Function at 0x18001b988
Capabilities:
Encode data using xor
Get hostname
Get session user name

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rbx, rcx
mov ecx, 0x500
call fcn.18001652c
mov edx, 0x100
mov rcx, rax
mov r12, rax
call fcn.1800168f4
mov edx, 0x100
mov rcx, r12
mov rsi, rax
call fcn.1800168f4
mov edx, 0x100
mov rcx, r12
mov r15, rax
call fcn.1800168f4
mov edi, 0x80
mov rcx, r12
mov edx, edi
mov r14, rax
call fcn.1800168f4
mov edx, edi
mov rcx, r12
call fcn.1800168f4
mov qword [0x180051cf8], rbx
mov ebx, 0x100
xor r13d, r13d
mov edx, ebx
mov rcx, r12
mov edi, r13d
call fcn.1800168f4
mov r8d, ebx
mov rcx, rax
xor edx, edx
mov qword [0x180051d08], rax
call fcn.18001fa30
call fcn.18001b7a4
mov ebx, 0x800
mov ecx, ebx
call fcn.18001f784
mov r8d, ebx
xor edx, edx
mov rcx, rax
mov qword [0x180051d00], rax
call fcn.18001fa30
mov rcx, qword [0x180051d00]
lea eax, [r13 + 1]
mov r9d, eax
mov r8d, eax
mov edx, ebx
mov qword [rsp + 0x20], r13
call fcn.18001efb4
lea ecx, [r13 + 8]
call fcn.18001b784
mov ebx, eax
test ax, ax
je 0x18001bad1
xor ecx, ecx
call fcn.18000f554
mov ecx, eax
call sub.WS2_32.dll_htonl
lea ecx, [r13 + 1]
mov dword [rbp + 0x48], eax
cmp bx, cx
jne 0x18001ba9b
and eax, 0xff000000
jmp 0x18001bab3
cmp bx, 2
jne 0x18001baa8
and eax, 0xffff0000
jmp 0x18001bab3
cmp bx, 3
jne 0x18001bab6
and eax, 0xffffff00
mov dword [rbp + 0x48], eax
lea r8, [rbp + 0x48]
lea rcx, str.._._._..._._._.._._...
mov r9d, 4
mov edx, 0x1800
call fcn.18001b8d4
mov ecx, 7
call fcn.18001b794
movzx ebx, ax
test ax, ax
je 0x18001bb0b
lea r8, [rbp + 0x40]
mov rdx, r14
mov ecx, 6
mov dword [rbp + 0x40], 0x100
call qword [sym.imp.KERNEL32.dll_GetComputerNameExA]
mov r8d, dword [rbp + 0x40]
movzx edx, bx
mov rcx, r14
call fcn.18001bfb4
mov ecx, 6
call fcn.18001b794
movzx ebx, ax
test ax, ax
je 0x18001bb40
lea rdx, [rbp + 0x40]
mov rcx, rsi
mov dword [rbp + 0x40], 0x100
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov r8d, dword [rbp + 0x40]
movzx edx, bx
mov rcx, rsi
call fcn.18001bfb4
mov ecx, 5
call fcn.18001b794
movzx ebx, ax
test ax, ax
je 0x18001bb84
lea rdx, [rbp + 0x40]
mov rcx, r15
mov dword [rbp + 0x40], 0x100
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov r8d, dword [rbp + 0x40]
mov r14d, 1
sub r8d, r14d
movzx edx, bx
mov rcx, r15
mov dword [rbp + 0x40], r8d
call fcn.18001bfb4
jmp 0x18001bb8a
mov r14d, 1
mov rax, r13
lea r15, str.._._._..._._._.._._...
mov esi, 0x1800
xor byte [rax + r15], 0x2e
add rax, r14
cmp rax, rsi
jl 0x18001bb99
mov ecx, 9
call fcn.18001b784
mov ebx, eax
test eax, eax
je 0x18001bc06
mov r8d, r13d
mov r9, r15
mov eax, 0x55555556
imul r8d
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea eax, [rdx + rdx*2]
mov edx, r8d
add r8d, r14d
sub edx, eax
movsx eax, byte [r9]
add r9, r14
add edx, r14d
movzx ecx, al
mov eax, 0xabcc772f
imul edx, ecx
add edx, edi
mov edi, edx
mul edx
shr edx, 0x1a
imul edx, edx, 0x5f5e0ff
sub edi, edx
cmp r8d, esi
jl 0x18001bbbc
sub ebx, r14d
jmp 0x18001bc09
mov ebx, r13d
lea rcx, [rbp - 0x20]
mov r8d, esi
mov rdx, r15
call fcn.180016644
cmp ebx, edi
jne 0x18001bd13
lea rcx, [rbp - 0x20]
call fcn.180016760
movzx edi, ax
test ax, ax
jle 0x18001bd13
lea rcx, [rbp - 0x20]
call fcn.180016760
lea rcx, [rbp - 0x20]
movsx ebx, ax
call fcn.180016760
mov rcx, qword [0x180051d00]
movsx rdi, di
mov edx, ebx
movzx esi, ax
shl rdi, 4
mov word [rdi + rcx], bx
dec edx
je 0x18001bce4
dec edx
je 0x18001bcce
dec edx
jne 0x18001bcf9
movsx rbx, ax
mov rcx, rbx
call fcn.18001f784
mov r8, qword [0x180051d00]
lea rcx, [rbp - 0x20]
movsx edx, si
mov qword [rdi + r8 + 8], rax
call fcn.1800168f4
mov rcx, qword [0x180051d00]
mov r8, rbx
mov rcx, qword [rdi + rcx + 8]
mov rdx, rax
call fcn.18001fe20
mov rcx, qword [0x180051d00]
mov r9d, r14d
mov rcx, qword [rdi + rcx + 8]
mov r8d, r14d
mov rdx, rbx
mov qword [rsp + 0x20], r13
call fcn.18001efb4
jmp 0x18001bcf9
lea rcx, [rbp - 0x20]
call fcn.180016654
mov rcx, qword [0x180051d00]
mov dword [rdi + rcx + 8], eax
jmp 0x18001bcf9
lea rcx, [rbp - 0x20]
call fcn.180016760
mov rcx, qword [0x180051d00]
mov word [rdi + rcx + 8], ax
lea rcx, [rbp - 0x20]
call fcn.180016760
movzx edi, ax
test ax, ax
jg 0x18001bc35
mov esi, 0x1800
mov rcx, r12
call fcn.180016620
mov r8, rsi
xor edx, edx
mov rcx, r15
call fcn.18001fa30
mov ecx, reloc.WS2_32.dll_recvfrom
call fcn.18001b950
mov ecx, eax
call fcn.18001cb8c
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret