Function at 0x180069538
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0x90
xorps xmm0, xmm0
movdqu xmmword [rbp - 9], xmm0
and qword [rbp + 7], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x20], eax
mov ebx, 1
mov r9b, bl
mov r8b, bl
lea rdx, str.IEFrame
lea rcx, [rbp - 9]
call fcn.180068e50
cmp byte [0x18010a364], 0
je 0x1800695d3
lea rcx, [rbp + 0x67]
call fcn.180066fb4
mov rdi, rax
cmp byte [rax + 0x31], 0
je 0x1800695bd
xor eax, eax
mov cl, al
and cl, 7
shl cl, 3
movabs r8, 0xd993efbb19cfe32d
shr r8, cl
xor byte [rax + rdi], r8b
add rax, rbx
cmp rax, 0x31
jb 0x180069597
mov byte [rdi + 0x31], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
mov rdx, rdi
mov ecx, 4
call fcn.18006a848
mov rax, qword [rbp - 1]
mov rcx, qword [rbp - 9]
sub rax, rcx
sar rax, 3
test rax, rax
jne 0x18006976c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x20], eax
mov r9b, bl
mov r8b, bl
lea rdx, str.Frame_Tab
lea rcx, [rbp - 9]
call fcn.180068e50
mov rax, qword [rbp - 1]
mov rcx, qword [rbp - 9]
sub rax, rcx
sar rax, 3
test rax, rax
jne 0x18006976c
and qword [rbp - 0x19], rax
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
lea r9, [0x1800d3f60]
xor edx, edx
lea r8d, [rdx + 0x17]
lea rcx, [0x1800d40b0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x180069757
mov rcx, qword [rbp - 0x19]
mov rax, qword [rcx]
lea rdx, [rbp + 0x6f]
call qword [rax + 0x38]
test eax, eax
js 0x180069757
xor edi, edi
cmp dword [rbp + 0x6f], edi
jle 0x180069757
mov eax, 3
mov word [rbp + 0xf], ax
mov dword [rbp + 0x17], edi
and qword [rbp + 0x7f], 0
movups xmm0, xmmword [rbp + 0xf]
movaps xmmword [rbp + 0x27], xmm0
movsd xmm1, qword [rbp + 0x1f]
movsd qword [rbp + 0x37], xmm1
mov rcx, qword [rbp - 0x19]
mov rax, qword [rcx]
lea r8, [rbp + 0x7f]
lea rdx, [rbp + 0x27]
call qword [rax + 0x40]
test eax, eax
js 0x1800697c0
mov rcx, qword [rbp + 0x7f]
cmp eax, ebx
je 0x180069736
test rcx, rcx
je 0x180069736
and qword [rbp + 0x77], 0
mov rax, qword [rcx]
lea r8, [rbp + 0x77]
lea rdx, [0x1800d3828]
call qword [rax]
test eax, eax
js 0x180069730
mov rcx, qword [rbp + 0x77]
test rcx, rcx
je 0x180069734
mov rax, qword [rcx]
lea rdx, [rbp - 0x11]
call qword [rax + pe_nt_image_headers64]
test eax, eax
jns 0x180069706
mov rcx, qword [rbp + 0x77]
test rcx, rcx
je 0x180069700
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov rcx, qword [rbp + 0x7f]
jmp 0x180069736
lea rdx, [rbp + 0x67]
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp eax, dword [rbp + 0x67]
jne 0x180069730
mov edx, ebx
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.USER32.dll_GetAncestor]
test rax, rax
je 0x1800697af
mov rcx, qword [rbp + 0x77]
jmp 0x1800696f4
test rcx, rcx
je 0x180069742
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
nop
lea rcx, [rbp + 0xf]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
add edi, ebx
cmp edi, dword [rbp + 0x6f]
jl 0x180069673
xor bl, bl
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x180069768
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x1800697a2
mov rdx, qword [rbp + 7]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006979d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800697e1
call fcn.18009d1f4
mov al, bl
add rsp, 0x90
pop rdi
pop rbx
pop rbp
ret
mov rcx, qword [rbp + 0x77]
test rcx, rcx
je 0x1800697c2
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
jmp 0x1800697c2
xor bl, bl
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x1800697d2
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
nop
lea rcx, [rbp + 0xf]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x180069759
call fcn.1800a45b8
int3