Function at 0x140039818
Capabilities:
Encode data using xor
Link many functions at runtime

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1d0
mov rax, qword [0x1400d5380]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov r15, rcx
xor r12d, r12d
mov dword [r11 - 0x58], 0xdeddcbe6
mov dword [r11 - 0x54], 0x8680ded4
mov dword [r11 - 0x50], 0xd4dbd29b
xor eax, eax
mov byte [r11 - 0x4c], al
mov edx, r12d
movsxd rcx, edx
lea eax, [rdx - 0x53]
xor byte [rsp + rcx + 0x1a0], al
inc edx
cmp edx, 0xc
jb 0x14003986c
mov byte [rsp + 0x1ac], r12b
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
jne 0x1400398b8
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x14003a39e
mov dword [rsp + 0x160], 0xdecadee2
mov dword [rsp + 0x164], 0xd7dcc0e1
mov dword [rsp + 0x168], 0xc4c5d0
mov edx, r12d
movsxd rcx, edx
lea eax, [rdx - 0x53]
xor byte [rsp + rcx + 0x160], al
inc edx
cmp edx, 0xb
jb 0x1400398dc
mov byte [rsp + 0x16b], r12b
xorps xmm0, xmm0
movups xmmword [rsp + 0x180], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x190], xmm1
lea rax, [rsp + 0x160]
or rsi, 0xffffffffffffffff
mov r8, rsi
inc r8
cmp byte [rax + r8], r12b
jne 0x14003991e
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x180]
call fcn.140003238
lea rdx, [rsp + 0x180]
mov r13d, reloc.OLEAUT32.dll_SafeArrayDestroy
cmp qword [rsp + 0x198], r13
cmova rdx, qword [rsp + 0x180]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [r15], rax
mov rdx, qword [rsp + 0x198]
mov r14d, 0x1000
cmp rdx, r13
jbe 0x1400399ae
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, r14
jb 0x1400399a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003a3b9
call fcn.140077818
test rbx, rbx
je 0x14003a3bf
lea rdx, str.CreateToolhelp32Snapshot
lea rcx, [rsp + 0x160]
call fcn.140033440
mov edx, r12d
movsxd rcx, edx
lea eax, [rdx - 0x53]
xor byte [rsp + rcx + 0x160], al
inc edx
cmp edx, 0x18
jb 0x1400399ce
mov byte [rsp + 0x178], r12b
xorps xmm0, xmm0
movups xmmword [rsp + 0x180], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x190], xmm1
lea rax, [rsp + 0x160]
mov r8, rsi
inc r8
cmp byte [rax + r8], r12b
jne 0x140039a0c
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x180]
call fcn.140003238
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], r13
cmova rdx, qword [rsp + 0x180]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [r15 + 0x38], rax
mov rdx, qword [rsp + 0x198]
cmp rdx, r13
jbe 0x140039a91
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, r14
jb 0x140039a8c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003a3da
call fcn.140077818
test rbx, rbx
je 0x14003a3e0
movdqa xmm0, xmmword [0x1400a7400]
movdqu xmmword [rsp + 0x160], xmm0
mov edx, r12d
movsxd rcx, edx
lea eax, [rdx - 0x53]
xor byte [rsp + rcx + 0x160], al
inc edx
cmp edx, r13d
jb 0x140039aae
mov byte [rsp + 0x16f], r12b
xorps xmm0, xmm0
movups xmmword [rsp + 0x180], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x190], xmm1
lea rax, [rsp + 0x160]
mov r8, rsi
inc r8
cmp byte [rax + r8], r12b
jne 0x140039aec
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x180]
call fcn.140003238
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], r13
cmova rdx, qword [rsp + 0x180]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [r15 + 0x40], rax
mov rdx, qword [rsp + 0x198]
cmp rdx, r13
jbe 0x140039b71
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, r14
jb 0x140039b6c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003a3fb
call fcn.140077818
test rbx, rbx
je 0x14003a401
mov dword [rsp + 0x160], 0xd3c0dcfd
mov dword [rsp + 0x164], 0x87c0c1d4
mov dword [rsp + 0x168], 0xc0d2f887
mov word [rsp + 0x16c], 0xedcd
xor eax, eax
mov byte [rsp + 0x16e], al
mov edx, r12d
movsxd rcx, edx
lea eax, [rdx - 0x53]
xor byte [rsp + rcx + 0x160], al
inc edx
cmp edx, 0xe
jb 0x140039bb1
mov byte [rsp + 0x16e], r12b
xorps xmm0, xmm0
movups xmmword [rsp + 0x180], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x190], xmm1
lea rax, [rsp + 0x160]
mov r8, rsi
inc r8
cmp byte [rax + r8], r12b
jne 0x140039bef
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x180]
call fcn.140003238
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], r13
cmova rdx, qword [rsp + 0x180]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [r15 + 0x48], rax
mov rdx, qword [rsp + 0x198]
cmp rdx, r13
jbe 0x140039c74
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, r14
jb 0x140039c6f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003a41c
call fcn.140077818
test rbx, rbx
je 0x14003a422
mov dword [rsp + 0x160], 0xc5cbc1e0
mov dword [rsp + 0x164], 0x8680d7dd
mov dword [rsp + 0x168], 0xcbc5dff3
mov word [rsp + 0x16c], 0xedcd
xor eax, eax
mov byte [rsp + 0x16e], al
mov edx, r12d
movsxd rcx, edx
lea eax, [rdx - 0x53]
xor byte [rsp + rcx + 0x160], al
inc edx
cmp edx, 0xe
jb 0x140039cb4
mov byte [rsp + 0x16e], r12b
xorps xmm0, xmm0
movups xmmword [rsp + 0x180], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x190], xmm1
lea rax, [rsp + 0x160]
mov r8, rsi
inc r8
cmp byte [rax + r8], r12b
jne 0x140039cf2
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x180]
call fcn.140003238
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], r13
cmova rdx, qword [rsp + 0x180]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [r15 + 0x50], rax
mov rdx, qword [rsp + 0x198]
cmp rdx, r13
jbe 0x140039d77
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, r14
jb 0x140039d72
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003a443
call fcn.140077818
test rbx, rbx
je 0x14003a449
mov dword [rsp + 0x160], 0xc5cbc1e0
mov dword [rsp + 0x164], 0x8680d7dd
mov dword [rsp + 0x168], 0xcccfd3fb
mov word [rsp + 0x16c], 0xee
mov edx, r12d
movsxd rcx, edx
lea eax, [rdx - 0x53]
xor byte [rsp + rcx + 0x160], al
inc edx
cmp edx, 0xd
jb 0x140039dae
mov byte [rsp + 0x16d], r12b
xorps xmm0, xmm0
movups xmmword [rsp + 0x180], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x190], xmm1
lea rax, [rsp + 0x160]
mov r8, rsi
inc r8
cmp byte [rax + r8], r12b
jne 0x140039dec
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x180]
call fcn.140003238
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], r13
cmova rdx, qword [rsp + 0x180]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [r15 + 0x58], rax
mov rdx, qword [rsp + 0x198]
cmp rdx, r13
jbe 0x140039e71
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, r14
jb 0x140039e6c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003a46a
call fcn.140077818
test rbx, rbx
je 0x14003a470
lea rdx, str.K32GetProcessMemoryInfo
lea rcx, [rsp + 0x160]
call fcn.140033508
mov edx, r12d
movsxd rcx, edx
lea eax, [rdx - 0x53]
xor byte [rsp + rcx + 0x160], al
inc edx
cmp edx, 0x17
jb 0x140039e91
mov byte [rsp + 0x177], r12b
xorps xmm0, xmm0
movups xmmword [rsp + 0x180], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x190], xmm1
lea rax, [rsp + 0x160]
mov r8, rsi
inc r8
cmp byte [rax + r8], r12b
jne 0x140039ecf
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x180]
call fcn.140003238
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], r13
cmova rdx, qword [rsp + 0x180]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [r15 + 0x60], rax
mov rdx, qword [rsp + 0x198]
cmp rdx, r13
jbe 0x140039f54
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, r14
jb 0x140039f4f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003a491
call fcn.140077818
test rbx, rbx
je 0x14003a497
movdqa xmm0, xmmword [0x1400a73f0]
movdqu xmmword [rsp + 0x160], xmm0
mov edx, r12d
movsxd rcx, edx
lea eax, [rdx - 0x53]
xor byte [rsp + rcx + 0x160], al
inc edx
cmp edx, r13d
jb 0x140039f71
mov byte [rsp + 0x16f], r12b
xorps xmm0, xmm0
movups xmmword [rsp + 0x180], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x190], xmm1
lea rax, [rsp + 0x160]
mov r8, rsi
inc r8
cmp byte [rax + r8], r12b
jne 0x140039faf
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x180]
call fcn.140003238
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], r13
cmova rdx, qword [rsp + 0x180]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [r15 + 0x70], rax
mov rdx, qword [rsp + 0x198]
cmp rdx, r13
jbe 0x14003a034
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, r14
jb 0x14003a02f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003a4b8
call fcn.140077818
test rbx, rbx
je 0x14003a4be
mov dword [rsp + 0x1b0], 0xd1d9caec
mov dword [rsp + 0x1b4], 0x8680dbc1
mov dword [rsp + 0x1b8], 0xd4dbd29b
xor eax, eax
mov byte [rsp + 0x1bc], al
mov edx, r12d
movsxd rcx, edx
lea eax, [rdx - 0x53]
xor byte [rsp + rcx + 0x1b0], al
inc edx
cmp edx, 0xc
jb 0x14003a06a
mov byte [rsp + 0x1bc], r12b
lea rcx, [rsp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x14003a0b6
lea rcx, [rsp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x14003a4df
movdqa xmm0, xmmword [0x1400a7430]
movdqu xmmword [rsp + 0x160], xmm0
xor eax, eax
mov byte [rsp + 0x170], al
mov edx, r12d
movsxd rcx, edx
lea eax, [rdx - 0x53]
xor byte [rsp + rcx + 0x160], al
inc edx
cmp edx, 0x10
jb 0x14003a0d3
mov byte [rsp + 0x170], r12b
xorps xmm0, xmm0
movups xmmword [rsp + 0x180], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x190], xmm1
lea rax, [rsp + 0x160]
mov r8, rsi
inc r8
cmp byte [rax + r8], r12b
jne 0x14003a111
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x180]
call fcn.140003238
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], r13
cmova rdx, qword [rsp + 0x180]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15 + 0x78], rax
mov rdx, qword [rsp + 0x198]
cmp rdx, r13
jbe 0x14003a196
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, r14
jb 0x14003a191
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003a500
call fcn.140077818
test rdi, rdi
je 0x14003a506
lea rdx, str.AdjustTokenPrivileges
lea rcx, [rsp + 0x160]
call fcn.1400335c8
mov edx, r12d
movsxd rcx, edx
lea eax, [rdx - 0x53]
xor byte [rsp + rcx + 0x160], al
inc edx
cmp edx, 0x15
jb 0x14003a1b6
mov byte [rsp + 0x175], r12b
xorps xmm0, xmm0
movups xmmword [rsp + 0x180], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x190], xmm1
lea rax, [rsp + 0x160]
mov r8, rsi
inc r8
cmp byte [rax + r8], r12b
jne 0x14003a1f4
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x180]
call fcn.140003238
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], r13
cmova rdx, qword [rsp + 0x180]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15 + 0x88], rax
mov rdx, qword [rsp + 0x198]
cmp rdx, r13
jbe 0x14003a27c
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, r14
jb 0x14003a277
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003a527
call fcn.140077818
test rdi, rdi
je 0x14003a52d
lea rdx, str.LookupPrivilegeValueW
lea rcx, [rsp + 0x160]
call fcn.1400335c8
mov edx, r12d
movsxd rcx, edx
lea eax, [rdx - 0x53]
xor byte [rsp + rcx + 0x160], al
inc edx
cmp edx, 0x15
jb 0x14003a29c
mov byte [rsp + 0x175], r12b
xorps xmm0, xmm0
movups xmmword [rsp + 0x180], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x190], xmm1
lea rax, [rsp + 0x160]
inc rsi
cmp byte [rax + rsi], r12b
jne 0x14003a2d7
mov r8, rsi
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x180]
call fcn.140003238
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], r13
cmova rdx, qword [rsp + 0x180]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [r15 + 0x80], rax
mov rdx, qword [rsp + 0x198]
cmp rdx, r13
jbe 0x14003a362
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, r14
jb 0x14003a35d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003a54e
call fcn.140077818
test rbx, rbx
je 0x14003a554
mov al, 1
jmp 0x14003a371
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.140077c90
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rcx, [rsp + 0x28]
call fcn.140033be4
lea rdx, [0x1400d3778]
lea rcx, [rsp + 0x28]
call fcn.140078bf0
call fcn.14007e634
int3
lea rcx, [rsp + 0x40]
call fcn.140033be4
lea rdx, [0x1400d3778]
lea rcx, [rsp + 0x40]
call fcn.140078bf0
call fcn.14007e634
int3
lea rcx, [rsp + 0x58]
call fcn.140033be4
lea rdx, [0x1400d3778]
lea rcx, [rsp + 0x58]
call fcn.140078bf0
call fcn.14007e634
int3
lea rcx, [rsp + 0x70]
call fcn.140033be4
lea rdx, [0x1400d3778]
lea rcx, [rsp + 0x70]
call fcn.140078bf0
call fcn.14007e634
int3
lea rcx, [rsp + 0x88]
call fcn.140033be4
lea rdx, [0x1400d3778]
lea rcx, [rsp + 0x88]
call fcn.140078bf0
call fcn.14007e634
int3
lea rcx, [rsp + 0xa0]
call fcn.140033be4
lea rdx, [0x1400d3778]
lea rcx, [rsp + 0xa0]
call fcn.140078bf0
call fcn.14007e634
int3
lea rcx, [rsp + 0xb8]
call fcn.140033be4
lea rdx, [0x1400d3778]
lea rcx, [rsp + 0xb8]
call fcn.140078bf0
call fcn.14007e634
int3
lea rcx, [rsp + 0xd0]
call fcn.140033be4
lea rdx, [0x1400d3778]
lea rcx, [rsp + 0xd0]
call fcn.140078bf0
call fcn.14007e634
int3
lea rcx, [rsp + 0xe8]
call fcn.140033be4
lea rdx, [0x1400d3778]
lea rcx, [rsp + 0xe8]
call fcn.140078bf0
lea rcx, [rsp + 0x100]
call fcn.140033be4
lea rdx, [0x1400d3778]
lea rcx, [rsp + 0x100]
call fcn.140078bf0
call fcn.14007e634
int3
lea rcx, [rsp + 0x118]
call fcn.140033be4
lea rdx, [0x1400d3778]
lea rcx, [rsp + 0x118]
call fcn.140078bf0
call fcn.14007e634
int3
lea rcx, [rsp + 0x130]
call fcn.140033be4
lea rdx, [0x1400d3778]
lea rcx, [rsp + 0x130]
call fcn.140078bf0
call fcn.14007e634
int3
lea rcx, [rsp + 0x148]
call fcn.140033be4
lea rdx, [0x1400d3778]
lea rcx, [rsp + 0x148]
call fcn.140078bf0
int3