Function at 0x140030e90
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Link many functions at runtime

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
push r14
sub rsp, 0x1c0
mov rax, qword [0x1400df080]
xor rax, rsp
mov qword [rsp + 0x1b8], rax
mov dword [r11 - 0x30], 0x7b667659
mov dword [r11 - 0x2c], 0x2b2b7b73
mov dword [r11 - 0x28], 0x71707f34
xor eax, eax
mov byte [r11 - 0x24], al
xor r14d, r14d
mov edx, r14d
nop
movsxd rax, edx
lea rcx, [rsp + 0x198]
add rcx, rax
lea eax, [rdx + 0x12]
xor byte [rcx], al
inc edx
cmp edx, 0xc
jb 0x140030ee0
mov byte [rsp + 0x1a4], r14b
lea rcx, [rsp + 0x198]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
test rax, rax
jne 0x140030f32
lea rcx, [rsp + 0x198]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x140031b90
mov dword [rsp + 0x158], 0x7b71635d
mov dword [rsp + 0x15c], 0x7a776546
mov dword [rsp + 0x160], 0x6f687f
mov edx, r14d
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x158]
add rcx, rax
lea eax, [rdx + 0x12]
xor byte [rcx], al
inc edx
cmp edx, 0xb
jb 0x140030f60
mov byte [rsp + 0x163], r14b
mov qword [rsp + 0x178], r14
mov qword [rsp + 0x188], r14
mov qword [rsp + 0x190], reloc.OLEAUT32.dll_SafeArrayDestroy
lea rax, [rsp + 0x158]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140030fb0
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x178]
call fcn.1400160c0
lea rdx, [rsp + 0x178]
cmp qword [rsp + 0x190], 0x10
cmovae rdx, qword [rsp + 0x178]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [0x1400e2fb0], rax
mov rdx, qword [rsp + 0x190]
cmp rdx, 0x10
jb 0x14003103f
inc rdx
mov rcx, qword [rsp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003103a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031bab
call fcn.1400761b0
test rdi, rdi
je 0x140031bb1
movdqa xmm0, xmmword [str.QaqtbrLvuwtxro]
movdqu xmmword [rsp + 0x158], xmm0
mov dword [rsp + 0x168], 0x55454d71
mov dword [rsp + 0x16c], 0x5d474f55
xor eax, eax
mov byte [rsp + 0x170], al
mov edx, r14d
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x158]
add rcx, rax
lea eax, [rdx + 0x12]
xor byte [rcx], al
inc edx
cmp edx, 0x18
jb 0x140031080
mov byte [rsp + 0x170], 0
mov qword [rsp + 0x178], r14
mov qword [rsp + 0x188], r14
mov qword [rsp + 0x190], reloc.OLEAUT32.dll_SafeArrayDestroy
lea rax, [rsp + 0x158]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400310d0
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x178]
call fcn.1400160c0
lea rdx, [rsp + 0x178]
cmp qword [rsp + 0x190], 0x10
cmovae rdx, qword [rsp + 0x178]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [0x1400e2fe8], rax
mov rdx, qword [rsp + 0x190]
cmp rdx, 0x10
jb 0x14003115f
inc rdx
mov rcx, qword [rsp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003115a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031bcc
call fcn.1400761b0
test rdi, rdi
je 0x140031bd2
movdqa xmm0, xmmword [str.Bavsdk__uomkw]
movdqu xmmword [rsp + 0x158], xmm0
mov edx, r14d
nop dword [rax]
movsxd rax, edx
lea rcx, [rsp + 0x158]
add rcx, rax
lea eax, [rdx + 0x12]
xor byte [rcx], al
inc edx
cmp edx, 0xf
jb 0x140031180
mov byte [rsp + 0x167], 0
mov qword [rsp + 0x178], r14
mov qword [rsp + 0x188], r14
mov qword [rsp + 0x190], reloc.OLEAUT32.dll_SafeArrayDestroy
lea rax, [rsp + 0x158]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400311d0
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x178]
call fcn.1400160c0
lea rdx, [rsp + 0x178]
cmp qword [rsp + 0x190], 0x10
cmovae rdx, qword [rsp + 0x178]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [0x1400e2ff0], rax
mov rdx, qword [rsp + 0x190]
cmp rdx, 0x10
jb 0x14003125f
inc rdx
mov rcx, qword [rsp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003125a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031bed
call fcn.1400761b0
test rdi, rdi
je 0x140031bf3
mov dword [rsp + 0x158], 0x767b6142
mov dword [rsp + 0x15c], 0x2a6b6473
mov dword [rsp + 0x160], 0x65795528
mov word [rsp + 0x164], 0x486a
xor eax, eax
mov byte [rsp + 0x166], al
mov edx, r14d
nop
movsxd rax, edx
lea rcx, [rsp + 0x158]
add rcx, rax
lea eax, [rdx + 0x12]
xor byte [rcx], al
inc edx
cmp edx, 0xe
jb 0x1400312a0
mov byte [rsp + 0x166], 0
mov qword [rsp + 0x178], r14
mov qword [rsp + 0x188], r14
mov qword [rsp + 0x190], reloc.OLEAUT32.dll_SafeArrayDestroy
lea rax, [rsp + 0x158]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400312f0
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x178]
call fcn.1400160c0
lea rdx, [rsp + 0x178]
cmp qword [rsp + 0x190], 0x10
cmovae rdx, qword [rsp + 0x178]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [0x1400e2ff8], rax
mov rdx, qword [rsp + 0x190]
cmp rdx, 0x10
jb 0x14003137f
inc rdx
mov rcx, qword [rsp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003137a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031c0e
call fcn.1400761b0
test rdi, rdi
je 0x140031c14
mov dword [rsp + 0x158], 0x60707c5f
mov dword [rsp + 0x15c], 0x2b2b727a
mov dword [rsp + 0x160], 0x6e6e725c
mov word [rsp + 0x164], 0x486a
xor eax, eax
mov byte [rsp + 0x166], al
mov edx, r14d
nop
movsxd rax, edx
lea rcx, [rsp + 0x158]
add rcx, rax
lea eax, [rdx + 0x12]
xor byte [rcx], al
inc edx
cmp edx, 0xe
jb 0x1400313c0
mov byte [rsp + 0x166], 0
mov qword [rsp + 0x178], r14
mov qword [rsp + 0x188], r14
mov qword [rsp + 0x190], reloc.OLEAUT32.dll_SafeArrayDestroy
lea rax, [rsp + 0x158]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140031410
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x178]
call fcn.1400160c0
lea rdx, [rsp + 0x178]
cmp qword [rsp + 0x190], 0x10
cmovae rdx, qword [rsp + 0x178]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [0x1400e3000], rax
mov rdx, qword [rsp + 0x190]
cmp rdx, 0x10
jb 0x14003149f
inc rdx
mov rcx, qword [rsp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003149a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031c35
call fcn.1400761b0
test rdi, rdi
je 0x140031c3b
mov dword [rsp + 0x158], 0x60707c5f
mov dword [rsp + 0x15c], 0x2b2b727a
mov dword [rsp + 0x160], 0x69647e54
mov word [rsp + 0x164], 0x49
mov edx, r14d
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x158]
add rcx, rax
lea eax, [rdx + 0x12]
xor byte [rcx], al
inc edx
cmp edx, 0xd
jb 0x1400314e0
mov byte [rsp + 0x165], 0
mov qword [rsp + 0x178], r14
mov qword [rsp + 0x188], r14
mov qword [rsp + 0x190], reloc.OLEAUT32.dll_SafeArrayDestroy
lea rax, [rsp + 0x158]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140031530
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x178]
call fcn.1400160c0
lea rdx, [rsp + 0x178]
cmp qword [rsp + 0x190], 0x10
cmovae rdx, qword [rsp + 0x178]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [0x1400e3008], rax
mov rdx, qword [rsp + 0x190]
cmp rdx, 0x10
jb 0x1400315bf
inc rdx
mov rcx, qword [rsp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400315ba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031c5c
call fcn.1400761b0
test rdi, rdi
je 0x140031c62
movdqa xmm0, xmmword [0x1400ce070]
movdqu xmmword [rsp + 0x158], xmm0
mov dword [rsp + 0x168], 0x6c5d514d
mov dword [rsp + 0x16c], 0x474148
mov edx, r14d
movsxd rax, edx
lea rcx, [rsp + 0x158]
add rcx, rax
lea eax, [rdx + 0x12]
xor byte [rcx], al
inc edx
cmp edx, 0x17
jb 0x1400315f2
mov byte [rsp + 0x16f], 0
mov qword [rsp + 0x178], r14
mov qword [rsp + 0x188], r14
mov qword [rsp + 0x190], reloc.OLEAUT32.dll_SafeArrayDestroy
lea rax, [rsp + 0x158]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140031640
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x178]
call fcn.1400160c0
lea rdx, [rsp + 0x178]
cmp qword [rsp + 0x190], 0x10
cmovae rdx, qword [rsp + 0x178]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [0x1400e3010], rax
mov rdx, qword [rsp + 0x190]
cmp rdx, 0x10
jb 0x1400316cf
inc rdx
mov rcx, qword [rsp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400316ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031c83
call fcn.1400761b0
test rdi, rdi
je 0x140031c89
movdqa xmm0, xmmword [str.VvburQvYtrilpL]
movdqu xmmword [rsp + 0x158], xmm0
mov edx, r14d
nop dword [rax]
movsxd rax, edx
lea rcx, [rsp + 0x158]
add rcx, rax
lea eax, [rdx + 0x12]
xor byte [rcx], al
inc edx
cmp edx, 0xf
jb 0x1400316f0
mov byte [rsp + 0x167], 0
mov qword [rsp + 0x178], r14
mov qword [rsp + 0x188], r14
mov qword [rsp + 0x190], reloc.OLEAUT32.dll_SafeArrayDestroy
lea rax, [rsp + 0x158]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140031740
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x178]
call fcn.1400160c0
lea rdx, [rsp + 0x178]
cmp qword [rsp + 0x190], 0x10
cmovae rdx, qword [rsp + 0x178]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [0x1400e3020], rax
mov rdx, qword [rsp + 0x190]
cmp rdx, 0x10
jb 0x1400317cf
inc rdx
mov rcx, qword [rsp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400317ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031caa
call fcn.1400761b0
test rdi, rdi
je 0x140031cb0
mov dword [rsp + 0x1a8], 0x74627753
mov dword [rsp + 0x1ac], 0x2b2b7e66
mov dword [rsp + 0x1b0], 0x71707f34
xor eax, eax
mov byte [rsp + 0x1b4], al
mov edx, r14d
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x1a8]
add rcx, rax
lea eax, [rdx + 0x12]
xor byte [rcx], al
inc edx
cmp edx, 0xc
jb 0x140031810
mov byte [rsp + 0x1b4], 0
lea rcx, [rsp + 0x1a8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
test rax, rax
jne 0x140031862
lea rcx, [rsp + 0x1a8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x140031cd1
lea rdx, str.OpenProcessToken
lea rcx, [rsp + 0x158]
call fcn.14003add0
mov edx, r14d
nop dword [rax]
movsxd rax, edx
lea rcx, [rsp + 0x158]
add rcx, rax
lea eax, [rdx + 0x12]
xor byte [rcx], al
inc edx
cmp edx, 0x10
jb 0x140031880
mov byte [rsp + 0x168], 0
mov qword [rsp + 0x178], r14
mov qword [rsp + 0x188], r14
mov qword [rsp + 0x190], reloc.OLEAUT32.dll_SafeArrayDestroy
lea rax, [rsp + 0x158]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400318d0
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x178]
call fcn.1400160c0
lea rdx, [rsp + 0x178]
cmp qword [rsp + 0x190], 0x10
cmovae rdx, qword [rsp + 0x178]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [0x1400e3028], rax
mov rdx, qword [rsp + 0x190]
cmp rdx, 0x10
jb 0x14003195f
inc rdx
mov rcx, qword [rsp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003195a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031cf2
call fcn.1400761b0
test rdi, rdi
je 0x140031cf8
lea rdx, str.AdjustTokenPrivileges
lea rcx, [rsp + 0x158]
call fcn.14003ad00
mov edx, r14d
nop
movsxd rax, edx
lea rcx, [rsp + 0x158]
add rcx, rax
lea eax, [rdx + 0x12]
xor byte [rcx], al
inc edx
cmp edx, 0x15
jb 0x140031980
mov byte [rsp + 0x16d], 0
mov qword [rsp + 0x178], r14
mov qword [rsp + 0x188], r14
mov qword [rsp + 0x190], reloc.OLEAUT32.dll_SafeArrayDestroy
lea rax, [rsp + 0x158]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400319d0
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x178]
call fcn.1400160c0
lea rdx, [rsp + 0x178]
cmp qword [rsp + 0x190], 0x10
cmovae rdx, qword [rsp + 0x178]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [0x1400e3038], rax
mov rdx, qword [rsp + 0x190]
cmp rdx, 0x10
jb 0x140031a5f
inc rdx
mov rcx, qword [rsp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031a5a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031d19
call fcn.1400761b0
test rdi, rdi
je 0x140031d1f
lea rdx, str.LookupPrivilegeValueW
lea rcx, [rsp + 0x158]
call fcn.14003ad00
mov edx, r14d
nop
movsxd rax, edx
lea rcx, [rsp + 0x158]
add rcx, rax
lea eax, [rdx + 0x12]
xor byte [rcx], al
inc edx
cmp edx, 0x15
jb 0x140031a80
mov byte [rsp + 0x16d], 0
mov qword [rsp + 0x178], r14
mov qword [rsp + 0x188], r14
mov qword [rsp + 0x190], reloc.OLEAUT32.dll_SafeArrayDestroy
lea rax, [rsp + 0x158]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140031ac6
mov r8, rbx
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x178]
call fcn.1400160c0
lea rdx, [rsp + 0x178]
cmp qword [rsp + 0x190], 0x10
cmovae rdx, qword [rsp + 0x178]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [0x1400e3030], rax
mov rdx, qword [rsp + 0x190]
cmp rdx, 0x10
jb 0x140031b57
inc rdx
mov rcx, qword [rsp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031b52
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031d40
call fcn.1400761b0
test rbx, rbx
je 0x140031d46
mov al, 1
jmp 0x140031b66
mov rcx, qword [rsp + 0x1b8]
xor rcx, rsp
call fcn.140076190
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r14
ret
lea rcx, [rsp + 0x20]
call fcn.140030130
lea rdx, [0x1400dd128]
lea rcx, [rsp + 0x20]
call fcn.140078e80
call fcn.14007cacc
int3
lea rcx, [rsp + 0x38]
call fcn.140030130
lea rdx, [0x1400dd128]
lea rcx, [rsp + 0x38]
call fcn.140078e80
call fcn.14007cacc
int3
lea rcx, [rsp + 0x50]
call fcn.140030130
lea rdx, [0x1400dd128]
lea rcx, [rsp + 0x50]
call fcn.140078e80
call fcn.14007cacc
int3
lea rcx, [rsp + 0x68]
call fcn.140030130
lea rdx, [0x1400dd128]
lea rcx, [rsp + 0x68]
call fcn.140078e80
call fcn.14007cacc
int3
lea rcx, [rsp + 0x80]
call fcn.140030130
lea rdx, [0x1400dd128]
lea rcx, [rsp + 0x80]
call fcn.140078e80
call fcn.14007cacc
int3
lea rcx, [rsp + 0x98]
call fcn.140030130
lea rdx, [0x1400dd128]
lea rcx, [rsp + 0x98]
call fcn.140078e80
call fcn.14007cacc
int3
lea rcx, [rsp + 0xb0]
call fcn.140030130
lea rdx, [0x1400dd128]
lea rcx, [rsp + 0xb0]
call fcn.140078e80
call fcn.14007cacc
int3
lea rcx, [rsp + 0xc8]
call fcn.140030130
lea rdx, [0x1400dd128]
lea rcx, [rsp + 0xc8]
call fcn.140078e80
call fcn.14007cacc
int3
lea rcx, [rsp + 0xe0]
call fcn.140030130
lea rdx, [0x1400dd128]
lea rcx, [rsp + 0xe0]
call fcn.140078e80
lea rcx, [rsp + 0xf8]
call fcn.140030130
lea rdx, [0x1400dd128]
lea rcx, [rsp + 0xf8]
call fcn.140078e80
call fcn.14007cacc
int3
lea rcx, [rsp + 0x110]
call fcn.140030130
lea rdx, [0x1400dd128]
lea rcx, [rsp + 0x110]
call fcn.140078e80
call fcn.14007cacc
int3
lea rcx, [rsp + 0x128]
call fcn.140030130
lea rdx, [0x1400dd128]
lea rcx, [rsp + 0x128]
call fcn.140078e80
call fcn.14007cacc
int3
lea rcx, [rsp + 0x140]
call fcn.140030130
lea rdx, [0x1400dd128]
lea rcx, [rsp + 0x140]
call fcn.140078e80
int3