Function at 0x18002b4f0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x100
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
mov rdi, rdx
mov r15, rcx
xor r12d, r12d
mov qword [rax + 0x10], r12
lea rbx, [rdx + 8]
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x18002b52f
mov rdx, qword [rbx]
lea rax, [rsp + 0x148]
mov qword [rsp + 0x20], rax
mov r9d, 0x20219
xor r8d, r8d
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18002ba0a
mov r13, qword [rsp + 0x148]
mov qword [rsp + 0x90], r13
mov rax, qword [rdi]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov r14, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x18002b58a
mov rbx, qword [rbx]
movabs rsi, 0x7fffffffffffffff
cmp r14, 0x10
jae 0x18002b5c1
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x68], xmm0
mov eax, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x80], rax
mov rdi, qword [rsp + 0x68]
jmp 0x18002b646
mov r15, r14
or r15, 0xf
cmp r15, rsi
cmova r15, rsi
mov qword [rsp + 0x150], r15
lea rcx, [r15 + 1]
cmp rcx, 0x1000
jb 0x18002b610
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18002ba30
mov rcx, rax
call fcn.18009d1b8
test rax, rax
je 0x18002ba35
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x18002b622
test rcx, rcx
je 0x18002b61f
call fcn.18009d1b8
mov rdi, rax
jmp 0x18002b622
mov rdi, r12
mov qword [rsp + 0x68], rdi
lea r8, [r14 + 1]
mov rdx, rbx
mov rcx, rdi
call fcn.18009fc20
mov qword [rsp + 0x80], r15
mov r15, qword [rsp + 0x140]
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x88], r13
mov byte [rsp + 0x20], 1
lea r8, str.MailProxy
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.18000e1e0
nop
mov eax, dword [rsp + 0x30]
dec eax
cmp eax, 1
jbe 0x18002b683
lea r13, [0x1800ea560]
jmp 0x18002b694
lea r13, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae r13, qword [rsp + 0x38]
lea r14, [r15 + 0xd0]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rbx + r13], 0
jne 0x18002b6a2
mov rcx, qword [r14 + 0x18]
mov qword [rsp + 0x158], rcx
cmp rbx, rcx
ja 0x18002b6e4
mov rsi, r14
cmp rcx, 0x10
jb 0x18002b6c9
mov rsi, qword [r14]
mov qword [r14 + 0x10], rbx
mov r8, rbx
mov rdx, r13
mov rcx, rsi
call fcn.18009fc20
mov byte [rsi + rbx], 0
jmp 0x18002b7d2
cmp rbx, rsi
ja 0x18002ba3b
mov rdx, rbx
or rdx, 0xf
cmp rdx, rsi
ja 0x18002b733
mov r8, rcx
shr r8, 1
mov rax, rsi
sub rax, r8
cmp rcx, rax
ja 0x18002b733
lea rax, [rcx + r8]
mov rsi, rdx
cmp rdx, rax
cmovb rsi, rax
lea rax, [rsi + 1]
cmp rax, 0x1000
jb 0x18002b759
lea rcx, [rax + 0x27]
cmp rcx, rax
jbe 0x18002ba40
jmp 0x18002b73d
movabs rcx, 0x8000000000000027
call fcn.18009d1b8
test rax, rax
je 0x18002ba45
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
jmp 0x18002b76e
test rax, rax
je 0x18002b76b
mov rcx, rax
call fcn.18009d1b8
mov r15, rax
jmp 0x18002b76e
mov r15, r12
mov qword [r14 + 0x10], rbx
mov qword [r14 + 0x18], rsi
mov r8, rbx
mov rdx, r13
mov rcx, r15
call fcn.18009fc20
mov byte [r15 + rbx], 0
mov rdx, qword [rsp + 0x158]
cmp rdx, 0x10
jb 0x18002b7c7
mov rcx, qword [r14]
inc rdx
cmp rdx, 0x1000
jb 0x18002b7c2
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18002ba45
mov rcx, r8
call fcn.18009d1f4
mov qword [r14], r15
mov r15, qword [rsp + 0x140]
mov rax, qword [rsp + 0x50]
cmp rax, 0x10
jb 0x18002b810
lea rdx, [rax + 1]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002b80b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002ba4b
call fcn.18009d1f4
mov byte [rsp + 0x20], 0
lea r8, str.MailProxyPort
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.18000e1e0
mov eax, dword [rsp + 0x30]
cmp eax, 4
je 0x18002b851
cmp eax, 3
jne 0x18002b841
cmp qword [rsp + 0x48], 4
je 0x18002b851
movzx ebx, r12w
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
jmp 0x18002b86b
lea rax, [rsp + 0x38]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
cmovae rax, rcx
movzx ebx, word [rax]
cmp rdx, 0x10
jb 0x18002b89e
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002b899
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002ba4b
call fcn.18009d1f4
test bx, bx
je 0x18002b8ab
mov word [r15 + 0x100], bx
mov byte [r15 + 0x104], 1
cmp byte [0x18010a364], 0
je 0x18002b995
cmp qword [r14 + 0x18], 0x10
jb 0x18002b8ca
mov r14, qword [r14]
movdqa xmm6, xmmword [0x1800ec9d0]
movdqa xmm7, xmmword [0x1800ec280]
mov dword [rsp + 0x50], 0x6def8443
mov dword [rsp + 0x54], 0xaab6cfd4
mov dword [rsp + 0x58], 0x19abc617
mov rcx, qword gs:[0x58]
mov eax, dword [0x18010bb98]
mov edx, 4
mov rcx, qword [rcx + rax*8]
mov eax, dword [rdx + rcx]
cmp dword [0x18010d1f0], eax
jg 0x18002ba51
lea r10, [0x180106030]
cmp byte [0x18010605c], 0
je 0x18002b97c
mov r9d, 1
sub r9, r10
movabs r11, 0xd993efbb19cfe32d
nop dword [rax]
lea r8, [r12 + r10]
movzx ecx, r12b
and cl, 7
shl cl, 3
mov rax, r11
shr rax, cl
xor byte [r8], al
lea ecx, [r8 + r9]
and cl, 7
shl cl, 3
mov rdx, r11
shr rdx, cl
xor byte [r8 + 1], dl
add r12, 2
cmp r12, 0x2c
jb 0x18002b940
mov byte [0x18010605c], 0
movzx r9d, word [r15 + 0x100]
mov r8, r14
mov rdx, r10
mov ecx, 5
call fcn.18006a848
nop
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x18002b9a8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rsp + 0x150]
cmp rdx, 0x10
jb 0x18002b9e7
inc rdx
mov rax, rdi
cmp rdx, 0x1000
jb 0x18002b9de
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002bab5
mov rcx, rdi
call fcn.18009d1f4
nop
movaps xmm6, xmmword [rsp + 0xf0]
movaps xmm7, xmmword [rsp + 0xe0]
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
xor r8d, r8d
mov edx, eax
lea rcx, [rsp + 0x98]
call fcn.18000fcf8
lea rdx, [0x1800fe618]
lea rcx, [rsp + 0x98]
call fcn.18009edd8
call fcn.180001df0
call fcn.1800a45b8
nop
call fcn.180001e88
call fcn.180001df0
call fcn.1800a45b8
nop
call fcn.1800a45b8
int3
lea rcx, [0x18010d1f0]
call fcn.18009d704
cmp dword [0x18010d1f0], 0xffffffff
jne 0x18002b919
mov byte [0x18010605c], 1
movaps xmmword [0x180106030], xmm6
movaps xmmword [0x180106040], xmm7
movsd xmm0, qword [rsp + 0x50]
movsd qword [0x180106050], xmm0
mov eax, dword [rsp + 0x58]
mov dword [0x180106058], eax
lea rcx, [0x1800cdea0]
call fcn.18009d564
lea rcx, [0x18010d1f0]
call fcn.18009d6a4
nop
jmp 0x18002b919
call fcn.1800a45b8
int3