
shr dl, 4
test dil, 1
movzx ebp, bl
movzx edx, dl
cmove edx, ebp
xor dl, r8b
add edi, 1
cmp edi, 0x10
cmove edi, esi
mov byte [rcx - 1], dl
movzx r8d, byte [rcx]
add rcx, 1
test r8b, r8b
jne 0x140002fc0
lea rdx, [rsp + 0x870]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, r12d
mov rdx, r15
mov r8, rax
call fcn.1400043b0
mov esi, eax
mov rcx, qword [rsp + 0x8b8]
xor rcx, rsp
call fcn.14000ea90
mov eax, esi
movaps xmm6, xmmword [rsp + 0x8c0]
add rsp, 0x8d8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov esi, 0x66
jmp 0x140002f46
lea rcx, str.invalid_stoull_argument
call fcn.140014914
lea rcx, str.stoull_argument_out_of_range
call fcn.14001495c
lea rcx, str.invalid_stoul_argument
call fcn.140014914
lea rcx, str.stoul_argument_out_of_range
call fcn.14001495c
call fcn.14004375c
int3