Function at 0x14000d2c0
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x190
mov qword [rsp + 0x120], 0xfffffffffffffffe
mov rax, qword [0x14005f020]
xor rax, rsp
mov qword [rsp + 0x188], rax
xor edx, edx
mov r8d, 0x84
lea rcx, [rsp + 0x54]
call fcn.140031700
xor eax, eax
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x118], rax
xor ebx, ebx
mov qword [rsp + 0xe0], rbx
mov qword [rsp + 0xd8], rbx
mov qword [rsp + 0xe8], rbx
mov qword [rsp + 0x100], 0xffffffffffffffff
mov dword [rsp + 0x50], 0xccaa9a9a
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0xf8], rax
lea rcx, str.kernelbase.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0xf0], rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0xd8], rax
test rax, rax
je 0x14000daba
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0xe0], rax
test rax, rax
jne 0x14000d3b3
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
jmp 0x14000daba
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0xe8], rax
test rax, rax
jne 0x14000d3f0
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
jmp 0x14000daba
lea rdx, str.GetNativeSystemInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0xc8]
test rax, rax
cmovne rcx, rax
mov qword [rsp + 0xc8], rcx
test rcx, rcx
jne 0x14000d448
lea rdx, str.GetSystemInfo
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0xc8]
test rax, rax
cmovne rcx, rax
mov qword [rsp + 0xc8], rcx
lea rdx, str.QueryFullProcessImageNameW
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0xd0]
test rax, rax
cmovne rcx, rax
lea rax, [fcn.14000c750]
test rcx, rcx
cmove rcx, rax
mov qword [rsp + 0xd0], rcx
lea rdx, str.NtQuerySystemInformation
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x58]
test rax, rax
cmovne rcx, rax
mov qword [rsp + 0x58], rcx
lea rdx, str.NtQueryInformationProcess
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x78]
test rax, rax
cmovne rcx, rax
mov qword [rsp + 0x78], rcx
lea rdx, str.NtQueryVirtualMemory
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x80]
test rax, rax
cmovne rcx, rax
mov qword [rsp + 0x80], rcx
lea rdx, str.NtReadVirtualMemory
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x88]
test rax, rax
cmovne rcx, rax
mov qword [rsp + 0x88], rcx
lea rdx, str.NtOpenProcess
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x110]
test rax, rax
cmovne rcx, rax
mov qword [rsp + 0x110], rcx
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], rbx
lea rdx, str.RtlInitUnicodeString
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0xa8]
test rax, rax
cmovne rcx, rax
mov qword [rsp + 0xa8], rcx
lea rdx, str.ZwOpenDirectoryObject
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0xb0]
test rax, rax
cmovne rcx, rax
mov qword [rsp + 0xb0], rcx
lea rdx, str.ZwQueryDirectoryObject
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0xb8]
test rax, rax
cmovne rcx, rax
mov qword [rsp + 0xb8], rcx
lea rdx, str.ZwClose
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0xc0]
test rax, rax
cmovne rcx, rax
mov qword [rsp + 0xc0], rcx
lea rdx, str.LookupPrivilegeValueW
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x60]
test rax, rax
cmovne rcx, rax
mov qword [rsp + 0x60], rcx
lea rdx, str.AdjustTokenPrivileges
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x68]
test rax, rax
cmovne rcx, rax
mov qword [rsp + 0x68], rcx
lea rdx, str.OpenProcessToken
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x70]
test rax, rax
cmovne rcx, rax
mov qword [rsp + 0x70], rcx
cmp qword [rsp + 0x58], 0
je 0x14000da98
cmp qword [rsp + 0x78], 0
je 0x14000da98
cmp qword [rsp + 0x80], 0
je 0x14000da98
cmp qword [rsp + 0x88], 0
je 0x14000da98
cmp qword [rsp + 0xc8], 0
je 0x14000da98
cmp qword [rsp + 0xa8], 0
je 0x14000da98
cmp qword [rsp + 0xb0], 0
je 0x14000da98
cmp qword [rsp + 0xb8], 0
je 0x14000da98
cmp qword [rsp + 0xc0], 0
je 0x14000da98
cmp qword [rsp + 0x60], 0
je 0x14000da98
cmp qword [rsp + 0x68], 0
je 0x14000da98
test rcx, rcx
je 0x14000da98
cmp qword [rsp + 0xd0], 0
je 0x14000da98
cmp qword [rsp + 0x110], 0
je 0x14000da98
mov ecx, 0x61
mov word [rsp + 0x168], cx
mov word [rsp + 0x16a], cx
mov eax, 0x33
mov word [rsp + 0x16c], ax
mov word [rsp + 0x16e], cx
mov eax, 0x7d
mov word [rsp + 0x170], ax
mov eax, 0x6d
mov word [rsp + 0x172], ax
mov eax, 0x7a
mov word [rsp + 0x174], ax
mov eax, 0x73
mov word [rsp + 0x176], ax
mov eax, 0x79
mov word [rsp + 0x178], ax
mov eax, 0x6a
mov word [rsp + 0x17a], ax
mov eax, 0x77
mov word [rsp + 0x17c], ax
mov eax, 0x36
mov word [rsp + 0x17e], ax
mov word [rsp + 0x180], bx
movzx eax, word [rsp + 0x168]
mov rax, rbx
movzx edx, word [rsp + rax*2 + 0x168]
sub edx, 5
mov word [rsp + rax*2 + 0x168], dx
inc rax
cmp rax, 0xc
jb 0x14000d7f1
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, [rsp + 0x168]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x40], rax
cmp rax, 0xffffffffffffffff
je 0x14000d863
mov rcx, rax
call fcn.14000fea0
test eax, eax
je 0x14000d858
mov rax, qword [rsp + 0x40]
jmp 0x14000d957
mov rcx, qword [rsp + 0x40]
call qword [0x1400472c0]
mov byte [rsp + 0x158], 0x67
mov byte [rsp + 0x159], 0x67
mov byte [rsp + 0x15a], 0x39
mov byte [rsp + 0x15b], 0x67
mov byte [rsp + 0x15c], 0x83
mov byte [rsp + 0x15d], 0x73
mov byte [rsp + 0x15e], pe_nt_image_headers64
mov byte [rsp + 0x15f], 0x79
mov byte [rsp + 0x160], 0x7f
mov byte [rsp + 0x161], 0x70
mov byte [rsp + 0x162], 0x7d
mov byte [rsp + 0x163], 0x3c
mov byte [rsp + 0x164], 0
movzx eax, byte [rsp + 0x158]
mov r8, rbx
nop word [rax + rax]
movsx ecx, byte [rsp + r8 + 0x158]
sub ecx, 0xb
mov byte [rsp + r8 + 0x158], cl
inc r8
cmp r8, 0xc
jb 0x14000d8e0
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, [rsp + 0x158]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x40], rax
cmp rax, 0xffffffffffffffff
je 0x14000d950
mov rcx, rax
call fcn.14000fea0
test eax, eax
je 0x14000d945
mov rax, qword [rsp + 0x40]
jmp 0x14000d957
mov rcx, qword [rsp + 0x40]
call qword [0x1400472c0]
mov rax, 0xffffffffffffffff
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x20], rbx
mov r9d, 4
lea r8, [rsp + 0x108]
lea edx, [r9 + 0x16]
mov rcx, 0xffffffffffffffff
call qword [rsp + 0x78]
mov edx, dword [rsp + 0x108]
test eax, eax
cmovs edx, ebx
mov dword [rsp + 0x108], edx
lea rdx, str.IsWow64Process2
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000d9c9
lea r8, [rsp + 0x118]
lea rdx, [rsp + 0x11a]
mov rcx, 0xffffffffffffffff
call rax
jmp 0x14000d9d4
mov dword [rsp + 0x118], 0x86648664
lea rcx, [rsp + 0x128]
call qword [rsp + 0xc8]
mov eax, 1
cmp word [rsp + 0x128], 0
cmove eax, ebx
mov dword [rsp + 0x10c], eax
call fcn.14000bd80
test eax, eax
setne bl
mov dword [rsp + 0x11c], ebx
mov ecx, 0xd0
call fcn.14002fd10
lea rcx, [rsp + 0x50]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rdx, [rax + 0x80]
movups xmm0, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x10], xmm0
movups xmm1, xmmword [rcx + 0x80]
movups xmmword [rdx], xmm1
movups xmm0, xmmword [rcx + 0x90]
movups xmmword [rdx + 0x10], xmm0
movups xmm1, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x20], xmm1
movups xmm0, xmmword [rcx + 0xb0]
movups xmmword [rdx + 0x30], xmm0
movups xmm1, xmmword [rcx + 0xc0]
movups xmmword [rdx + 0x40], xmm1
jmp 0x14000daba
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
jmp 0x14000daba
mov rcx, qword [rsp + 0x188]
xor rcx, rsp
call fcn.14002fb30
add rsp, 0x190
pop rbx
ret