Function at 0x180074140
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x178]
sub rsp, 0x250
mov r14d, ecx
mov r12, r8
lea rcx, [rbp - 0x48]
mov rbx, rdx
call fcn.18003d8c0
xor r13d, r13d
mov edi, r13d
call fcn.180071420
test al, al
jne 0x1800747d3
mov edx, 0x544
lea rcx, [rbp - 0x48]
call fcn.18003e08c
mov ecx, r14d
lea r15d, [r13 + 1]
sub ecx, r15d
je 0x1800741c8
sub ecx, r15d
je 0x1800741c8
cmp ecx, 2
je 0x1800741c8
call fcn.18005cbe0
test al, al
je 0x1800741cb
mov eax, r15d
lock xadd dword [0x180102568], eax
add eax, r15d
jne 0x1800741cb
mov edi, r15d
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1800746fe
call fcn.180071464
test al, al
je 0x1800746fe
mov rdx, rbx
lea rcx, [rbp - 0x68]
call fcn.18006ff40
cmp qword [rbp - 0x50], 0x10
lea rcx, [rbp - 0x68]
mov r8d, socket
cmovae rcx, qword [rbp - 0x68]
cmp qword [rbp - 0x58], r8
jne 0x180074222
lea rdx, str.ApplicationFrameWindow
call fcn.18009fb20
mov dil, r15b
test eax, eax
je 0x180074225
mov dil, r13b
cmp qword [rbp - 0x50], 0x10
lea rcx, [rbp - 0x68]
mov r8d, DispGetIDsOfNames
cmovae rcx, qword [rbp - 0x68]
cmp qword [rbp - 0x58], r8
jne 0x180074252
lea rdx, str.Windows.UI.Core.CoreWindow
call fcn.18009fb20
mov dl, r15b
test eax, eax
je 0x180074255
mov dl, r13b
test dil, dil
jne 0x180074277
test dl, dl
jne 0x180074277
mov r9, r12
mov r8, rbx
mov edx, r14d
xor ecx, ecx
call qword [sym.imp.USER32.dll_CallNextHookEx]
mov rbx, rax
jmp 0x1800746ba
mov esi, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x78], r13
mov ecx, r14d
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], rsi
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], rsi
sub ecx, r15d
je 0x180074401
sub ecx, r15d
je 0x1800743cd
sub ecx, 2
je 0x18007438a
sub ecx, 2
je 0x1800742c4
cmp ecx, 2
jne 0x180074611
test dl, dl
jne 0x180074409
mov rdi, rbx
lea r9, [rsp + 0x58]
mov rcx, rbx
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x50]
call fcn.18006f530
test al, al
je 0x180074611
mov esi, 0x104
lea rcx, [rbp + 0x48]
mov r8d, esi
xor edx, edx
call fcn.1800a02d0
mov eax, dword [rsp + 0x50]
mov dword [rbp + 0x44], eax
mov dword [rbp + 0x40], r14d
cmp qword [rsp + 0x68], r13
je 0x180074328
lea rdx, [0x1800eaeec]
lea rcx, [rsp + 0x58]
call fcn.180021520
test al, al
jne 0x18007432b
mov r15b, r13b
mov r8, rdi
lea rcx, [rbp - 0x48]
mov dl, r15b
call fcn.180071fb8
test r15b, r15b
je 0x180074359
cmp qword [rsp + 0x70], 0x10
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x48]
cmovae rdx, qword [rsp + 0x58]
call fcn.18003de6c
cmp qword [rbp - 0x78], r13
je 0x18007443a
cmp qword [rbp - 0x70], 0x10
lea r8, [rsp + 0x78]
mov r9d, 0x103
lea rcx, [rbp + 0x48]
cmovae r8, qword [rsp + 0x78]
mov rdx, rsi
call fcn.1800af284
jmp 0x180074449
cmp byte [0x18010aa38], r13b
je 0x18007439c
test dil, dil
je 0x180074611
lea r9, [rsp + 0x58]
mov rcx, rbx
lea r8, [rsp + 0x78]
mov rdi, rbx
lea rdx, [rsp + 0x50]
call fcn.18006f530
test al, al
jne 0x1800742ee
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x50], eax
jmp 0x1800742ee
cmp byte [0x18010aa38], r13b
je 0x180074611
test dl, dl
jne 0x180074611
call fcn.18005cb00
test al, al
je 0x180074611
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x50], eax
mov rdi, rbx
jmp 0x1800742ee
test dl, dl
je 0x180074611
cmp byte [0x18010aa38], r13b
je 0x1800742cc
mov edx, r15d
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetAncestor]
mov rcx, rax
mov rdi, rax
call fcn.180070f30
test al, al
je 0x180074611
jmp 0x1800742cf
mov r8d, esi
lea rdx, [rbp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor r9d, r9d
lea rdx, [rbp + 0x40]
mov r8d, 0x10c
lea rcx, [rbp - 0x48]
call fcn.18003de9c
cmp byte [0x18010a364], r13b
je 0x1800745f5
lea rdx, [rbp + 0x18]
lea rcx, [rbp - 0x48]
call fcn.18003db9c
mov rdi, rax
cmp qword [rax + 0x18], 0x10
jb 0x180074486
mov rdi, qword [rax]
lea rdx, [rbp - 8]
lea rcx, [rbp - 0x48]
call fcn.18003dcd8
mov rsi, rax
cmp qword [rax + 0x18], 0x10
jb 0x1800744a0
mov rsi, qword [rax]
mov rdx, rbx
lea rcx, [rbp - 0x28]
call fcn.18006ff40
mov r15, rax
cmp qword [rax + 0x18], 0x10
jb 0x1800744b9
mov r15, qword [rax]
lea rcx, [rbp + 0x198]
call fcn.18006d968
mov r10, rax
cmp byte [rax + 0x7a], r13b
je 0x1800744fb
mov r8, r13
movabs r9, 0xd993efbb19cfe32d
mov cl, r8b
mov rax, r9
and cl, 7
shl cl, 3
shr rax, cl
xor byte [r8 + r10], al
inc r8
cmp r8, 0x7a
jb 0x1800744db
mov byte [r10 + 0x7a], r13b
mov r9d, dword [rbp + 0x44]
lea rax, [rbp + 0x48]
mov qword [rsp + 0x40], rax
mov r8d, r14d
mov qword [rsp + 0x38], rdi
mov rdx, r10
mov qword [rsp + 0x30], rsi
mov ecx, 4
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rbx
call fcn.18006a848
mov rdx, qword [rbp - 0x10]
mov edi, 0x1000
cmp rdx, 0x10
jb 0x180074568
mov rcx, qword [rbp - 0x28]
inc rdx
mov rax, rcx
cmp rdx, rdi
jb 0x180074563
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18007481a
call fcn.18009d1f4
mov rdx, qword [rbp + 0x10]
mov esi, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x10], rsi
mov byte [rbp - 0x28], r13b
cmp rdx, 0x10
jb 0x1800745b0
mov rcx, qword [rbp - 8]
inc rdx
mov rax, rcx
cmp rdx, rdi
jb 0x1800745ab
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18007481a
call fcn.18009d1f4
mov rdx, qword [rbp + 0x30]
mov qword [rbp + 8], r13
mov qword [rbp + 0x10], rsi
mov byte [rbp - 8], r13b
cmp rdx, 0x10
jb 0x1800745fa
mov rcx, qword [rbp + 0x18]
inc rdx
mov rax, rcx
cmp rdx, rdi
jb 0x1800745ee
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18007481a
call fcn.18009d1f4
jmp 0x1800745fa
mov esi, reloc.WS2_32.dll_ntohs
call fcn.180049c04
mov rcx, rax
lea rdx, [rbp - 0x48]
mov r8d, 0x3e8
call fcn.180077c5c
mov r9, r12
mov r8, rbx
mov edx, r14d
xor ecx, ecx
call qword [sym.imp.USER32.dll_CallNextHookEx]
mov rdx, qword [rsp + 0x70]
mov rbx, rax
cmp rdx, 0x10
jb 0x180074662
mov rcx, qword [rsp + 0x58]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18007465d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180074814
call fcn.18009d1f4
mov rdx, qword [rbp - 0x70]
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], rsi
mov byte [rsp + 0x58], r13b
cmp rdx, 0x10
jb 0x1800746ad
mov rcx, qword [rsp + 0x78]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800746a8
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180074814
call fcn.18009d1f4
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], rsi
mov byte [rsp + 0x78], r13b
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x1800747e7
mov rcx, qword [rbp - 0x68]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800746f4
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180074814
call fcn.18009d1f4
jmp 0x1800747e7
test edi, edi
je 0x1800747d3
mov esi, 0x104
lea rcx, [rbp + 0x48]
mov r8d, esi
xor edx, edx
call fcn.1800a02d0
mov dword [rbp + 0x40], r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, esi
lea rdx, [rbp + 0x48]
xor ecx, ecx
mov dword [rbp + 0x44], eax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp byte [0x18010a364], r13b
je 0x1800747a6
lea rcx, [rbp + 0x198]
call fcn.18006e2c4
mov rdi, rax
cmp byte [rax + 0x49], r13b
je 0x180074780
mov r8, r13
movabs r9, 0xd993efbb19cfe32d
mov cl, r8b
mov rax, r9
and cl, 7
shl cl, 3
shr rax, cl
xor byte [r8 + rdi], al
add r8, r15
cmp r8, 0x49
jb 0x180074760
mov byte [rdi + 0x49], r13b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x28], eax
mov r9, rbx
lea rax, [rbp + 0x48]
mov r8d, r14d
mov rdx, rdi
mov qword [rsp + 0x20], rax
mov ecx, 4
call fcn.18006a848
xor r9d, r9d
lea rdx, [rbp + 0x40]
mov r8d, 0x10c
lea rcx, [rbp - 0x48]
call fcn.18003de9c
call fcn.180049c04
mov rcx, rax
lea rdx, [rbp - 0x48]
mov r8d, 0x3e8
call fcn.180077c5c
mov r9, r12
mov r8, rbx
mov edx, r14d
xor ecx, ecx
call qword [sym.imp.USER32.dll_CallNextHookEx]
mov rbx, rax
lea rcx, [rbp - 0x48]
call fcn.18001d6c0
lea r11, [rsp + 0x250]
mov rax, rbx
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1800a45b8
int3
call fcn.1800a45b8
int3