Function at 0x18003a4a0
Capabilities:
Create thread
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov rax, qword [0x1801561e0]
xor rax, rsp
mov qword [rbp + 0xa0], rax
mov rdi, rcx
mov qword [rbp + 0x98], rcx
xor r15d, r15d
mov dword [rbp - 0x78], r15d
mov dword [rsp + 0x58], 0xeeefefe8
mov dword [rsp + 0x5c], 0xa4b8da90
mov word [rsp + 0x60], 0x100
lea rdx, [rbp + 0x78]
lea rcx, [rsp + 0x58]
call fcn.18001e490
lea rcx, [rbp + 0x78]
call fcn.18000ee90
test al, al
jne 0x18003acaa
movdqa xmm0, xmmword [0x18013a650]
movdqu xmmword [rbp], xmm0
mov dword [rbp + 0x10], 0xb5a9e5fe
mov word [rbp + 0x14], 0xab
mov byte [rbp + 0x16], 1
mov ecx, r15d
nop word [rax + rax]
lea eax, [rcx - 0x46]
xor byte [rbp + rcx], al
inc rcx
cmp rcx, 0x15
jb 0x18003a540
mov byte [rbp + 0x16], 0
mov qword [rbp + 0x18], r15
mov qword [rbp + 0x28], r15
mov qword [rbp + 0x30], reloc.WS2_32.dll_ntohs
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, [rbp]
lea rcx, [rbp + 0x18]
call fcn.180040f40
lea rcx, [rbp + 0x18]
call fcn.18000ee90
test al, al
jne 0x18003acaa
movdqa xmm0, xmmword [0x180139690]
movdqu xmmword [rsp + 0x68], xmm0
mov dword [rsp + 0x78], 0xfbbeaeb8
mov dword [rsp + 0x7c], 0xbdb4e1fa
mov word [rbp - 0x80], 0xbe
mov byte [rbp - 0x7e], 1
mov rcx, r15
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x46]
xor byte [rsp + rcx + 0x68], al
inc rcx
cmp rcx, 0x19
jb 0x18003a5c0
mov byte [rbp - 0x7e], 0
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r14, rax
test rax, rax
jne 0x18003a5f3
cmp byte [0x180180826], al
je 0x18003ac14
mov dword [rsp + 0x50], 0x8d8489d8
mov word [rsp + 0x54], Ordinal_143
mov byte [rsp + 0x56], 1
mov rcx, r15
nop word [rax + rax]
lea eax, [rcx - 0x46]
xor byte [rsp + rcx + 0x50], al
inc rcx
cmp rcx, 5
jb 0x18003a610
mov byte [rsp + 0x56], 0
mov qword [rbp + 0x38], r15
movdqa xmm0, xmmword [0x180137e20]
movdqu xmmword [rbp + 0x48], xmm0
mov r8d, 5
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x38]
call fcn.180040f40
lea rdx, [rbp + 0x38]
cmp qword [rbp + 0x50], 0x10
cmovae rdx, qword [rbp + 0x38]
mov r8, qword [rdi + 0x10]
mov rcx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18003a669
mov rcx, qword [rdi]
cmp r8, qword [rbp + 0x48]
jne 0x18003a690
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x18003a690
lea rcx, [rbp + 0x38]
call fcn.180040e40
mov dword [0x1801807e8], 0x300
jmp 0x18003a800
lea rcx, [rbp + 0x38]
call fcn.180040e40
mov dword [rsp + 0x48], 0x898589d8
mov word [rsp + 0x4c], Ordinal_143
mov byte [rsp + 0x4e], 1
mov rcx, r15
lea eax, [rcx - 0x46]
xor byte [rsp + rcx + 0x48], al
inc rcx
cmp rcx, 5
jb 0x18003a6b0
mov byte [rsp + 0x4e], 0
mov qword [rbp + 0x58], r15
movdqa xmm0, xmmword [0x180137e20]
movdqu xmmword [rbp + 0x68], xmm0
mov byte [rbp + 0x58], 0
mov r8d, 5
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x58]
call fcn.180040f40
nop
mov ebx, 0x1fd
mov dword [rbp - 0x78], ebx
lea rdx, [rbp + 0x58]
cmp qword [rbp + 0x70], 0x10
cmovae rdx, qword [rbp + 0x58]
mov r8, qword [rdi + 0x10]
mov rcx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18003a716
mov rcx, qword [rdi]
cmp r8, qword [rbp + 0x68]
jne 0x18003a729
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x18003a7b0
mov dword [rsp + 0x40], 0x848c88d8
mov word [rsp + 0x44], Ordinal_143
mov byte [rsp + 0x46], 1
mov rcx, r15
lea eax, [rcx - 0x46]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 5
jb 0x18003a740
mov byte [rsp + 0x46], 0
mov qword [rbp - 0x50], r15
movdqa xmm0, xmmword [0x180137e20]
movdqu xmmword [rbp - 0x40], xmm0
mov r8d, 5
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x50]
call fcn.180040f40
mov ebx, 0x7ff
mov dword [rbp - 0x78], ebx
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov r8, qword [rdi + 0x10]
mov rcx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18003a7a1
mov rcx, qword [rdi]
cmp r8, qword [rbp - 0x40]
jne 0x18003a7b5
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x18003a7b5
mov sil, 1
jmp 0x18003a7b8
xor sil, sil
test bl, 2
je 0x18003a7cd
and ebx, 0xfffffffd
mov dword [rbp - 0x78], ebx
lea rcx, [rbp - 0x50]
call fcn.180040e40
nop
test bl, 1
je 0x18003a7db
lea rcx, [rbp + 0x58]
call fcn.180040e40
test sil, sil
je 0x18003a7f6
mov dword [0x1801807e8], 0x300
mov dword [0x1801807e4], 0xe8
jmp 0x18003a80a
mov dword [0x1801807e8], 0x320
mov dword [0x1801807e4], 0x88
mov dword [rsp + 0x30], 0xeadfc9dd
mov dword [rsp + 0x34], 0xaea4d1d7
mov word [rsp + 0x38], 0xb5
mov byte [rsp + 0x3a], 1
mov rcx, r15
nop dword [rax]
lea eax, [rcx - 0x46]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 9
jb 0x18003a830
mov byte [rsp + 0x3a], 0
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x180184770], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [0x180184778], rax
movdqa xmm0, xmmword [0x180139840]
movdqu xmmword [rbp - 0x70], xmm0
mov dword [rbp - 0x60], 0xe3a9bda3
mov dword [rbp - 0x5c], 0xbca3aa
mov byte [rbp - 0x58], 1
mov rcx, r15
nop word [rax + rax]
lea eax, [rcx - 0x46]
xor byte [rbp + rcx - 0x70], al
inc rcx
cmp rcx, 0x17
jb 0x18003a890
mov byte [rbp - 0x58], 0
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [0x180184860], rax
mov rsi, qword [0x180180740]
add rsi, r14
add r14, qword [0x180180748]
lea rdx, [0x1801806b0]
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rdx, qword [0x1801806b0]
mov rcx, rax
call fcn.180010380
mov qword [0x180184868], rax
lea rdx, [0x1801806d0]
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rdx, qword [0x1801806d0]
mov rcx, qword [0x180184860]
call fcn.180010380
mov qword [0x180184870], rax
mov rdx, qword [0x180184778]
mov rax, qword [0x180180700]
add rax, rdx
je 0x18003a92e
mov rax, qword [rax]
jmp 0x18003a931
mov rax, r15
mov qword [0x1801847a0], rax
mov rax, qword [0x180180708]
add rax, rdx
je 0x18003a949
mov rax, qword [rax]
jmp 0x18003a94c
mov rax, r15
mov qword [0x1801847a8], rax
mov rax, qword [0x180180720]
add rax, rdx
je 0x18003a964
mov rax, qword [rax]
jmp 0x18003a967
mov rax, r15
mov qword [0x1801847b8], rax
mov rcx, qword [0x180180718]
add rcx, rdx
je 0x18003a97f
mov rax, qword [rcx]
jmp 0x18003a982
mov rax, r15
mov qword [0x1801847b0], rax
mov rcx, qword [0x180180728]
add rcx, rdx
mov qword [0x180184790], rcx
mov rcx, qword [0x180180710]
add rcx, rdx
mov qword [0x1801847c0], rcx
mov rcx, qword [0x180180730]
add rcx, rdx
lea rax, [rcx - 0xc]
mov qword [0x180184798], rax
lea rax, [rcx - 0xb]
test rax, rax
je 0x18003a9ce
mov r8d, dword [rax]
jmp 0x18003a9d1
mov r8d, r15d
movsxd rax, r8d
add rcx, 0xfffffffffffffff9
add rcx, rax
mov qword [0x180184798], rcx
mov rcx, qword [0x180180750]
add rcx, rdx
mov qword [0x1801847f0], rcx
mov rcx, qword [0x180180760]
add rcx, rdx
mov qword [0x1801847f8], rcx
mov rcx, qword [0x180180768]
add rcx, rdx
mov qword [0x180184800], rcx
mov rcx, qword [0x180180758]
add rcx, rdx
mov qword [0x180184808], rcx
mov rcx, qword [0x180180770]
add rcx, rdx
mov qword [0x180184810], rcx
mov rcx, qword [0x180180798]
add rcx, rdx
mov qword [0x180184838], rcx
mov rcx, qword [0x1801807a0]
add rcx, rdx
mov qword [0x180184840], rcx
mov rcx, qword [0x1801807b0]
add rcx, rdx
mov qword [0x180184850], rcx
mov rcx, qword [0x1801807a8]
add rcx, rdx
mov qword [0x180184848], rcx
lea rcx, [rdx - 0x56]
add rcx, qword [0x180180738]
mov qword [0x1801846d0], rcx
mov rcx, qword [0x1801807b8]
add rcx, rdx
mov qword [0x1801846c8], rcx
mov rcx, qword [0x180180778]
add rcx, rdx
mov qword [0x180184818], rcx
mov rcx, qword [0x180180780]
add rcx, rdx
mov qword [0x180184820], rcx
mov rcx, qword [0x180180790]
add rcx, rdx
mov qword [0x180184830], rcx
mov rcx, qword [0x180180788]
add rcx, rdx
mov qword [0x180184828], rcx
mov rbx, r15
xor eax, eax
mov r12d, 1
lock cmpxchg dword [0x180184738], r12d
je 0x18003ab1b
cmp rbx, 0x20
jae 0x18003ab02
xor ecx, ecx
jmp 0x18003ab05
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x180184738], r12d
jne 0x18003aaf8
cmp qword [0x180184740], 0
jne 0x18003ab39
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [0x180184740], rax
mov eax, r15d
xchg dword [0x180184738], eax
cmp byte [0x180180826], 0
je 0x18003ab6b
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [0x180039df0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x18003ab97
lea r8, [0x180184710]
lea rdx, [0x180039890]
mov rcx, r14
call fcn.1800a73e0
lea r8, [0x1801846f0]
lea rdx, [0x180039990]
mov rcx, rsi
call fcn.1800a73e0
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [0x1801846c0]
lea rdx, [0x180039550]
mov rcx, qword [0x180184798]
call fcn.1800a73e0
lea r8, [0x1801846b8]
lea rdx, [0x1800392c0]
mov rcx, qword [0x180184790]
call fcn.1800a73e0
mov edx, r12d
xor ecx, ecx
call fcn.1800a7710
nop
mov rcx, rdi
call fcn.180040e40
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.180112f90
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
lea rax, [rbp + 0x78]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x30], 0xc8d8d4f7
mov dword [rsp + 0x34], 0xe1b3dad2
mov dword [rsp + 0x38], 0xaab6b187
mov word [rsp + 0x3c], 0x100
lea rdx, [rbp + 0x78]
lea rcx, [rsp + 0x30]
call fcn.18003de80
mov rbx, rax
movdqa xmm0, xmmword [0x180139bf0]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x180139b40]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmmword [0x180138610]
movdqa xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0x848f8284
mov dword [rbp - 0x1c], 0xd19fcf8b
mov dword [rbp - 0x18], 0x90829ab4
mov dword [rbp - 0x14], 0x100d9bb
lea rdx, [rbp + 0x18]
lea rcx, [rbp - 0x50]
call fcn.18003af30
nop
mov rdx, rbx
mov rcx, rax
call fcn.18000edc0
int3
lea rax, [rbp + 0x78]
mov qword [rsp + 0x40], rax
movdqa xmm0, xmmword [0x180139a20]
movdqu xmmword [rsp + 0x68], xmm0
mov dword [rsp + 0x78], 0xafa5bfab
mov dword [rsp + 0x7c], 0xa5b9a3a7
mov word [rbp - 0x80], 0xab
mov byte [rbp - 0x7e], 1
lea rdx, [rbp + 0x78]
lea rcx, [rsp + 0x68]
call fcn.18003c560
mov rbx, rax
movdqa xmm0, xmmword [0x180139f30]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x18013a0d0]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmmword [0x180138e50]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x180138c90]
movdqa xmmword [rbp - 0x20], xmm1
mov dword [rbp - 0x10], 0x100d595
lea rdx, [rbp + 0x18]
lea rcx, [rbp - 0x50]
call fcn.18003b0f0
nop
mov rdx, rbx
mov rcx, rax
call fcn.18000edc0
int3