Function at 0x1400025e0
Capabilities:
Acquire debug privileges
Encode data using xor
Link many functions at runtime

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x8a8
mov esi, edx
mov rdi, rcx
mov rax, qword [0x14007c498]
xor rax, rsp
mov qword [rsp + 0x8a0], rax
lea rcx, [rsp + 0x50]
mov r8d, 0x800
xor edx, edx
call fcn.140039520
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rbx, [rsp + 0x48]
mov rcx, rax
mov edx, 0x28
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400026d8
lea rax, [0x1400620d0]
mov qword [rsp + 0x860], rax
mov qword [rsp + 0x868], rbx
lea rbx, [rsp + 0x860]
mov qword [rsp + 0x898], rbx
lea rdx, str.SeDebugPrivilege
lea r8, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x1400026ee
mov dword [rsp + 0x850], 1
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x854], rax
mov dword [rsp + 0x85c], 2
mov rcx, qword [rsp + 0x48]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
lea r8, [rsp + 0x850]
xor edx, edx
mov r9d, 0x10
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x140002702
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.LoadDebugPrivilege:_AdjustTokenPrivileges_failed__x
jmp 0x1400026fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.LoadDebugPrivilege:_OpenProcessToken_failed__x
mov edx, eax
call fcn.140001cb0
jmp 0x14000273c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.LoadDebugPrivilege:_LookupPrivilegeValue_failed__x
mov edx, eax
call fcn.140001cb0
mov rcx, qword [rsp + 0x898]
test rcx, rcx
je 0x14000273c
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140076550]
mov rcx, qword [rsp + 0x898]
test rcx, rcx
je 0x14000273c
cmp rcx, rbx
setne dl
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [0x140076550]
cmp esi, 2
jg 0x14000275a
lea rcx, str.Missing_argument_s__for_inject__required_3__supplied__d
mov edx, esi
call fcn.140001cb0
mov r15d, pe_nt_image_headers64
jmp 0x140003083
lea rdx, [rsp + 0x50]
xor ecx, ecx
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1400028c9
lea rsi, [rsp + 0x50]
mov rcx, rsi
mov dx, 0x5c
call fcn.1400396b0
test rax, rax
je 0x1400028e0
mov rcx, rax
add rcx, 2
mov word [rax + 2], 0
mov rdx, qword [rdi]
call fcn.14004c5d4
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov rcx, rsi
xor edx, edx
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x140002802
lea rdx, [rsp + 0x50]
mov rcx, rax
mov r8d, 0x3ff
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
dec eax
xor ecx, ecx
cmp eax, 0x3ff
setb cl
lea rsi, [rsp + rcx*8]
add rsi, 0x50
lea r14, [rsp + 0x860]
mov rcx, r14
mov rdx, rsi
call fcn.140006e90
mov rcx, r14
call fcn.14000c230
mov ebx, eax
mov rax, qword [rsp + 0x878]
cmp rax, 0x10
jb 0x140002866
mov rcx, qword [rsp + 0x860]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140002861
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x1400030cd
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.14000e420
mov r15d, 0x56
test bl, bl
je 0x140003083
mov rbx, qword [rdi + 8]
mov qword [rsp + 0x860], 0
mov qword [rsp + 0x870], 0
mov qword [rsp + 0x878], 7
mov word [rsp + 0x860], 0
mov rcx, rbx
call fcn.14004c5f0
cmp rax, 7
jbe 0x1400028fe
lea rcx, [rsp + 0x860]
mov rdx, rax
mov r9, rbx
call fcn.1400022a0
jmp 0x140002929
lea rcx, str.InjectHook:_GetModuleFileNameW_failed
call fcn.140001cb0
mov r15d, 0x79
jmp 0x140003083
lea rcx, str.InjectHook:_wcsrchr_failed:__p___ls_
lea r8, [rsp + 0x50]
xor edx, edx
call fcn.140001cb0
mov r15d, 0x7a
jmp 0x140003083
mov qword [rsp + 0x870], rax
mov r8, rax
add r8, rax
lea rcx, [rsp + 0x860]
mov rdx, rbx
mov rbx, rax
call fcn.140038e70
mov word [rsp + rbx*2 + 0x860], 0
call fcn.140042b88
mov r15, rax
cmp qword [rsp + 0x878], 8
jb 0x140002944
mov r14, qword [rsp + 0x860]
mov dword [r15], 0
lea rdx, [rsp + 0x850]
mov rcx, r14
mov r8d, 0xa
call fcn.14004b43c
cmp r14, qword [rsp + 0x850]
je 0x1400030b5
cmp dword [r15], 0x22
je 0x1400030c1
mov rbx, rax
mov rax, qword [rsp + 0x878]
cmp rax, 8
jb 0x1400029ca
mov rcx, qword [rsp + 0x860]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x1400029c5
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x1400030cd
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14000e420
mov rdi, qword [rdi + 0x10]
mov qword [rsp + 0x860], 0
mov qword [rsp + 0x870], 0
mov qword [rsp + 0x878], 7
mov word [rsp + 0x860], 0
mov rcx, rdi
call fcn.14004c5f0
cmp rax, 7
jbe 0x140002a1f
lea rcx, [rsp + 0x860]
mov rdx, rax
mov r9, rdi
call fcn.1400022a0
jmp 0x140002a4a
mov qword [rsp + 0x870], rax
mov r8, rax
add r8, rax
lea rcx, [rsp + 0x860]
mov rdx, rdi
mov rdi, rax
call fcn.140038e70
mov word [rsp + rdi*2 + 0x860], 0
call fcn.140042b88
mov r14, rax
cmp qword [rsp + 0x878], 8
jb 0x140002a67
mov r15, qword [rsp + 0x860]
jmp 0x140002a6f
lea r15, [rsp + 0x860]
mov dword [r14], 0
lea rdx, [rsp + 0x850]
mov rcx, r15
mov r8d, 0xa
call fcn.14004b388
cmp r15, qword [rsp + 0x850]
je 0x1400030d2
cmp dword [r14], 0x22
je 0x1400030de
mov edi, eax
mov rax, qword [rsp + 0x878]
cmp rax, 8
jb 0x140002af4
mov rcx, qword [rsp + 0x860]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140002aef
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x1400030cd
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14000e420
test rbx, rbx
jne 0x140002fc4
lea rcx, str.KERNEL32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movabs rcx, 0x6b6d7251636a7848
mov qword [rsp + 0x860], rcx
mov dword [rsp + 0x868], 0x7e7c62
movabs rcx, 0xc82efdf78201df87
mov qword [rsp + 0x850], rcx
xor ecx, ecx
mov r9b, 0x48
lea rdx, [rsp + 0x861]
xor r8d, r8d
nop dword [rax]
mov r10d, r8d
shr r10d, 0x1f
add r10d, r8d
sar r10d, 1
movsxd r10, r10d
movzx r10d, byte [rsp + r10 + 0x850]
mov r11d, r10d
and r11b, 0xf
shr r10b, 4
test r8b, 1
movzx r11d, r11b
movzx r10d, r10b
cmove r10d, r11d
xor r10b, r9b
inc r8d
cmp r8d, 0x10
cmove r8d, ecx
mov byte [rdx - 1], r10b
movzx r9d, byte [rdx]
inc rdx
test r9b, r9b
jne 0x140002b50
lea rdx, [rsp + 0x860]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140002f64
mov ecx, 0x1fffff
xor edx, edx
mov r8d, edi
call qword [0x140076550]
test rax, rax
je 0x140002f70
mov rbx, rax
xor ebp, ebp
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400030aa
lea rcx, str.KERNEL32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r14, rax
movabs rax, 0x58737e6c7d6a68
mov qword [rsp + 0x865], rax
movabs rax, 0x7d6a684766616e44
mov qword [rsp + 0x860], rax
movabs rax, 0x350bfacdf81b2018
mov qword [rsp + 0x850], rax
mov dl, 0x44
lea rax, [rsp + 0x861]
xor ecx, ecx
nop
mov r8d, ecx
shr r8d, 0x1f
add r8d, ecx
sar r8d, 1
movsxd r8, r8d
movzx r8d, byte [rsp + r8 + 0x850]
mov r9d, r8d
and r9b, 0xf
shr r8b, 4
test cl, 1
movzx r9d, r9b
movzx r8d, r8b
cmove r8d, r9d
xor r8b, dl
inc ecx
cmp ecx, 0x10
cmove ecx, ebp
mov byte [rax - 1], r8b
movzx edx, byte [rax]
inc rax
test dl, dl
jne 0x140002c40
lea rdx, [rsp + 0x860]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
movabs rax, 0x7b4064667a4867
mov qword [rsp + 0x866], rax
movabs rax, 0x4867617d7b7d685a
mov qword [rsp + 0x860], rax
movabs rax, 0x57135138eb08ff1c
mov qword [rsp + 0x850], rax
xor eax, eax
mov r8b, 0x5a
lea rcx, [rsp + 0x861]
xor edx, edx
nop word cs:[rax + rax]
mov r9d, edx
shr r9d, 0x1f
add r9d, edx
sar r9d, 1
movsxd r9, r9d
movzx r9d, byte [rsp + r9 + 0x850]
mov r10d, r9d
and r10b, 0xf
shr r9b, 4
test dl, 1
movzx r10d, r10b
movzx r9d, r9b
cmove r9d, r10d
xor r9b, r8b
inc edx
cmp edx, 0x10
cmove edx, eax
mov byte [rcx - 1], r9b
movzx r8d, byte [rcx]
inc rcx
test r8b, r8b
jne 0x140002cf0
lea rdx, [rsp + 0x860]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
movabs rax, 0x7443696867654b
mov qword [rsp + 0x867], rax
movabs rax, 0x4b606c72777e605d
mov qword [rsp + 0x860], rax
movabs rax, 0xadc6a7b9acd73c9b
mov qword [rsp + 0x850], rax
xor eax, eax
mov r8b, 0x5d
lea rcx, [rsp + 0x861]
xor edx, edx
nop word [rax + rax]
mov r9d, edx
shr r9d, 0x1f
add r9d, edx
sar r9d, 1
movsxd r9, r9d
movzx r9d, byte [rsp + r9 + 0x850]
mov r10d, r9d
and r10b, 0xf
shr r9b, 4
test dl, 1
movzx r10d, r10b
movzx r9d, r9b
cmove r9d, r10d
xor r9b, r8b
inc edx
cmp edx, 0x10
cmove edx, eax
mov byte [rcx - 1], r9b
movzx r8d, byte [rcx]
inc rcx
test r8b, r8b
jne 0x140002da0
lea rdx, [rsp + 0x860]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
movups xmm0, xmmword [str.Rqbr_TcnorBnlgwz]
movaps xmmword [rsp + 0x860], xmm0
mov dword [rsp + 0x86f], 0x7a7767
movabs rax, 0x81bf81adc9456b35
mov qword [rsp + 0x850], rax
xor eax, eax
mov r8b, 0x52
lea rcx, [rsp + 0x861]
xor edx, edx
nop dword [rax]
mov r9d, edx
shr r9d, 0x1f
add r9d, edx
sar r9d, 1
movsxd r9, r9d
movzx r9d, byte [rsp + r9 + 0x850]
mov r10d, r9d
and r10b, 0xf
shr r9b, 4
test dl, 1
movzx r10d, r10b
movzx r9d, r9b
cmove r9d, r10d
xor r9b, r8b
inc edx
cmp edx, 0x10
cmove edx, eax
mov byte [rcx - 1], r9b
movzx r8d, byte [rcx]
inc rcx
test r8b, r8b
jne 0x140002e40
lea rdx, [rsp + 0x860]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbp, rax
movups xmm0, xmmword [str.Emod_cefubWkbgk]
movaps xmmword [rsp + 0x860], xmm0
mov dword [rsp + 0x86f], 0x6b6762
movabs rax, 0x7c3371986918e8f6
mov qword [rsp + 0x850], rax
xor eax, eax
mov r8b, 0x45
lea rcx, [rsp + 0x861]
xor edx, edx
nop dword [rax]
mov r9d, edx
shr r9d, 0x1f
add r9d, edx
sar r9d, 1
movsxd r9, r9d
movzx r9d, byte [rsp + r9 + 0x850]
mov r10d, r9d
and r10b, 0xf
shr r9b, 4
test dl, 1
movzx r10d, r10b
movzx r9d, r9b
cmove r9d, r10d
xor r9b, r8b
inc edx
cmp edx, 0x10
cmove edx, eax
mov byte [rcx - 1], r9b
movzx r8d, byte [rcx]
inc rcx
test r8b, r8b
jne 0x140002ee0
lea rdx, [rsp + 0x860]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r13
mov rcx, rbx
mov rdx, rsi
mov r8, rax
mov r9, rbp
call fcn.140003f70
mov r15d, eax
jmp 0x140002f96
lea rcx, str.SafeOpenProcess_failed_to_load_open_process
call fcn.140001cb0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rcx, str.DeobfuscateInjectLibraryNormal:_SafeOpenProcess_failed__x
mov edx, eax
call fcn.140001cb0
xor r15d, r15d
cmp ebx, 5
sete r15b
xor r15d, 0x65
xor ebx, ebx
lea rax, [rbx + 1]
cmp rax, 2
jb 0x140002fa9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [r15 - 0x65]
cmp eax, 7
ja 0x140003083
mov ecx, 0xa9
bt ecx, eax
jae 0x140003083
lea rcx, str.USER32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movups xmm0, xmmword [str._bsfbkmwuKfmfOvI]
movaps xmmword [rsp + 0x860], xmm0
mov word [rsp + 0x870], 0x49
movabs rcx, 0xead293602fcf9778
mov qword [rsp + 0x850], rcx
xor ecx, ecx
mov r9b, 0x5b
lea rdx, [rsp + 0x861]
xor r8d, r8d
nop dword [rax]
mov r10d, r8d
shr r10d, 0x1f
add r10d, r8d
sar r10d, 1
movsxd r10, r10d
movzx r10d, byte [rsp + r10 + 0x850]
mov r11d, r10d
and r11b, 0xf
shr r10b, 4
test r8b, 1
movzx r11d, r11b
movzx r10d, r10b
cmove r10d, r11d
xor r10b, r9b
inc r8d
cmp r8d, 0x10
cmove r8d, ecx
mov byte [rdx - 1], r10b
movzx r9d, byte [rdx]
inc rdx
test r9b, r9b
jne 0x140003010
lea rdx, [rsp + 0x860]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, edi
mov rdx, rsi
mov r8, rax
call fcn.140004380
mov r15d, eax
mov rcx, qword [rsp + 0x8a0]
xor rcx, rsp
call fcn.14000e5d0
mov eax, r15d
add rsp, 0x8a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r15d, 0x66
jmp 0x140002f96
lea rcx, str.invalid_stoull_argument
call fcn.140014454
lea rcx, str.stoull_argument_out_of_range
call fcn.14001449c
call fcn.1400432ac
lea rcx, str.invalid_stoul_argument
call fcn.140014454
lea rcx, str.stoul_argument_out_of_range
call fcn.14001449c
int3