Function at 0x5a3290
Capabilities:
Check os version
Encode data using xor
Link many functions at runtime

Disassembly:
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x5a32b0
mov dword [0x6755e4], 2
mov dword [0x6755e8], 1
push ebx
push esi
push edi
xor eax, eax
mov bl, 0xaa
mov cl, byte [eax + 0x67568c]
xor cl, bl
mov byte [eax + 0x67568c], cl
inc eax
cmp eax, 0xa
jb 0x5a32b7
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x67568c
call esi
mov dword [0xd14b04], eax
xor ecx, ecx
mov dl, byte [ecx + 0x67568c]
xor dl, bl
mov byte [ecx + 0x67568c], dl
inc ecx
cmp ecx, 0xa
jb 0x5a32df
xor ecx, ecx
mov dl, byte [ecx + 0x6756bc]
xor dl, bl
mov byte [ecx + 0x6756bc], dl
inc ecx
cmp ecx, 9
jb 0x5a32f5
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x6756bc
push eax
call edi
mov dword [0xd14b08], eax
xor eax, eax
mov cl, byte [eax + 0x6756bc]
xor cl, bl
mov byte [eax + 0x6756bc], cl
inc eax
cmp eax, 9
jb 0x5a331e
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x5a33f7
mov eax, dword [0xd14b08]
push 2
push eax
push 0xd14ae8
call fcn.005a3250
add esp, 0xc
xor eax, eax
mov cl, byte [eax + 0x675720]
xor cl, bl
mov byte [eax + 0x675720], cl
inc eax
cmp eax, 0xb
jb 0x5a3357
mov ecx, dword [0xd14b04]
push 0x675720
push ecx
call edi
mov dword [0xd14b08], eax
xor ecx, ecx
mov dl, byte [ecx + 0x675720]
xor dl, bl
mov byte [ecx + 0x675720], dl
inc ecx
cmp ecx, 0xb
jb 0x5a3380
push 3
push eax
push 0xd14ab8
call fcn.005a3250
add esp, 0xc
xor eax, eax
mov cl, byte [eax + 0x67572c]
xor cl, bl
mov byte [eax + 0x67572c], cl
inc eax
cmp eax, 0xb
jb 0x5a33a6
mov edx, dword [0xd14b04]
push 0x67572c
push edx
call edi
mov dword [0xd14b08], eax
xor ecx, ecx
mov dl, byte [ecx + 0x67572c]
xor dl, bl
mov byte [ecx + 0x67572c], dl
inc ecx
cmp ecx, 0xb
jb 0x5a33cf
push 3
push eax
push 0xd14abc
call fcn.005a3250
add esp, 0xc
pop edi
pop esi
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, dword [0xd14b08]
push 0
push 3
push 0xd14ae8
push ecx
push eax
mov dword [0xd14b0c], eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xor eax, eax
mov cl, byte [eax + 0x67567c]
xor cl, bl
mov byte [eax + 0x67567c], cl
inc eax
cmp eax, 0xc
jb 0x5a341b
push 0x67567c
call esi
mov dword [0xd14b04], eax
xor ecx, ecx
mov dl, byte [ecx + 0x67567c]
xor dl, bl
mov byte [ecx + 0x67567c], dl
inc ecx
cmp ecx, 0xc
jb 0x5a343d
xor ecx, ecx
mov dl, byte [ecx + 0x675738]
xor dl, bl
mov byte [ecx + 0x675738], dl
inc ecx
cmp ecx, 0x11
jb 0x5a3453
push 0x675738
push eax
call edi
mov dword [0xd14a94], eax
xor eax, eax
mov cl, byte [eax + 0x675738]
xor cl, bl
mov byte [eax + 0x675738], cl
inc eax
cmp eax, 0x11
jb 0x5a3476
xor eax, eax
mov cl, byte [eax + 0x6756d4]
xor cl, bl
mov byte [eax + 0x6756d4], cl
inc eax
cmp eax, 0xd
jb 0x5a348c
mov edx, dword [0xd14b04]
push 0x6756d4
push edx
call edi
mov dword [0xd14a98], eax
xor eax, eax
mov cl, byte [eax + 0x6756d4]
xor cl, bl
mov byte [eax + 0x6756d4], cl
inc eax
cmp eax, 0xd
jb 0x5a34b5
xor eax, eax
mov cl, byte [eax + 0x6756e4]
xor cl, bl
mov byte [eax + 0x6756e4], cl
inc eax
cmp eax, 0xc
jb 0x5a34cb
mov eax, dword [0xd14b04]
push 0x6756e4
push eax
call edi
mov dword [0xd14a9c], eax
xor eax, eax
mov cl, byte [eax + 0x6756e4]
xor cl, bl
mov byte [eax + 0x6756e4], cl
inc eax
cmp eax, 0xc
jb 0x5a34f3
xor eax, eax
mov cl, byte [eax + 0x6756f4]
xor cl, bl
mov byte [eax + 0x6756f4], cl
inc eax
cmp eax, 0x10
jb 0x5a3509
mov ecx, dword [0xd14b04]
push 0x6756f4
push ecx
call edi
mov dword [0xd14aa0], eax
xor eax, eax
mov cl, byte [eax + 0x6756f4]
xor cl, bl
mov byte [eax + 0x6756f4], cl
inc eax
cmp eax, 0x10
jb 0x5a3532
xor eax, eax
mov cl, byte [eax + 0x675708]
xor cl, bl
mov byte [eax + 0x675708], cl
inc eax
cmp eax, 0x15
jb 0x5a3548
mov edx, dword [0xd14b04]
push 0x675708
push edx
call edi
mov dword [0xd14aa4], eax
xor ecx, ecx
mov dl, byte [ecx + 0x675708]
xor dl, bl
mov byte [ecx + 0x675708], dl
inc ecx
cmp ecx, 0x15
jb 0x5a3571
mov ecx, dword [0xd14a94]
mov edx, dword [0xd14a98]
mov dword [0xd14af0], ecx
mov ecx, dword [0xd14a9c]
mov dword [0xd14af4], edx
mov edx, dword [0xd14aa0]
pop edi
pop esi
mov dword [0xd14af8], ecx
mov dword [0xd14afc], edx
mov dword [0xd14b00], eax
pop ebx
ret