Function at 0x1800725f4
Capabilities:
Accept command line arguments
Create thread
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x3d0
xor ebx, ebx
test edx, edx
je 0x180073087
cmp edx, 1
jne 0x1800731ad
mov r8d, 0x104
lea r12, [0x18010a5f0]
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x180072910
mov rdx, r12
lea rcx, [rsp + 0x150]
call fcn.1800085d8
nop
lea rcx, [rsp + 0x150]
call fcn.18007193c
test al, al
jne 0x1800728f0
lea rcx, [rsp + 0x150]
call fcn.1800714c0
test al, al
jne 0x1800728f0
lea rcx, [rsp + 0x150]
call fcn.180071264
test al, al
jne 0x1800728f0
lea rcx, [rsp + 0x150]
call fcn.1800710a8
test al, al
jne 0x1800728f0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], bl
lea r9, str.jnwnzvagreargraunaprefreivpr
mov r8b, bl
lea edx, [rbx + 0x1c]
lea rcx, [rsp + 0x40]
call fcn.180003a38
nop
lea r14, [rsp + 0x40]
mov rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x58]
cmp r8, 0x10
cmovae r14, rdx
lea r15, [rsp + 0x40]
cmovae r15, rdx
mov rcx, qword [rsp + 0x50]
add r15, rcx
lea rsi, [rsp + 0x40]
cmp r8, 0x10
cmovae rsi, rdx
lea edi, [rbx + 1]
cmp rsi, r15
je 0x180072732
mov cl, byte [rsi]
call fcn.180099128
mov byte [r14], al
add rsi, rdi
add r14, rdi
mov r8, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x40]
jmp 0x18007270c
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 4
jb 0x1800731ce
lea r9, [rsp + 0x40]
cmp r8, 0x10
cmovae r9, rdx
mov qword [rsp + 0x30], 4
lea rax, str..exe
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r8, [rsp + 0x40]
mov dl, byte [rsp + 0x408]
lea rcx, [rsp + 0xc8]
call fcn.1800090dc
nop
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rbx
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x70]
call fcn.180003170
lea rdx, [rsp + 0xc8]
cmp qword [rsp + 0xe0], 0x10
cmovae rdx, qword [rsp + 0xc8]
lea rcx, [rsp + 0x70]
cmp qword [rsp + 0x88], 0x10
cmovae rcx, qword [rsp + 0x70]
call fcn.1800a84ac
test eax, eax
sete sil
mov rdx, qword [rsp + 0x88]
mov r14d, 0x1000
cmp rdx, 0x10
jb 0x18007282c
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, r14
jb 0x180072827
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800731d4
call fcn.18009d1f4
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x70], bl
mov rdx, qword [rsp + 0xe0]
cmp rdx, 0x10
jb 0x180072883
inc rdx
mov rcx, qword [rsp + 0xc8]
mov rax, rcx
cmp rdx, r14
jb 0x18007287e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800731da
call fcn.18009d1f4
movzx eax, byte [0x18010a5a5]
test sil, sil
cmovne eax, edi
mov byte [0x18010a5a5], al
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x1800728cf
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, r14
jb 0x1800728ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800731e0
call fcn.18009d1f4
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], bl
lea rcx, [rsp + 0x150]
call fcn.18000d260
jmp 0x18007291b
mov edi, 1
mov byte [0x18010a5df], dil
lea rcx, [rsp + 0x150]
call fcn.18000d260
mov eax, edi
jmp 0x1800731b6
mov edi, 1
mov r14d, 0x1000
jmp 0x18007292f
call fcn.180093b2c
call fcn.18005cb50
mov sil, al
test al, al
jne 0x18007294b
call fcn.18000ce3c
test al, al
mov al, bl
je 0x18007294e
mov al, dil
mov byte [0x18010a5de], al
call fcn.18005cbb8
test al, al
je 0x180072974
call fcn.180007af8
test al, al
je 0x180072974
call fcn.18000f3c4
test al, al
jne 0x180072974
call fcn.180070d3c
cmp byte [0x18010a5de], bl
je 0x180072ae8
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea rdx, str.__type
mov rcx, rax
call fcn.18009eb24
test rax, rax
jne 0x1800729a3
mov byte [0x18010a5dc], dil
jmp 0x1800729e7
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea rdx, [0x1800d5c10]
mov rcx, rax
call fcn.18009eb24
test rax, rax
jne 0x1800729e0
call fcn.18000ce10
test al, al
je 0x1800729e7
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea rdx, str.__typeutility
mov rcx, rax
call fcn.18009eb24
test rax, rax
je 0x1800729e7
mov byte [0x18010a5dd], dil
mov rdx, r12
lea rcx, [rsp + 0xe8]
call fcn.180070850
lea rcx, [0x1801025d0]
cmp rcx, rax
je 0x180072a0e
mov r8b, bl
mov rdx, rax
call fcn.180007418
mov rdx, qword [rsp + 0x100]
cmp rdx, 0x10
jb 0x180072a4d
inc rdx
mov rcx, qword [rsp + 0xe8]
mov rax, rcx
cmp rdx, r14
jb 0x180072a48
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800731e6
call fcn.18009d1f4
cmp byte [0x18010a5dc], bl
jne 0x180072a61
cmp byte [0x18010a5dd], bl
je 0x180072ae8
call fcn.18000ce10
test al, al
jne 0x180072ada
mov r9b, sil
mov r8b, byte [0x18010a5dd]
mov rdx, r12
lea rcx, [rsp + 0x108]
call fcn.18006f7d8
lea rcx, [0x1801025b0]
cmp rcx, rax
je 0x180072a9b
mov r8b, bl
mov rdx, rax
call fcn.180007418
mov rdx, qword [rsp + 0x120]
cmp rdx, 0x10
jb 0x180072ada
inc rdx
mov rcx, qword [rsp + 0x108]
mov rax, rcx
cmp rdx, r14
jb 0x180072ad5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800731ec
call fcn.18009d1f4
call fcn.18000f3c4
test al, al
jne 0x180072ae8
call fcn.180070d3c
mov rcx, rbx
mov al, byte [rcx + r12]
mov byte [rsp + rcx + 0x1b0], al
add rcx, rdi
test al, al
jne 0x180072aeb
lea rcx, [rsp + 0x1b0]
call fcn.1800a4a50
xorps xmm0, xmm0
movups xmmword [0x18010a5c0], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x18010a5c0], eax
mov dword [0x18010a5c4], edi
call fcn.180099824
mov dword [0x18010a5d0], eax
call fcn.180099824
mov dword [0x18010a5d4], eax
call fcn.180099824
mov dword [0x18010a5d8], eax
call fcn.18005cf84
test al, al
jne 0x180072b59
call fcn.18005d000
test al, al
je 0x180072b64
call fcn.1800927c8
or dword [0x18010a5cc], eax
mov r15, qword [rsp + 0x400]
mov qword [0x18010a5b8], r15
mov r8d, 0x105
lea rsi, [0x18010a700]
mov rdx, rsi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea r8, [0x18010ac88]
mov rdx, rsi
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExA]
lea rax, [rsp + 0x2c8]
mov qword [rsp + 0x2c0], rax
mov r8d, 3
mov rdx, rsi
lea rcx, [rsp + 0x2c0]
call fcn.180070c30
mov r8, qword [rsp + 0x2c0]
mov edx, 0x105
lea rcx, [0x18010a810]
call fcn.1800af140
lea rax, [rsp + 0x2c8]
mov rcx, qword [rsp + 0x2c0]
cmp rcx, rax
je 0x180072bf7
call fcn.1800a89bc
xor r8d, r8d
lea edx, [r8 + 0x12]
mov cl, dil
call fcn.18006e4c8
test al, al
je 0x180072c3f
call fcn.18006ffe0
lea rdx, [0x1801025f0]
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rdx, qword [0x1801025f0]
mov rcx, r12
call fcn.1800a8764
test eax, eax
sete byte [0x18010a5a7]
test eax, eax
je 0x1800731ad
call fcn.180085050
mov rcx, r12
call fcn.1800882f8
mov byte [0x18010a5a6], al
mov rdx, r15
lea rcx, [rsp + 0x60]
call fcn.18000ee68
nop
lea rdx, [rsp + 0x90]
mov rcx, rax
call fcn.18000eedc
nop
cmp qword [rax + 0x18], 0x10
jb 0x180072c7b
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0xb8]
call fcn.1800098d0
nop
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0x10
jb 0x180072ccb
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, r14
jb 0x180072cc6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800731f2
call fcn.18009d1f4
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x90], bl
lea rcx, [rsp + 0x60]
call fcn.1800098c4
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0xb8]
call fcn.180009bfc
call fcn.1800658a0
mov rsi, rax
mov qword [rax + 8], r15
mov r8d, 4
lea rdx, [rsp + 0x128]
lea rcx, [rsp + 0xb0]
call fcn.18000eb74
lea rcx, [rsi + 0x70]
cmp rcx, rax
je 0x180072d40
mov r8b, bl
mov rdx, rax
call fcn.180007418
mov rdx, qword [rsp + 0x140]
cmp rdx, 0x10
jb 0x180072d7f
inc rdx
mov rcx, qword [rsp + 0x128]
mov rax, rcx
cmp rdx, r14
jb 0x180072d7a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800731f8
call fcn.18009d1f4
lea rdx, str.firefox.exe
lea rcx, [rsp + 0x1b0]
call fcn.18009eb24
test rax, rax
jne 0x180072e32
lea rdx, str.iexplore.exe
lea rcx, [rsp + 0x1b0]
call fcn.18009eb24
test rax, rax
jne 0x180072e32
lea rdx, str.waol.exe
lea rcx, [rsp + 0x1b0]
call fcn.18009eb24
test rax, rax
jne 0x180072e32
lea rdx, str.aolbrowser.exe
lea rcx, [rsp + 0x1b0]
call fcn.18009eb24
test rax, rax
jne 0x180072e32
lea rdx, str.aoldesktop.exe
lea rcx, [rsp + 0x1b0]
call fcn.18009eb24
test rax, rax
jne 0x180072e32
lea rdx, str.aolhelix.exe
lea rcx, [rsp + 0x1b0]
call fcn.18009eb24
test rax, rax
jne 0x180072e32
lea rdx, str.msn.exe
lea rcx, [rsp + 0x1b0]
call fcn.18009eb24
test rax, rax
je 0x180072e38
mov dword [0x18010a5b4], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [0x18010a5e0], rax
call fcn.180049f74
test al, al
jne 0x180072e6c
call fcn.180049e38
test al, al
jne 0x180072e6c
call fcn.18004a0b0
test al, al
mov al, bl
je 0x180072e6f
mov al, dil
mov byte [0x18010a5a4], al
call fcn.180007af8
test al, al
jne 0x180072f7c
call fcn.18005ceb8
test al, al
je 0x180072f7c
call fcn.18006a890
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx]
call fcn.18006a890
mov r8, qword [rax]
mov dl, dil
mov rcx, rax
call qword [r8 + 0x18]
mov al, byte [0x18010a364]
test al, al
je 0x180072f25
call fcn.1800658a0
lea rsi, [rax + 0x70]
cmp qword [rsi + 0x18], 0x10
jb 0x180072ecb
mov rsi, qword [rsi]
lea rcx, [rsp + 0x408]
call fcn.18006e22c
mov r9, rax
movabs r14, 0xd993efbb19cfe32d
cmp byte [rax + 0x13], bl
je 0x180072f0d
mov r8, rbx
mov cl, r8b
and cl, 7
shl cl, 3
mov rax, r14
shr rax, cl
xor byte [r8 + r9], al
add r8, rdi
cmp r8, 0x13
jb 0x180072eed
mov byte [r9 + 0x13], bl
mov r8, rsi
mov rdx, r9
mov ecx, 4
call fcn.18006a848
mov al, byte [0x18010a364]
jmp 0x180072f2f
movabs r14, 0xd993efbb19cfe32d
cmp byte [0x18010a5a6], bl
je 0x180072f7c
test al, al
je 0x180072f7c
lea rcx, [rsp + 0x408]
call fcn.18006db9c
cmp byte [rax + 0x41], bl
je 0x180072f6f
mov r9, rbx
mov cl, r9b
and cl, 7
shl cl, 3
mov r8, r14
shr r8, cl
xor byte [r9 + rax], r8b
add r9, rdi
cmp r9, 0x41
jb 0x180072f50
mov byte [rax + 0x41], bl
mov rdx, rax
mov ecx, 4
call fcn.18006a848
call fcn.18005cb50
test al, al
jne 0x180072fa0
call fcn.18005cf84
test al, al
jne 0x180072fa0
call fcn.18005cbb8
test al, al
jne 0x180072fa0
call fcn.18000ce3c
test al, al
je 0x180072fd0
xor eax, eax
lock cmpxchg dword [0x18010a808], edi
jne 0x180072fd0
lea rax, [rsp + 0x418]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
xor r9d, r9d
lea r8, [0x180071b6c]
xor edx, edx
xor ecx, ecx
call fcn.1800a8cdc
cmp byte [0x18010a5a5], bl
jne 0x180072ff2
call fcn.18005cb28
test al, al
jne 0x180072ff2
call fcn.18005cf08
test al, al
jne 0x180072ff2
cmp byte [0x18010a5a6], bl
je 0x180073032
call fcn.18000f3c4
test al, al
jne 0x180073002
call fcn.180070d3c
jmp 0x180073032
xor eax, eax
lock cmpxchg dword [0x18010a808], edi
jne 0x180073032
lea rax, [rsp + 0x408]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
xor r9d, r9d
lea r8, [0x180071b6c]
xor edx, edx
xor ecx, ecx
call fcn.1800a8cdc
call fcn.180071040
test al, al
jne 0x180073044
call fcn.18000f3c4
test al, al
je 0x180073049
call fcn.18006efe0
call fcn.18005cbb8
test al, al
je 0x180073075
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call fcn.1800815dc
mov qword [0x18010a5e8], rax
test rax, rax
je 0x180073075
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
nop
lea rcx, [rsp + 0xb8]
call fcn.180005f10
jmp 0x1800731ad
cmp byte [0x18010a5a7], bl
jne 0x1800731ad
mov rcx, qword [0x18010a5e8]
test rcx, rcx
je 0x1800730a5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x18010a5df], bl
je 0x1800730b7
mov eax, 1
jmp 0x1800731b6
cmp dword [0x18010a060], ebx
je 0x1800730d6
call fcn.180069d9c
mov edx, 0x1388
mov rcx, qword [0x18010a068]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x18010a5e0]
test rcx, rcx
je 0x1800730e8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x68], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x64], ebx
call fcn.18005d848
call fcn.180047b48
call fcn.18005cbb8
test al, al
je 0x18007311d
cmp byte [0x18010ad71], bl
jne 0x18007311d
xor ecx, ecx
call fcn.18005ec58
call fcn.18005e4b0
lea rcx, [rsp + 0x90]
call fcn.18003d8c0
nop
mov edx, 0x53b
lea rcx, [rsp + 0x90]
call fcn.18003e08c
xor r9d, r9d
lea r8d, [r9 + 0x10]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x90]
call fcn.18003de9c
call fcn.180049c04
mov r8d, 0x3e8
lea rdx, [rsp + 0x90]
mov rcx, rax
call fcn.180077c5c
call fcn.180072560
mov edx, 0x9c4
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.1800721b0
call fcn.180072178
call fcn.1800721e8
call fcn.180072210
nop
lea rcx, [rsp + 0x90]
call fcn.18001d6c0
nop
mov eax, 1
jmp 0x1800731b6
mov rbx, qword [rsp + 0x410]
add rsp, 0x3d0
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call fcn.180001e88
nop
call fcn.1800a45b8
nop
call fcn.1800a45b8
nop
call fcn.1800a45b8
nop
call fcn.1800a45b8
int3
call fcn.1800a45b8
nop
call fcn.1800a45b8
nop
call fcn.1800a45b8
int3