Function at 0x14000d310
Capabilities:
Encode data using xor
Link many functions at runtime

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x290
mov rax, qword [0x140087040]
xor rax, rsp
mov qword [rsp + 0x288], rax
mov r15, rcx
xor ebx, ebx
mov dword [r11 - 0x40], 0xc8d7c1e8
mov dword [r11 - 0x3c], 0x989ac4c2
mov dword [r11 - 0x38], 0xc2c1c885
xor eax, eax
mov byte [r11 - 0x34], al
mov edx, ebx
nop
movsxd rax, edx
lea rcx, [rsp + 0x268]
add rcx, rax
lea eax, [rdx - 0x5d]
xor byte [rcx], al
inc edx
cmp edx, 0xc
jb 0x14000d360
mov byte [rsp + 0x274], 0
lea rcx, [rsp + 0x268]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
test rax, rax
jne 0x14000d3b2
lea rcx, [rsp + 0x268]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14000e79b
mov dword [rsp + 0x228], 0xc8c0d4ec
mov dword [rsp + 0x22c], 0xc9c6daf7
mov dword [rsp + 0x230], 0xdedfce
mov edx, ebx
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x228]
add rcx, rax
lea eax, [rdx - 0x5d]
xor byte [rcx], al
inc edx
cmp edx, 0xb
jb 0x14000d3e0
mov byte [rsp + 0x233], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x248], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x258], xmm1
lea rax, [rsp + 0x228]
mov r14, 0xffffffffffffffff
mov r8, r14
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14000d430
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x248]
call fcn.140001280
lea rdx, [rsp + 0x248]
cmp qword [rsp + 0x260], 0xf
cmova rdx, qword [rsp + 0x248]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15], rax
mov rdx, qword [rsp + 0x260]
cmp rdx, 0xf
jbe 0x14000d4bb
inc rdx
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d4b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e7bd
call fcn.140038514
test rdi, rdi
je 0x14000e7c3
movdqa xmm0, xmmword [0x140068f50]
movdqu xmmword [rsp + 0x228], xmm0
mov dword [rsp + 0x238], 0xc6d4dae0
mov dword [rsp + 0x23c], 0xced6d0c4
xor eax, eax
mov byte [rsp + 0x240], al
mov edx, ebx
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x228]
add rcx, rax
lea eax, [rdx - 0x5d]
xor byte [rcx], al
inc edx
cmp edx, 0x18
jb 0x14000d500
mov byte [rsp + 0x240], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x248], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x258], xmm1
lea rax, [rsp + 0x228]
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x14000d544
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x248]
call fcn.140001280
lea rdx, [rsp + 0x248]
cmp qword [rsp + 0x260], 0xf
cmova rdx, qword [rsp + 0x248]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15 + 0x38], rax
mov rdx, qword [rsp + 0x260]
cmp rdx, 0xf
jbe 0x14000d5d0
inc rdx
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d5cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e7e5
call fcn.140038514
test rdi, rdi
je 0x14000e7eb
movdqa xmm0, xmmword [0x140068f40]
movdqu xmmword [rsp + 0x228], xmm0
mov edx, ebx
nop dword [rax]
movsxd rax, edx
lea rcx, [rsp + 0x228]
add rcx, rax
lea eax, [rdx - 0x5d]
xor byte [rcx], al
inc edx
cmp edx, 0xf
jb 0x14000d5f0
mov byte [rsp + 0x237], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x248], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x258], xmm1
lea rax, [rsp + 0x228]
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x14000d634
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x248]
call fcn.140001280
lea rdx, [rsp + 0x248]
cmp qword [rsp + 0x260], 0xf
cmova rdx, qword [rsp + 0x248]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15 + 0x40], rax
mov rdx, qword [rsp + 0x260]
cmp rdx, 0xf
jbe 0x14000d6c0
inc rdx
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d6bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e80d
call fcn.140038514
test rdi, rdi
je 0x14000e813
mov dword [rsp + 0x228], 0xc5cad6f3
mov dword [rsp + 0x22c], 0x99dadbc2
mov dword [rsp + 0x230], 0xd6c8e299
mov word [rsp + 0x234], 0xe7db
xor eax, eax
mov byte [rsp + 0x236], al
mov edx, ebx
nop
movsxd rax, edx
lea rcx, [rsp + 0x228]
add rcx, rax
lea eax, [rdx - 0x5d]
xor byte [rcx], al
inc edx
cmp edx, 0xe
jb 0x14000d700
mov byte [rsp + 0x236], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x248], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x258], xmm1
lea rax, [rsp + 0x228]
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x14000d744
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x248]
call fcn.140001280
lea rdx, [rsp + 0x248]
cmp qword [rsp + 0x260], 0xf
cmova rdx, qword [rsp + 0x248]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15 + 0x48], rax
mov rdx, qword [rsp + 0x260]
cmp rdx, 0xf
jbe 0x14000d7d0
inc rdx
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d7cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e835
call fcn.140038514
test rdi, rdi
je 0x14000e83b
mov dword [rsp + 0x228], 0xd3c1cbee
mov dword [rsp + 0x22c], 0x989acdcb
mov dword [rsp + 0x230], 0xdddfc5ed
mov word [rsp + 0x234], 0xe7db
xor eax, eax
mov byte [rsp + 0x236], al
mov edx, ebx
nop
movsxd rax, edx
lea rcx, [rsp + 0x228]
add rcx, rax
lea eax, [rdx - 0x5d]
xor byte [rcx], al
inc edx
cmp edx, 0xe
jb 0x14000d810
mov byte [rsp + 0x236], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x248], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x258], xmm1
lea rax, [rsp + 0x228]
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x14000d854
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x248]
call fcn.140001280
lea rdx, [rsp + 0x248]
cmp qword [rsp + 0x260], 0xf
cmova rdx, qword [rsp + 0x248]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15 + 0x50], rax
mov rdx, qword [rsp + 0x260]
cmp rdx, 0xf
jbe 0x14000d8e0
inc rdx
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d8db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e863
call fcn.140038514
test rdi, rdi
je 0x14000e869
mov dword [rsp + 0x228], 0xd3c1cbee
mov dword [rsp + 0x22c], 0x989acdcb
mov dword [rsp + 0x230], 0xdad5c9e5
mov word [rsp + 0x234], 0xf8
mov edx, ebx
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x228]
add rcx, rax
lea eax, [rdx - 0x5d]
xor byte [rcx], al
inc edx
cmp edx, 0xd
jb 0x14000d920
mov byte [rsp + 0x235], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x248], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x258], xmm1
lea rax, [rsp + 0x228]
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x14000d964
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x248]
call fcn.140001280
lea rdx, [rsp + 0x248]
cmp qword [rsp + 0x260], 0xf
cmova rdx, qword [rsp + 0x248]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15 + 0x58], rax
mov rdx, qword [rsp + 0x260]
cmp rdx, 0xf
jbe 0x14000d9f0
inc rdx
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d9eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e891
call fcn.140038514
test rdi, rdi
je 0x14000e897
movdqa xmm0, xmmword [0x140068fe0]
movdqu xmmword [rsp + 0x228], xmm0
mov dword [rsp + 0x238], 0xffccc6dc
mov dword [rsp + 0x23c], 0xd6ded9
mov edx, ebx
movsxd rax, edx
lea rcx, [rsp + 0x228]
add rcx, rax
lea eax, [rdx - 0x5d]
xor byte [rcx], al
inc edx
cmp edx, 0x17
jb 0x14000da22
mov byte [rsp + 0x23f], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x248], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x258], xmm1
lea rax, [rsp + 0x228]
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x14000da66
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x248]
call fcn.140001280
lea rdx, [rsp + 0x248]
cmp qword [rsp + 0x260], 0xf
cmova rdx, qword [rsp + 0x248]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15 + 0x60], rax
mov rdx, qword [rsp + 0x260]
cmp rdx, 0xf
jbe 0x14000daf2
inc rdx
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000daed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e8bf
call fcn.140038514
test rdi, rdi
je 0x14000e8c5
movdqa xmm0, xmmword [0x140068f30]
movdqu xmmword [rsp + 0x228], xmm0
mov edx, ebx
nop
movsxd rax, edx
lea rcx, [rsp + 0x228]
add rcx, rax
lea eax, [rdx - 0x5d]
xor byte [rcx], al
inc edx
cmp edx, 0xf
jb 0x14000db10
mov byte [rsp + 0x237], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x248], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x258], xmm1
lea rax, [rsp + 0x228]
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x14000db54
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x248]
call fcn.140001280
lea rdx, [rsp + 0x248]
cmp qword [rsp + 0x260], 0xf
cmova rdx, qword [rsp + 0x248]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15 + 0x70], rax
mov rdx, qword [rsp + 0x260]
cmp rdx, 0xf
jbe 0x14000dbe0
inc rdx
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000dbdb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e8ed
call fcn.140038514
test rdi, rdi
je 0x14000e8f3
mov dword [rsp + 0x278], 0xc7d3c0e2
mov dword [rsp + 0x27c], 0x989ac1d7
mov dword [rsp + 0x280], 0xc2c1c885
xor eax, eax
mov byte [rsp + 0x284], al
mov edx, ebx
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x278]
add rcx, rax
lea eax, [rdx - 0x5d]
xor byte [rcx], al
inc edx
cmp edx, 0xc
jb 0x14000dc20
mov byte [rsp + 0x284], 0
lea rcx, [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
test rax, rax
jne 0x14000dc72
lea rcx, [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14000e91b
movdqa xmm0, xmmword [0x140068fc0]
movdqu xmmword [rsp + 0x228], xmm0
xor eax, eax
mov byte [rsp + 0x238], al
mov edx, ebx
nop
movsxd rax, edx
lea rcx, [rsp + 0x228]
add rcx, rax
lea eax, [rdx - 0x5d]
xor byte [rcx], al
inc edx
cmp edx, 0x10
jb 0x14000dc90
mov byte [rsp + 0x238], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x248], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x258], xmm1
lea rax, [rsp + 0x228]
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x14000dcd4
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x248]
call fcn.140001280
lea rdx, [rsp + 0x248]
cmp qword [rsp + 0x260], 0xf
cmova rdx, qword [rsp + 0x248]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15 + 0x78], rax
mov rdx, qword [rsp + 0x260]
cmp rdx, 0xf
jbe 0x14000dd60
inc rdx
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000dd5b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e943
call fcn.140038514
test rdi, rdi
je 0x14000e949
movdqa xmm0, xmmword [0x140068fb0]
movdqu xmmword [rsp + 0x228], xmm0
mov dword [rsp + 0x238], 0xd3d2d1df
mov word [rsp + 0x23c], 0xc4
mov edx, ebx
movsxd rax, edx
lea rcx, [rsp + 0x228]
add rcx, rax
lea eax, [rdx - 0x5d]
xor byte [rcx], al
inc edx
cmp edx, 0x15
jb 0x14000dd91
mov byte [rsp + 0x23d], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x248], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x258], xmm1
lea rax, [rsp + 0x228]
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x14000ddd5
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x248]
call fcn.140001280
lea rdx, [rsp + 0x248]
cmp qword [rsp + 0x260], 0xf
cmova rdx, qword [rsp + 0x248]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15 + 0x88], rax
mov rdx, qword [rsp + 0x260]
cmp rdx, 0xf
jbe 0x14000de64
inc rdx
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000de5f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e971
call fcn.140038514
test rdi, rdi
je 0x14000e977
movdqa xmm0, xmmword [0x140068f70]
movdqu xmmword [rsp + 0x228], xmm0
mov word [rsp + 0x238], 0xc7c6
xor eax, eax
mov byte [rsp + 0x23a], al
mov edx, ebx
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x228]
add rcx, rax
lea eax, [rdx - 0x5d]
xor byte [rcx], al
inc edx
cmp edx, 0x12
jb 0x14000dea0
mov byte [rsp + 0x23a], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x248], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x258], xmm1
lea rax, [rsp + 0x228]
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x14000dee4
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x248]
call fcn.140001280
lea rdx, [rsp + 0x248]
cmp qword [rsp + 0x260], 0xf
cmova rdx, qword [rsp + 0x248]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15 + 0xa0], rax
mov rdx, qword [rsp + 0x260]
cmp rdx, 0xf
jbe 0x14000df73
inc rdx
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000df6e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e99f
call fcn.140038514
test rdi, rdi
je 0x14000e9a5
mov dword [rsp + 0x228], 0xd2cbcbe0
mov dword [rsp + 0x22c], 0xf9c5c7d5
mov dword [rsp + 0x230], 0xc7dbdece
mov word [rsp + 0x234], 0xd5cc
xor eax, eax
mov byte [rsp + 0x236], al
mov edx, ebx
movsxd rax, edx
lea rcx, [rsp + 0x228]
add rcx, rax
lea eax, [rdx - 0x5d]
xor byte [rcx], al
inc edx
cmp edx, 0xe
jb 0x14000dfb2
mov byte [rsp + 0x236], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x248], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x258], xmm1
lea rax, [rsp + 0x228]
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x14000dff6
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x248]
call fcn.140001280
lea rdx, [rsp + 0x248]
cmp qword [rsp + 0x260], 0xf
cmova rdx, qword [rsp + 0x248]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15 + 0xa8], rax
mov rdx, qword [rsp + 0x260]
cmp rdx, 0xf
jbe 0x14000e085
inc rdx
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e080
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e9cd
call fcn.140038514
test rdi, rdi
je 0x14000e9d3
mov dword [rsp + 0x228], 0xc3c9c1e7
mov dword [rsp + 0x22c], 0xcffacdd3
mov dword [rsp + 0x230], 0xcdc4dad9
mov word [rsp + 0x234], 0xca
mov edx, ebx
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x228]
add rcx, rax
lea eax, [rdx - 0x5d]
xor byte [rcx], al
inc edx
cmp edx, 0xd
jb 0x14000e0c0
mov byte [rsp + 0x235], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x248], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x258], xmm1
lea rax, [rsp + 0x228]
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x14000e104
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x248]
call fcn.140001280
lea rdx, [rsp + 0x248]
cmp qword [rsp + 0x260], 0xf
cmova rdx, qword [rsp + 0x248]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15 + 0xb8], rax
mov rdx, qword [rsp + 0x260]
cmp rdx, 0xf
jbe 0x14000e193
inc rdx
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e18e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e9fb
call fcn.140038514
test rdi, rdi
je 0x14000ea01
lea rdx, str.CloseServiceHandle
lea rcx, [rsp + 0x228]
call fcn.140009390
mov edx, ebx
movsxd rax, edx
lea rcx, [rsp + 0x228]
add rcx, rax
lea eax, [rdx - 0x5d]
xor byte [rcx], al
inc edx
cmp edx, 0x12
jb 0x14000e1b2
mov byte [rsp + 0x23a], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x248], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x258], xmm1
lea rax, [rsp + 0x228]
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x14000e1f6
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x248]
call fcn.140001280
lea rdx, [rsp + 0x248]
cmp qword [rsp + 0x260], 0xf
cmova rdx, qword [rsp + 0x248]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15 + 0xc0], rax
mov rdx, qword [rsp + 0x260]
cmp rdx, 0xf
jbe 0x14000e285
inc rdx
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e280
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ea29
call fcn.140038514
test rdi, rdi
je 0x14000ea2f
lea rdx, str.LookupPrivilegeValueW
lea rcx, [rsp + 0x228]
call fcn.1400092c0
mov edx, ebx
nop dword [rax]
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x228]
add rcx, rax
lea eax, [rdx - 0x5d]
xor byte [rcx], al
inc edx
cmp edx, 0x15
jb 0x14000e2b0
mov byte [rsp + 0x23d], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x248], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x258], xmm1
lea rax, [rsp + 0x228]
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x14000e2f4
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x248]
call fcn.140001280
lea rdx, [rsp + 0x248]
cmp qword [rsp + 0x260], 0xf
cmova rdx, qword [rsp + 0x248]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15 + 0x80], rax
mov rdx, qword [rsp + 0x260]
cmp rdx, 0xf
jbe 0x14000e383
inc rdx
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e37e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ea57
call fcn.140038514
test rdi, rdi
je 0x14000ea5d
lea rdx, str.OpenSCManagerW
lea rcx, [rsp + 0x228]
call fcn.140009440
mov edx, ebx
movsxd rax, edx
lea rcx, [rsp + 0x228]
add rcx, rax
lea eax, [rdx - 0x5d]
xor byte [rcx], al
inc edx
cmp edx, 0xe
jb 0x14000e3a2
mov byte [rsp + 0x236], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x248], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x258], xmm1
lea rax, [rsp + 0x228]
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x14000e3e6
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x248]
call fcn.140001280
lea rdx, [rsp + 0x248]
cmp qword [rsp + 0x260], 0xf
cmova rdx, qword [rsp + 0x248]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15 + 0x90], rax
mov rdx, qword [rsp + 0x260]
cmp rdx, 0xf
jbe 0x14000e475
inc rdx
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e470
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ea85
call fcn.140038514
test rdi, rdi
je 0x14000ea8b
mov dword [rsp + 0x228], 0xc8c0d4ec
mov dword [rsp + 0x22c], 0xdcdbcdf4
mov dword [rsp + 0x230], 0xf9c8cfc2
xor eax, eax
mov byte [rsp + 0x234], al
mov edx, ebx
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x228]
add rcx, rax
lea eax, [rdx - 0x5d]
xor byte [rcx], al
inc edx
cmp edx, 0xc
jb 0x14000e4b0
mov byte [rsp + 0x234], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x248], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x258], xmm1
lea rax, [rsp + 0x228]
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x14000e4f4
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x248]
call fcn.140001280
lea rdx, [rsp + 0x248]
cmp qword [rsp + 0x260], 0xf
cmova rdx, qword [rsp + 0x248]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15 + 0x98], rax
mov rdx, qword [rsp + 0x260]
cmp rdx, 0xf
jbe 0x14000e583
inc rdx
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e57e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000eab3
call fcn.140038514
test rdi, rdi
je 0x14000eab9
mov dword [rsp + 0x228], 0xd4c4d0f0
mov dword [rsp + 0x22c], 0xd8ccfbd3
mov dword [rsp + 0x230], 0xcbcec5dd
mov word [rsp + 0x234], 0xf8
mov edx, ebx
nop dword [rax]
movsxd rax, edx
lea rcx, [rsp + 0x228]
add rcx, rax
lea eax, [rdx - 0x5d]
xor byte [rcx], al
inc edx
cmp edx, 0xd
jb 0x14000e5c0
mov byte [rsp + 0x235], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x248], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x258], xmm1
lea rax, [rsp + 0x228]
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x14000e604
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x248]
call fcn.140001280
lea rdx, [rsp + 0x248]
cmp qword [rsp + 0x260], 0xf
cmova rdx, qword [rsp + 0x248]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15 + 0xb0], rax
mov rdx, qword [rsp + 0x260]
cmp rdx, 0xf
jbe 0x14000e693
inc rdx
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e68e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000eae1
call fcn.140038514
test rdi, rdi
je 0x14000eae7
lea rdx, str.CreateServiceW
lea rcx, [rsp + 0x228]
call fcn.140009440
movsxd rax, ebx
lea rcx, [rsp + 0x228]
add rcx, rax
lea eax, [rbx - 0x5d]
xor byte [rcx], al
inc ebx
cmp ebx, 0xe
jb 0x14000e6b0
mov byte [rsp + 0x236], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x248], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x258], xmm1
lea rax, [rsp + 0x228]
inc r14
cmp byte [rax + r14], 0
jne 0x14000e6f1
mov r8, r14
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x248]
call fcn.140001280
lea rdx, [rsp + 0x248]
cmp qword [rsp + 0x260], 0xf
cmova rdx, qword [rsp + 0x248]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [r15 + 0xc8], rax
mov r8, qword [rsp + 0x260]
cmp r8, 0xf
jbe 0x14000e763
mov rdx, qword [rsp + 0x248]
lea rcx, [rsp + 0x248]
call fcn.140010a80
test rbx, rbx
je 0x14000eb0f
mov al, 1
jmp 0x14000e772
mov rcx, qword [rsp + 0x288]
xor rcx, rsp
call fcn.140038630
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
lea rdx, str.dll_1__not_found.
lea rcx, [rsp + 0x30]
call fcn.1400099a0
lea rdx, [0x140084d70]
lea rcx, [rsp + 0x30]
call fcn.14003b310
call fcn.140040fa0
int3
lea rdx, str.Cannot_find_function_1.
lea rcx, [rsp + 0x48]
call fcn.1400099a0
lea rdx, [0x140084d70]
lea rcx, [rsp + 0x48]
call fcn.14003b310
call fcn.140040fa0
int3
lea rdx, str.Cannot_find_function_8.
lea rcx, [rsp + 0x60]
call fcn.1400099a0
lea rdx, [0x140084d70]
lea rcx, [rsp + 0x60]
call fcn.14003b310
call fcn.140040fa0
int3
lea rdx, str.Cannot_find_function_9.
lea rcx, [rsp + 0x78]
call fcn.1400099a0
lea rdx, [0x140084d70]
lea rcx, [rsp + 0x78]
call fcn.14003b310
call fcn.140040fa0
int3
lea rdx, str.Cannot_find_function_10.
lea rcx, [rsp + 0x90]
call fcn.1400099a0
lea rdx, [0x140084d70]
lea rcx, [rsp + 0x90]
call fcn.14003b310
call fcn.140040fa0
int3
lea rdx, str.Cannot_find_function_11.
lea rcx, [rsp + 0xa8]
call fcn.1400099a0
lea rdx, [0x140084d70]
lea rcx, [rsp + 0xa8]
call fcn.14003b310
call fcn.140040fa0
int3
lea rdx, str.Cannot_find_function_12.
lea rcx, [rsp + 0xc0]
call fcn.1400099a0
lea rdx, [0x140084d70]
lea rcx, [rsp + 0xc0]
call fcn.14003b310
call fcn.140040fa0
int3
lea rdx, str.Cannot_find_function_13.
lea rcx, [rsp + 0xd8]
call fcn.1400099a0
lea rdx, [0x140084d70]
lea rcx, [rsp + 0xd8]
call fcn.14003b310
call fcn.140040fa0
int3
lea rdx, str.Cannot_find_function_15.
lea rcx, [rsp + 0xf0]
call fcn.1400099a0
lea rdx, [0x140084d70]
lea rcx, [rsp + 0xf0]
call fcn.14003b310
lea rdx, str.dll_2__not_found.
lea rcx, [rsp + 0x108]
call fcn.1400099a0
lea rdx, [0x140084d70]
lea rcx, [rsp + 0x108]
call fcn.14003b310
call fcn.140040fa0
int3
lea rdx, str.Cannot_find_function_a1.
lea rcx, [rsp + 0x120]
call fcn.1400099a0
lea rdx, [0x140084d70]
lea rcx, [rsp + 0x120]
call fcn.14003b310
call fcn.140040fa0
int3
lea rdx, str.Cannot_find_function_a3.
lea rcx, [rsp + 0x138]
call fcn.1400099a0
lea rdx, [0x140084d70]
lea rcx, [rsp + 0x138]
call fcn.14003b310
call fcn.140040fa0
int3
lea rdx, str.Cannot_find_function_a6.
lea rcx, [rsp + 0x150]
call fcn.1400099a0
lea rdx, [0x140084d70]
lea rcx, [rsp + 0x150]
call fcn.14003b310
call fcn.140040fa0
int3
lea rdx, str.Cannot_find_function_a7.
lea rcx, [rsp + 0x168]
call fcn.1400099a0
lea rdx, [0x140084d70]
lea rcx, [rsp + 0x168]
call fcn.14003b310
call fcn.140040fa0
int3
lea rdx, str.Cannot_find_function_a9.
lea rcx, [rsp + 0x180]
call fcn.1400099a0
lea rdx, [0x140084d70]
lea rcx, [rsp + 0x180]
call fcn.14003b310
call fcn.140040fa0
int3
lea rdx, str.Cannot_find_function_a10.
lea rcx, [rsp + 0x198]
call fcn.1400099a0
lea rdx, [0x140084d70]
lea rcx, [rsp + 0x198]
call fcn.14003b310
call fcn.140040fa0
int3
lea rdx, str.Cannot_find_function_a2.
lea rcx, [rsp + 0x1b0]
call fcn.1400099a0
lea rdx, [0x140084d70]
lea rcx, [rsp + 0x1b0]
call fcn.14003b310
call fcn.140040fa0
int3
lea rdx, str.Cannot_find_function_a4.
lea rcx, [rsp + 0x1c8]
call fcn.1400099a0
lea rdx, [0x140084d70]
lea rcx, [rsp + 0x1c8]
call fcn.14003b310
call fcn.140040fa0
int3
lea rdx, str.Cannot_find_function_a5.
lea rcx, [rsp + 0x1e0]
call fcn.1400099a0
lea rdx, [0x140084d70]
lea rcx, [rsp + 0x1e0]
call fcn.14003b310
call fcn.140040fa0
int3
lea rdx, str.Cannot_find_function_a8.
lea rcx, [rsp + 0x1f8]
call fcn.1400099a0
lea rdx, [0x140084d70]
lea rcx, [rsp + 0x1f8]
call fcn.14003b310
lea rdx, str.Cannot_find_function_a11.
lea rcx, [rsp + 0x210]
call fcn.1400099a0
lea rdx, [0x140084d70]
lea rcx, [rsp + 0x210]
call fcn.14003b310
int3