Function at 0x140036604
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Link many functions at runtime

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1c0
mov rax, qword [0x1400d9448]
xor rax, rsp
mov qword [rsp + 0x1b8], rax
mov r14, rcx
mov dword [r11 - 0x50], 0x4a51476a
mov dword [r11 - 0x4c], 0x1a144a40
mov dword [r11 - 0x48], 0x40474e07
xor eax, eax
mov byte [r11 - 0x44], al
xor r15d, r15d
mov edx, r15d
movsxd rcx, edx
lea eax, [rdx + 0x21]
xor byte [rsp + rcx + 0x198], al
inc edx
cmp edx, 0xc
jb 0x140036658
mov byte [rsp + 0x1a4], r15b
lea rcx, [rsp + 0x198]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
jne 0x1400366a4
lea rcx, [rsp + 0x198]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x1400370b8
mov dword [rsp + 0x158], 0x4a46526e
mov dword [rsp + 0x15c], 0x4b485475
mov dword [rsp + 0x160], 0x58594c
mov edx, r15d
movsxd rcx, edx
lea eax, [rdx + 0x21]
xor byte [rsp + rcx + 0x158], al
inc edx
cmp edx, 0xb
jb 0x1400366c8
mov byte [rsp + 0x163], r15b
mov qword [rsp + 0x178], r15
mov qword [rsp + 0x188], r15
mov r13d, reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rsp + 0x190], r13
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x178]
call fcn.140021b50
lea rdx, [rsp + 0x178]
lea r12d, [r13 + 1]
cmp qword [rsp + 0x190], r12
cmovae rdx, qword [rsp + 0x178]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [r14], rax
mov rdx, qword [rsp + 0x190]
mov esi, 0x1000
cmp rdx, r12
jb 0x140036786
inc rdx
mov rcx, qword [rsp + 0x178]
mov rax, rcx
cmp rdx, rsi
jb 0x140036781
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400370d3
call fcn.1400716ac
test rbx, rbx
je 0x1400370d9
lea rdx, str.CreateToolhelp32Snapshot
lea rcx, [rsp + 0x158]
call fcn.140030c70
mov edx, r15d
movsxd rcx, edx
lea eax, [rdx + 0x21]
xor byte [rsp + rcx + 0x158], al
inc edx
cmp edx, 0x18
jb 0x1400367a6
mov byte [rsp + 0x170], r15b
mov qword [rsp + 0x178], r15
mov qword [rsp + 0x188], r15
mov qword [rsp + 0x190], r13
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x178]
call fcn.140021b50
lea rdx, [rsp + 0x178]
cmp qword [rsp + 0x190], r12
cmovae rdx, qword [rsp + 0x178]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [r14 + 0x38], rax
mov rdx, qword [rsp + 0x190]
cmp rdx, r12
jb 0x140036856
inc rdx
mov rcx, qword [rsp + 0x178]
mov rax, rcx
cmp rdx, rsi
jb 0x140036851
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400370f4
call fcn.1400716ac
test rbx, rbx
je 0x1400370fa
movdqa xmm0, xmmword [str.qPLG_UTeelBZx]
movdqu xmmword [rsp + 0x158], xmm0
mov edx, r15d
movsxd rcx, edx
lea eax, [rdx + 0x21]
xor byte [rsp + rcx + 0x158], al
inc edx
cmp edx, r13d
jb 0x140036873
mov byte [rsp + 0x167], r15b
mov qword [rsp + 0x178], r15
mov qword [rsp + 0x188], r15
mov qword [rsp + 0x190], r13
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x178]
call fcn.140021b50
lea rdx, [rsp + 0x178]
cmp qword [rsp + 0x190], r12
cmovae rdx, qword [rsp + 0x178]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [r14 + 0x40], rax
mov rdx, qword [rsp + 0x190]
cmp rdx, r12
jb 0x140036923
inc rdx
mov rcx, qword [rsp + 0x178]
mov rax, rcx
cmp rdx, rsi
jb 0x14003691e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037115
call fcn.1400716ac
test rbx, rbx
je 0x14003711b
mov dword [rsp + 0x158], 0x474c5071
mov dword [rsp + 0x15c], 0x1b545540
mov dword [rsp + 0x160], 0x544e641b
mov word [rsp + 0x164], 0x7959
xor eax, eax
mov byte [rsp + 0x166], al
mov edx, r15d
movsxd rcx, edx
lea eax, [rdx + 0x21]
xor byte [rsp + rcx + 0x158], al
inc edx
cmp edx, 0xe
jb 0x140036963
mov byte [rsp + 0x166], r15b
mov qword [rsp + 0x178], r15
mov qword [rsp + 0x188], r15
mov qword [rsp + 0x190], r13
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x178]
call fcn.140021b50
lea rdx, [rsp + 0x178]
cmp qword [rsp + 0x190], r12
cmovae rdx, qword [rsp + 0x178]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [r14 + 0x48], rax
mov rdx, qword [rsp + 0x190]
cmp rdx, r12
jb 0x140036a13
inc rdx
mov rcx, qword [rsp + 0x178]
mov rax, rcx
cmp rdx, rsi
jb 0x140036a0e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037136
call fcn.1400716ac
test rbx, rbx
je 0x14003713c
mov dword [rsp + 0x158], 0x51474d6c
mov dword [rsp + 0x15c], 0x1a144349
mov dword [rsp + 0x160], 0x5f59436f
mov word [rsp + 0x164], 0x7959
xor eax, eax
mov byte [rsp + 0x166], al
mov edx, r15d
movsxd rcx, edx
lea eax, [rdx + 0x21]
xor byte [rsp + rcx + 0x158], al
inc edx
cmp edx, 0xe
jb 0x140036a53
mov byte [rsp + 0x166], r15b
mov qword [rsp + 0x178], r15
mov qword [rsp + 0x188], r15
mov qword [rsp + 0x190], r13
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x178]
call fcn.140021b50
lea rdx, [rsp + 0x178]
cmp qword [rsp + 0x190], r12
cmovae rdx, qword [rsp + 0x178]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [r14 + 0x50], rax
mov rdx, qword [rsp + 0x190]
cmp rdx, r12
jb 0x140036b03
inc rdx
mov rcx, qword [rsp + 0x178]
mov rax, rcx
cmp rdx, rsi
jb 0x140036afe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003715d
call fcn.1400716ac
test rbx, rbx
je 0x140037163
mov dword [rsp + 0x158], 0x51474d6c
mov dword [rsp + 0x15c], 0x1a144349
mov dword [rsp + 0x160], 0x58534f67
mov word [rsp + 0x164], 0x7a
mov edx, r15d
movsxd rcx, edx
lea eax, [rdx + 0x21]
xor byte [rsp + rcx + 0x158], al
inc edx
cmp edx, 0xd
jb 0x140036b3a
mov byte [rsp + 0x165], r15b
mov qword [rsp + 0x178], r15
mov qword [rsp + 0x188], r15
mov qword [rsp + 0x190], r13
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x178]
call fcn.140021b50
lea rdx, [rsp + 0x178]
cmp qword [rsp + 0x190], r12
cmovae rdx, qword [rsp + 0x178]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [r14 + 0x58], rax
mov rdx, qword [rsp + 0x190]
cmp rdx, r12
jb 0x140036bea
inc rdx
mov rcx, qword [rsp + 0x178]
mov rax, rcx
cmp rdx, rsi
jb 0x140036be5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037184
call fcn.1400716ac
test rbx, rbx
je 0x14003718a
lea rdx, str.K32GetProcessMemoryInfo
lea rcx, [rsp + 0x158]
call fcn.140030d38
mov edx, r15d
movsxd rcx, edx
lea eax, [rdx + 0x21]
xor byte [rsp + rcx + 0x158], al
inc edx
cmp edx, 0x17
jb 0x140036c0a
mov byte [rsp + 0x16f], r15b
mov qword [rsp + 0x178], r15
mov qword [rsp + 0x188], r15
mov qword [rsp + 0x190], r13
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x178]
call fcn.140021b50
lea rdx, [rsp + 0x178]
cmp qword [rsp + 0x190], r12
cmovae rdx, qword [rsp + 0x178]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [r14 + 0x60], rax
mov rdx, qword [rsp + 0x190]
cmp rdx, r12
jb 0x140036cba
inc rdx
mov rcx, qword [rsp + 0x178]
mov rax, rcx
cmp rdx, rsi
jb 0x140036cb5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400371ab
call fcn.1400716ac
test rbx, rbx
je 0x1400371b1
movdqa xmm0, xmmword [str.eGUMFCnGjEEX_AC]
movdqu xmmword [rsp + 0x158], xmm0
mov edx, r15d
movsxd rcx, edx
lea eax, [rdx + 0x21]
xor byte [rsp + rcx + 0x158], al
inc edx
cmp edx, r13d
jb 0x140036cd7
mov byte [rsp + 0x167], r15b
mov qword [rsp + 0x178], r15
mov qword [rsp + 0x188], r15
mov qword [rsp + 0x190], r13
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x178]
call fcn.140021b50
lea rdx, [rsp + 0x178]
cmp qword [rsp + 0x190], r12
cmovae rdx, qword [rsp + 0x178]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [r14 + 0x70], rax
mov rdx, qword [rsp + 0x190]
cmp rdx, r12
jb 0x140036d87
inc rdx
mov rcx, qword [rsp + 0x178]
mov rax, rcx
cmp rdx, rsi
jb 0x140036d82
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400371d2
call fcn.1400716ac
test rbx, rbx
je 0x1400371d8
mov dword [rsp + 0x1a8], 0x45554660
mov dword [rsp + 0x1ac], 0x1a144f55
mov dword [rsp + 0x1b0], 0x40474e07
xor eax, eax
mov byte [rsp + 0x1b4], al
mov edx, r15d
movsxd rcx, edx
lea eax, [rdx + 0x21]
xor byte [rsp + rcx + 0x1a8], al
inc edx
cmp edx, 0xc
jb 0x140036dbd
mov byte [rsp + 0x1b4], r15b
lea rcx, [rsp + 0x1a8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x140036e09
lea rcx, [rsp + 0x1a8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x1400371f9
movdqa xmm0, xmmword [0x1400a53a0]
movdqu xmmword [rsp + 0x158], xmm0
xor eax, eax
mov byte [rsp + 0x168], al
mov edx, r15d
movsxd rcx, edx
lea eax, [rdx + 0x21]
xor byte [rsp + rcx + 0x158], al
inc edx
cmp edx, r12d
jb 0x140036e26
mov byte [rsp + 0x168], r15b
mov qword [rsp + 0x178], r15
mov qword [rsp + 0x188], r15
mov qword [rsp + 0x190], r13
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x178]
call fcn.140021b50
lea rdx, [rsp + 0x178]
cmp qword [rsp + 0x190], r12
cmovae rdx, qword [rsp + 0x178]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r14 + 0x78], rax
mov rdx, qword [rsp + 0x190]
cmp rdx, r12
jb 0x140036ed6
inc rdx
mov rcx, qword [rsp + 0x178]
mov rax, rcx
cmp rdx, rsi
jb 0x140036ed1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003721a
call fcn.1400716ac
test rdi, rdi
je 0x140037220
lea rdx, str.AdjustTokenPrivileges
lea rcx, [rsp + 0x158]
call fcn.140030df8
mov edx, r15d
movsxd rcx, edx
lea eax, [rdx + 0x21]
xor byte [rsp + rcx + 0x158], al
inc edx
cmp edx, 0x15
jb 0x140036ef6
mov byte [rsp + 0x16d], r15b
mov qword [rsp + 0x178], r15
mov qword [rsp + 0x188], r15
mov qword [rsp + 0x190], r13
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x178]
call fcn.140021b50
lea rdx, [rsp + 0x178]
cmp qword [rsp + 0x190], r12
cmovae rdx, qword [rsp + 0x178]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r14 + 0x88], rax
mov rdx, qword [rsp + 0x190]
cmp rdx, r12
jb 0x140036fa9
inc rdx
mov rcx, qword [rsp + 0x178]
mov rax, rcx
cmp rdx, rsi
jb 0x140036fa4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037241
call fcn.1400716ac
test rdi, rdi
je 0x140037247
lea rdx, str.LookupPrivilegeValueW
lea rcx, [rsp + 0x158]
call fcn.140030df8
mov edx, r15d
movsxd rcx, edx
lea eax, [rdx + 0x21]
xor byte [rsp + rcx + 0x158], al
inc edx
cmp edx, 0x15
jb 0x140036fc9
mov byte [rsp + 0x16d], r15b
mov qword [rsp + 0x178], r15
mov qword [rsp + 0x188], r15
mov qword [rsp + 0x190], r13
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x178]
call fcn.140021b50
lea rdx, [rsp + 0x178]
cmp qword [rsp + 0x190], r12
cmovae rdx, qword [rsp + 0x178]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [r14 + 0x80], rax
mov rdx, qword [rsp + 0x190]
cmp rdx, r12
jb 0x14003707c
inc rdx
mov rcx, qword [rsp + 0x178]
mov rax, rcx
cmp rdx, rsi
jb 0x140037077
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037268
call fcn.1400716ac
test rbx, rbx
je 0x14003726e
mov al, 1
jmp 0x14003708b
mov rcx, qword [rsp + 0x1b8]
xor rcx, rsp
call fcn.140071cb0
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rcx, [rsp + 0x20]
call fcn.1400313bc
lea rdx, [0x1400d6ba8]
lea rcx, [rsp + 0x20]
call fcn.140072c14
call fcn.1400780a4
int3
lea rcx, [rsp + 0x38]
call fcn.1400313bc
lea rdx, [0x1400d6ba8]
lea rcx, [rsp + 0x38]
call fcn.140072c14
call fcn.1400780a4
int3
lea rcx, [rsp + 0x50]
call fcn.1400313bc
lea rdx, [0x1400d6ba8]
lea rcx, [rsp + 0x50]
call fcn.140072c14
call fcn.1400780a4
int3
lea rcx, [rsp + 0x68]
call fcn.1400313bc
lea rdx, [0x1400d6ba8]
lea rcx, [rsp + 0x68]
call fcn.140072c14
call fcn.1400780a4
int3
lea rcx, [rsp + 0x80]
call fcn.1400313bc
lea rdx, [0x1400d6ba8]
lea rcx, [rsp + 0x80]
call fcn.140072c14
call fcn.1400780a4
int3
lea rcx, [rsp + 0x98]
call fcn.1400313bc
lea rdx, [0x1400d6ba8]
lea rcx, [rsp + 0x98]
call fcn.140072c14
call fcn.1400780a4
int3
lea rcx, [rsp + 0xb0]
call fcn.1400313bc
lea rdx, [0x1400d6ba8]
lea rcx, [rsp + 0xb0]
call fcn.140072c14
call fcn.1400780a4
int3
lea rcx, [rsp + 0xc8]
call fcn.1400313bc
lea rdx, [0x1400d6ba8]
lea rcx, [rsp + 0xc8]
call fcn.140072c14
call fcn.1400780a4
int3
lea rcx, [rsp + 0xe0]
call fcn.1400313bc
lea rdx, [0x1400d6ba8]
lea rcx, [rsp + 0xe0]
call fcn.140072c14
lea rcx, [rsp + 0xf8]
call fcn.1400313bc
lea rdx, [0x1400d6ba8]
lea rcx, [rsp + 0xf8]
call fcn.140072c14
call fcn.1400780a4
int3
lea rcx, [rsp + 0x110]
call fcn.1400313bc
lea rdx, [0x1400d6ba8]
lea rcx, [rsp + 0x110]
call fcn.140072c14
call fcn.1400780a4
int3
lea rcx, [rsp + 0x128]
call fcn.1400313bc
lea rdx, [0x1400d6ba8]
lea rcx, [rsp + 0x128]
call fcn.140072c14
call fcn.1400780a4
int3
lea rcx, [rsp + 0x140]
call fcn.1400313bc
lea rdx, [0x1400d6ba8]
lea rcx, [rsp + 0x140]
call fcn.140072c14
int3