Function at 0x4015f0
Capabilities:
Encode data using xor
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x448040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4454fc]
movq xmm0, qword [str.kernel32.dll]
mov dword [ebp - 0x6c], eax
movzx eax, byte [0x445500]
movq qword [ebp - 0x74], xmm0
mov byte [ebp - 0x68], al
mov al, byte [ebp - 0x74]
push ebx
mov ebx, ecx
lea ecx, [ebp - 0x74]
push edi
test al, al
je 0x40163e
xor al, 0x5a
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
mov al, byte [ecx]
test al, al
jne 0x401630
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x124]
push 0x40
push eax
call fcn.00408f60
mov al, byte [ebp - 0x124]
lea ecx, [ebp - 0x124]
add esp, 0xc
test al, al
je 0x401671
xor al, 0x5a
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
mov al, byte [ecx]
test al, al
jne 0x401663
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
jne 0x401696
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004025d0
mov esp, ebp
pop ebp
ret
mov eax, dword [0x44550c]
lea ecx, [ebp - 0x54]
movq xmm0, qword [str.CreateProcessA]
mov dword [ebp - 0x4c], eax
mov ax, word [0x445510]
mov word [ebp - 0x48], ax
movzx eax, byte [0x445512]
movq qword [ebp - 0x54], xmm0
mov byte [ebp - 0x46], al
mov al, byte [ebp - 0x54]
test al, al
je 0x4016de
nop dword [eax]
xor al, 0x5a
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
mov al, byte [ecx]
test al, al
jne 0x4016d0
movups xmm0, xmmword [str.GetThreadContext]
mov al, byte [0x445524]
lea edx, [ebp - 0xbc]
mov byte [ebp - 0xac], al
movd ecx, xmm0
movups xmmword [ebp - 0xbc], xmm0
test cl, cl
je 0x401716
xor cl, 0x5a
lea edx, [edx + 1]
mov byte [edx - 1], cl
mov al, byte [edx]
mov cl, al
test al, al
jne 0x401705
movups xmm0, xmmword [str.SetThreadContext]
mov al, byte [0x445538]
lea edx, [ebp - 0xd0]
mov byte [ebp - 0xc0], al
movd ecx, xmm0
movups xmmword [ebp - 0xd0], xmm0
test cl, cl
je 0x401751
nop dword [eax]
xor cl, 0x5a
lea edx, [edx + 1]
mov byte [edx - 1], cl
mov al, byte [edx]
mov cl, al
test al, al
jne 0x401740
movups xmm0, xmmword [str.ReadProcessMemory]
mov ax, word [0x44554c]
lea edx, [ebp - 0xe4]
mov word [ebp - 0xd4], ax
movd ecx, xmm0
movups xmmword [ebp - 0xe4], xmm0
test cl, cl
je 0x401791
nop word [eax + eax]
xor cl, 0x5a
lea edx, [edx + 1]
mov byte [edx - 1], cl
mov al, byte [edx]
mov cl, al
test al, al
jne 0x401780
movups xmm0, xmmword [str.WriteProcessMemory]
mov ax, word [0x445560]
lea edx, [ebp - 0xa8]
mov word [ebp - 0x98], ax
mov al, byte [0x445562]
movd ecx, xmm0
movups xmmword [ebp - 0xa8], xmm0
mov byte [ebp - 0x96], al
test cl, cl
je 0x4017d6
xor cl, 0x5a
lea edx, [edx + 1]
mov byte [edx - 1], cl
mov al, byte [edx]
mov cl, al
test al, al
jne 0x4017c5
mov eax, dword [0x44556c]
lea ecx, [ebp - 0x64]
movq xmm0, qword [str.VirtualAllocEx]
mov dword [ebp - 0x5c], eax
mov ax, word [0x445570]
mov word [ebp - 0x58], ax
movzx eax, byte [0x445572]
movq qword [ebp - 0x64], xmm0
mov byte [ebp - 0x56], al
mov al, byte [ebp - 0x64]
test al, al
je 0x40181e
nop dword [eax]
xor al, 0x5a
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
mov al, byte [ecx]
test al, al
jne 0x401810
mov eax, dword [0x44557c]
lea ecx, [ebp - 0x84]
movq xmm0, qword [str.VirtualAlloc]
mov dword [ebp - 0x7c], eax
movzx eax, byte [0x445580]
movq qword [ebp - 0x84], xmm0
mov byte [ebp - 0x78], al
mov al, byte [ebp - 0x84]
test al, al
je 0x40185e
xor al, 0x5a
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
mov al, byte [ecx]
test al, al
jne 0x401850
mov eax, dword [0x44558c]
lea ecx, [ebp - 0x94]
movq xmm0, qword [str.ResumeThread]
mov dword [ebp - 0x8c], eax
movzx eax, byte [0x445590]
movq qword [ebp - 0x94], xmm0
mov byte [ebp - 0x88], al
mov al, byte [ebp - 0x94]
test al, al
je 0x4018a4
xor al, 0x5a
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
mov al, byte [ecx]
test al, al
jne 0x401896
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push 0x40
push eax
call fcn.00408f60
mov al, byte [ebp - 0x44]
lea ecx, [ebp - 0x44]
add esp, 0xc
test al, al
je 0x4018ce
xor al, 0x5a
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
mov al, byte [ecx]
test al, al
jne 0x4018c0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea eax, [ebp - 0x44]
push eax
push edi
call esi
mov dword [ebx], eax
lea eax, [ebp - 0xbc]
push eax
lea eax, [ebp - 0x44]
push 0x40
push eax
call fcn.00408f60
mov al, byte [ebp - 0x44]
lea ecx, [ebp - 0x44]
add esp, 0xc
test al, al
je 0x40190e
nop dword [eax]
xor al, 0x5a
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
mov al, byte [ecx]
test al, al
jne 0x401900
lea eax, [ebp - 0x44]
push eax
push edi
call esi
mov dword [ebx + 4], eax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x44]
push 0x40
push eax
call fcn.00408f60
mov al, byte [ebp - 0x44]
lea ecx, [ebp - 0x44]
add esp, 0xc
test al, al
je 0x401945
xor al, 0x5a
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
mov al, byte [ecx]
test al, al
jne 0x401937
lea eax, [ebp - 0x44]
push eax
push edi
call esi
mov dword [ebx + 8], eax
lea eax, [ebp - 0xe4]
push eax
lea eax, [ebp - 0x44]
push 0x40
push eax
call fcn.00408f60
mov al, byte [ebp - 0x44]
lea ecx, [ebp - 0x44]
add esp, 0xc
test al, al
je 0x40197e
nop
xor al, 0x5a
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
mov al, byte [ecx]
test al, al
jne 0x401970
lea eax, [ebp - 0x44]
push eax
push edi
call esi
mov dword [ebx + 0xc], eax
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x44]
push 0x40
push eax
call fcn.00408f60
mov al, byte [ebp - 0x44]
lea ecx, [ebp - 0x44]
add esp, 0xc
test al, al
je 0x4019b5
xor al, 0x5a
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
mov al, byte [ecx]
test al, al
jne 0x4019a7
lea eax, [ebp - 0x44]
push eax
push edi
call esi
mov dword [ebx + 0x10], eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x44]
push 0x40
push eax
call fcn.00408f60
mov al, byte [ebp - 0x44]
lea ecx, [ebp - 0x44]
add esp, 0xc
test al, al
je 0x4019ee
nop dword [eax + eax]
xor al, 0x5a
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
mov al, byte [ecx]
test al, al
jne 0x4019e0
lea eax, [ebp - 0x44]
push eax
push edi
call esi
mov dword [ebx + 0x14], eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x44]
push 0x40
push eax
call fcn.00408f60
mov al, byte [ebp - 0x44]
lea ecx, [ebp - 0x44]
add esp, 0xc
test al, al
je 0x401a25
xor al, 0x5a
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
mov al, byte [ecx]
test al, al
jne 0x401a17
lea eax, [ebp - 0x44]
push eax
push edi
call esi
mov dword [ebx + 0x18], eax
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x44]
push 0x40
push eax
call fcn.00408f60
mov al, byte [ebp - 0x44]
lea ecx, [ebp - 0x44]
add esp, 0xc
test al, al
je 0x401a5e
nop
xor al, 0x5a
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
mov al, byte [ecx]
test al, al
jne 0x401a50
lea eax, [ebp - 0x44]
push eax
push edi
call esi
mov ecx, dword [ebp - 4]
pop esi
mov dword [ebx + 0x1c], eax
xor ecx, ebp
pop edi
mov al, 1
pop ebx
call fcn.004025d0
mov esp, ebp
pop ebp
ret