Function at 0x140042790
Capabilities:
Encode data using xor
Link many functions at runtime

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x1c0
mov rax, qword [0x1400f2688]
xor rax, rsp
mov qword [rsp + 0x1b8], rax
mov r14, rcx
mov dword [r11 - 0x40], 0xc9d4c0ef
mov dword [r11 - 0x3c], 0x9999c5cd
mov dword [r11 - 0x38], 0xc3c2c982
xor eax, eax
mov byte [r11 - 0x34], al
xor r15d, r15d
mov edx, r15d
movsxd rax, edx
lea rcx, [rsp + 0x198]
add rcx, rax
lea eax, [rdx - 0x5c]
xor byte [rcx], al
inc edx
cmp edx, 0xc
jb 0x1400427e0
mov byte [rsp + 0x1a4], r15b
lea rcx, [rsp + 0x198]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
test rax, rax
jne 0x140042832
lea rcx, [rsp + 0x198]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14004347f
mov dword [rsp + 0x158], 0xc9c3d5eb
mov dword [rsp + 0x15c], 0xc8c5dbf8
mov dword [rsp + 0x160], 0xdddec9
mov edx, r15d
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x158]
add rcx, rax
lea eax, [rdx - 0x5c]
xor byte [rcx], al
inc edx
cmp edx, 0xb
jb 0x140042860
mov byte [rsp + 0x163], r15b
mov qword [rsp + 0x178], r15
mov qword [rsp + 0x188], r15
mov qword [rsp + 0x190], reloc.OLEAUT32.dll_SafeArrayDestroy
lea rax, [rsp + 0x158]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x1400428b0
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x178]
call fcn.1400294c0
lea rdx, [rsp + 0x178]
cmp qword [rsp + 0x190], 0x10
cmovae rdx, qword [rsp + 0x178]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r14], rax
mov rdx, qword [rsp + 0x190]
cmp rdx, 0x10
jb 0x14004293b
inc rdx
mov rcx, qword [rsp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140042936
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004349a
call fcn.140087c4c
test rdi, rdi
je 0x1400434a0
movdqa xmm0, xmmword [0x1400bb3a0]
movdqu xmmword [rsp + 0x158], xmm0
mov dword [rsp + 0x168], 0xc7d7dbe7
mov dword [rsp + 0x16c], 0xcfd5d1cb
xor eax, eax
mov byte [rsp + 0x170], al
mov edx, r15d
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x158]
add rcx, rax
lea eax, [rdx - 0x5c]
xor byte [rcx], al
inc edx
cmp edx, 0x18
jb 0x140042980
mov byte [rsp + 0x170], 0
mov qword [rsp + 0x178], r15
mov qword [rsp + 0x188], r15
mov qword [rsp + 0x190], reloc.OLEAUT32.dll_SafeArrayDestroy
lea rax, [rsp + 0x158]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400429d0
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x178]
call fcn.1400294c0
lea rdx, [rsp + 0x178]
cmp qword [rsp + 0x190], 0x10
cmovae rdx, qword [rsp + 0x178]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r14 + 0x38], rax
mov rdx, qword [rsp + 0x190]
cmp rdx, 0x10
jb 0x140042a5c
inc rdx
mov rcx, qword [rsp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140042a57
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400434bb
call fcn.140087c4c
test rdi, rdi
je 0x1400434c1
movdqa xmm0, xmmword [0x1400bb390]
movdqu xmmword [rsp + 0x158], xmm0
mov edx, r15d
nop dword [rax]
movsxd rax, edx
lea rcx, [rsp + 0x158]
add rcx, rax
lea eax, [rdx - 0x5c]
xor byte [rcx], al
inc edx
cmp edx, 0xf
jb 0x140042a80
mov byte [rsp + 0x167], 0
mov qword [rsp + 0x178], r15
mov qword [rsp + 0x188], r15
mov qword [rsp + 0x190], reloc.OLEAUT32.dll_SafeArrayDestroy
lea rax, [rsp + 0x158]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140042ad0
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x178]
call fcn.1400294c0
lea rdx, [rsp + 0x178]
cmp qword [rsp + 0x190], 0x10
cmovae rdx, qword [rsp + 0x178]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r14 + 0x40], rax
mov rdx, qword [rsp + 0x190]
cmp rdx, 0x10
jb 0x140042b5c
inc rdx
mov rcx, qword [rsp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140042b57
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400434dc
call fcn.140087c4c
test rdi, rdi
je 0x1400434e2
mov dword [rsp + 0x158], 0xc4c9d7f4
mov dword [rsp + 0x15c], 0x98d9dacd
mov dword [rsp + 0x160], 0xd7cbe39e
mov word [rsp + 0x164], 0xe6c4
xor eax, eax
mov byte [rsp + 0x166], al
mov edx, r15d
nop dword [rax]
movsxd rax, edx
lea rcx, [rsp + 0x158]
add rcx, rax
lea eax, [rdx - 0x5c]
xor byte [rcx], al
inc edx
cmp edx, 0xe
jb 0x140042ba0
mov byte [rsp + 0x166], 0
mov qword [rsp + 0x178], r15
mov qword [rsp + 0x188], r15
mov qword [rsp + 0x190], reloc.OLEAUT32.dll_SafeArrayDestroy
lea rax, [rsp + 0x158]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140042bf0
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x178]
call fcn.1400294c0
lea rdx, [rsp + 0x178]
cmp qword [rsp + 0x190], 0x10
cmovae rdx, qword [rsp + 0x178]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r14 + 0x48], rax
mov rdx, qword [rsp + 0x190]
cmp rdx, 0x10
jb 0x140042c7c
inc rdx
mov rcx, qword [rsp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140042c77
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400434fd
call fcn.140087c4c
test rdi, rdi
je 0x140043503
mov dword [rsp + 0x158], 0xd2c2cae9
mov dword [rsp + 0x15c], 0x9999ccc4
mov dword [rsp + 0x160], 0xdcdcc4ea
mov word [rsp + 0x164], 0xe6c4
xor eax, eax
mov byte [rsp + 0x166], al
mov edx, r15d
nop dword [rax]
movsxd rax, edx
lea rcx, [rsp + 0x158]
add rcx, rax
lea eax, [rdx - 0x5c]
xor byte [rcx], al
inc edx
cmp edx, 0xe
jb 0x140042cc0
mov byte [rsp + 0x166], 0
mov qword [rsp + 0x178], r15
mov qword [rsp + 0x188], r15
mov qword [rsp + 0x190], reloc.OLEAUT32.dll_SafeArrayDestroy
lea rax, [rsp + 0x158]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140042d10
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x178]
call fcn.1400294c0
lea rdx, [rsp + 0x178]
cmp qword [rsp + 0x190], 0x10
cmovae rdx, qword [rsp + 0x178]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r14 + 0x50], rax
mov rdx, qword [rsp + 0x190]
cmp rdx, 0x10
jb 0x140042d9c
inc rdx
mov rcx, qword [rsp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140042d97
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140043524
call fcn.140087c4c
test rdi, rdi
je 0x14004352a
mov dword [rsp + 0x158], 0xd2c2cae9
mov dword [rsp + 0x15c], 0x9999ccc4
mov dword [rsp + 0x160], 0xdbd6c8e2
mov word [rsp + 0x164], 0xe7
mov edx, r15d
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x158]
add rcx, rax
lea eax, [rdx - 0x5c]
xor byte [rcx], al
inc edx
cmp edx, 0xd
jb 0x140042de0
mov byte [rsp + 0x165], 0
mov qword [rsp + 0x178], r15
mov qword [rsp + 0x188], r15
mov qword [rsp + 0x190], reloc.OLEAUT32.dll_SafeArrayDestroy
lea rax, [rsp + 0x158]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140042e30
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x178]
call fcn.1400294c0
lea rdx, [rsp + 0x178]
cmp qword [rsp + 0x190], 0x10
cmovae rdx, qword [rsp + 0x178]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r14 + 0x58], rax
mov rdx, qword [rsp + 0x190]
cmp rdx, 0x10
jb 0x140042ebc
inc rdx
mov rcx, qword [rsp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140042eb7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004354b
call fcn.140087c4c
test rdi, rdi
je 0x140043551
movdqa xmm0, xmmword [0x1400bb3f0]
movdqu xmmword [rsp + 0x158], xmm0
mov dword [rsp + 0x168], 0xfecfc7db
mov dword [rsp + 0x16c], 0xd5dfd6
mov edx, r15d
nop
movsxd rax, edx
lea rcx, [rsp + 0x158]
add rcx, rax
lea eax, [rdx - 0x5c]
xor byte [rcx], al
inc edx
cmp edx, 0x17
jb 0x140042ef0
mov byte [rsp + 0x16f], 0
mov qword [rsp + 0x178], r15
mov qword [rsp + 0x188], r15
mov qword [rsp + 0x190], reloc.OLEAUT32.dll_SafeArrayDestroy
lea rax, [rsp + 0x158]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140042f40
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x178]
call fcn.1400294c0
lea rdx, [rsp + 0x178]
cmp qword [rsp + 0x190], 0x10
cmovae rdx, qword [rsp + 0x178]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r14 + 0x60], rax
mov rdx, qword [rsp + 0x190]
cmp rdx, 0x10
jb 0x140042fcc
inc rdx
mov rcx, qword [rsp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140042fc7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140043572
call fcn.140087c4c
test rdi, rdi
je 0x140043578
lea rdx, str.DeviceIoControl
lea rcx, [rsp + 0x158]
call fcn.14003bcb0
mov edx, r15d
nop dword [rax]
movsxd rax, edx
lea rcx, [rsp + 0x158]
add rcx, rax
lea eax, [rdx - 0x5c]
xor byte [rcx], al
inc edx
cmp edx, 0xf
jb 0x140042ff0
mov byte [rsp + 0x167], 0
mov qword [rsp + 0x178], r15
mov qword [rsp + 0x188], r15
mov qword [rsp + 0x190], reloc.OLEAUT32.dll_SafeArrayDestroy
lea rax, [rsp + 0x158]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140043040
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x178]
call fcn.1400294c0
lea rdx, [rsp + 0x178]
cmp qword [rsp + 0x190], 0x10
cmovae rdx, qword [rsp + 0x178]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r14 + 0x70], rax
mov rdx, qword [rsp + 0x190]
cmp rdx, 0x10
jb 0x1400430cc
inc rdx
mov rcx, qword [rsp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400430c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140043599
call fcn.140087c4c
test rdi, rdi
je 0x14004359f
mov dword [rsp + 0x1a8], 0xc6d0c1e5
mov dword [rsp + 0x1ac], 0x9999c0d8
mov dword [rsp + 0x1b0], 0xc3c2c982
xor eax, eax
mov byte [rsp + 0x1b4], al
mov edx, r15d
movsxd rax, edx
lea rcx, [rsp + 0x1a8]
add rcx, rax
lea eax, [rdx - 0x5c]
xor byte [rcx], al
inc edx
cmp edx, 0xc
jb 0x140043102
mov byte [rsp + 0x1b4], 0
lea rcx, [rsp + 0x1a8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
test rax, rax
jne 0x140043154
lea rcx, [rsp + 0x1a8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1400435c0
lea rdx, str.OpenProcessToken
lea rcx, [rsp + 0x158]
call fcn.14003bc10
mov edx, r15d
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x158]
add rcx, rax
lea eax, [rdx - 0x5c]
xor byte [rcx], al
inc edx
cmp edx, 0x10
jb 0x140043170
mov byte [rsp + 0x168], 0
mov qword [rsp + 0x178], r15
mov qword [rsp + 0x188], r15
mov qword [rsp + 0x190], reloc.OLEAUT32.dll_SafeArrayDestroy
lea rax, [rsp + 0x158]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400431c0
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x178]
call fcn.1400294c0
lea rdx, [rsp + 0x178]
cmp qword [rsp + 0x190], 0x10
cmovae rdx, qword [rsp + 0x178]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r14 + 0x78], rax
mov rdx, qword [rsp + 0x190]
cmp rdx, 0x10
jb 0x14004324c
inc rdx
mov rcx, qword [rsp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140043247
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400435e1
call fcn.140087c4c
test rdi, rdi
je 0x1400435e7
lea rdx, str.AdjustTokenPrivileges
lea rcx, [rsp + 0x158]
call fcn.14003bb40
mov edx, r15d
nop dword [rax]
movsxd rax, edx
lea rcx, [rsp + 0x158]
add rcx, rax
lea eax, [rdx - 0x5c]
xor byte [rcx], al
inc edx
cmp edx, 0x15
jb 0x140043270
mov byte [rsp + 0x16d], 0
mov qword [rsp + 0x178], r15
mov qword [rsp + 0x188], r15
mov qword [rsp + 0x190], reloc.OLEAUT32.dll_SafeArrayDestroy
lea rax, [rsp + 0x158]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400432c0
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x178]
call fcn.1400294c0
lea rdx, [rsp + 0x178]
cmp qword [rsp + 0x190], 0x10
cmovae rdx, qword [rsp + 0x178]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r14 + 0x88], rax
mov rdx, qword [rsp + 0x190]
cmp rdx, 0x10
jb 0x14004334f
inc rdx
mov rcx, qword [rsp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004334a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140043608
call fcn.140087c4c
test rdi, rdi
je 0x14004360e
lea rdx, str.LookupPrivilegeValueW
lea rcx, [rsp + 0x158]
call fcn.14003bb40
mov edx, r15d
nop
movsxd rax, edx
lea rcx, [rsp + 0x158]
add rcx, rax
lea eax, [rdx - 0x5c]
xor byte [rcx], al
inc edx
cmp edx, 0x15
jb 0x140043370
mov byte [rsp + 0x16d], 0
mov qword [rsp + 0x178], r15
mov qword [rsp + 0x188], r15
mov qword [rsp + 0x190], reloc.OLEAUT32.dll_SafeArrayDestroy
lea rax, [rsp + 0x158]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400433b6
mov r8, rbx
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x178]
call fcn.1400294c0
lea rdx, [rsp + 0x178]
cmp qword [rsp + 0x190], 0x10
cmovae rdx, qword [rsp + 0x178]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [r14 + 0x80], rax
mov rdx, qword [rsp + 0x190]
cmp rdx, 0x10
jb 0x140043447
inc rdx
mov rcx, qword [rsp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140043442
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004362f
call fcn.140087c4c
test rbx, rbx
je 0x140043635
mov al, 1
jmp 0x140043456
mov rcx, qword [rsp + 0x1b8]
xor rcx, rsp
call fcn.140088250
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
lea rcx, [rsp + 0x20]
call fcn.14003c710
lea rdx, [0x1400f0828]
lea rcx, [rsp + 0x20]
call fcn.1400891b4
call fcn.14008e46c
int3
lea rcx, [rsp + 0x38]
call fcn.14003c710
lea rdx, [0x1400f0828]
lea rcx, [rsp + 0x38]
call fcn.1400891b4
call fcn.14008e46c
int3
lea rcx, [rsp + 0x50]
call fcn.14003c710
lea rdx, [0x1400f0828]
lea rcx, [rsp + 0x50]
call fcn.1400891b4
call fcn.14008e46c
int3
lea rcx, [rsp + 0x68]
call fcn.14003c710
lea rdx, [0x1400f0828]
lea rcx, [rsp + 0x68]
call fcn.1400891b4
call fcn.14008e46c
int3
lea rcx, [rsp + 0x80]
call fcn.14003c710
lea rdx, [0x1400f0828]
lea rcx, [rsp + 0x80]
call fcn.1400891b4
call fcn.14008e46c
int3
lea rcx, [rsp + 0x98]
call fcn.14003c710
lea rdx, [0x1400f0828]
lea rcx, [rsp + 0x98]
call fcn.1400891b4
call fcn.14008e46c
int3
lea rcx, [rsp + 0xb0]
call fcn.14003c710
lea rdx, [0x1400f0828]
lea rcx, [rsp + 0xb0]
call fcn.1400891b4
call fcn.14008e46c
int3
lea rcx, [rsp + 0xc8]
call fcn.14003c710
lea rdx, [0x1400f0828]
lea rcx, [rsp + 0xc8]
call fcn.1400891b4
call fcn.14008e46c
int3
lea rcx, [rsp + 0xe0]
call fcn.14003c710
lea rdx, [0x1400f0828]
lea rcx, [rsp + 0xe0]
call fcn.1400891b4
lea rcx, [rsp + 0xf8]
call fcn.14003c710
lea rdx, [0x1400f0828]
lea rcx, [rsp + 0xf8]
call fcn.1400891b4
call fcn.14008e46c
int3
lea rcx, [rsp + 0x110]
call fcn.14003c710
lea rdx, [0x1400f0828]
lea rcx, [rsp + 0x110]
call fcn.1400891b4
call fcn.14008e46c
int3
lea rcx, [rsp + 0x128]
call fcn.14003c710
lea rdx, [0x1400f0828]
lea rcx, [rsp + 0x128]
call fcn.1400891b4
call fcn.14008e46c
int3
lea rcx, [rsp + 0x140]
call fcn.14003c710
lea rdx, [0x1400f0828]
lea rcx, [rsp + 0x140]
call fcn.1400891b4
int3