Function at 0x4022d0
Capabilities:
Acquire debug privileges
Contain obfuscated stackstrings
Encode data using xor
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x870
mov edi, dword [ebp + 0xc]
mov eax, dword [0x459444]
xor eax, ebp
mov dword [esp + 0x868], eax
lea ebx, [esp + 0x30]
push 0x800
push 0
push ebx
call fcn.00425e40
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea esi, [esp + 0x2c]
push esi
push 0x28
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4023b9
mov dword [esp + 0x840], 0x446110
mov dword [esp + 0x844], esi
lea eax, [esp + 0x840]
mov dword [esp + 0x864], eax
lea eax, [esp + 0x24]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x40254c
mov dword [esp + 0x830], 1
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x838], ecx
mov dword [esp + 0x834], eax
mov dword [esp + 0x83c], 2
lea eax, [esp + 0x830]
push 0
push 0
push 0x10
push eax
push 0
push dword [esp + 0x40]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x402560
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LoadDebugPrivilege:_AdjustTokenPrivileges_failed__x
jmp 0x402558
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LoadDebugPrivilege:_OpenProcessToken_failed__x
call fcn.00401a40
add esp, 8
cmp edi, 2
jle 0x4025b7
push 0x400
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4025cf
push 0x5c
push ebx
call fcn.00425fa0
add esp, 8
test eax, eax
je 0x4025e6
mov edi, dword [ebp + 8]
mov ecx, eax
add ecx, 2
mov word [eax + 2], 0
push dword [edi]
push ecx
call fcn.00433602
sub esp, 0x14
movaps xmm0, xmmword [0x446130]
movups xmmword [esp + 4], xmm0
mov dword [esp], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x402468
lea ecx, [esp + 0x30]
push 0
push 0x3ff
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
add eax, 0xffffffff
xor ecx, ecx
cmp eax, 0x3ff
setb cl
lea ebx, [esp + ecx*8]
add ebx, 0x30
lea esi, [esp + 0x840]
push ebx
push esi
call fcn.004068b0
add esp, 8
push esi
call fcn.00408e00
add esp, 4
mov esi, dword [esp + 0x854]
cmp esi, 0x10
jb 0x4024cc
mov byte [esp + 8], al
mov ecx, dword [esp + 0x840]
lea eax, [esi + 1]
cmp eax, 0x1000
jb 0x4024bb
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x402d7c
add esi, 0x24
mov eax, esi
mov ecx, edx
push eax
push ecx
call fcn.0040ad91
add esp, 8
mov edi, dword [ebp + 8]
mov al, byte [esp + 8]
mov dword [esp + 8], ebx
mov ebx, 0x56
test al, al
je 0x402d32
mov ebx, dword [edi + 4]
mov dword [esp + 0x840], 0
mov dword [esp + 0x850], 0
mov dword [esp + 0x854], 7
mov word [esp + 0x840], 0
push ebx
call fcn.00433624
add esp, 4
mov esi, eax
cmp eax, 7
jbe 0x402604
sub esp, 0xc
mov al, byte [esp + 0x83c]
mov byte [esp + 4], al
mov dword [esp + 8], ebx
mov dword [esp], esi
lea ecx, [esp + 0x84c]
call fcn.00401ff0
lea edi, [esp + 0x840]
jmp 0x40262b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LoadDebugPrivilege:_LookupPrivilegeValue_failed__x
call fcn.00401a40
add esp, 8
mov esi, dword [esp + 0x864]
test esi, esi
je 0x4025ab
mov eax, dword [esi]
mov edi, dword [eax + 8]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
call edi
lea eax, [esp + 0x840]
mov esi, dword [esp + 0x864]
test esi, esi
je 0x4025ab
xor ebx, ebx
cmp esi, eax
setne bl
mov eax, dword [esi]
mov edi, dword [eax + 0x10]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push ebx
lea ebx, [esp + 0x34]
call edi
mov edi, dword [ebp + 0xc]
cmp edi, 2
jg 0x4023d6
push edi
push str.Missing_argument_s__for_inject__required_3__supplied__d
call fcn.00401a40
add esp, 8
mov ebx, pe_nt_image_headers32
jmp 0x402d32
push str.InjectHook:_GetModuleFileNameW_failed
call fcn.00401a40
add esp, 4
mov ebx, 0x79
jmp 0x402d32
lea eax, [esp + 0x30]
push eax
push 0
push str.InjectHook:_wcsrchr_failed:__p___ls_
call fcn.00401a40
add esp, 0xc
mov ebx, 0x7a
jmp 0x402d32
mov dword [esp + 0x850], esi
mov eax, esi
add eax, esi
push eax
push ebx
lea edi, [esp + 0x848]
push edi
call fcn.004258c0
add esp, 0xc
mov word [esp + esi*2 + 0x840], 0
call fcn.0042d1f4
mov esi, eax
cmp dword [esp + 0x854], 8
jb 0x402643
mov edi, dword [esp + 0x840]
mov dword [esi], 0
lea eax, [esp + 0x830]
push 0xa
push eax
push edi
call fcn.00432777
add esp, 0xc
cmp edi, dword [esp + 0x830]
je 0x402d54
mov dword [esp + 4], edx
cmp dword [esi], 0x22
je 0x402d5e
mov ebx, eax
mov ecx, dword [esp + 0x854]
cmp ecx, 8
mov esi, dword [ebp + 8]
jb 0x4026c0
mov eax, dword [esp + 0x840]
lea edx, [ecx + ecx]
add edx, 2
cmp edx, 0x1000
jb 0x4026b6
mov edx, eax
add edx, 0xfffffffc
mov eax, dword [eax - 4]
sub edx, eax
cmp edx, 0x20
jae 0x402d7c
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.0040ad91
add esp, 8
mov edi, dword [esi + 8]
mov dword [esp + 0x840], 0
mov dword [esp + 0x850], 0
mov dword [esp + 0x854], 7
mov word [esp + 0x840], 0
push edi
call fcn.00433624
add esp, 4
mov esi, eax
cmp eax, 7
jbe 0x402721
sub esp, 0xc
mov al, byte [esp + 0x83c]
mov byte [esp + 4], al
mov dword [esp + 8], edi
mov dword [esp], esi
lea ecx, [esp + 0x84c]
call fcn.00401ff0
jmp 0x402748
mov dword [esp + 0x850], esi
mov eax, esi
add eax, esi
lea ecx, [esp + 0x840]
push eax
push edi
push ecx
call fcn.004258c0
add esp, 0xc
mov word [esp + esi*2 + 0x840], 0
call fcn.0042d1f4
mov esi, eax
cmp dword [esp + 0x854], 8
jb 0x402762
mov edi, dword [esp + 0x840]
jmp 0x402769
lea edi, [esp + 0x840]
mov dword [esi], 0
push 0xa
lea eax, [esp + 0x834]
push eax
push edi
call fcn.00432731
add esp, 0xc
mov dword [esp + 0xc], eax
cmp edi, dword [esp + 0x830]
je 0x402d68
cmp dword [esi], 0x22
je 0x402d72
mov ecx, dword [esp + 0x854]
cmp ecx, 8
jb 0x4027e1
mov eax, dword [esp + 0x840]
lea edx, [ecx + ecx]
add edx, 2
cmp edx, 0x1000
jb 0x4027d7
mov edx, eax
add edx, 0xfffffffc
mov eax, dword [eax - 4]
sub edx, eax
cmp edx, 0x20
jae 0x402d7c
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.0040ad91
add esp, 8
or ebx, dword [esp + 4]
jne 0x402c7e
push str.KERNEL32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [esp + 4], eax
mov dword [esp + 0x848], 0x7e7c62
mov dword [esp + 0x844], 0x6b6d7251
mov dword [esp + 0x840], 0x636a7848
mov dword [esp + 0x834], 0xc82efdf7
mov dword [esp + 0x830], 0x8201df87
lea ecx, [esp + 0x841]
xor esi, esi
mov al, 0x48
xor ebx, ebx
nop
mov edx, ebx
shr edx, 0x1f
add edx, ebx
sar edx, 1
movzx edx, byte [esp + edx + 0x830]
mov ah, dl
and ah, 0xf
shr dl, 4
test bl, 1
movzx edi, ah
movzx edx, dl
cmove edx, edi
xor dl, al
add ebx, 1
cmp ebx, 0x10
cmove ebx, esi
mov byte [ecx - 1], dl
movzx eax, byte [ecx]
add ecx, 1
test al, al
jne 0x402840
lea eax, [esp + 0x840]
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x402c25
mov ecx, eax
call dword [section..00cfg]
push dword [esp + 0xc]
push 0
push 0x1fffff
call ecx
test eax, eax
je 0x402c32
mov esi, eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x402d4a
mov dword [esp + 0x20], esi
push str.KERNEL32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [esp + 4], eax
mov byte [esp + 0x84c], 0
mov dword [esp + 0x848], 0x58737e6c
mov dword [esp + 0x844], 0x7d6a6847
mov dword [esp + 0x840], 0x66616e44
mov dword [esp + 0x834], 0x350bfacd
mov dword [esp + 0x830], 0xf81b2018
lea eax, [esp + 0x841]
xor esi, esi
mov bl, 0x44
xor edx, edx
nop word cs:[eax + eax]
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sar ecx, 1
movzx ecx, byte [esp + ecx + 0x830]
mov ch, cl
and ch, 0xf
shr cl, 4
test dl, 1
movzx edi, ch
movzx ecx, cl
cmove ecx, edi
xor cl, bl
add edx, 1
cmp edx, 0x10
cmove edx, esi
mov byte [eax - 1], cl
movzx ebx, byte [eax]
add eax, 1
test bl, bl
jne 0x402930
lea eax, [esp + 0x840]
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x1c], eax
mov word [esp + 0x84c], 0x7b
mov dword [esp + 0x848], 0x4064667a
mov dword [esp + 0x844], 0x4867617d
mov dword [esp + 0x840], 0x7b7d685a
mov dword [esp + 0x834], 0x57135138
mov dword [esp + 0x830], 0xeb08ff1c
lea eax, [esp + 0x841]
xor esi, esi
mov bl, 0x5a
xor edx, edx
nop word cs:[eax + eax]
nop dword [eax + eax]
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sar ecx, 1
movzx ecx, byte [esp + ecx + 0x830]
mov ch, cl
and ch, 0xf
shr cl, 4
test dl, 1
movzx edi, ch
movzx ecx, cl
cmove ecx, edi
xor cl, bl
add edx, 1
cmp edx, 0x10
cmove edx, esi
mov byte [eax - 1], cl
movzx ebx, byte [eax]
add eax, 1
test bl, bl
jne 0x4029e0
lea eax, [esp + 0x840]
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x18], eax
mov dword [esp + 0x84b], 0x744369
mov dword [esp + 0x848], 0x69686765
mov dword [esp + 0x844], 0x4b606c72
mov dword [esp + 0x840], 0x777e605d
mov dword [esp + 0x834], 0xadc6a7b9
mov dword [esp + 0x830], 0xacd73c9b
lea eax, [esp + 0x841]
xor esi, esi
mov bl, 0x5d
xor edx, edx
nop word cs:[eax + eax]
nop dword [eax]
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sar ecx, 1
movzx ecx, byte [esp + ecx + 0x830]
mov ch, cl
and ch, 0xf
shr cl, 4
test dl, 1
movzx edi, ch
movzx ecx, cl
cmove ecx, edi
xor cl, bl
add edx, 1
cmp edx, 0x10
cmove edx, esi
mov byte [eax - 1], cl
movzx ebx, byte [eax]
add eax, 1
test bl, bl
jne 0x402a90
lea eax, [esp + 0x840]
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x14], eax
movups xmm0, xmmword [str.Rqbr_TcnorBnlgwz]
movaps xmmword [esp + 0x840], xmm0
mov dword [esp + 0x84f], 0x7a7767
mov dword [esp + 0x834], 0x81bf81ad
mov dword [esp + 0x830], 0xc9456b35
lea eax, [esp + 0x841]
xor esi, esi
mov bl, 0x52
xor edx, edx
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sar ecx, 1
movzx ecx, byte [esp + ecx + 0x830]
mov ch, cl
and ch, 0xf
shr cl, 4
test dl, 1
movzx edi, ch
movzx ecx, cl
cmove ecx, edi
xor cl, bl
add edx, 1
cmp edx, 0x10
cmove edx, esi
mov byte [eax - 1], cl
movzx ebx, byte [eax]
add eax, 1
test bl, bl
jne 0x402b20
lea eax, [esp + 0x840]
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x10], eax
movups xmm0, xmmword [str.Emod_cefubWkbgk]
movaps xmmword [esp + 0x840], xmm0
mov dword [esp + 0x84f], 0x6b6762
mov dword [esp + 0x834], 0x7c337198
mov dword [esp + 0x830], 0x6918e8f6
lea eax, [esp + 0x841]
xor esi, esi
mov bl, 0x45
xor edx, edx
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sar ecx, 1
movzx ecx, byte [esp + ecx + 0x830]
mov ch, cl
and ch, 0xf
shr cl, 4
test dl, 1
movzx edi, ch
movzx ecx, cl
cmove ecx, edi
xor cl, bl
add edx, 1
cmp edx, 0x10
cmove edx, esi
mov byte [eax - 1], cl
movzx ebx, byte [eax]
add eax, 1
test bl, bl
jne 0x402bb0
lea eax, [esp + 0x840]
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push eax
push dword [esp + 0x1c]
mov esi, dword [esp + 0x38]
push esi
call fcn.00403d30
add esp, 0x1c
mov ebx, eax
jmp 0x402c55
push str.SafeOpenProcess_failed_to_load_open_process
call fcn.00401a40
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push eax
push str.DeobfuscateInjectLibraryNormal:_SafeOpenProcess_failed__x
call fcn.00401a40
add esp, 8
xor ebx, ebx
cmp esi, 5
sete bl
xor ebx, 0x65
xor esi, esi
lea eax, [esi + 1]
cmp eax, 2
jb 0x402c64
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx - 0x65]
cmp eax, 7
ja 0x402d32
mov ecx, 0xa9
bt ecx, eax
jae 0x402d32
push str.USER32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [esp + 4], eax
movups xmm0, xmmword [str._bsfbkmwuKfmfOvI]
movaps xmmword [esp + 0x840], xmm0
mov word [esp + 0x850], 0x49
mov dword [esp + 0x834], 0xead29360
mov dword [esp + 0x830], 0x2fcf9778
lea ecx, [esp + 0x841]
xor esi, esi
mov al, 0x5b
xor ebx, ebx
nop dword [eax]
mov edx, ebx
shr edx, 0x1f
add edx, ebx
sar edx, 1
movzx edx, byte [esp + edx + 0x830]
mov ah, dl
and ah, 0xf
shr dl, 4
test bl, 1
movzx edi, ah
movzx edx, dl
cmove edx, edi
xor dl, al
add ebx, 1
cmp ebx, 0x10
cmove ebx, esi
mov byte [ecx - 1], dl
movzx eax, byte [ecx]
add ecx, 1
test al, al
jne 0x402cd0
lea eax, [esp + 0x840]
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
push dword [esp + 0xc]
push dword [esp + 0x14]
call fcn.00404110
add esp, 0xc
mov ebx, eax
mov ecx, dword [esp + 0x868]
xor ecx, ebp
call fcn.0040adc8
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, 0x66
jmp 0x402c55
push str.invalid_stoull_argument
call fcn.0040fb10
push str.stoull_argument_out_of_range
call fcn.0040fb50
push str.invalid_stoul_argument
call fcn.0040fb10
push str.stoul_argument_out_of_range
call fcn.0040fb50
call fcn.0042d843
int3