Function at 0x140041b20
Capabilities:
Encode data using xor
Link many functions at runtime

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x1d0
mov rax, qword [0x1400ef380]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov r15, rcx
xor ebx, ebx
mov dword [r11 - 0x48], 0xccd3c5d4
mov dword [r11 - 0x44], 0x9496c8c6
mov dword [r11 - 0x40], 0xc6c5cc89
xor eax, eax
mov byte [r11 - 0x3c], al
mov edx, ebx
nop
movsxd rax, edx
lea rcx, [rsp + 0x1a0]
add rcx, rax
lea eax, [rdx - 0x61]
xor byte [rcx], al
inc edx
cmp edx, 0xc
jb 0x140041b70
mov byte [rsp + 0x1ac], 0
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r14, rax
test rax, rax
jne 0x140041bc2
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, rax
test rax, rax
je 0x1400427ba
mov dword [rsp + 0x160], 0xccc4d0d0
mov dword [rsp + 0x164], 0xc5cad6f3
mov dword [rsp + 0x168], 0xdadbc2
mov edx, ebx
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x160]
add rcx, rax
lea eax, [rdx - 0x61]
xor byte [rcx], al
inc edx
cmp edx, 0xb
jb 0x140041bf0
mov byte [rsp + 0x16b], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x180], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x190], xmm1
lea rax, [rsp + 0x160]
mov rsi, 0xffffffffffffffff
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140041c40
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x180]
call fcn.1400030a0
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], 0xf
cmova rdx, qword [rsp + 0x180]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15], rax
mov rdx, qword [rsp + 0x198]
cmp rdx, 0xf
jbe 0x140041ccb
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041cc6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400427d5
call fcn.14008983c
test rdi, rdi
je 0x1400427db
movdqa xmm0, xmmword [0x1400bb240]
movdqu xmmword [rsp + 0x160], xmm0
mov dword [rsp + 0x170], 0xc2d0defc
mov dword [rsp + 0x174], 0xc2dadcc0
xor eax, eax
mov byte [rsp + 0x178], al
mov edx, ebx
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x160]
add rcx, rax
lea eax, [rdx - 0x61]
xor byte [rcx], al
inc edx
cmp edx, 0x18
jb 0x140041d10
mov byte [rsp + 0x178], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x180], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x190], xmm1
lea rax, [rsp + 0x160]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140041d54
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x180]
call fcn.1400030a0
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], 0xf
cmova rdx, qword [rsp + 0x180]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15 + 0x38], rax
mov rdx, qword [rsp + 0x198]
cmp rdx, 0xf
jbe 0x140041de0
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041ddb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400427f6
call fcn.14008983c
test rdi, rdi
je 0x1400427fc
movdqa xmm0, xmmword [0x1400bb230]
movdqu xmmword [rsp + 0x160], xmm0
mov edx, ebx
nop dword [rax]
movsxd rax, edx
lea rcx, [rsp + 0x160]
add rcx, rax
lea eax, [rdx - 0x61]
xor byte [rcx], al
inc edx
cmp edx, 0xf
jb 0x140041e00
mov byte [rsp + 0x16f], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x180], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x190], xmm1
lea rax, [rsp + 0x160]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140041e44
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x180]
call fcn.1400030a0
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], 0xf
cmova rdx, qword [rsp + 0x180]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15 + 0x40], rax
mov rdx, qword [rsp + 0x198]
cmp rdx, 0xf
jbe 0x140041ed0
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041ecb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140042817
call fcn.14008983c
test rdi, rdi
je 0x14004281d
mov dword [rsp + 0x160], 0xc1ced2cf
mov dword [rsp + 0x164], 0x95d6d7c6
mov dword [rsp + 0x168], 0xd2cce695
mov word [rsp + 0x16c], 0xfbdf
xor eax, eax
mov byte [rsp + 0x16e], al
mov edx, ebx
nop
movsxd rax, edx
lea rcx, [rsp + 0x160]
add rcx, rax
lea eax, [rdx - 0x61]
xor byte [rcx], al
inc edx
cmp edx, 0xe
jb 0x140041f10
mov byte [rsp + 0x16e], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x180], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x190], xmm1
lea rax, [rsp + 0x160]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140041f54
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x180]
call fcn.1400030a0
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], 0xf
cmova rdx, qword [rsp + 0x180]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15 + 0x48], rax
mov rdx, qword [rsp + 0x198]
cmp rdx, 0xf
jbe 0x140041fe0
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041fdb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140042838
call fcn.14008983c
test rdi, rdi
je 0x14004283e
mov dword [rsp + 0x160], 0xd7c5cfd2
mov dword [rsp + 0x164], 0x9496c1cf
mov dword [rsp + 0x168], 0xd9dbc1e1
mov word [rsp + 0x16c], 0xfbdf
xor eax, eax
mov byte [rsp + 0x16e], al
mov edx, ebx
nop
movsxd rax, edx
lea rcx, [rsp + 0x160]
add rcx, rax
lea eax, [rdx - 0x61]
xor byte [rcx], al
inc edx
cmp edx, 0xe
jb 0x140042020
mov byte [rsp + 0x16e], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x180], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x190], xmm1
lea rax, [rsp + 0x160]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140042064
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x180]
call fcn.1400030a0
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], 0xf
cmova rdx, qword [rsp + 0x180]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15 + 0x50], rax
mov rdx, qword [rsp + 0x198]
cmp rdx, 0xf
jbe 0x1400420f0
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400420eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004285f
call fcn.14008983c
test rdi, rdi
je 0x140042865
mov dword [rsp + 0x160], 0xd7c5cfd2
mov dword [rsp + 0x164], 0x9496c1cf
mov dword [rsp + 0x168], 0xded1cde9
mov word [rsp + 0x16c], 0xfc
mov edx, ebx
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x160]
add rcx, rax
lea eax, [rdx - 0x61]
xor byte [rcx], al
inc edx
cmp edx, 0xd
jb 0x140042130
mov byte [rsp + 0x16d], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x180], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x190], xmm1
lea rax, [rsp + 0x160]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140042174
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x180]
call fcn.1400030a0
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], 0xf
cmova rdx, qword [rsp + 0x180]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15 + 0x58], rax
mov rdx, qword [rsp + 0x198]
cmp rdx, 0xf
jbe 0x140042200
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400421fb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140042886
call fcn.14008983c
test rdi, rdi
je 0x14004288c
movdqa xmm0, xmmword [0x1400bb270]
movdqu xmmword [rsp + 0x160], xmm0
mov dword [rsp + 0x170], 0xfbc8c2c0
mov dword [rsp + 0x174], 0xdad2dd
mov edx, ebx
movsxd rax, edx
lea rcx, [rsp + 0x160]
add rcx, rax
lea eax, [rdx - 0x61]
xor byte [rcx], al
inc edx
cmp edx, 0x17
jb 0x140042232
mov byte [rsp + 0x177], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x180], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x190], xmm1
lea rax, [rsp + 0x160]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140042276
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x180]
call fcn.1400030a0
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], 0xf
cmova rdx, qword [rsp + 0x180]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15 + 0x60], rax
mov rdx, qword [rsp + 0x198]
cmp rdx, 0xf
jbe 0x140042302
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400422fd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400428ad
call fcn.14008983c
test rdi, rdi
je 0x1400428b3
movdqa xmm0, xmmword [0x1400bb220]
movdqu xmmword [rsp + 0x160], xmm0
mov edx, ebx
nop
movsxd rax, edx
lea rcx, [rsp + 0x160]
add rcx, rax
lea eax, [rdx - 0x61]
xor byte [rcx], al
inc edx
cmp edx, 0xf
jb 0x140042320
mov byte [rsp + 0x16f], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x180], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x190], xmm1
lea rax, [rsp + 0x160]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140042364
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x180]
call fcn.1400030a0
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], 0xf
cmova rdx, qword [rsp + 0x180]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15 + 0x70], rax
mov rdx, qword [rsp + 0x198]
cmp rdx, 0xf
jbe 0x1400423f0
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400423eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400428d4
call fcn.14008983c
test rdi, rdi
je 0x1400428da
mov dword [rsp + 0x1b0], 0xc3d7c4de
mov dword [rsp + 0x1b4], 0x9496cdd3
mov dword [rsp + 0x1b8], 0xc6c5cc89
xor eax, eax
mov byte [rsp + 0x1bc], al
mov edx, ebx
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x1b0]
add rcx, rax
lea eax, [rdx - 0x61]
xor byte [rcx], al
inc edx
cmp edx, 0xc
jb 0x140042430
mov byte [rsp + 0x1bc], 0
lea rcx, [rsp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r14, rax
test rax, rax
jne 0x140042482
lea rcx, [rsp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, rax
test rax, rax
je 0x1400428fb
movdqa xmm0, xmmword [0x1400bb250]
movdqu xmmword [rsp + 0x160], xmm0
xor eax, eax
mov byte [rsp + 0x170], al
mov edx, ebx
nop
movsxd rax, edx
lea rcx, [rsp + 0x160]
add rcx, rax
lea eax, [rdx - 0x61]
xor byte [rcx], al
inc edx
cmp edx, 0x10
jb 0x1400424a0
mov byte [rsp + 0x170], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x180], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x190], xmm1
lea rax, [rsp + 0x160]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x1400424e4
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x180]
call fcn.1400030a0
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], 0xf
cmova rdx, qword [rsp + 0x180]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15 + 0x78], rax
mov rdx, qword [rsp + 0x198]
cmp rdx, 0xf
jbe 0x140042570
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004256b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004291c
call fcn.14008983c
test rdi, rdi
je 0x140042922
movdqa xmm0, xmmword [0x1400bb280]
movdqu xmmword [rsp + 0x160], xmm0
mov dword [rsp + 0x170], 0xd7d6d5c3
mov word [rsp + 0x174], 0xc0
mov edx, ebx
movsxd rax, edx
lea rcx, [rsp + 0x160]
add rcx, rax
lea eax, [rdx - 0x61]
xor byte [rcx], al
inc edx
cmp edx, 0x15
jb 0x1400425a1
mov byte [rsp + 0x175], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x180], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x190], xmm1
lea rax, [rsp + 0x160]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x1400425e5
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x180]
call fcn.1400030a0
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], 0xf
cmova rdx, qword [rsp + 0x180]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [r15 + 0x88], rax
mov rdx, qword [rsp + 0x198]
cmp rdx, 0xf
jbe 0x140042674
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004266f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140042943
call fcn.14008983c
test rdi, rdi
je 0x140042949
movdqa xmm0, xmmword [0x1400bb2d0]
movdqu xmmword [rsp + 0x160], xmm0
mov dword [rsp + 0x170], 0xd7c4dcce
mov word [rsp + 0x174], 0xe4
nop dword [rax]
nop word [rax + rax]
movsxd rax, ebx
lea rcx, [rsp + 0x160]
add rcx, rax
lea eax, [rbx - 0x61]
xor byte [rcx], al
inc ebx
cmp ebx, 0x15
jb 0x1400426b0
mov byte [rsp + 0x175], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x180], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x190], xmm1
lea rax, [rsp + 0x160]
inc rsi
cmp byte [rax + rsi], 0
jne 0x1400426f1
mov r8, rsi
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x180]
call fcn.1400030a0
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], 0xf
cmova rdx, qword [rsp + 0x180]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [r15 + 0x80], rax
mov rdx, qword [rsp + 0x198]
cmp rdx, 0xf
jbe 0x140042782
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004277d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004296a
call fcn.14008983c
test rbx, rbx
je 0x140042970
mov al, 1
jmp 0x140042791
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.140089cb0
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
lea rcx, [rsp + 0x28]
call fcn.14003aef0
lea rdx, [0x1400ed770]
lea rcx, [rsp + 0x28]
call fcn.14008ac10
call fcn.140090654
int3
lea rcx, [rsp + 0x40]
call fcn.14003aef0
lea rdx, [0x1400ed770]
lea rcx, [rsp + 0x40]
call fcn.14008ac10
call fcn.140090654
int3
lea rcx, [rsp + 0x58]
call fcn.14003aef0
lea rdx, [0x1400ed770]
lea rcx, [rsp + 0x58]
call fcn.14008ac10
call fcn.140090654
int3
lea rcx, [rsp + 0x70]
call fcn.14003aef0
lea rdx, [0x1400ed770]
lea rcx, [rsp + 0x70]
call fcn.14008ac10
call fcn.140090654
int3
lea rcx, [rsp + 0x88]
call fcn.14003aef0
lea rdx, [0x1400ed770]
lea rcx, [rsp + 0x88]
call fcn.14008ac10
call fcn.140090654
int3
lea rcx, [rsp + 0xa0]
call fcn.14003aef0
lea rdx, [0x1400ed770]
lea rcx, [rsp + 0xa0]
call fcn.14008ac10
call fcn.140090654
int3
lea rcx, [rsp + 0xb8]
call fcn.14003aef0
lea rdx, [0x1400ed770]
lea rcx, [rsp + 0xb8]
call fcn.14008ac10
call fcn.140090654
int3
lea rcx, [rsp + 0xd0]
call fcn.14003aef0
lea rdx, [0x1400ed770]
lea rcx, [rsp + 0xd0]
call fcn.14008ac10
call fcn.140090654
int3
lea rcx, [rsp + 0xe8]
call fcn.14003aef0
lea rdx, [0x1400ed770]
lea rcx, [rsp + 0xe8]
call fcn.14008ac10
lea rcx, [rsp + 0x100]
call fcn.14003aef0
lea rdx, [0x1400ed770]
lea rcx, [rsp + 0x100]
call fcn.14008ac10
call fcn.140090654
int3
lea rcx, [rsp + 0x118]
call fcn.14003aef0
lea rdx, [0x1400ed770]
lea rcx, [rsp + 0x118]
call fcn.14008ac10
call fcn.140090654
int3
lea rcx, [rsp + 0x130]
call fcn.14003aef0
lea rdx, [0x1400ed770]
lea rcx, [rsp + 0x130]
call fcn.14008ac10
call fcn.140090654
int3
lea rcx, [rsp + 0x148]
call fcn.14003aef0
lea rdx, [0x1400ed770]
lea rcx, [rsp + 0x148]
call fcn.14008ac10
int3