The dropped payload is a DLL file that has been packed using the UPX packer. The unpacked sample is highly obfuscated and important API calls and strings have been encrypted using a custom encryption algorithm. Whenever in the code the malware needs to use a string, it takes the encrypted string and passes it into two functions to decrypt it