Function at 0x180006fb0
Capabilities:
Encode data using xor
Hash data with crc32
Terminate process

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x110
lea rbp, [rsp + 0x60]
mov qword [rbp + 0xf0], rbx
mov rax, qword [0x180081de0]
xor rax, rbp
mov qword [rbp + 0xa0], rax
mov rbx, qword [rbp + 0x110]
lea edi, [r9 - 0xd]
mov rsi, qword [rbp + reloc.SHLWAPI.dll_SHRegGetIntW]
mov eax, r9d
mov dword [rbp + 0x30], eax
mov r14, rdx
mov qword [rbp + 0x60], r8
mov qword [rbp + 0x70], rdx
mov qword [rbp + 0x78], rcx
mov qword [rbp + 0x80], rbx
mov qword [rbp + 0x38], rsi
mov dword [rbp + 8], edi
cmp r9d, edi
jbe 0x180007ac9
mov r13d, dword [rbp + 0x20]
lea r9, [0x180000000]
mov r15d, dword [rbp + 0x20]
xor edx, edx
mov r12d, dword [rbp + 0x20]
movabs r11, 0xffffffffffffff0
lea r10d, [rdx + 0x32]
add eax, 0xffffff04
cmp eax, 0x36
ja case.0x180007063.265
movzx eax, byte [r9 + rax + 0x7b30]
mov ecx, dword [r9 + rax*4 + 0x7af8]
add rcx, r9
jmp rcx
xor r8d, r8d
lea rdx, [0x180082408]
mov ecx, 0xa2
call fcn.18003eed0
xor edx, edx
mov edi, edx
cmp dword [r14], edx
jle 0x1800070ec
mov eax, dword [rsi]
test eax, eax
jne 0x1800070a2
mov eax, dword [rbx]
lea r9, [rbp + 0x18]
xor edx, edx
mov dword [rbp + 0x18], eax
xor ecx, ecx
mov r8d, 0x127
call fcn.180007dc0
xor edx, edx
mov qword [rsp + 0x38], rdx
lea r8, [0x180082408]
mov dword [rbp + 0x10], eax
mov r9d, 0x60
mov eax, dword [rbx]
xor ecx, ecx
mov dword [rbp + 0x18], eax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
xor edx, edx
call fcn.18002bb20
inc edi
add rbx, 4
ret
add al, 0xba
add byte [rax], al
add byte [rax], al
cmp edi, dword [r14]
jl 0x180007082
mov edi, dword [rbp + 8]
jmp 0x18000718d
mov rcx, 0xffffffffffffffff
nop dword [rax + rax]
inc rcx
cmp byte [r14 + rcx], 0
jne 0x180007100
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rsi + rax], 0
jne 0x180007111
add rcx, 2
add rax, rcx
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x18000712d
mov rcx, r11
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.18005fe60
sub rsp, rcx
mov rcx, r14
lea r8, [rsp + 0x60]
mov rdx, r8
mov qword [rbp + 0x68], r8
sub rdx, r14
nop
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x180007150
lea rcx, [r8 - 1]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
add qword [r13 - 0xa], rsi
movzx eax, word [0x1800788a0]
xor edx, edx
mov word [rcx], ax
jmp 0x180007194
mov r8, qword [rbp + 0x68]
mov edx, 0x4f
mov rcx, rbx
call fcn.18000a7c0
xor edx, edx
lea r9, [0x180000000]
mov r10d, 0x32
movabs r11, 0xffffffffffffff0
mov eax, dword [rbp + 0x30]
dec eax
mov dword [rbp + 0x30], eax
cmp eax, edi
jbe 0x180007ac9
mov rsi, qword [rbp + 0x38]
mov r8, qword [rbp + 0x60]
mov r14, qword [rbp + 0x70]
mov rbx, qword [rbp + 0x80]
jmp 0x180007041
jne resource.8
invalid
invalid
cmp dword [r14], 0
mov dword [rbp + 0x18], edx
jle 0x18000753d
mov r14, rbx
mov qword [rbp + 0x40], rbx
mov eax, reloc.SHLWAPI.dll_SHUnicodeToAnsi
mov dword [rbp + 0x10], eax
nop dword [rax + rax]
cmp eax, 0xd9
jne 0x18000750d
mov esi, dword [rsi]
test esi, esi
jne 0x18000721c
invalid
mov eax, dword [r14]
lea r9, [rbp]
xor edx, edx
mov dword [rbp], eax
xor ecx, ecx
mov r8d, 0x127
call fcn.180007dc0
mov esi, eax
xor edi, edi
mov dword [rbp], esi
mov qword [rsp + 0x38], rdi
lea r8, [0x180082428]
mov qword [rsp + 0x30], rdi
lea rcx, [rbp]
mov qword [rsp + 0x28], rdi
xor edx, edx
lea r9d, [rdi + 0x60]
mov qword [rsp + 0x20], rdi
call fcn.18003ea90
cmp eax, 0xffffffff
jne 0x1800072ab
mov ebx, 0x76
mov eax, ebx
sub eax, 0x76
je 0x1800078e9
sub eax, 3
je 0x1800072a1
cmp eax, 1
jne 0x1800072a4
xor r9d, r9d
mov dword [rbp], r13d
lea r8, str.SwitchIpUnset
mov ecx, 0x128
lea rdx, [rbp]
call fcn.180045490
test r13d, r13d
jle 0x1800072a4
movsxd r8, r13d
xor edx, edx
movabs rcx, 0x7049686374697753
call sub.VCRUNTIME140.dll_memcpy
jmp 0x1800072a4
mov r13d, edi
inc ebx
cmp ebx, 0x79
jb 0x180007255
mov qword [rsp + 0x38], rdi
lea r8, [0x180082428]
mov qword [rsp + 0x30], rdi
lea rcx, [rbp]
mov qword [rsp + 0x28], rdi
mov r9d, 0x60
xor edx, edx
mov qword [rsp + 0x20], rdi
mov dword [rbp], esi
call fcn.18003ea90
movsxd rcx, esi
lea rdx, [0x180000000]
lea rdi, [rdx + 0x68390]
lea rdi, [rdi + rcx*4]
mov ecx, dword [rdi]
and ecx, dword [r14]
cmp eax, ecx
je 0x180007362
mov ebx, 0x76
nop dword [rax]
mov eax, ebx
sub eax, 0x76
je 0x180007916
sub eax, 3
je 0x180007350
cmp eax, 1
jne 0x180007357
movsxd r14, dword [rbp + 0x50]
lea r8, str.Unexpected_stack_frame_type
xor r9d, r9d
mov dword [rbp], r14d
lea rdx, [rbp]
mov ecx, 0x128
call fcn.180045490
test r14d, r14d
jle 0x180007357
mov r8, r14
xor edx, edx
movabs rcx, 0x7463657078656e55
call sub.VCRUNTIME140.dll_memcpy
jmp 0x180007357
mov dword [rbp + 0x50], 0
inc ebx
cmp ebx, 0x79
jb 0x180007300
mov r14, qword [rbp + 0x40]
cmp esi, 1
jne 0x18000747e
xor r9d, r9d
lea rcx, [0x180082428]
xor r8d, r8d
mov edx, 0xff
call fcn.180056e40
mov ecx, dword [rdi]
and ecx, dword [r14]
cmp eax, ecx
je 0x1800073ee
mov ebx, 0x76
mov eax, ebx
sub eax, 0x76
je 0x180007943
sub eax, 3
je resource.10
cmp eax, 1
jne 0x1800073e7
movsxd r14, dword [rbp + 0x54]
lea r8, str.Warning:_Wrote_empty_property_section.
xor r9d, r9d
mov dword [rbp], r14d
lea rdx, [rbp]
mov ecx, 0x128
call fcn.180045490
test r14d, r14d
jle 0x1800073e7
mov r8, r14
xor edx, edx
movabs rcx, 0x3a676e696e726157
call sub.VCRUNTIME140.dll_memcpy
jmp 0x1800073e7
mov dword [rbp + 0x54], 0
inc ebx
cmp ebx, 0x79
jb 0x180007390
cmp esi, 1
jne 0x18000747e
xor r8d, r8d
lea rdx, [0x180082428]
mov ecx, 0xc1
call fcn.18003eed0
mov r14, qword [rbp + 0x40]
mov ecx, dword [rdi]
and ecx, dword [r14]
cmp eax, ecx
je 0x180007506
mov ebx, 0x76
mov eax, ebx
sub eax, 0x76
je 0x180007970
sub eax, 3
je 0x18000746d
cmp eax, 1
jne 0x180007472
xor r9d, r9d
mov dword [rbp], r15d
lea r8, str.Emit_line_level_debug_information
mov ecx, 0x128
lea rdx, [rbp]
call fcn.180045490
test r15d, r15d
jle 0x180007472
movsxd r8, r15d
xor edx, edx
movabs rcx, 0x6e696c2074696d45
call sub.VCRUNTIME140.dll_memcpy
jmp 0x180007472
xor edx, edx
mov r15d, edx
inc ebx
cmp ebx, 0x79
jb 0x180007421
jmp 0x180007506
mov r8d, 0x10c
mov dword [rbp], esi
lea rdx, [0x180082428]
lea rcx, [rbp]
call fcn.18004fc60
mov r14, qword [rbp + 0x40]
mov ecx, dword [rdi]
and ecx, dword [r14]
cmp eax, ecx
je 0x180007506
mov ebx, 0x76
nop dword [rax]
mov eax, ebx
sub eax, 0x76
je 0x18000799d
sub eax, 3
je 0x1800074fc
cmp eax, 1
jne 0x1800074ff
xor r9d, r9d
mov dword [rbp], r12d
lea r8, str.getSupportedMediaTypes
mov ecx, 0x128
lea rdx, [rbp]
call fcn.180045490
test r12d, r12d
jle 0x1800074ff
movsxd r8, r12d
xor edx, edx
movabs rcx, 0x6f70707553746567
call sub.VCRUNTIME140.dll_memcpy
jmp 0x1800074ff
xor r12d, r12d
inc ebx
cmp ebx, 0x79
jb 0x1800074b0
mov rsi, qword [rbp + 0x38]
mov eax, dword [rbp + 0x10]
add eax, 6
mov dword [rbp + 0x10], eax
cmp eax, 0xdf
jb 0x1800071f0
mov ecx, dword [rbp + 0x18]
add r14, 4
mov rax, qword [rbp + 0x70]
inc ecx
mov dword [rbp + 0x18], ecx
mov qword [rbp + 0x40], r14
cmp ecx, dword [rax]
jl 0x1800071e0
mov edi, dword [rbp + 8]
lea r8, [0x180082428]
mov edx, 0x31
xor ecx, ecx
call fcn.18002b7f0
cmp eax, dword [rbp + 0x28]
je 0x18000718b
mov ebx, 0x76
nop
mov eax, ebx
sub eax, 0x76
je 0x1800079ca
sub eax, 3
je 0x1800075bd
cmp eax, 1
jne 0x1800075ac
movsxd rdi, dword [rbp + 0x58]
lea r8, str.0_IsPostRegisterAllocated
xor r9d, r9d
mov dword [rbp], edi
lea rdx, [rbp]
mov ecx, 0x128
call fcn.180045490
xor edx, edx
test edi, edi
jle 0x1800075ae
mov r8, rdi
movabs rcx, 0x6f507349207d307b
call sub.VCRUNTIME140.dll_memcpy
xor edx, edx
inc ebx
cmp ebx, 0x79
jb 0x180007560
mov edi, dword [rbp + 8]
jmp 0x18000718d
xor edx, edx
mov dword [rbp + 0x58], edx
jmp 0x1800075ae
xorps xmm0, xmm0
mov ecx, pe_nt_image_headers64
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov byte [rax], 0
mov dword [rbx + 0x18], pe_nt_image_headers64
jmp 0x18000718b
xor r9d, r9d
lea r8, [0x180082408]
xor ecx, ecx
lea edx, [r9 + 0x3c]
call fcn.180052fd0
lea r8, [0x180082408]
mov qword [rbp + 0x48], rax
mov edx, 0x31
xor ecx, ecx
call fcn.18002b7f0
mov rcx, qword [rbp + 0x78]
mov dword [rbp + 0x28], eax
cmp eax, dword [rcx]
je 0x18000718b
mov ebx, 0x76
mov ecx, ebx
sub ecx, 0x76
je 0x1800079f7
sub ecx, 3
je 0x18000768d
cmp ecx, 1
jne 0x18000767c
movsxd rdi, dword [rbp + 0x20]
lea r8, str.BFD_RELOC_IA64_LTV32MSB
xor r9d, r9d
mov dword [rbp], edi
lea rdx, [rbp]
mov ecx, 0x128
call fcn.180045490
xor edx, edx
test edi, edi
jle 0x18000767e
mov r8, rdi
movabs rcx, 0x4f4c45525f444642
call sub.VCRUNTIME140.dll_memcpy
xor edx, edx
inc ebx
cmp ebx, 0x79
jb 0x180007630
mov edi, dword [rbp + 8]
jmp 0x18000718d
xor edx, edx
mov dword [rbp + 0x20], edx
jmp 0x18000767e
mov eax, 0x64
mov dword [rbp + 0x92], 0x2e0032
mov word [rbp + 0x96], ax
mov dword [rbp + 0x98], 0x6c006c
mov word [rbp + 0x9c], dx
jmp case.0x180007063.265
mov eax, dword [rbp + 0x28]
lea r9, [rbp]
mov rdx, qword [rbp + 0x48]
lea rcx, [0x180082428]
mov r8d, 0xab
mov dword [rbp], eax
call fcn.180051420
jmp 0x18000718b
mov rcx, qword [rbp + 0x68]
dec rcx
nop dword [rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1800076f0
xor edx, edx
nop dword [rax]
movzx eax, byte [rsi + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x180007700
xor edx, edx
jmp case.0x180007063.265
mov dword [rbp + 0x88], 0x730077
mov word [rbp + 0x8c], r10w
mov dword [rbp + 0x8e], 0x33005f
jmp case.0x180007063.265
lea r8, [0x180081ef0]
nop
mov ecx, edx
lea r8, [r8 + 4]
and ecx, 1
mov eax, edx
shr eax, 1
neg ecx
and ecx, 0xedb88320
inc edx
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [r8 - 4], eax
cmp edx, 0x100
jb 0x180007740
xor edx, edx
jmp case.0x180007063.265
movsxd rcx, dword [rbp + 0x28]
mov r14d, edx
mov rdi, rdx
mov rsi, rcx
test ecx, ecx
jle 0x1800078e1
mov rbx, qword [rbp + 0x48]
nop dword [rax]
movzx eax, byte [rdi + rbx]
cmp eax, dword [r8 + rdi*4]
je 0x1800078c3
mov rdi, rdx
mov r14d, ecx
nop dword [rax]
nop dword [rax + rax]
movzx ebx, byte [rdi + rbx]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, ebx
lea rdx, str._x__x_n
mov rcx, rax
mov rax, qword [rbp + 0x60]
mov r9d, dword [rax + rdi*4]
call fcn.18005f710
mov rbx, qword [rbp + 0x48]
inc rdi
cmp rdi, rsi
jl 0x180007820
mov ebx, 0x76
nop word [rax + rax]
mov eax, ebx
sub eax, 0x76
je 0x180007a24
sub eax, 3
je 0x1800078da
cmp eax, 1
jne 0x1800078af
mov eax, dword [rbp + 0x2c]
lea r8, str.DecodeAndDecrypt_failed
xor r9d, r9d
mov dword [rbp], eax
lea rdx, [rbp]
mov ecx, 0x128
call fcn.180045490
movsxd rax, dword [rbp + 0x2c]
xor edx, edx
test eax, eax
jle 0x1800078b1
mov r8, rax
movabs rcx, 0x6e4165646f636544
call sub.VCRUNTIME140.dll_memcpy
xor edx, edx
inc ebx
cmp ebx, 0x79
jb 0x180007860
mov rbx, qword [rbp + 0x48]
mov r8, qword [rbp + 0x60]
mov ecx, dword [rbp + 0x28]
inc r14d
inc rdi
cmp rdi, rsi
jl 0x180007800
mov edi, dword [rbp + 8]
jmp 0x18000718d
xor edx, edx
mov dword [rbp + 0x2c], edx
jmp 0x1800078b1
mov edi, dword [rbp + 8]
jmp case.0x180007063.265
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, str.SwitchIpUnset
lea rdx, [0x18007a85c]
call fcn.18005f710
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, str.Unexpected_stack_frame_type
lea rdx, [0x18007a85c]
call fcn.18005f710
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, str.Warning:_Wrote_empty_property_section.
lea rdx, [0x18007a85c]
call fcn.18005f710
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, str.Emit_line_level_debug_information
lea rdx, [0x18007a85c]
call fcn.18005f710
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, str.getSupportedMediaTypes
lea rdx, [0x18007a85c]
call fcn.18005f710
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, str.0_IsPostRegisterAllocated
lea rdx, [0x18007a85c]
call fcn.18005f710
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, str.BFD_RELOC_IA64_LTV32MSB
lea rdx, [0x18007a85c]
call fcn.18005f710
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, str.DecodeAndDecrypt_failed
lea rdx, [0x18007a85c]
call fcn.18005f710
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rsp + 0x30], GetAcceptLanguagesA
lea rax, [rbp + 0x88]
mov qword [rsp + 0x28], rdx
mov r9d, 0x46
xor edx, edx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
call fcn.1800503f0
mov rcx, r14
call rax
movzx ecx, word [rsi]
lea rdx, [rbp + 8]
mov dword [rsp + 0x50], 0x10a
xor r9d, r9d
mov word [rbp + 8], cx
xor r8d, r8d
xor ecx, ecx
mov dword [rbp + 0x20], eax
mov qword [rsp + 0x48], rcx
lea rax, [rbp + 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rcx
call fcn.1800481c0
jmp 0x180007acd
movzx eax, byte [rbp + 8]
mov rcx, qword [rbp + 0xa0]
xor rcx, rbp
call fcn.18005fed0
mov rbx, qword [rbp + 0xf0]
lea rsp, [rbp + 0xb0]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret