Function at 0x180008760
Capabilities:
Encode data using xor
Hash data using sha1
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x18008b088]
xor rax, rsp
mov qword [rbp + 0x50], rax
imul eax, r8d, 0x85e
mov rbx, r9
mov esi, r8d
mov dword [rsp + 0x44], r8d
mov r14, rdx
mov rdi, rcx
mov r15d, r8d
mov dword [rsp + 0x3c], eax
cmp r8d, eax
ja 0x180008eea
mov r12d, dword [rsp + 0x3c]
mov edx, 1
mov r13d, dword [rsp + 0x3c]
cmp r15d, 0x69f0
ja 0x180008d20
je 0x180008eea
cmp r15d, 0xe2
ja 0x180008bfe
je 0x180008be2
mov eax, r15d
sub eax, 0x14
je 0x180008862
sub eax, 0x19
je 0x18000884e
sub eax, 0x5b
je 0x180008846
cmp eax, 0x53
jne 0x180008834
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x40], 0
test rbx, rbx
je 0x180008e62
xor edx, edx
mov r8d, 0xd9
mov rcx, rbx
call fcn.18006aee0
test eax, eax
je 0x180008e59
mov edx, 1
imul eax, esi, 0x77
add r15d, eax
cmp r15d, dword [rsp + 0x3c]
jbe 0x1800087c1
jmp 0x180008eea
xor r12d, r12d
xor r13d, r13d
jmp 0x180008834
mov rdx, rbx
mov ecx, 0x89
call fcn.18001cc00
mov eax, dword [r14]
add dword [rbx], eax
jmp 0x18000882f
mov dword [rbp - 8], 0x67452301
xor esi, esi
test dword [r14], 0xffffffc0
mov dword [rbp - 4], 0xefcdab89
mov dword [rbp], 0x98badcfe
mov dword [rbp + 4], 0x10325476
movups xmm0, xmmword [rbp - 8]
mov dword [rbp - 0x10], 0xc3d2e1f0
movups xmmword [rbp - 0x20], xmm0
jbe 0x180008a11
nop dword [rax]
lea r9, [rbp + 0x18]
mov r10d, 2
nop word [rax + rax]
movzx eax, byte [rbx + 2]
movzx ecx, byte [rbx + 1]
movzx r8d, byte [rbx]
movzx edx, byte [rbx + 3]
shl edx, 8
or edx, eax
movzx eax, byte [rbx + 6]
shl edx, 8
or edx, ecx
movzx ecx, byte [rbx + 5]
shl edx, 8
or edx, r8d
movzx r8d, byte [rbx + 4]
mov dword [r9 - 8], edx
movzx edx, byte [rbx + 7]
shl edx, 8
or edx, eax
movzx eax, byte [rbx + 0xa]
shl edx, 8
or edx, ecx
movzx ecx, byte [rbx + 9]
shl edx, 8
or edx, r8d
movzx r8d, byte [rbx + 8]
mov dword [r9 - 4], edx
movzx edx, byte [rbx + 0xb]
shl edx, 8
or edx, eax
movzx eax, byte [rbx + 0xe]
shl edx, 8
or edx, ecx
movzx ecx, byte [rbx + 0xd]
shl edx, 8
or edx, r8d
movzx r8d, byte [rbx + 0xc]
mov dword [r9], edx
movzx edx, byte [rbx + 0xf]
shl edx, 8
or edx, eax
movzx eax, byte [rbx + 0x12]
shl edx, 8
or edx, ecx
movzx ecx, byte [rbx + 0x11]
shl edx, 8
or edx, r8d
movzx r8d, byte [rbx + 0x10]
mov dword [r9 + 4], edx
movzx edx, byte [rbx + 0x13]
shl edx, 8
or edx, eax
movzx eax, byte [rbx + 0x16]
shl edx, 8
or edx, ecx
movzx ecx, byte [rbx + 0x15]
shl edx, 8
or edx, r8d
movzx r8d, byte [rbx + 0x14]
mov dword [r9 + 8], edx
movzx edx, byte [rbx + 0x17]
shl edx, 8
or edx, eax
movzx eax, byte [rbx + 0x1a]
shl edx, 8
or edx, ecx
movzx ecx, byte [rbx + 0x19]
shl edx, 8
or edx, r8d
movzx r8d, byte [rbx + 0x18]
mov dword [r9 + 0xc], edx
movzx edx, byte [rbx + 0x1b]
shl edx, 8
or edx, eax
movzx eax, byte [rbx + 0x1e]
shl edx, 8
or edx, ecx
movzx ecx, byte [rbx + 0x1d]
shl edx, 8
or edx, r8d
movzx r8d, byte [rbx + 0x1c]
mov dword [r9 + 0x10], edx
movzx edx, byte [rbx + 0x1f]
shl edx, 8
lea r9, [r9 + 0x20]
or edx, eax
add rbx, 0x20
shl edx, 8
or edx, ecx
shl edx, 8
or edx, r8d
mov dword [r9 - 0xc], edx
sub r10, 1
jne 0x1800088b0
lea r9, [rbp - 0x20]
mov dword [rsp + 0x20], 0x25
lea r8, [rbp + 0x10]
xor edx, edx
xor ecx, ecx
call fcn.18004a680
mov eax, dword [r14]
inc esi
shr eax, 6
cmp esi, eax
jb 0x1800088a0
mov esi, 0x112
cmp esi, 0x112
je 0x180008a5e
cmp esi, 0x7062
je 0x180008a50
cmp esi, 0xdfb2
jne 0x180008b24
lea r9, [rbp - 0x20]
mov dword [rsp + 0x20], 0x25
lea r8, [rbp + 0x10]
xor edx, edx
xor ecx, ecx
call fcn.18004a680
jmp 0x180008b24
mov eax, dword [r14]
shr eax, 0x1d
mov dword [rbp + 0x4c], eax
jmp 0x180008b24
mov r11d, dword [r14]
xorps xmm0, xmm0
mov r10d, r11d
movaps xmmword [rbp + 0x10], xmm0
xor r8d, r8d
movaps xmmword [rbp + 0x20], xmm0
movaps xmmword [rbp + 0x30], xmm0
movaps xmmword [rbp + 0x40], xmm0
and r10d, 0x3f
je 0x180008abd
xor r9d, r9d
nop dword [rax]
nop word [rax + rax]
mov rax, r9
lea rdx, [rbp + 0x10]
shr rax, 2
mov ecx, r8d
lea rdx, [rdx + rax*4]
and ecx, 3
movzx eax, byte [rbx]
inc r8d
shl ecx, 3
inc rbx
shl eax, cl
inc r9
xor dword [rdx], eax
cmp r8d, r10d
jb 0x180008a90
mov rax, r11
lea rdx, [rbp + 0x10]
shr rax, 2
and eax, 0xf
mov ecx, dword [rdx + rax*4]
lea rdx, [rdx + rax*4]
mov eax, r11d
and eax, 3
lea eax, [rax*8 + 7]
btc ecx, eax
mov dword [rdx], ecx
cmp r10d, 0x37
jbe 0x180008b19
lea r9, [rbp - 0x20]
mov dword [rsp + 0x20], 0x25
lea r8, [rbp + 0x10]
xor edx, edx
xor ecx, ecx
call fcn.18004a680
mov r11d, dword [r14]
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
lea eax, [r11*8]
mov dword [rbp + 0x48], eax
add esi, 0x6f50
cmp esi, 0x14df0
jbe 0x180008a16
mov ecx, dword [rbp - 0x20]
movzx eax, byte [rbp - 0x20]
mov byte [rdi], al
mov eax, ecx
mov esi, dword [rsp + 0x44]
shr eax, 8
mov byte [rdi + 1], al
mov eax, ecx
shr eax, 0x10
mov byte [rdi + 2], al
movzx eax, byte [rbp - 0x1c]
shr ecx, 0x18
mov byte [rdi + 3], cl
mov byte [rdi + 4], al
mov ecx, dword [rbp - 0x1c]
mov eax, ecx
shr eax, 8
mov byte [rdi + 5], al
mov eax, ecx
shr eax, 0x10
mov byte [rdi + 6], al
movzx eax, byte [rbp - 0x18]
shr ecx, 0x18
mov byte [rdi + 7], cl
mov ecx, dword [rbp - 0x18]
mov byte [rdi + 8], al
mov eax, ecx
shr eax, 8
mov byte [rdi + 9], al
mov eax, ecx
shr eax, 0x10
mov byte [rdi + 0xa], al
movzx eax, byte [rbp - 0x14]
shr ecx, 0x18
mov byte [rdi + 0xb], cl
mov ecx, dword [rbp - 0x14]
mov byte [rdi + 0xc], al
mov eax, ecx
shr eax, 8
mov byte [rdi + 0xd], al
mov eax, ecx
shr eax, 0x10
mov byte [rdi + 0xe], al
movzx eax, byte [rbp - 0x10]
shr ecx, 0x18
mov byte [rdi + 0xf], cl
mov ecx, dword [rbp - 0x10]
mov byte [rdi + 0x10], al
mov eax, ecx
shr eax, 8
mov byte [rdi + 0x11], al
mov eax, ecx
shr eax, 0x10
shr ecx, 0x18
mov byte [rdi + 0x12], al
mov byte [rdi + 0x13], cl
add rdi, 0x14
jmp 0x18000882f
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
je 0x180008e99
mov qword [rsp + 0x30], rax
jmp 0x18000882f
cmp r15d, 0x1518
je 0x180008d15
cmp r15d, 0x2a03
je 0x180008eea
cmp r15d, 0x3fc0
je 0x180008cd8
cmp r15d, 0x66a8
jne 0x180008834
test r14, r14
je 0x180008ec8
test rdi, rdi
je 0x180008ebf
lea r9, [rsp + 0x48]
mov r8, rdi
mov edx, 0x2d
lea rcx, [rsp + 0x40]
call fcn.18005d230
cmp dword [rsp + 0x40], 0
jne 0x18000882f
mov r9, rbx
lea r8, [rsp + 0x70]
mov edx, 0xe5
mov rcx, r14
call fcn.180021ca0
test eax, eax
je 0x18000882f
mov r9, rbx
lea r8, [rsp + 0x48]
mov edx, 0xae
lea rcx, [rsp + 0x70]
call fcn.180026ad0
mov dword [rsp + 0x38], eax
cmp eax, 0
je 0x180008cbd
mov r9d, 0x10b
lea r8, [rsp + 0x70]
xor edx, edx
mov rcx, r14
call fcn.18005ba20
jmp 0x18000882f
xorps xmm0, xmm0
movups xmmword [r14], xmm0
movups xmmword [r14 + 0x10], xmm0
movups xmmword [r14 + 0x20], xmm0
movups xmmword [r14 + 0x30], xmm0
jmp 0x18000882f
xor eax, eax
cmp dword [rbx + 0x1c], 0x7fffffff
setb al
xor edx, edx
or r13d, eax
cmp dword [rbx + 0x1c], 0x7fffffff
mov eax, r13d
not eax
seta dl
xor ecx, ecx
and edx, eax
or r12d, edx
cmp dword [rbx + 0x18], 0xffffffff
mov eax, r12d
not eax
setb cl
and ecx, eax
or r13d, ecx
jmp 0x18000882f
mov eax, dword [rbx]
mov dword [rsp + 0x30], eax
jmp 0x180008834
cmp r15d, 0x13242
ja 0x180008dfb
je 0x180008eea
cmp r15d, 0x7ef8
je 0x180008dce
cmp r15d, 0xbe30
je 0x180008d9d
cmp r15d, 0xcc75
je 0x180008d90
cmp r15d, 0xfd68
jne 0x180008834
xor ecx, ecx
mov eax, r13d
cmp dword [rbx + 8], 0x57a4501d
not eax
seta cl
and ecx, eax
or r12d, ecx
xor ecx, ecx
cmp dword [rbx + 4], 0xdfe92f46
mov eax, r12d
not eax
setb cl
and ecx, eax
or r13d, ecx
jmp 0x180008834
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x30], eax
jmp 0x180008834
xor ecx, ecx
mov eax, r13d
cmp dword [rbx + 0xc], 0x5d576e73
not eax
seta cl
and ecx, eax
or r12d, ecx
xor ecx, ecx
cmp dword [rbx + 8], 0x57a4501d
mov eax, r12d
not eax
setb cl
and ecx, eax
or r13d, ecx
jmp 0x180008834
xor ecx, ecx
cmp dword [rbx + 0xc], 0x5d576e73
setb cl
xor eax, eax
cmp dword [rbx + 0x14], 0xffffffff
setb al
or ecx, eax
mov eax, r12d
cmp dword [rbx + 0x10], 0xffffffff
not eax
cmovb ecx, edx
and ecx, eax
or r13d, ecx
jmp 0x180008834
cmp r15d, 0x13ca0
je 0x180008e3e
cmp r15d, 0x17bd8
je 0x180008e1f
cmp r15d, 0x1bb10
je 0x180008eea
jmp 0x180008834
xor ecx, ecx
mov eax, r13d
cmp dword [rbx], 0x681b20a0
not eax
seta cl
and ecx, eax
or r12d, ecx
mov dword [rsp + 0x30], r12d
jmp 0x180008834
xor ecx, ecx
mov eax, r13d
cmp dword [rbx + 4], 0xdfe92f46
not eax
seta cl
and ecx, eax
or r12d, ecx
jmp 0x180008834
lea r9, str.nsSocketTransportService::AttachSocket__handler_x_
jmp 0x180008ecf
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
xor r9d, r9d
lea r8, [0x180070fd1]
mov rcx, rax
lea rdx, str.Setup.lzh
lea rax, str.Saa_ya_Majira_ya_joto_ya_Mauritius
mov qword [rsp + 0x20], rax
call fcn.18006ca50
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Execing__s_to_restart_server.....
call fcn.18006ca50
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea r9, str.SectorSize__i
jmp 0x180008ecf
lea r9, str.V16cV16iV16cUs
lea r8, [rbx + 0xc8]
xor edx, edx
mov ecx, 0xdc
call fcn.18006bec0
mov dword [rsp + 0x30], 0
mov rax, qword [rsp + 0x30]
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.18006d4c0
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x160
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret