Function at 0x1800b8f80
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0x78
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov byte [rax - 0x48], 0
mov byte [rax - 0x47], 0
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
xor eax, eax
movzx ebx, r9b
movzx edi, r8w
cmp dword [0x18022ff54], eax
movzx esi, dx
movzx ebp, cx
mov qword [rsp + 0x32], rax
mov byte [rsp + 0x3a], al
mov word [rsp + 0x3b], ax
jne 0x1800b8fcf
mov eax, 1
jmp 0x1800b95e5
mov qword [rsp + 0x58], r15
xor r15d, r15d
cmp dword [0x180230554], eax
je 0x1800b90ba
lea rcx, [0x18022e8a0]
xor edx, edx
mov r8d, 0xa5
call fcn.18000abd0
mov eax, dword [0x18014ed00]
mov edx, dword [0x18022f408]
mov dword [0x18022e8e5], edx
add eax, 0x11
lea r8d, [r15 + 0x30]
movzx ecx, al
mov qword [0x18022eaf8], r15
mov qword [0x18022eb00], r15
xor dl, cl
mov dword [0x18014ed00], ecx
lea rcx, [0x18022e8ad]
mov byte [0x18022e8a0], dl
lea rdx, [0x1802304f0]
mov qword [0x18022eb08], r15
mov qword [0x18022eb10], r15
mov qword [0x18022eb18], r15
mov qword [0x18022eb20], r15
mov qword [0x18022eb28], r15
mov dword [0x18022eb30], r15d
mov word [0x18022eb34], r15w
mov byte [0x18022eaf9], 8
mov byte [0x18022e8a1], 0x62
mov word [0x18022e8e3], 0x206c
mov word [0x18022e8dd], 0x2454
mov word [0x18022e8a2], bp
mov word [0x18022e8a4], si
mov word [0x18022e8a6], di
mov byte [0x18022e8a8], bl
mov word [0x18022e928], 0x1bbc
call fcn.180005f30
jmp 0x1800b9109
cmp dword [0x1802304e4], eax
je 0x1800b90f3
movzx r9d, di
movzx r8d, si
movzx edx, bp
mov cl, 0x62
mov byte [rsp + 0x20], bl
call fcn.1800b89a0
lea rdx, [0x180230480]
lea rcx, [0x18022e8ad]
mov r8d, gethostbyname
call fcn.180005f30
jmp 0x1800b9109
movzx r9d, di
movzx r8d, si
movzx edx, bp
mov cl, 0x31
mov byte [rsp + 0x20], bl
call fcn.1800b89a0
movzx ecx, byte [0x18022ff60]
mov qword [rsp + 0x70], r12
dec ecx
je 0x1800b91c9
sub ecx, 3
je 0x1800b917b
cmp ecx, 4
je 0x1800b917b
mov ecx, dword [reloc.WSOCK32.dll_accept]
mov eax, dword [reloc.WSOCK32.dll_closesocket]
mov ebp, 1
cmp ecx, ebp
lea r8d, [rbp + 0x1d]
jge 0x1800b9144
mov ecx, ebp
jmp 0x1800b914b
cmp ecx, r8d
cmovg ecx, r8d
cmp eax, ebp
jge 0x1800b9161
cmp ebp, ecx
mov eax, ebp
cmovl eax, ecx
cdq
idiv ecx
mov r12d, eax
jmp 0x1800b920a
mov edx, 0x3c
cmp eax, edx
cmovg eax, edx
cmp eax, ecx
cmovl eax, ecx
cdq
idiv ecx
mov r12d, eax
jmp 0x1800b920a
mov ecx, dword [reloc.WSOCK32.dll_accept]
mov eax, dword [reloc.WSOCK32.dll_closesocket]
mov ebp, 1
cmp ecx, ebp
lea r8d, [rbp + 0x1d]
jge 0x1800b9198
mov ecx, ebp
jmp 0x1800b919f
cmp ecx, r8d
cmovg ecx, r8d
cmp eax, ebp
jge 0x1800b91b2
cmp ebp, ecx
mov eax, ebp
cmovl eax, ecx
cdq
idiv ecx
mov r12d, eax
jmp 0x1800b920a
mov edx, 0x3c
cmp eax, edx
cmovg eax, edx
cmp eax, ecx
cmovl eax, ecx
cdq
idiv ecx
mov r12d, eax
jmp 0x1800b920a
mov ecx, dword [reloc.WSOCK32.dll_accept]
mov eax, dword [reloc.WSOCK32.dll_closesocket]
mov ebp, 1
cmp ecx, ebp
lea r8d, [rbp + 0x1d]
jge 0x1800b91e6
mov ecx, ebp
jmp 0x1800b91ed
cmp ecx, r8d
cmovg ecx, r8d
cmp eax, ebp
jge 0x1800b91f5
mov eax, ebp
jmp 0x1800b91ff
mov edx, 0x3c
cmp eax, edx
cmovg eax, edx
cmp eax, ecx
cmovl eax, ecx
cdq
idiv ecx
mov r12d, eax
cmp r12d, 1
jge 0x1800b9215
mov r12d, ebp
jmp 0x1800b921d
cmp r12d, 0x1e
cmovg r12d, r8d
mov qword [rsp + 0x68], r13
mov esi, r15d
mov qword [rsp + 0x60], r14
call fcn.1800b7c00
inc r12d
je 0x1800b9591
lea rdx, [0x180000000]
lea r14, [0x18022ea7c]
lea r13, [0x18022eaf9]
mov edi, 0x1b
test esi, esi
jne 0x1800b95ad
cmp dword [0x18022ff54], r15d
mov ebx, r15d
jle 0x1800b93fd
lea rdi, [0x18022ff60]
mov rax, qword [rdi]
lea rcx, [rsp + 0x40]
mov qword [rcx], rax
mov eax, dword [rdi + 8]
mov dword [rcx + 8], eax
movzx eax, byte [rdi + 0xc]
mov byte [rcx + 0xc], al
cmp byte [rsp + 0x40], 8
mov rax, qword [rdi]
mov qword [rdx + 0x22f3f8], rax
mov eax, dword [rdi + 8]
mov dword [rdx + 0x22f400], eax
movzx eax, byte [rdi + 0xc]
mov byte [rdx + 0x22f404], al
jne 0x1800b957c
movzx ecx, word [0x18022f3c8]
call qword [0x18022eaa8]
mov word [0x18022e8df], ax
movzx eax, byte [0x18022e8a1]
cmp al, 0x31
je 0x1800b93ce
cmp al, 0x62
je 0x1800b93ce
cmp al, 0x60
je 0x1800b93ce
lea rcx, [0x18022e9d0]
xor edx, edx
mov r8d, 0xad
call fcn.18000abd0
movzx eax, word [0x18014ed04]
lea rdx, [0x18022e8a0]
lea rcx, [0x18022e9d8]
mov r8d, 0xa5
mov word [0x18022e9d2], ax
mov word [0x18022e9d0], 0x2309
mov word [0x18022e9d4], 0x12c
mov word [0x18022e9d6], 0xa5
call fcn.180005f30
movzx r11d, byte [0x18022e8a0]
movzx eax, r11b
and al, 0xf
movzx r10d, al
nop
xor r9b, r9b
mov r8w, 0xa4
mov rdx, r14
nop
nop
movzx ecx, byte [rdx]
movzx eax, r9b
dec rdx
movzx r9d, cl
add cl, cl
or cl, al
shr r9b, 7
add r8w, 0xffff
mov byte [rdx + 1], cl
jne 0x1800b9360
test r9b, r9b
je 0x1800b938d
or byte [0x18022ea7c], 1
movzx eax, r10w
add r10w, 0xffff
test ax, ax
jne 0x1800b9350
lea rax, [0x18022e9d9]
mov ecx, 0xa4
nop
nop
xor byte [rax], r11b
inc rax
dec rcx
jne 0x1800b93b0
lea rdx, [0x18022e9d0]
lea rcx, [rsp + 0x40]
call fcn.1800b8030
jmp 0x1800b93d8
lea rcx, [rsp + 0x40]
call fcn.1800b7ec0
inc ebx
add rdi, 0xd
mov dword [0x18022f414], r15d
cmp ebx, dword [0x18022ff54]
lea rdx, [0x180000000]
jl 0x1800b9271
mov edi, 0x1b
mov r11d, ebp
test r11d, r11d
je 0x1800b956b
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
xor r8d, r8d
mov byte [rsp + 0x40], 8
call fcn.1800b8470
cmp eax, 0x3e
mov r11d, eax
jne 0x1800b9563
mov rax, qword [0x18022e4a0]
mov rcx, qword [0x18022e470]
mov qword [0x18022eaf8], rcx
mov rcx, qword [0x18022e478]
movzx edx, byte [0x18022eaf8]
mov qword [0x18022eb00], rcx
mov rcx, qword [0x18022e480]
mov qword [0x18022eb28], rax
mov eax, dword [0x18022e4a8]
mov qword [0x18022eb08], rcx
mov rcx, qword [0x18022e488]
mov qword [0x18022eb10], rcx
mov rcx, qword [0x18022e490]
mov dword [0x18022eb30], eax
movzx eax, word [0x18022e4ac]
mov qword [0x18022eb18], rcx
mov rcx, qword [0x18022e498]
mov qword [0x18022eb20], rcx
mov word [0x18022eb34], ax
mov ecx, 0x3d
mov rax, r13
nop
nop
nop
xor byte [rax], dl
inc rax
dec rcx
jne 0x1800b94c0
and dl, 0xf
movzx r10d, dl
xor r8b, r8b
mov r9w, 0x3d
mov rdx, r13
nop
movzx ecx, byte [rdx]
movzx eax, r8b
inc rdx
movzx r8d, cl
shr cl, 1
shl al, 7
or cl, al
and r8b, 1
add r9w, 0xffff
mov byte [rdx - 1], cl
jne 0x1800b94e0
test r8b, r8b
je 0x1800b9510
or byte [0x18022eaf9], 0x80
movzx eax, r10w
add r10w, 0xffff
test ax, ax
jne 0x1800b94d1
movzx eax, word [0x18022eb34]
movzx ecx, byte [0x18022eaf9]
cmp ax, 0x206c
mov word [0x18022f40c], ax
cmovb ecx, edi
cmp word [0x18022f3dc], r15w
mov byte [0x18022eaf9], cl
jne 0x1800b9555
movzx eax, cl
mov word [0x18022f3dc], ax
test cl, cl
cmove esi, ebp
cmp dword [0x18022f424], r15d
jne 0x1800b958d
test esi, esi
je 0x1800b9400
dec r12d
je 0x1800b958d
lea rdx, [0x180000000]
jmp 0x1800b9252
mov dword [0x18022f414], 0xa
mov eax, 0xfffffef1
jmp 0x1800b95d1
test esi, esi
jne 0x1800b95a6
mov eax, 0xfffffffd
cdq
xor eax, edx
sub eax, edx
mov byte [0x18022eaf9], al
movzx eax, al
jmp 0x1800b95d1
lea rdx, [0x180000000]
lea rcx, [rsp + 0x30]
mov rax, qword [rcx]
mov qword [rdx + 0x22f3e8], rax
mov eax, dword [rcx + 8]
mov dword [rdx + 0x22f3f0], eax
movzx eax, byte [rcx + 0xc]
mov byte [rdx + 0x22f3f4], al
xor eax, eax
mov r14, qword [rsp + 0x60]
mov r13, qword [rsp + 0x68]
mov r12, qword [rsp + 0x70]
mov r15, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
add rsp, 0x78
ret