Function at 0x402340
Capabilities:
Acquire debug privileges
Check if file exists
Contain obfuscated stackstrings
Encode data using xor
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x870
mov edi, dword [ebp + 0xc]
mov eax, dword [0x45a454]
xor eax, ebp
mov dword [esp + 0x868], eax
lea ebx, [esp + 0x30]
push 0x800
push 0
push ebx
call fcn.004273a0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea esi, [esp + 0x2c]
push esi
push 0x28
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x402429
mov dword [esp + 0x840], 0x447110
mov dword [esp + 0x844], esi
lea eax, [esp + 0x840]
mov dword [esp + 0x864], eax
lea eax, [esp + 0x24]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x4025b7
mov dword [esp + 0x830], 1
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x838], ecx
mov dword [esp + 0x834], eax
mov dword [esp + 0x83c], 2
lea eax, [esp + 0x830]
push 0
push 0
push 0x10
push eax
push 0
push dword [esp + 0x40]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x4025cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LoadDebugPrivilege:_AdjustTokenPrivileges_failed__x
jmp 0x4025c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LoadDebugPrivilege:_OpenProcessToken_failed__x
call fcn.00401b00
add esp, 8
cmp edi, 2
jle 0x402622
push 0x400
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40263a
push 0x5c
push ebx
call fcn.00427500
add esp, 8
test eax, eax
je 0x402651
mov edi, dword [ebp + 8]
mov ecx, eax
add ecx, 2
mov word [eax + 2], 0
push dword [edi]
push ecx
call fcn.00434b62
sub esp, 0x14
movaps xmm0, xmmword [0x447130]
movups xmmword [esp + 4], xmm0
mov dword [esp], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x4024d6
lea ecx, [esp + 0x30]
push 0
push 0x3ff
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
dec eax
xor ecx, ecx
cmp eax, 0x3ff
setb cl
lea ebx, [esp + ecx*8]
add ebx, 0x30
lea esi, [esp + 0x840]
push ebx
push esi
call fcn.00406920
add esp, 8
push esi
call fcn.0040b470
add esp, 4
mov esi, dword [esp + 0x854]
cmp esi, 0x10
jb 0x402538
mov byte [esp + 8], al
mov ecx, dword [esp + 0x840]
lea eax, [esi + 1]
cmp eax, 0x1000
jb 0x402529
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x402db4
add esi, 0x24
mov eax, esi
mov ecx, edx
push eax
push ecx
call fcn.0040d311
add esp, 8
movzx eax, byte [esp + 8]
mov dword [esp + 8], ebx
mov ebx, 0x56
test al, al
je 0x402d7e
mov esi, dword [edi + 4]
mov dword [esp + 0x840], 0
mov dword [esp + 0x850], 0
mov dword [esp + 0x854], 7
mov word [esp + 0x840], 0
push esi
call fcn.00434b84
add esp, 4
cmp eax, 7
jbe 0x40266f
sub esp, 0xc
movzx ecx, byte [esp + 0x83c]
mov byte [esp + 4], cl
mov dword [esp + 8], esi
mov dword [esp], eax
lea ecx, [esp + 0x84c]
call fcn.00402050
lea edi, [esp + 0x840]
jmp 0x402698
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LoadDebugPrivilege:_LookupPrivilegeValue_failed__x
call fcn.00401b00
add esp, 8
mov esi, dword [esp + 0x864]
test esi, esi
je 0x402616
mov eax, dword [esi]
mov edi, dword [eax + 8]
mov ecx, edi
call dword [0x457158]
mov ecx, esi
call edi
lea eax, [esp + 0x840]
mov esi, dword [esp + 0x864]
test esi, esi
je 0x402616
xor ebx, ebx
cmp esi, eax
setne bl
mov eax, dword [esi]
mov edi, dword [eax + 0x10]
mov ecx, edi
call dword [0x457158]
mov ecx, esi
push ebx
lea ebx, [esp + 0x34]
call edi
mov edi, dword [ebp + 0xc]
cmp edi, 2
jg 0x402446
push edi
push str.Missing_argument_s__for_inject__required_3__supplied__d
call fcn.00401b00
add esp, 8
mov ebx, pe_nt_image_headers32
jmp 0x402d7e
push str.InjectHook:_GetModuleFileNameW_failed
call fcn.00401b00
add esp, 4
mov ebx, 0x79
jmp 0x402d7e
lea eax, [esp + 0x30]
push eax
push 0
push str.InjectHook:_wcsrchr_failed:__p___ls_
call fcn.00401b00
add esp, 0xc
mov ebx, 0x7a
jmp 0x402d7e
mov dword [esp + 0x850], eax
mov ecx, eax
add ecx, eax
push ecx
push esi
lea edi, [esp + 0x848]
push edi
mov esi, eax
call fcn.00426e20
add esp, 0xc
mov word [esp + esi*2 + 0x840], 0
call fcn.0042e754
mov esi, eax
cmp dword [esp + 0x854], 8
jb 0x4026b0
mov edi, dword [esp + 0x840]
mov dword [esi], 0
lea eax, [esp + 0x830]
push 0xa
push eax
push edi
call fcn.00433cd7
add esp, 0xc
cmp edi, dword [esp + 0x830]
je 0x402da0
mov dword [esp + 4], edx
cmp dword [esi], 0x22
je 0x402daa
mov ebx, eax
mov eax, dword [esp + 0x854]
cmp eax, 8
jb 0x40272b
mov ecx, dword [esp + 0x840]
lea esi, [eax*2 + 2]
cmp esi, 0x1000
jb 0x402721
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x402db4
add eax, eax
add eax, 0x25
mov esi, eax
mov ecx, edx
push esi
push ecx
call fcn.0040d311
add esp, 8
mov eax, dword [ebp + 8]
mov esi, dword [eax + 8]
mov dword [esp + 0x840], 0
mov dword [esp + 0x850], 0
mov dword [esp + 0x854], 7
mov word [esp + 0x840], 0
push esi
call fcn.00434b84
add esp, 4
cmp eax, 7
jbe 0x40278e
sub esp, 0xc
movzx ecx, byte [esp + 0x83c]
mov byte [esp + 4], cl
mov dword [esp + 8], esi
mov dword [esp], eax
lea ecx, [esp + 0x84c]
call fcn.00402050
jmp 0x4027b7
mov dword [esp + 0x850], eax
mov ecx, eax
add ecx, eax
lea edx, [esp + 0x840]
push ecx
push esi
push edx
mov esi, eax
call fcn.00426e20
add esp, 0xc
mov word [esp + esi*2 + 0x840], 0
call fcn.0042e754
mov esi, eax
cmp dword [esp + 0x854], 8
jb 0x4027d1
mov edi, dword [esp + 0x840]
jmp 0x4027d8
lea edi, [esp + 0x840]
lea eax, [esp + 0x830]
mov dword [esi], 0
push 0xa
push eax
push edi
call fcn.00433c91
add esp, 0xc
mov dword [esp + 0xc], eax
cmp edi, dword [esp + 0x830]
je 0x402db9
cmp dword [esi], 0x22
je 0x402dc3
mov eax, dword [esp + 0x854]
cmp eax, 8
jb 0x402851
mov ecx, dword [esp + 0x840]
lea esi, [eax*2 + 2]
cmp esi, 0x1000
jb 0x402847
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x402db4
add eax, eax
add eax, 0x25
mov esi, eax
mov ecx, edx
push esi
push ecx
call fcn.0040d311
add esp, 8
or ebx, dword [esp + 4]
jne 0x402cca
push str.KERNEL32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [esp + 4], eax
mov dword [esp + 0x848], 0x7e7c62
mov dword [esp + 0x844], 0x6b6d7251
mov dword [esp + 0x840], 0x636a7848
mov dword [esp + 0x834], 0xc82efdf7
mov dword [esp + 0x830], 0x8201df87
xor esi, esi
mov al, 0x48
lea edx, [esp + 0x841]
xor ebx, ebx
nop
mov ecx, ebx
shr ecx, 0x1f
add ecx, ebx
sar ecx, 1
movzx ecx, byte [esp + ecx + 0x830]
mov ah, cl
and ah, 0xf
shr cl, 4
test bl, 1
movzx edi, ah
movzx ecx, cl
cmove ecx, edi
xor cl, al
inc ebx
cmp ebx, 0x10
cmove ebx, esi
mov byte [edx - 1], cl
movzx eax, byte [edx]
inc edx
test al, al
jne 0x4028b0
lea eax, [esp + 0x840]
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x402c71
mov ecx, eax
call dword [0x457158]
push dword [esp + 0xc]
push 0
push 0x1fffff
call ecx
test eax, eax
je 0x402c7e
mov esi, eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x402d96
mov dword [esp + 0x20], esi
push str.KERNEL32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [esp + 4], eax
mov byte [esp + 0x84c], 0
mov dword [esp + 0x848], 0x58737e6c
mov dword [esp + 0x844], 0x7d6a6847
mov dword [esp + 0x840], 0x66616e44
mov dword [esp + 0x834], 0x350bfacd
mov dword [esp + 0x830], 0xf81b2018
xor esi, esi
mov bl, 0x44
lea ecx, [esp + 0x841]
xor edx, edx
nop word cs:[eax + eax]
mov eax, edx
shr eax, 0x1f
add eax, edx
sar eax, 1
movzx eax, byte [esp + eax + 0x830]
mov ah, al
and ah, 0xf
shr al, 4
test dl, 1
movzx edi, ah
movzx eax, al
cmove eax, edi
xor al, bl
inc edx
cmp edx, 0x10
cmove edx, esi
mov byte [ecx - 1], al
movzx ebx, byte [ecx]
inc ecx
test bl, bl
jne 0x4029a0
lea eax, [esp + 0x840]
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x1c], eax
mov word [esp + 0x84c], 0x7b
mov dword [esp + 0x848], 0x4064667a
mov dword [esp + 0x844], 0x4867617d
mov dword [esp + 0x840], 0x7b7d685a
mov dword [esp + 0x834], 0x57135138
mov dword [esp + 0x830], 0xeb08ff1c
xor esi, esi
mov bl, 0x5a
lea ecx, [esp + 0x841]
xor edx, edx
nop dword [eax]
mov eax, edx
shr eax, 0x1f
add eax, edx
sar eax, 1
movzx eax, byte [esp + eax + 0x830]
mov ah, al
and ah, 0xf
shr al, 4
test dl, 1
movzx edi, ah
movzx eax, al
cmove eax, edi
xor al, bl
inc edx
cmp edx, 0x10
cmove edx, esi
mov byte [ecx - 1], al
movzx ebx, byte [ecx]
inc ecx
test bl, bl
jne 0x402a40
lea eax, [esp + 0x840]
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x18], eax
mov dword [esp + 0x84b], 0x744369
mov dword [esp + 0x848], 0x69686765
mov dword [esp + 0x844], 0x4b606c72
mov dword [esp + 0x840], 0x777e605d
mov dword [esp + 0x834], 0xadc6a7b9
mov dword [esp + 0x830], 0xacd73c9b
xor esi, esi
mov bl, 0x5d
lea ecx, [esp + 0x841]
xor edx, edx
nop
mov eax, edx
shr eax, 0x1f
add eax, edx
sar eax, 1
movzx eax, byte [esp + eax + 0x830]
mov ah, al
and ah, 0xf
shr al, 4
test dl, 1
movzx edi, ah
movzx eax, al
cmove eax, edi
xor al, bl
inc edx
cmp edx, 0x10
cmove edx, esi
mov byte [ecx - 1], al
movzx ebx, byte [ecx]
inc ecx
test bl, bl
jne 0x402ae0
lea eax, [esp + 0x840]
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x14], eax
movups xmm0, xmmword [str.Rqbr_TcnorBnlgwz]
movaps xmmword [esp + 0x840], xmm0
mov dword [esp + 0x84f], 0x7a7767
mov dword [esp + 0x834], 0x81bf81ad
mov dword [esp + 0x830], 0xc9456b35
xor esi, esi
mov bl, 0x52
lea ecx, [esp + 0x841]
xor edx, edx
nop dword [eax]
mov eax, edx
shr eax, 0x1f
add eax, edx
sar eax, 1
movzx eax, byte [esp + eax + 0x830]
mov ah, al
and ah, 0xf
shr al, 4
test dl, 1
movzx edi, ah
movzx eax, al
cmove eax, edi
xor al, bl
inc edx
cmp edx, 0x10
cmove edx, esi
mov byte [ecx - 1], al
movzx ebx, byte [ecx]
inc ecx
test bl, bl
jne 0x402b70
lea eax, [esp + 0x840]
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x10], eax
movups xmm0, xmmword [str.Emod_cefubWkbgk]
movaps xmmword [esp + 0x840], xmm0
mov dword [esp + 0x84f], 0x6b6762
mov dword [esp + 0x834], 0x7c337198
mov dword [esp + 0x830], 0x6918e8f6
xor esi, esi
mov bl, 0x45
lea ecx, [esp + 0x841]
xor edx, edx
nop dword [eax]
mov eax, edx
shr eax, 0x1f
add eax, edx
sar eax, 1
movzx eax, byte [esp + eax + 0x830]
mov ah, al
and ah, 0xf
shr al, 4
test dl, 1
movzx edi, ah
movzx eax, al
cmove eax, edi
xor al, bl
inc edx
cmp edx, 0x10
cmove edx, esi
mov byte [ecx - 1], al
movzx ebx, byte [ecx]
inc ecx
test bl, bl
jne 0x402c00
lea eax, [esp + 0x840]
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push eax
push dword [esp + 0x1c]
mov esi, dword [esp + 0x38]
push esi
call fcn.00403dc0
add esp, 0x1c
mov ebx, eax
jmp 0x402ca1
push str.SafeOpenProcess_failed_to_load_open_process
call fcn.00401b00
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push eax
push str.DeobfuscateInjectLibraryNormal:_SafeOpenProcess_failed__x
call fcn.00401b00
add esp, 8
xor ebx, ebx
cmp esi, 5
sete bl
xor ebx, 0x65
xor esi, esi
lea eax, [esi + 1]
cmp eax, 2
jb 0x402cb0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx - 0x65]
cmp eax, 7
ja 0x402d7e
mov ecx, 0xa9
bt ecx, eax
jae 0x402d7e
push str.USER32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [esp + 4], eax
movups xmm0, xmmword [str._bsfbkmwuKfmfOvI]
movaps xmmword [esp + 0x840], xmm0
mov word [esp + 0x850], 0x49
mov dword [esp + 0x834], 0xead29360
mov dword [esp + 0x830], 0x2fcf9778
xor esi, esi
mov al, 0x5b
lea edx, [esp + 0x841]
xor ebx, ebx
nop word cs:[eax + eax]
mov ecx, ebx
shr ecx, 0x1f
add ecx, ebx
sar ecx, 1
movzx ecx, byte [esp + ecx + 0x830]
mov ah, cl
and ah, 0xf
shr cl, 4
test bl, 1
movzx edi, ah
movzx ecx, cl
cmove ecx, edi
xor cl, al
inc ebx
cmp ebx, 0x10
cmove ebx, esi
mov byte [edx - 1], cl
movzx eax, byte [edx]
inc edx
test al, al
jne 0x402d20
lea eax, [esp + 0x840]
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
push dword [esp + 0xc]
push dword [esp + 0x14]
call fcn.004041a0
add esp, 0xc
mov ebx, eax
mov ecx, dword [esp + 0x868]
xor ecx, ebp
call fcn.0040d348
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, 0x66
jmp 0x402ca1
push str.invalid_stoull_argument
call fcn.00410f10
push str.stoull_argument_out_of_range
call fcn.00410f50
call fcn.0042eda3
push str.invalid_stoul_argument
call fcn.00410f10
push str.stoul_argument_out_of_range
call fcn.00410f50
int3