Function at 0x180002020
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push rbp
push rbx
lea rbp, [rsp - 0x38]
sub rsp, 0x138
mov rax, qword [0x180008040]
xor rax, rsp
mov qword [rbp + 0x10], rax
cmp edx, 1
jne 0x1800026c7
call fcn.1800017f0
test eax, eax
je 0x1800026c7
mov rcx, qword [0x1800087e8]
lea rdx, [0x1800018a0]
call fcn.180001380
mov rax, qword [0x1800087a8]
lea rbx, [fcn.180001890]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rbx
call fcn.1800032d0
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.180003990
mov rdx, rbx
lea rcx, [rbp - 0x60]
call fcn.180002e00
test eax, eax
je 0x1800020cc
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.Failed_to_attach_hook.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
call fcn.180003390
mov rbx, qword [rbp - 0x60]
lea rdx, [rbp - 0x58]
call fcn.180001420
mov rcx, qword [0x180008798]
lea rdx, [0x180001f30]
mov qword [rax], rbx
call fcn.180001380
mov rax, qword [0x1800087e0]
lea rbx, [fcn.180001890]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rbx
call fcn.1800032d0
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.180003990
mov rdx, rbx
lea rcx, [rbp - 0x60]
call fcn.180002e00
test eax, eax
je 0x18000215a
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.Failed_to_attach_hook.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
call fcn.180003390
mov rbx, qword [rbp - 0x60]
lea rdx, [rbp - 0x58]
call fcn.180001420
mov rcx, qword [0x1800087d0]
lea r9, [rbp - 0x50]
mov edx, 0x10
mov qword [rax], rbx
movsxd rax, dword [rcx + 0x3c]
lea r8d, [rdx + 0x30]
mov ebx, dword [rax + rcx + 0x28]
add rbx, rcx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1800026c7
mov qword [rsp + 0x150], rsi
movabs rax, 0xd177fd611cd211fe
mov qword [rbp - 0x40], rax
movabs rdx, 0xf037bd611cd20dfe
mov qword [rsp + 0x158], rdi
movabs rax, 0xf2b7bd611cd201fe
mov qword [rbp - 0x28], rax
movabs rcx, 0xd077fd611cd211fe
mov qword [rsp + 0x160], r12
movabs rax, 0x1077fd611cd205ff
mov qword [rbp - 0x20], rax
movabs rsi, 0xa8591ebb8cacc9f2
movabs rax, 0x9377fd611cd215fe
mov qword [rsp + 0x130], r13
mov qword [rbp - 0x18], rax
movabs r8, 0x28ebf90bc5dd370c
movabs rax, 0xf277bd611cd20dfe
mov qword [rsp + 0x128], r14
mov qword [rbp - 0x10], rax
movabs r9, 0x36146208854cb6c1
movabs rax, 0x33b7bd611cc609dc
mov qword [rsp + 0x120], r15
mov qword [rbp + 8], rax
movabs r10, 0x66e601daf20c26c1
xor eax, eax
mov qword [rbp - 0x38], rdx
mov qword [rsp + 0x38], rax
xor edi, edi
mov word [rsp + 0x40], ax
movabs r11, 0xb9075885e2ef3e0e
movabs rax, 0x5d8a33109917681b
mov qword [rbp - 0x30], rcx
mov qword [rsp + 0x48], rax
movabs r14, 0x5abe6752564c165f
movabs rax, 0x580279eb1370a921
mov qword [rbp - 8], rcx
mov qword [rsp + 0x50], rax
mov ecx, edi
movabs rax, 0xf53f10f31b994135
mov qword [rbp], rdx
mov qword [rsp + 0x58], rax
movabs rdx, 0x1b5bf0d5905c1e7d
movabs rax, 0x4dc3afbf05359ede
mov qword [rbx], 0x25ff
mov qword [rsp + 0x60], rax
movabs r15, 0x65c99ed58cf9413a
movabs rax, 0x565759404b2ab12c
movabs r12, 0x340d36c59c09e9bd
mov qword [rsp + 0x68], rax
movabs r13, 0x2f44a9a180873af7
movabs rax, 0xcc399763342b94bc
mov qword [rsp + 0x70], rax
movabs rax, 0x27ee18f3a8934be0
mov qword [rsp + 0x78], rax
movabs rax, 0xfb1074f23b8723c1
mov qword [rbp - 0x80], rax
movabs rax, 0x713514cd4a5572a4
mov qword [rbp - 0x78], rax
movabs rax, 0xa869213e57fb1b32
mov qword [rbp - 0x70], rax
movabs rax, 0xe69b548b2c32c24
mov qword [rbp - 0x68], rax
movabs rax, 0x21b164ebb39cd319
mov qword [rsp + 0x28], rax
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rbp + rcx*8 - 0x40]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
xor rax, rdx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
rol rax, 0x33
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
xor rax, r8
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
ror rax, 0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
bswap rax
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
xor rax, r9
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
rol rax, 9
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
bswap rax
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
bswap rax
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
not rax
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
rol rax, 0x42
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
not rax
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
not rax
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
xor rax, r10
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
xor rax, r11
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
bswap rax
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
ror rax, 0x6c
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
bswap rax
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
xor rax, rsi
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
bswap rax
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
not rax
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
bswap rax
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
sub rax, r14
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
bswap rax
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
rol rax, 0xd
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
not rax
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
sub rax, r15
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
rol rax, 0xb0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
add rax, r12
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
sub rax, r13
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
rol rax, 0x51
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
rol rax, 0x7e
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
sub rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
add rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
xor rax, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
ror rax, 0x98
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
ror rax, 0xc1
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
xor rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
add rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
xor rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
add rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
xor rax, qword [rbp - 0x80]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
not rax
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
xor rax, qword [rbp - 0x78]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
xor rax, qword [rbp - 0x70]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
rol rax, 0x82
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
sub rax, qword [rbp - 0x68]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
not rax
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
rol rax, 0x93
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
sub rax, qword [rsp + 0x28]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov byte [rsp + rcx + 0x38], al
inc rcx
cmp rcx, 0xa
jl 0x180002380
movsd xmm0, qword [rsp + 0x38]
lea rdx, [rsp + 0x28]
movzx eax, word [rsp + 0x40]
mov rcx, qword [0x1800087a0]
mov r15, qword [rsp + 0x120]
mov r14, qword [rsp + 0x128]
mov r13, qword [rsp + 0x130]
mov r12, qword [rsp + 0x160]
mov rsi, qword [rsp + 0x150]
movsd qword [rsp + 0x28], xmm0
mov word [rsp + 0x30], ax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 6], rax
lea r9, [rbp - 0x50]
mov r8d, dword [rbp - 0x50]
mov edx, 0x10
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne dil
mov eax, edi
mov rdi, qword [rsp + 0x158]
jmp 0x1800026c9
xor eax, eax
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.180004190
add rsp, 0x138
pop rbx
pop rbp
ret