Function at 0x18006b5e8
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
push r12
push r14
sub rsp, 0x200
xor r12d, r12d
cmp byte [0x18010a364], r12b
je 0x18006b659
lea rcx, [rax + 8]
call fcn.18006b140
mov dil, 7
movabs rsi, 0xd993efbb19cfe32d
cmp byte [rax + 0x15], r12b
je 0x18006b64a
mov r8d, r12d
mov cl, r8b
and cl, dil
shl cl, 3
mov rdx, rsi
shr rdx, cl
xor byte [r8 + rax], dl
inc r8
cmp r8, 0x15
jb 0x18006b62a
mov byte [rax + 0x15], r12b
mov rdx, rax
mov ecx, 4
call fcn.18006a848
jmp 0x18006b666
mov dil, 7
movabs rsi, 0xd993efbb19cfe32d
call fcn.18006b458
test al, al
je 0x18006bde3
cmp byte [0x18010a364], r12b
je 0x18006b6bf
lea rcx, [rsp + 0x220]
call fcn.18006b264
cmp byte [rax + 0x13], r12b
je 0x18006b6b2
mov r9, r12
mov cl, r9b
and cl, dil
shl cl, 3
mov r8, rsi
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x13
jb 0x18006b692
mov byte [rax + 0x13], r12b
mov rdx, rax
mov ecx, 5
call fcn.18006a848
call fcn.1800658a0
mov rdx, qword [rax + 8]
lea rcx, [rsp + 0x90]
call fcn.18000ee68
nop
lea rdx, [rsp + 0x70]
mov rcx, rax
call fcn.18000eedc
nop
mov rdx, rax
lea rcx, [rsp + 0xe0]
call fcn.180008634
nop
mov rdx, qword [rsp + 0x88]
mov r14d, 0x1000
cmp rdx, 0x10
jb 0x18006b737
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, r14
jb 0x18006b732
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006be04
call fcn.18009d1f4
mov qword [rsp + 0x80], r12
mov qword [rsp + 0x88], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x70], r12b
lea rcx, [rsp + 0x90]
call fcn.1800098c4
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xe0]
call fcn.180008938
nop
cmp byte [0x18010a364], r12b
je 0x18006b7d1
lea rbx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rbx, qword [rsp + 0x50]
lea rcx, [rsp + 0x220]
call fcn.18006afe8
cmp byte [rax + 0xf], r12b
je 0x18006b7c0
mov r10, r12
mov cl, r10b
and cl, dil
shl cl, 3
mov r9, rsi
shr r9, cl
xor byte [r10 + rax], r9b
inc r10
cmp r10, 0xf
jb 0x18006b7a0
mov byte [rax + 0xf], r12b
mov r8, rbx
mov rdx, rax
mov ecx, 5
call fcn.18006a848
nop
mov cl, 1
call fcn.18009bd18
mov rbx, rax
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x80], r12
mov qword [rsp + 0x88], r12
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x70]
call fcn.180003170
nop
mov qword [rsp + 0x98], rbx
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r8, [rsp + 0x90]
lea rdx, str..dll
lea rcx, [rsp + 0xb8]
call fcn.1800145cc
mov r9b, byte [rsp + 0x220]
mov r8, rax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.18006ab98
nop
mov rdx, qword [rsp + 0x88]
cmp rdx, 0x10
jb 0x18006b88f
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, r14
jb 0x18006b88a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006be0a
call fcn.18009d1f4
mov qword [rsp + 0x80], r12
mov qword [rsp + 0x88], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x70], r12b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
test rax, rax
je 0x18006b8c5
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
nop
mov cl, 1
call fcn.18009bd18
mov qword [rsp + 0x98], rax
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rcx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
add r8, rcx
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rdx, qword [rsp + 0x30]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9, rdx
lea rcx, [rsp + 0x220]
call fcn.18001491c
nop
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x18006b942
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
test rax, rax
je 0x18006b942
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
lea rcx, [rsp + 0x140]
call fcn.180013578
nop
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x140]
call fcn.1800055c8
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x140]
call fcn.18001337c
cmp byte [0x18010a364], r12b
je 0x18006b9c0
lea rcx, [rsp + 0x220]
call fcn.18006b094
cmp byte [rax + 0x1c], r12b
je 0x18006b9b3
mov r9, r12
mov cl, r9b
and cl, dil
shl cl, 3
mov r8, rsi
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x1c
jb 0x18006b993
mov byte [rax + 0x1c], r12b
mov rdx, rax
mov ecx, 5
call fcn.18006a848
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x140]
call fcn.180005504
nop
mov rcx, rax
call fcn.18000f230
mov bl, al
mov rdx, qword [rsp + 0x88]
cmp rdx, 0x10
jb 0x18006ba19
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, r14
jb 0x18006ba14
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006be10
call fcn.18009d1f4
test bl, bl
je 0x18006bcea
cmp byte [0x18010a364], r12b
je 0x18006ba6d
lea rcx, [rsp + 0x220]
call fcn.18006b1d4
cmp byte [rax + 0x12], r12b
je 0x18006ba60
mov r9, r12
mov cl, r9b
and cl, dil
shl cl, 3
mov r8, rsi
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x12
jb 0x18006ba40
mov byte [rax + 0x12], r12b
mov rdx, rax
mov ecx, 5
call fcn.18006a848
lea rcx, [rsp + 0xa0]
call fcn.180005664
nop
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0xa0]
call fcn.1800123c4
test al, al
je 0x18006bbaa
cmp byte [0x18010a364], r12b
je 0x18006bae5
lea rcx, [rsp + 0x220]
call fcn.18006ae88
cmp byte [rax + 0x1a], r12b
je 0x18006bad7
mov r9, r12
mov cl, r9b
and cl, dil
shl cl, 3
mov r8, rsi
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x1a
jb 0x18006bab7
mov byte [rax + 0x1a], r12b
mov rdx, rax
mov ecx, 4
call fcn.18006a848
nop
lea rcx, [rsp + 0xa0]
call fcn.1800061bc
nop
lea rcx, [rsp + 0x140]
call fcn.180012d04
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x18006bb3a
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, r14
jb 0x18006bb35
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006be16
call fcn.18009d1f4
mov qword [rsp + 0x40], r12
mov ebx, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x48], rbx
mov byte [rsp + 0x30], r12b
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x18006bb87
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, r14
jb 0x18006bb82
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006be1c
call fcn.18009d1f4
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], rbx
mov byte [rsp + 0x50], r12b
lea rcx, [rsp + 0xe0]
call fcn.18000d260
mov al, 1
jmp 0x18006bdeb
cmp byte [0x18010a364], r12b
je 0x18006bbf6
lea rcx, [rsp + 0x220]
call fcn.18006af38
cmp byte [rax + 0x23], r12b
je 0x18006bbe9
mov r9, r12
mov cl, r9b
and cl, dil
shl cl, 3
mov r8, rsi
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x23
jb 0x18006bbc9
mov byte [rax + 0x23], r12b
mov rdx, rax
mov ecx, 4
call fcn.18006a848
call fcn.180013d48
mov bl, al
call fcn.18001279c
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x140]
call fcn.180013024
mov dil, al
test bl, bl
je 0x18006bc24
call fcn.180013db4
nop
lea rcx, [rsp + 0xa0]
call fcn.1800061bc
nop
lea rcx, [rsp + 0x140]
call fcn.180012d04
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x18006bc79
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, r14
jb 0x18006bc74
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006be16
call fcn.18009d1f4
mov qword [rsp + 0x40], r12
mov ebx, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x48], rbx
mov byte [rsp + 0x30], r12b
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x18006bcc6
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, r14
jb 0x18006bcc1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006be1c
call fcn.18009d1f4
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], rbx
mov byte [rsp + 0x50], r12b
lea rcx, [rsp + 0xe0]
call fcn.18000d260
mov al, dil
jmp 0x18006bdeb
cmp byte [0x18010a364], r12b
je 0x18006bd37
lea rcx, [rsp + 0x220]
call fcn.18006b2fc
cmp byte [rax + 0x1b], r12b
je 0x18006bd29
mov r9, r12
mov cl, r9b
and cl, dil
shl cl, 3
mov r8, rsi
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x1b
jb 0x18006bd09
mov byte [rax + 0x1b], r12b
mov rdx, rax
mov ecx, 2
call fcn.18006a848
nop
lea rcx, [rsp + 0x140]
call fcn.180012d04
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x18006bd7e
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, r14
jb 0x18006bd79
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006be22
call fcn.18009d1f4
mov qword [rsp + 0x40], r12
mov ebx, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x48], rbx
mov byte [rsp + 0x30], r12b
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x18006bdc7
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, r14
jb 0x18006bdc2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006be28
call fcn.18009d1f4
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], rbx
mov byte [rsp + 0x50], r12b
lea rcx, [rsp + 0xe0]
call fcn.18000d260
call sym.OSMIMHK.DLL_UnconfigLSP
nop
xor al, al
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r12
pop rdi
ret
call fcn.1800a45b8
nop
call fcn.1800a45b8
nop
call fcn.1800a45b8
nop
call fcn.1800a45b8
nop
call fcn.1800a45b8
nop
call fcn.1800a45b8
nop
call fcn.1800a45b8
int3