Function at 0x18005e9cc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
xor esi, esi
mov dword [0x180109bb8], esi
mov r8d, 0x104
lea rdx, [rbp - 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea r14d, [rsi + 1]
test eax, eax
je 0x18005ebd6
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x60]
call fcn.1800085d8
nop
mov cl, r14b
call fcn.18009bd18
mov rbx, rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rsi
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x20]
call fcn.180003170
nop
mov qword [rsp + 0x48], rbx
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r8, [rsp + 0x40]
lea rdx, str.firefox.exe
lea rcx, [rsp + 0x20]
call fcn.18005e548
mov dil, al
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x18005eab0
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005eaab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005ec51
call fcn.18009d1f4
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], sil
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
test rax, rax
je 0x18005eadd
mov r8, qword [rax]
mov edx, r14d
mov rcx, rax
call qword [r8]
mov eax, dword [0x180109bb8]
test dil, dil
cmovne eax, r14d
mov dword [0x180109bb8], eax
mov cl, r14b
call fcn.18009bd18
mov rbx, rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rsi
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x20]
call fcn.180003170
nop
mov qword [rsp + 0x48], rbx
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r8, [rsp + 0x40]
lea rdx, str.wcs2000.exe
lea rcx, [rsp + 0x20]
call fcn.18005e548
mov dil, al
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x18005eb82
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005eb7d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005ec4b
call fcn.18009d1f4
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], sil
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
test rax, rax
je 0x18005ebaf
mov r8, qword [rax]
mov edx, r14d
mov rcx, rax
call qword [r8]
mov eax, dword [0x180109bb8]
mov ecx, 3
test dil, dil
cmovne eax, ecx
cmp eax, ecx
cmove eax, r14d
mov dword [0x180109bb8], eax
lea rcx, [rsp + 0x60]
call fcn.18000d260
cmp byte [0x18010a364], sil
je 0x18005ec33
lea rcx, [rbp + 0xf0]
call fcn.18005e850
cmp byte [rax + 0x2a], sil
je 0x18005ec1b
mov r9, rsi
mov cl, r9b
and cl, 7
shl cl, 3
movabs r8, 0xd993efbb19cfe32d
shr r8, cl
xor byte [r9 + rax], r8b
add r9, r14
cmp r9, 0x2a
jb 0x18005ebf4
mov byte [rax + 0x2a], sil
lea r9, [rbp - 0x40]
mov r8d, dword [0x180109bb8]
mov rdx, rax
mov ecx, 4
call fcn.18006a848
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.1800a45b8
nop
call fcn.1800a45b8
int3