Function at 0x140051120
Capabilities:
Encode data using xor
Link many functions at runtime

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
push r14
sub rsp, 0x1d0
mov rax, qword [0x14012a098]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov dword [r11 - 0x38], 0x8b9686a9
mov dword [r11 - 0x34], 0xdbdb8b83
mov dword [r11 - 0x30], 0x81808fc4
xor eax, eax
mov byte [r11 - 0x2c], al
xor r14d, r14d
mov ecx, r14d
mov edx, r14d
lea eax, [rcx - 0x1e]
xor byte [rsp + rdx + 0x1a0], al
inc ecx
movsxd rdx, ecx
cmp rdx, 0xc
jb 0x140051171
mov byte [rsp + 0x1ac], r14b
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
test rax, rax
jne 0x1400511be
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x140051e0d
mov dword [rsp + 0x160], 0x8b8193ad
mov dword [rsp + 0x164], 0x8a8795b6
mov dword [rsp + 0x168], 0x9f988f
mov ecx, r14d
mov rdx, r14
nop word [rax + rax]
lea eax, [rcx - 0x1e]
xor byte [rsp + rdx + 0x160], al
inc ecx
movsxd rdx, ecx
cmp rdx, 0xb
jb 0x1400511f0
mov byte [rsp + 0x16b], r14b
mov qword [rsp + 0x180], r14
mov qword [rsp + 0x190], r14
mov qword [rsp + 0x198], reloc.OLEAUT32.dll_SafeArrayDestroy
lea rax, [rsp + 0x160]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140051240
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x180]
call fcn.140015ff0
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], 0x10
cmovae rdx, qword [rsp + 0x180]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013e6b0], rax
test rax, rax
sete dil
mov rdx, qword [rsp + 0x198]
cmp rdx, 0x10
jb 0x1400512d3
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400512ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140051e2f
call fcn.1400998c0
test dil, dil
jne 0x140051e35
movdqa xmm0, xmmword [0x1401163e0]
movdqu xmmword [rsp + 0x160], xmm0
mov dword [rsp + 0x170], 0x85959da1
mov dword [rsp + 0x174], 0x8d979f85
xor eax, eax
mov byte [rsp + 0x178], al
mov ecx, r14d
mov rdx, r14
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x1e]
xor byte [rsp + rdx + 0x160], al
inc ecx
movsxd rdx, ecx
cmp rdx, 0x18
jb 0x140051320
mov byte [rsp + 0x178], 0
mov qword [rsp + 0x180], r14
mov qword [rsp + 0x190], r14
mov qword [rsp + 0x198], reloc.OLEAUT32.dll_SafeArrayDestroy
lea rax, [rsp + 0x160]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140051364
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x180]
call fcn.140015ff0
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], 0x10
cmovae rdx, qword [rsp + 0x180]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013e6e8], rax
test rax, rax
sete dil
mov rdx, qword [rsp + 0x198]
cmp rdx, 0x10
jb 0x1400513f7
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400513f2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140051e57
call fcn.1400998c0
test dil, dil
jne 0x140051e5d
movdqa xmm0, xmmword [0x140116360]
movdqu xmmword [rsp + 0x160], xmm0
mov ecx, r14d
mov rdx, r14
nop word [rax + rax]
lea eax, [rcx - 0x1e]
xor byte [rsp + rdx + 0x160], al
inc ecx
movsxd rdx, ecx
cmp rdx, 0xf
jb 0x140051420
mov byte [rsp + 0x16f], 0
mov qword [rsp + 0x180], r14
mov qword [rsp + 0x190], r14
mov qword [rsp + 0x198], reloc.OLEAUT32.dll_SafeArrayDestroy
lea rax, [rsp + 0x160]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140051464
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x180]
call fcn.140015ff0
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], 0x10
cmovae rdx, qword [rsp + 0x180]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013e6f0], rax
test rax, rax
sete dil
mov rdx, qword [rsp + 0x198]
cmp rdx, 0x10
jb 0x1400514f7
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400514f2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140051e7f
call fcn.1400998c0
test dil, dil
jne 0x140051e85
mov dword [rsp + 0x160], 0x868b91b2
mov dword [rsp + 0x164], 0xda9b9483
mov dword [rsp + 0x168], 0x9589a5d8
mov word [rsp + 0x16c], 0xb89a
xor eax, eax
mov byte [rsp + 0x16e], al
mov ecx, r14d
mov rdx, r14
nop word [rax + rax]
lea eax, [rcx - 0x1e]
xor byte [rsp + rdx + 0x160], al
inc ecx
movsxd rdx, ecx
cmp rdx, 0xe
jb 0x140051540
mov byte [rsp + 0x16e], 0
mov qword [rsp + 0x180], r14
mov qword [rsp + 0x190], r14
mov qword [rsp + 0x198], reloc.OLEAUT32.dll_SafeArrayDestroy
lea rax, [rsp + 0x160]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140051584
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x180]
call fcn.140015ff0
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], 0x10
cmovae rdx, qword [rsp + 0x180]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013e6f8], rax
test rax, rax
sete dil
mov rdx, qword [rsp + 0x198]
cmp rdx, 0x10
jb 0x140051617
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051612
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140051ea7
call fcn.1400998c0
test dil, dil
jne 0x140051ead
mov dword [rsp + 0x160], 0x90808caf
mov dword [rsp + 0x164], 0xdbdb828a
mov dword [rsp + 0x168], 0x9e9e82ac
mov word [rsp + 0x16c], 0xb89a
xor eax, eax
mov byte [rsp + 0x16e], al
mov ecx, r14d
mov rdx, r14
nop word [rax + rax]
lea eax, [rcx - 0x1e]
xor byte [rsp + rdx + 0x160], al
inc ecx
movsxd rdx, ecx
cmp rdx, 0xe
jb 0x140051660
mov byte [rsp + 0x16e], 0
mov qword [rsp + 0x180], r14
mov qword [rsp + 0x190], r14
mov qword [rsp + 0x198], reloc.OLEAUT32.dll_SafeArrayDestroy
lea rax, [rsp + 0x160]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x1400516a4
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x180]
call fcn.140015ff0
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], 0x10
cmovae rdx, qword [rsp + 0x180]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013e700], rax
test rax, rax
sete dil
mov rdx, qword [rsp + 0x198]
cmp rdx, 0x10
jb 0x140051737
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051732
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140051ed5
call fcn.1400998c0
test dil, dil
jne 0x140051edb
mov dword [rsp + 0x160], 0x90808caf
mov dword [rsp + 0x164], 0xdbdb828a
mov dword [rsp + 0x168], 0x99948ea4
mov word [rsp + 0x16c], 0xb9
mov ecx, r14d
mov rdx, r14
lea eax, [rcx - 0x1e]
xor byte [rsp + rdx + 0x160], al
inc ecx
movsxd rdx, ecx
cmp rdx, 0xd
jb 0x140051771
mov byte [rsp + 0x16d], 0
mov qword [rsp + 0x180], r14
mov qword [rsp + 0x190], r14
mov qword [rsp + 0x198], reloc.OLEAUT32.dll_SafeArrayDestroy
lea rax, [rsp + 0x160]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x1400517b5
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x180]
call fcn.140015ff0
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], 0x10
cmovae rdx, qword [rsp + 0x180]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013e708], rax
test rax, rax
sete dil
mov rdx, qword [rsp + 0x198]
cmp rdx, 0x10
jb 0x140051848
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051843
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140051f03
call fcn.1400998c0
test dil, dil
jne 0x140051f09
movdqa xmm0, xmmword [0x1401163c0]
movdqu xmmword [rsp + 0x160], xmm0
mov dword [rsp + 0x170], 0xbc8d819d
mov dword [rsp + 0x174], 0x979198
mov ecx, r14d
mov rdx, r14
nop
lea eax, [rcx - 0x1e]
xor byte [rsp + rdx + 0x160], al
inc ecx
movsxd rdx, ecx
cmp rdx, 0x17
jb 0x140051880
mov byte [rsp + 0x177], 0
mov qword [rsp + 0x180], r14
mov qword [rsp + 0x190], r14
mov qword [rsp + 0x198], reloc.OLEAUT32.dll_SafeArrayDestroy
lea rax, [rsp + 0x160]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x1400518c4
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x180]
call fcn.140015ff0
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], 0x10
cmovae rdx, qword [rsp + 0x180]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013e710], rax
test rax, rax
sete dil
mov rdx, qword [rsp + 0x198]
cmp rdx, 0x10
jb 0x140051957
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051952
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140051f31
call fcn.1400998c0
test dil, dil
jne 0x140051f37
movdqa xmm0, xmmword [0x140116350]
movdqu xmmword [rsp + 0x160], xmm0
mov ecx, r14d
mov rdx, r14
nop word [rax + rax]
lea eax, [rcx - 0x1e]
xor byte [rsp + rdx + 0x160], al
inc ecx
movsxd rdx, ecx
cmp rdx, 0xf
jb 0x140051980
mov byte [rsp + 0x16f], 0
mov qword [rsp + 0x180], r14
mov qword [rsp + 0x190], r14
mov qword [rsp + 0x198], reloc.OLEAUT32.dll_SafeArrayDestroy
lea rax, [rsp + 0x160]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x1400519c4
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x180]
call fcn.140015ff0
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], 0x10
cmovae rdx, qword [rsp + 0x180]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013e720], rax
test rax, rax
sete dil
mov rdx, qword [rsp + 0x198]
cmp rdx, 0x10
jb 0x140051a57
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051a52
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140051f5f
call fcn.1400998c0
test dil, dil
jne 0x140051f65
mov dword [rsp + 0x1b0], 0x849287a3
mov dword [rsp + 0x1b4], 0xdbdb8e96
mov dword [rsp + 0x1b8], 0x81808fc4
xor eax, eax
mov byte [rsp + 0x1bc], al
mov ecx, r14d
mov rdx, r14
lea eax, [rcx - 0x1e]
xor byte [rsp + rdx + 0x1b0], al
inc ecx
movsxd rdx, ecx
cmp rdx, 0xc
jb 0x140051a90
mov byte [rsp + 0x1bc], 0
lea rcx, [rsp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
jne 0x140051add
lea rcx, [rsp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x140051f8d
lea rdx, str.OpenProcessToken
lea rcx, [rsp + 0x160]
call fcn.1400592c0
mov ecx, r14d
mov rdx, r14
nop word [rax + rax]
lea eax, [rcx - 0x1e]
xor byte [rsp + rdx + 0x160], al
inc ecx
movsxd rdx, ecx
cmp rdx, 0x10
jb 0x140051b00
mov byte [rsp + 0x170], 0
mov qword [rsp + 0x180], r14
mov qword [rsp + 0x190], r14
mov qword [rsp + 0x198], reloc.OLEAUT32.dll_SafeArrayDestroy
lea rax, [rsp + 0x160]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140051b44
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x180]
call fcn.140015ff0
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], 0x10
cmovae rdx, qword [rsp + 0x180]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013e728], rax
test rax, rax
sete sil
mov rdx, qword [rsp + 0x198]
cmp rdx, 0x10
jb 0x140051bd7
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051bd2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140051fb5
call fcn.1400998c0
test sil, sil
jne 0x140051fbb
lea rdx, str.AdjustTokenPrivileges
lea rcx, [rsp + 0x160]
call fcn.1400591f0
mov ecx, r14d
mov rdx, r14
nop word [rax + rax]
lea eax, [rcx - 0x1e]
xor byte [rsp + rdx + 0x160], al
inc ecx
movsxd rdx, ecx
cmp rdx, 0x15
jb 0x140051c00
mov byte [rsp + 0x175], 0
mov qword [rsp + 0x180], r14
mov qword [rsp + 0x190], r14
mov qword [rsp + 0x198], reloc.OLEAUT32.dll_SafeArrayDestroy
lea rax, [rsp + 0x160]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140051c44
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x180]
call fcn.140015ff0
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], 0x10
cmovae rdx, qword [rsp + 0x180]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013e738], rax
test rax, rax
sete sil
mov rdx, qword [rsp + 0x198]
cmp rdx, 0x10
jb 0x140051cd7
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051cd2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140051fe3
call fcn.1400998c0
test sil, sil
jne 0x140051fe9
lea rdx, str.LookupPrivilegeValueW
lea rcx, [rsp + 0x160]
call fcn.1400591f0
mov ecx, r14d
mov rdx, r14
nop word [rax + rax]
lea eax, [rcx - 0x1e]
xor byte [rsp + rdx + 0x160], al
inc ecx
movsxd rdx, ecx
cmp rdx, 0x15
jb 0x140051d00
mov byte [rsp + 0x175], 0
mov qword [rsp + 0x180], r14
mov qword [rsp + 0x190], r14
mov qword [rsp + 0x198], reloc.OLEAUT32.dll_SafeArrayDestroy
lea rax, [rsp + 0x160]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140051d41
mov r8, rbx
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x180]
call fcn.140015ff0
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], 0x10
cmovae rdx, qword [rsp + 0x180]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14013e730], rax
test rax, rax
sete bl
mov rdx, qword [rsp + 0x198]
cmp rdx, 0x10
jb 0x140051dd5
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051dd0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140052011
call fcn.1400998c0
test bl, bl
jne 0x140052017
mov al, 1
jmp 0x140051de3
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1400998a0
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r14
ret
lea rdx, str.dll_1__not_found.
lea rcx, [rsp + 0x28]
call fcn.140002110
lea rdx, [0x140128d58]
lea rcx, [rsp + 0x28]
call fcn.14009c580
call fcn.1400a03a4
int3
lea rdx, str.Cannot_find_function_1.
lea rcx, [rsp + 0x40]
call fcn.140002110
lea rdx, [0x140128d58]
lea rcx, [rsp + 0x40]
call fcn.14009c580
call fcn.1400a03a4
int3
lea rdx, str.Cannot_find_function_8.
lea rcx, [rsp + 0x58]
call fcn.140002110
lea rdx, [0x140128d58]
lea rcx, [rsp + 0x58]
call fcn.14009c580
call fcn.1400a03a4
int3
lea rdx, str.Cannot_find_function_9.
lea rcx, [rsp + 0x70]
call fcn.140002110
lea rdx, [0x140128d58]
lea rcx, [rsp + 0x70]
call fcn.14009c580
call fcn.1400a03a4
int3
lea rdx, str.Cannot_find_function_10.
lea rcx, [rsp + 0x88]
call fcn.140002110
lea rdx, [0x140128d58]
lea rcx, [rsp + 0x88]
call fcn.14009c580
call fcn.1400a03a4
int3
lea rdx, str.Cannot_find_function_11.
lea rcx, [rsp + 0xa0]
call fcn.140002110
lea rdx, [0x140128d58]
lea rcx, [rsp + 0xa0]
call fcn.14009c580
call fcn.1400a03a4
int3
lea rdx, str.Cannot_find_function_12.
lea rcx, [rsp + 0xb8]
call fcn.140002110
lea rdx, [0x140128d58]
lea rcx, [rsp + 0xb8]
call fcn.14009c580
call fcn.1400a03a4
int3
lea rdx, str.Cannot_find_function_13.
lea rcx, [rsp + 0xd0]
call fcn.140002110
lea rdx, [0x140128d58]
lea rcx, [rsp + 0xd0]
call fcn.14009c580
call fcn.1400a03a4
int3
lea rdx, str.Cannot_find_function_15.
lea rcx, [rsp + 0xe8]
call fcn.140002110
lea rdx, [0x140128d58]
lea rcx, [rsp + 0xe8]
call fcn.14009c580
lea rdx, str.dll_2__not_found.
lea rcx, [rsp + 0x100]
call fcn.140002110
lea rdx, [0x140128d58]
lea rcx, [rsp + 0x100]
call fcn.14009c580
call fcn.1400a03a4
int3
lea rdx, str.Cannot_find_function_a1.
lea rcx, [rsp + 0x118]
call fcn.140002110
lea rdx, [0x140128d58]
lea rcx, [rsp + 0x118]
call fcn.14009c580
call fcn.1400a03a4
int3
lea rdx, str.Cannot_find_function_a3.
lea rcx, [rsp + 0x130]
call fcn.140002110
lea rdx, [0x140128d58]
lea rcx, [rsp + 0x130]
call fcn.14009c580
call fcn.1400a03a4
int3
lea rdx, str.Cannot_find_function_a2.
lea rcx, [rsp + 0x148]
call fcn.140002110
lea rdx, [0x140128d58]
lea rcx, [rsp + 0x148]
call fcn.14009c580
int3