Function at 0x14000d710
Capabilities:
Encode data using xor
Link many functions at runtime

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x290
mov rax, qword [0x14008dfc0]
xor rax, rsp
mov qword [rsp + 0x288], rax
mov r15, rcx
xor ebx, ebx
mov dword [r11 - 0x40], 0x8eadbb96
mov dword [r11 - 0x3c], 0xd6d08e84
mov dword [r11 - 0x38], 0x848b82cb
xor eax, eax
mov byte [r11 - 0x34], al
mov edx, ebx
nop
movsxd rax, edx
lea rcx, [rsp + 0x268]
add rcx, rax
lea eax, [rdx - 0x23]
xor byte [rcx], al
inc edx
cmp edx, 0xc
jb 0x14000d760
mov byte [rsp + 0x274], 0
lea rcx, [rsp + 0x268]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
test rax, rax
jne 0x14000d7b2
lea rcx, [rsp + 0x268]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14000ebbb
mov dword [rsp + 0x228], 0x8ebaae92
mov dword [rsp + 0x22c], 0x878c90b1
mov dword [rsp + 0x230], 0x949580
mov edx, ebx
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x228]
add rcx, rax
lea eax, [rdx - 0x23]
xor byte [rcx], al
inc edx
cmp edx, 0xb
jb 0x14000d7e0
mov byte [rsp + 0x233], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x248], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x258], xmm1
lea rax, [rsp + 0x228]
mov r14, 0xffffffffffffffff
mov r8, r14
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14000d830
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x248]
call fcn.140001130
lea rdx, [rsp + 0x248]
cmp qword [rsp + 0x260], 0xf
cmova rdx, qword [rsp + 0x248]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15], rax
mov rdx, qword [rsp + 0x260]
cmp rdx, 0xf
jbe 0x14000d8bb
inc rdx
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d8b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ebdd
call fcn.14003d438
test rdi, rdi
je 0x14000ebe3
movdqa xmm0, xmmword [0x14006c030]
movdqu xmmword [rsp + 0x228], xmm0
mov dword [rsp + 0x238], 0x808e80be
mov dword [rsp + 0x23c], 0x809c9a82
xor eax, eax
mov byte [rsp + 0x240], al
mov edx, ebx
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x228]
add rcx, rax
lea eax, [rdx - 0x23]
xor byte [rcx], al
inc edx
cmp edx, 0x18
jb 0x14000d900
mov byte [rsp + 0x240], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x248], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x258], xmm1
lea rax, [rsp + 0x228]
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x14000d944
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x248]
call fcn.140001130
lea rdx, [rsp + 0x248]
cmp qword [rsp + 0x260], 0xf
cmova rdx, qword [rsp + 0x248]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15 + 0x38], rax
mov rdx, qword [rsp + 0x260]
cmp rdx, 0xf
jbe 0x14000d9d0
inc rdx
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d9cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ec05
call fcn.14003d438
test rdi, rdi
je 0x14000ec0b
movdqa xmm0, xmmword [0x14006bf90]
movdqu xmmword [rsp + 0x228], xmm0
mov edx, ebx
nop dword [rax]
movsxd rax, edx
lea rcx, [rsp + 0x228]
add rcx, rax
lea eax, [rdx - 0x23]
xor byte [rcx], al
inc edx
cmp edx, 0xf
jb 0x14000d9f0
mov byte [rsp + 0x237], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x248], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x258], xmm1
lea rax, [rsp + 0x228]
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x14000da34
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x248]
call fcn.140001130
lea rdx, [rsp + 0x248]
cmp qword [rsp + 0x260], 0xf
cmova rdx, qword [rsp + 0x248]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15 + 0x40], rax
mov rdx, qword [rsp + 0x260]
cmp rdx, 0xf
jbe 0x14000dac0
inc rdx
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000dabb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ec2d
call fcn.14003d438
test rdi, rdi
je 0x14000ec33
mov dword [rsp + 0x228], 0x83b0ac8d
mov dword [rsp + 0x22c], 0xd7909184
mov dword [rsp + 0x230], 0x9082a8d7
mov word [rsp + 0x234], 0xbd9d
xor eax, eax
mov byte [rsp + 0x236], al
mov edx, ebx
nop
movsxd rax, edx
lea rcx, [rsp + 0x228]
add rcx, rax
lea eax, [rdx - 0x23]
xor byte [rcx], al
inc edx
cmp edx, 0xe
jb 0x14000db00
mov byte [rsp + 0x236], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x248], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x258], xmm1
lea rax, [rsp + 0x228]
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x14000db44
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x248]
call fcn.140001130
lea rdx, [rsp + 0x248]
cmp qword [rsp + 0x260], 0xf
cmova rdx, qword [rsp + 0x248]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15 + 0x48], rax
mov rdx, qword [rsp + 0x260]
cmp rdx, 0xf
jbe 0x14000dbd0
inc rdx
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000dbcb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ec55
call fcn.14003d438
test rdi, rdi
je 0x14000ec5b
mov dword [rsp + 0x228], 0x95bbb190
mov dword [rsp + 0x22c], 0xd6d0878d
mov dword [rsp + 0x230], 0x9b958fa3
mov word [rsp + 0x234], 0xbd9d
xor eax, eax
mov byte [rsp + 0x236], al
mov edx, ebx
nop
movsxd rax, edx
lea rcx, [rsp + 0x228]
add rcx, rax
lea eax, [rdx - 0x23]
xor byte [rcx], al
inc edx
cmp edx, 0xe
jb 0x14000dc10
mov byte [rsp + 0x236], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x248], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x258], xmm1
lea rax, [rsp + 0x228]
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x14000dc54
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x248]
call fcn.140001130
lea rdx, [rsp + 0x248]
cmp qword [rsp + 0x260], 0xf
cmova rdx, qword [rsp + 0x248]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15 + 0x50], rax
mov rdx, qword [rsp + 0x260]
cmp rdx, 0xf
jbe 0x14000dce0
inc rdx
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000dcdb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ec83
call fcn.14003d438
test rdi, rdi
je 0x14000ec89
mov dword [rsp + 0x228], 0x95bbb190
mov dword [rsp + 0x22c], 0xd6d0878d
mov dword [rsp + 0x230], 0x9c9f83ab
mov word [rsp + 0x234], 0xbe
mov edx, ebx
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x228]
add rcx, rax
lea eax, [rdx - 0x23]
xor byte [rcx], al
inc edx
cmp edx, 0xd
jb 0x14000dd20
mov byte [rsp + 0x235], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x248], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x258], xmm1
lea rax, [rsp + 0x228]
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x14000dd64
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x248]
call fcn.140001130
lea rdx, [rsp + 0x248]
cmp qword [rsp + 0x260], 0xf
cmova rdx, qword [rsp + 0x248]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15 + 0x58], rax
mov rdx, qword [rsp + 0x260]
cmp rdx, 0xf
jbe 0x14000ddf0
inc rdx
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ddeb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ecb1
call fcn.14003d438
test rdi, rdi
je 0x14000ecb7
movdqa xmm0, xmmword [0x14006bfa0]
movdqu xmmword [rsp + 0x228], xmm0
mov dword [rsp + 0x238], 0xb9969c82
mov dword [rsp + 0x23c], 0x9c949f
mov edx, ebx
movsxd rax, edx
lea rcx, [rsp + 0x228]
add rcx, rax
lea eax, [rdx - 0x23]
xor byte [rcx], al
inc edx
cmp edx, 0x17
jb 0x14000de22
mov byte [rsp + 0x23f], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x248], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x258], xmm1
lea rax, [rsp + 0x228]
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x14000de66
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x248]
call fcn.140001130
lea rdx, [rsp + 0x248]
cmp qword [rsp + 0x260], 0xf
cmova rdx, qword [rsp + 0x248]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15 + 0x60], rax
mov rdx, qword [rsp + 0x260]
cmp rdx, 0xf
jbe 0x14000def2
inc rdx
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000deed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ecdf
call fcn.14003d438
test rdi, rdi
je 0x14000ece5
movdqa xmm0, xmmword [0x14006bf80]
movdqu xmmword [rsp + 0x228], xmm0
mov edx, ebx
nop
movsxd rax, edx
lea rcx, [rsp + 0x228]
add rcx, rax
lea eax, [rdx - 0x23]
xor byte [rcx], al
inc edx
cmp edx, 0xf
jb 0x14000df10
mov byte [rsp + 0x237], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x248], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x258], xmm1
lea rax, [rsp + 0x228]
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x14000df54
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x248]
call fcn.140001130
lea rdx, [rsp + 0x248]
cmp qword [rsp + 0x260], 0xf
cmova rdx, qword [rsp + 0x248]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15 + 0x70], rax
mov rdx, qword [rsp + 0x260]
cmp rdx, 0xf
jbe 0x14000dfe0
inc rdx
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000dfdb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ed0d
call fcn.14003d438
test rdi, rdi
je 0x14000ed13
mov dword [rsp + 0x278], 0x81a9ba9c
mov dword [rsp + 0x27c], 0xd6d08b91
mov dword [rsp + 0x280], 0x848b82cb
xor eax, eax
mov byte [rsp + 0x284], al
mov edx, ebx
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x278]
add rcx, rax
lea eax, [rdx - 0x23]
xor byte [rcx], al
inc edx
cmp edx, 0xc
jb 0x14000e020
mov byte [rsp + 0x284], 0
lea rcx, [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
test rax, rax
jne 0x14000e072
lea rcx, [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14000ed3b
movdqa xmm0, xmmword [0x14006bfb0]
movdqu xmmword [rsp + 0x228], xmm0
xor eax, eax
mov byte [rsp + 0x238], al
mov edx, ebx
nop
movsxd rax, edx
lea rcx, [rsp + 0x228]
add rcx, rax
lea eax, [rdx - 0x23]
xor byte [rcx], al
inc edx
cmp edx, 0x10
jb 0x14000e090
mov byte [rsp + 0x238], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x248], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x258], xmm1
lea rax, [rsp + 0x228]
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x14000e0d4
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x248]
call fcn.140001130
lea rdx, [rsp + 0x248]
cmp qword [rsp + 0x260], 0xf
cmova rdx, qword [rsp + 0x248]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15 + 0x78], rax
mov rdx, qword [rsp + 0x260]
cmp rdx, 0xf
jbe 0x14000e160
inc rdx
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e15b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ed63
call fcn.14003d438
test rdi, rdi
je 0x14000ed69
movdqa xmm0, xmmword [0x14006bfd0]
movdqu xmmword [rsp + 0x228], xmm0
mov dword [rsp + 0x238], 0x95888b81
mov word [rsp + 0x23c], 0x82
mov edx, ebx
movsxd rax, edx
lea rcx, [rsp + 0x228]
add rcx, rax
lea eax, [rdx - 0x23]
xor byte [rcx], al
inc edx
cmp edx, 0x15
jb 0x14000e191
mov byte [rsp + 0x23d], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x248], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x258], xmm1
lea rax, [rsp + 0x228]
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x14000e1d5
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x248]
call fcn.140001130
lea rdx, [rsp + 0x248]
cmp qword [rsp + 0x260], 0xf
cmova rdx, qword [rsp + 0x248]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15 + 0x88], rax
mov rdx, qword [rsp + 0x260]
cmp rdx, 0xf
jbe 0x14000e264
inc rdx
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e25f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ed91
call fcn.14003d438
test rdi, rdi
je 0x14000ed97
movdqa xmm0, xmmword [0x14006c010]
movdqu xmmword [rsp + 0x228], xmm0
mov word [rsp + 0x238], 0x9d98
xor eax, eax
mov byte [rsp + 0x23a], al
mov edx, ebx
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x228]
add rcx, rax
lea eax, [rdx - 0x23]
xor byte [rcx], al
inc edx
cmp edx, 0x12
jb 0x14000e2a0
mov byte [rsp + 0x23a], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x248], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x258], xmm1
lea rax, [rsp + 0x228]
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x14000e2e4
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x248]
call fcn.140001130
lea rdx, [rsp + 0x248]
cmp qword [rsp + 0x260], 0xf
cmova rdx, qword [rsp + 0x248]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15 + 0xa0], rax
mov rdx, qword [rsp + 0x260]
cmp rdx, 0xf
jbe 0x14000e373
inc rdx
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e36e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000edbf
call fcn.14003d438
test rdi, rdi
je 0x14000edc5
mov dword [rsp + 0x228], 0x94b1b19e
mov dword [rsp + 0x22c], 0xb78f8d93
mov dword [rsp + 0x230], 0x81919480
mov word [rsp + 0x234], 0x8f8a
xor eax, eax
mov byte [rsp + 0x236], al
mov edx, ebx
movsxd rax, edx
lea rcx, [rsp + 0x228]
add rcx, rax
lea eax, [rdx - 0x23]
xor byte [rcx], al
inc edx
cmp edx, 0xe
jb 0x14000e3b2
mov byte [rsp + 0x236], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x248], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x258], xmm1
lea rax, [rsp + 0x228]
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x14000e3f6
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x248]
call fcn.140001130
lea rdx, [rsp + 0x248]
cmp qword [rsp + 0x260], 0xf
cmova rdx, qword [rsp + 0x248]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15 + 0xa8], rax
mov rdx, qword [rsp + 0x260]
cmp rdx, 0xf
jbe 0x14000e485
inc rdx
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e480
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000eded
call fcn.14003d438
test rdi, rdi
je 0x14000edf3
mov dword [rsp + 0x228], 0x85b3bb99
mov dword [rsp + 0x22c], 0x81b08795
mov dword [rsp + 0x230], 0x8b8e9097
mov word [rsp + 0x234], 0x8c
mov edx, ebx
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x228]
add rcx, rax
lea eax, [rdx - 0x23]
xor byte [rcx], al
inc edx
cmp edx, 0xd
jb 0x14000e4c0
mov byte [rsp + 0x235], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x248], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x258], xmm1
lea rax, [rsp + 0x228]
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x14000e504
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x248]
call fcn.140001130
lea rdx, [rsp + 0x248]
cmp qword [rsp + 0x260], 0xf
cmova rdx, qword [rsp + 0x248]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15 + 0xb8], rax
mov rdx, qword [rsp + 0x260]
cmp rdx, 0xf
jbe 0x14000e593
inc rdx
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e58e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ee1b
call fcn.14003d438
test rdi, rdi
je 0x14000ee21
lea rdx, str.CloseServiceHandle
lea rcx, [rsp + 0x228]
call fcn.140009860
mov edx, ebx
movsxd rax, edx
lea rcx, [rsp + 0x228]
add rcx, rax
lea eax, [rdx - 0x23]
xor byte [rcx], al
inc edx
cmp edx, 0x12
jb 0x14000e5b2
mov byte [rsp + 0x23a], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x248], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x258], xmm1
lea rax, [rsp + 0x228]
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x14000e5f6
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x248]
call fcn.140001130
lea rdx, [rsp + 0x248]
cmp qword [rsp + 0x260], 0xf
cmova rdx, qword [rsp + 0x248]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15 + 0xc0], rax
mov rdx, qword [rsp + 0x260]
cmp rdx, 0xf
jbe 0x14000e685
inc rdx
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e680
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ee49
call fcn.14003d438
test rdi, rdi
je 0x14000ee4f
lea rdx, str.LookupPrivilegeValueW
lea rcx, [rsp + 0x228]
call fcn.140009790
mov edx, ebx
nop dword [rax]
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x228]
add rcx, rax
lea eax, [rdx - 0x23]
xor byte [rcx], al
inc edx
cmp edx, 0x15
jb 0x14000e6b0
mov byte [rsp + 0x23d], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x248], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x258], xmm1
lea rax, [rsp + 0x228]
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x14000e6f4
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x248]
call fcn.140001130
lea rdx, [rsp + 0x248]
cmp qword [rsp + 0x260], 0xf
cmova rdx, qword [rsp + 0x248]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15 + 0x80], rax
mov rdx, qword [rsp + 0x260]
cmp rdx, 0xf
jbe 0x14000e783
inc rdx
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e77e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ee77
call fcn.14003d438
test rdi, rdi
je 0x14000ee7d
lea rdx, str.OpenSCManagerW
lea rcx, [rsp + 0x228]
call fcn.140009910
mov edx, ebx
movsxd rax, edx
lea rcx, [rsp + 0x228]
add rcx, rax
lea eax, [rdx - 0x23]
xor byte [rcx], al
inc edx
cmp edx, 0xe
jb 0x14000e7a2
mov byte [rsp + 0x236], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x248], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x258], xmm1
lea rax, [rsp + 0x228]
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x14000e7e6
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x248]
call fcn.140001130
lea rdx, [rsp + 0x248]
cmp qword [rsp + 0x260], 0xf
cmova rdx, qword [rsp + 0x248]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15 + 0x90], rax
mov rdx, qword [rsp + 0x260]
cmp rdx, 0xf
jbe 0x14000e875
inc rdx
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e870
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000eea5
call fcn.14003d438
test rdi, rdi
je 0x14000eeab
mov dword [rsp + 0x228], 0x8ebaae92
mov dword [rsp + 0x22c], 0x929187b2
mov dword [rsp + 0x230], 0xbf82858c
xor eax, eax
mov byte [rsp + 0x234], al
mov edx, ebx
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x228]
add rcx, rax
lea eax, [rdx - 0x23]
xor byte [rcx], al
inc edx
cmp edx, 0xc
jb 0x14000e8b0
mov byte [rsp + 0x234], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x248], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x258], xmm1
lea rax, [rsp + 0x228]
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x14000e8f4
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x248]
call fcn.140001130
lea rdx, [rsp + 0x248]
cmp qword [rsp + 0x260], 0xf
cmova rdx, qword [rsp + 0x248]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15 + 0x98], rax
mov rdx, qword [rsp + 0x260]
cmp rdx, 0xf
jbe 0x14000e983
inc rdx
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e97e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000eed3
call fcn.14003d438
test rdi, rdi
je 0x14000eed9
mov dword [rsp + 0x228], 0x92beaa8e
mov dword [rsp + 0x22c], 0x9686b195
mov dword [rsp + 0x230], 0x8d848f93
mov word [rsp + 0x234], 0xbe
mov edx, ebx
nop dword [rax]
movsxd rax, edx
lea rcx, [rsp + 0x228]
add rcx, rax
lea eax, [rdx - 0x23]
xor byte [rcx], al
inc edx
cmp edx, 0xd
jb 0x14000e9c0
mov byte [rsp + 0x235], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x248], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x258], xmm1
lea rax, [rsp + 0x228]
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x14000ea04
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x248]
call fcn.140001130
lea rdx, [rsp + 0x248]
cmp qword [rsp + 0x260], 0xf
cmova rdx, qword [rsp + 0x248]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15 + 0xb0], rax
mov rdx, qword [rsp + 0x260]
cmp rdx, 0xf
jbe 0x14000ea93
inc rdx
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ea8e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ef01
call fcn.14003d438
test rdi, rdi
je 0x14000ef07
lea rdx, str.CreateServiceW
lea rcx, [rsp + 0x228]
call fcn.140009910
movsxd rax, ebx
lea rcx, [rsp + 0x228]
add rcx, rax
lea eax, [rbx - 0x23]
xor byte [rcx], al
inc ebx
cmp ebx, 0xe
jb 0x14000eab0
mov byte [rsp + 0x236], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x248], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x258], xmm1
lea rax, [rsp + 0x228]
inc r14
cmp byte [rax + r14], 0
jne 0x14000eaf1
mov r8, r14
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x248]
call fcn.140001130
lea rdx, [rsp + 0x248]
cmp qword [rsp + 0x260], 0xf
cmova rdx, qword [rsp + 0x248]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [r15 + 0xc8], rax
mov rdx, qword [rsp + 0x260]
cmp rdx, 0xf
jbe 0x14000eb83
inc rdx
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000eb7e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ef2f
call fcn.14003d438
test rbx, rbx
je 0x14000ef35
mov al, 1
jmp 0x14000eb92
mov rcx, qword [rsp + 0x288]
xor rcx, rsp
call fcn.14003d550
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
lea rdx, str.dll_1__not_found.
lea rcx, [rsp + 0x30]
call fcn.140009e70
lea rdx, [0x14008aa80]
lea rcx, [rsp + 0x30]
call fcn.14003e784
call fcn.14004442c
int3
lea rdx, str.Cannot_find_function_1.
lea rcx, [rsp + 0x48]
call fcn.140009e70
lea rdx, [0x14008aa80]
lea rcx, [rsp + 0x48]
call fcn.14003e784
call fcn.14004442c
int3
lea rdx, str.Cannot_find_function_8.
lea rcx, [rsp + 0x60]
call fcn.140009e70
lea rdx, [0x14008aa80]
lea rcx, [rsp + 0x60]
call fcn.14003e784
call fcn.14004442c
int3
lea rdx, str.Cannot_find_function_9.
lea rcx, [rsp + 0x78]
call fcn.140009e70
lea rdx, [0x14008aa80]
lea rcx, [rsp + 0x78]
call fcn.14003e784
call fcn.14004442c
int3
lea rdx, str.Cannot_find_function_10.
lea rcx, [rsp + 0x90]
call fcn.140009e70
lea rdx, [0x14008aa80]
lea rcx, [rsp + 0x90]
call fcn.14003e784
call fcn.14004442c
int3
lea rdx, str.Cannot_find_function_11.
lea rcx, [rsp + 0xa8]
call fcn.140009e70
lea rdx, [0x14008aa80]
lea rcx, [rsp + 0xa8]
call fcn.14003e784
call fcn.14004442c
int3
lea rdx, str.Cannot_find_function_12.
lea rcx, [rsp + 0xc0]
call fcn.140009e70
lea rdx, [0x14008aa80]
lea rcx, [rsp + 0xc0]
call fcn.14003e784
call fcn.14004442c
int3
lea rdx, str.Cannot_find_function_13.
lea rcx, [rsp + 0xd8]
call fcn.140009e70
lea rdx, [0x14008aa80]
lea rcx, [rsp + 0xd8]
call fcn.14003e784
call fcn.14004442c
int3
lea rdx, str.Cannot_find_function_15.
lea rcx, [rsp + 0xf0]
call fcn.140009e70
lea rdx, [0x14008aa80]
lea rcx, [rsp + 0xf0]
call fcn.14003e784
lea rdx, str.dll_2__not_found.
lea rcx, [rsp + 0x108]
call fcn.140009e70
lea rdx, [0x14008aa80]
lea rcx, [rsp + 0x108]
call fcn.14003e784
call fcn.14004442c
int3
lea rdx, str.Cannot_find_function_a1.
lea rcx, [rsp + 0x120]
call fcn.140009e70
lea rdx, [0x14008aa80]
lea rcx, [rsp + 0x120]
call fcn.14003e784
call fcn.14004442c
int3
lea rdx, str.Cannot_find_function_a3.
lea rcx, [rsp + 0x138]
call fcn.140009e70
lea rdx, [0x14008aa80]
lea rcx, [rsp + 0x138]
call fcn.14003e784
call fcn.14004442c
int3
lea rdx, str.Cannot_find_function_a6.
lea rcx, [rsp + 0x150]
call fcn.140009e70
lea rdx, [0x14008aa80]
lea rcx, [rsp + 0x150]
call fcn.14003e784
call fcn.14004442c
int3
lea rdx, str.Cannot_find_function_a7.
lea rcx, [rsp + 0x168]
call fcn.140009e70
lea rdx, [0x14008aa80]
lea rcx, [rsp + 0x168]
call fcn.14003e784
call fcn.14004442c
int3
lea rdx, str.Cannot_find_function_a9.
lea rcx, [rsp + 0x180]
call fcn.140009e70
lea rdx, [0x14008aa80]
lea rcx, [rsp + 0x180]
call fcn.14003e784
call fcn.14004442c
int3
lea rdx, str.Cannot_find_function_a10.
lea rcx, [rsp + 0x198]
call fcn.140009e70
lea rdx, [0x14008aa80]
lea rcx, [rsp + 0x198]
call fcn.14003e784
call fcn.14004442c
int3
lea rdx, str.Cannot_find_function_a2.
lea rcx, [rsp + 0x1b0]
call fcn.140009e70
lea rdx, [0x14008aa80]
lea rcx, [rsp + 0x1b0]
call fcn.14003e784
call fcn.14004442c
int3
lea rdx, str.Cannot_find_function_a4.
lea rcx, [rsp + 0x1c8]
call fcn.140009e70
lea rdx, [0x14008aa80]
lea rcx, [rsp + 0x1c8]
call fcn.14003e784
call fcn.14004442c
int3
lea rdx, str.Cannot_find_function_a5.
lea rcx, [rsp + 0x1e0]
call fcn.140009e70
lea rdx, [0x14008aa80]
lea rcx, [rsp + 0x1e0]
call fcn.14003e784
call fcn.14004442c
int3
lea rdx, str.Cannot_find_function_a8.
lea rcx, [rsp + 0x1f8]
call fcn.140009e70
lea rdx, [0x14008aa80]
lea rcx, [rsp + 0x1f8]
call fcn.14003e784
call fcn.14004442c
int3
lea rdx, str.Cannot_find_function_a11.
lea rcx, [rsp + 0x210]
call fcn.140009e70
lea rdx, [0x14008aa80]
lea rcx, [rsp + 0x210]
call fcn.14003e784
int3