Function at 0x180023870
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x78]
sub rsp, 0x140
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
movaps xmmword [rax - 0x68], xmm8
movaps xmmword [rax - 0x78], xmm9
mov r15, rcx
mov dword [rbp + 0x88], 0
lea rdx, [rsp + 0x40]
call fcn.18001ea60
nop
mov cl, 1
call fcn.18009bd18
mov qword [rsp + 0x68], rax
mov esi, 1
mov ebx, esi
mov dword [rbp + 0x88], ebx
mov qword [rsp + 0x38], rax
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_VariantClear]
lea r8, [rsp + 0x30]
lea rdx, str.waol.exe
lea rcx, [rsp + 0x40]
call fcn.18002a620
test al, al
jne 0x180023a9b
movzx ecx, sil
call fcn.18009bd18
mov qword [rbp - 0x18], rax
mov ebx, 3
mov dword [rbp + 0x88], ebx
mov qword [rsp + 0x38], rax
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_VariantClear]
lea r8, [rsp + 0x30]
lea rdx, str.wcs2000.exe
lea rcx, [rsp + 0x40]
call fcn.18002a620
test al, al
jne 0x180023a9b
movzx ecx, sil
call fcn.18009bd18
mov qword [rbp - 8], rax
mov ebx, 7
mov dword [rbp + 0x88], ebx
mov qword [rsp + 0x38], rax
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_VariantClear]
lea r8, [rsp + 0x30]
lea rdx, str.wwm.exe
lea rcx, [rsp + 0x40]
call fcn.18002a620
test al, al
jne 0x180023a9b
movzx ecx, sil
call fcn.18009bd18
mov r13, rax
mov qword [rsp + 0x38], rax
mov ebx, reloc.WS2_32.dll_ntohs
mov dword [rbp + 0x88], ebx
mov qword [rbp - 0x28], rax
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_VariantClear]
lea r8, [rbp - 0x30]
lea rdx, str.aolopen
lea rcx, [rsp + 0x40]
call fcn.18002a620
test al, al
jne 0x180023aa0
movzx ecx, sil
call fcn.18009bd18
mov r12, rax
mov qword [rbp - 0x28], rax
mov ebx, 0x1f
mov dword [rbp + 0x88], ebx
mov qword [rbp - 0x38], rax
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_VariantClear]
lea r8, [rbp - 0x40]
lea rdx, str.aolbrowser.exe
lea rcx, [rsp + 0x40]
call fcn.18002a620
test al, al
jne 0x180023aa4
movzx ecx, sil
call fcn.18009bd18
mov r14, rax
mov qword [rbp - 0x38], rax
mov ebx, 0x3f
mov dword [rbp + 0x88], ebx
mov qword [rbp - 0x48], rax
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_VariantClear]
lea r8, [rbp - 0x50]
lea rdx, str.aolhelix.exe
lea rcx, [rsp + 0x40]
call fcn.18002a620
test al, al
jne 0x180023aa8
movzx ecx, sil
call fcn.18009bd18
mov rdi, rax
mov qword [rbp - 0x48], rax
mov ebx, 0x7f
mov dword [rbp + 0x88], ebx
mov qword [rsp + 0x28], rax
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_VariantClear]
lea r8, [rsp + 0x20]
lea rdx, str.aoldesktop.exe
lea rcx, [rsp + 0x40]
call fcn.18002a620
test al, al
jne 0x180023aac
mov byte [rbp + 0x88], al
jmp 0x180023ab3
mov r13, qword [rsp + 0x38]
mov r12, qword [rbp - 0x28]
mov r14, qword [rbp - 0x38]
mov rdi, qword [rbp - 0x48]
mov byte [rbp + 0x88], 1
test bl, 0x40
je 0x180023ada
and ebx, 0xffffffbf
test rdi, rdi
je 0x180023ada
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_recv]
test rax, rax
je 0x180023ada
mov r8, qword [rax]
mov edx, esi
mov rcx, rax
call qword [r8]
nop
test bl, 0x20
je 0x180023b01
and ebx, 0xffffffdf
test r14, r14
je 0x180023b01
mov rax, qword [r14]
mov rcx, r14
call qword [rax + reloc.WS2_32.dll_recv]
test rax, rax
je 0x180023b01
mov r8, qword [rax]
mov edx, esi
mov rcx, rax
call qword [r8]
nop
test bl, 0x10
je 0x180023b29
and ebx, 0xffffffef
test r12, r12
je 0x180023b29
mov rax, qword [r12]
mov rcx, r12
call qword [rax + reloc.WS2_32.dll_recv]
test rax, rax
je 0x180023b29
mov r8, qword [rax]
mov edx, esi
mov rcx, rax
call qword [r8]
nop
test bl, 8
je 0x180023b51
and ebx, 0xfffffff7
test r13, r13
je 0x180023b51
mov rax, qword [r13]
mov rcx, r13
call qword [rax + reloc.WS2_32.dll_recv]
test rax, rax
je 0x180023b51
mov r8, qword [rax]
mov edx, esi
mov rcx, rax
call qword [r8]
nop
test bl, 4
je 0x180023b79
and ebx, 0xfffffffb
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x180023b79
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
test rax, rax
je 0x180023b79
mov r8, qword [rax]
mov edx, esi
mov rcx, rax
call qword [r8]
nop
test bl, 2
je 0x180023ba1
and ebx, 0xfffffffd
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x180023ba1
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
test rax, rax
je 0x180023ba1
mov r8, qword [rax]
mov edx, esi
mov rcx, rax
call qword [r8]
nop
test bl, 1
je 0x180023bc4
and ebx, 0xfffffffe
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
test rax, rax
je 0x180023bc4
mov r8, qword [rax]
mov edx, esi
mov rcx, rax
call qword [r8]
cmp byte [rbp + 0x88], 0
je 0x180023bdc
mov word [r15 + 0x120], 0x101
jmp 0x180023dd4
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdx, qword [rsp + 0x40]
lea rcx, str.aolmed.exe
call fcn.180004158
test al, al
je 0x180023c0a
mov byte [r15 + 0x120], 0
jmp 0x180023dd4
mov cl, 1
call fcn.18009bd18
mov r12, rax
mov qword [rbp - 0x18], rax
bts ebx, 7
mov dword [rbp + 0x88], ebx
mov qword [rsp + 0x28], rax
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_VariantClear]
lea r8, [rsp + 0x20]
lea rdx, str.ac_authd.exe
lea rcx, [rsp + 0x40]
call fcn.18002a620
test al, al
jne 0x180023cf6
mov cl, 1
call fcn.18009bd18
mov r14, rax
mov qword [rsp + 0x68], rax
bts ebx, 8
mov dword [rbp + 0x88], ebx
mov qword [rsp + 0x28], rax
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_VariantClear]
lea r8, [rsp + 0x20]
lea rdx, str.ac_media.exe
lea rcx, [rsp + 0x40]
call fcn.18002a620
test al, al
jne 0x180023cfb
mov cl, 1
call fcn.18009bd18
mov rdi, rax
mov qword [rsp + 0x38], rax
bts ebx, 9
mov dword [rbp + 0x88], ebx
mov qword [rsp + 0x28], rax
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_VariantClear]
lea r8, [rsp + 0x20]
lea rdx, str.ac_secdbm.exe
lea rcx, [rsp + 0x40]
call fcn.18002a620
test al, al
jne 0x180023d00
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdx, qword [rsp + 0x40]
lea rcx, str.aol.exe
call fcn.180004158
test al, al
jne 0x180023d00
xor r13b, r13b
jmp 0x180023d03
mov r14, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x38]
mov r13b, 1
bt ebx, 9
jae 0x180023d2c
btr ebx, 9
test rdi, rdi
je 0x180023d2c
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_recv]
test rax, rax
je 0x180023d2c
mov r8, qword [rax]
mov edx, esi
mov rcx, rax
call qword [r8]
nop
bt ebx, 8
jae 0x180023d55
btr ebx, 8
test r14, r14
je 0x180023d55
mov rax, qword [r14]
mov rcx, r14
call qword [rax + reloc.WS2_32.dll_recv]
test rax, rax
je 0x180023d55
mov r8, qword [rax]
mov edx, esi
mov rcx, rax
call qword [r8]
nop
test bl, bl
jns 0x180023d73
mov rax, qword [r12]
mov rcx, r12
call qword [rax + reloc.WS2_32.dll_recv]
test rax, rax
je 0x180023d73
mov r8, qword [rax]
mov edx, esi
mov rcx, rax
call qword [r8]
test r13b, r13b
je 0x180023dd4
mov cl, 1
call fcn.18009bd18
mov rbx, rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x28], rax
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_VariantClear]
lea r8, [rsp + 0x20]
lea rdx, str.aolservicehost.exe
lea rcx, [rsp + 0x40]
call fcn.18002a620
movzx edi, al
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + reloc.WS2_32.dll_recv]
test rax, rax
je 0x180023dc7
mov r8, qword [rax]
mov edx, esi
mov rcx, rax
call qword [r8]
test dil, dil
sete al
mov byte [r15 + 0x120], al
mov cl, 1
call fcn.18009bd18
mov rbx, rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x28], rax
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_VariantClear]
lea r8, [rsp + 0x20]
lea rdx, str.acsd.exe
lea rcx, [rsp + 0x40]
call fcn.18002a620
movzx edi, al
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + reloc.WS2_32.dll_recv]
test rax, rax
je 0x180023e23
mov r8, qword [rax]
mov edx, esi
mov rcx, rax
call qword [r8]
mov edx, 4
movabs r12, 0xd993efbb19cfe32d
mov r13d, 2
mov r14d, dword [0x18010bb98]
test dil, dil
je 0x1800240a1
mov byte [r15 + 0x120], 1
xor ebx, ebx
mov dword [r15 + 0x124], ebx
cmp byte [0x18010a364], bl
je 0x180023f14
movdqa xmm6, xmmword [0x1800ec3e0]
movdqa xmm7, xmmword [0x1800ec6c0]
mov dword [rbp - 0x80], 0x6ba0850d
mov dword [rbp - 0x7c], 0xaaf08e9b
mov dword [rbp - 0x78], 0x61aacd49
mov word [rbp - 0x74], 0xefde
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx + r14*8]
mov eax, dword [rdx + rcx]
cmp dword [0x18010d138], eax
jg 0x18002422c
lea rdx, [0x180105a80]
cmp byte [0x180105aae], bl
je 0x180023f0a
mov r10, rbx
mov r11, rsi
sub r11, rdx
nop dword [rax]
nop dword [rax + rax]
lea r9, [r10 + rdx]
movzx ecx, r10b
and cl, 7
shl cl, 3
mov rax, r12
shr rax, cl
xor byte [r9], al
lea ecx, [r9 + r11]
and cl, 7
shl cl, 3
mov r8, r12
shr r8, cl
xor byte [r9 + 1], r8b
add r10, r13
cmp r10, 0x2e
jb 0x180023ed0
mov byte [0x180105aae], bl
mov ecx, 3
call fcn.18006a848
mov edi, 4
mov dword [r15 + 0x114], 0x100007f
mov ecx, 0x203e
call qword [sym.imp.WS2_32.dll_htons]
mov word [r15 + 0x112], ax
mov word [r15 + 0x110], r13w
cmp byte [0x18010a364], 0
je 0x18002401c
movdqa xmm6, xmmword [0x1800ec310]
movdqa xmm7, xmmword [0x1800ec990]
mov dword [rbp - 0x80], 0x3c948c59
mov dword [rbp - 0x7c], 0xbdb6d5c8
mov word [rbp - 0x78], 0xe370
mov rcx, qword gs:[0x58]
mov edx, edi
mov rcx, qword [rcx + r14*8]
mov eax, dword [rdx + rcx]
cmp dword [0x18010d188], eax
jg 0x180024298
lea rdi, [0x1801059d0]
cmp byte [0x1801059fa], 0
je 0x180023feb
sub rsi, rdi
nop dword [rax]
nop word [rax + rax]
lea rdx, [rbx + rdi]
movzx ecx, bl
and cl, 7
shl cl, 3
mov rax, r12
shr rax, cl
xor byte [rdx], al
lea r8, [rdx + 1]
lea ecx, [rsi + rdx]
and cl, 7
shl cl, 3
mov rdx, r12
shr rdx, cl
xor byte [r8], dl
add rbx, r13
cmp rbx, 0x2a
jb 0x180023fb0
mov byte [0x1801059fa], 0
movzx ecx, word [r15 + 0x112]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ebx, ax
mov ecx, dword [r15 + 0x114]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov r8, rax
mov r9d, ebx
mov rdx, rdi
mov ecx, 4
call fcn.18006a848
mov byte [r15 + 0x122], 1
lea rcx, [r15 + 0x130]
xor edx, edx
call fcn.1800460d0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x180024070
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002406b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800242fb
call fcn.18009d1f4
mov al, 1
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, [r15 + 0x28]
lea rdx, [rsp + 0x60]
call fcn.18001df90
cmp qword [rsp + 0x70], 0
sete bl
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x1800240f5
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800240f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180024301
call fcn.18009d1f4
test bl, bl
je 0x1800241ba
mov edi, 4
cmp byte [0x18010a364], 0
je 0x1800241c1
movdqa xmm6, xmmword [0x1800ec370]
movdqa xmm7, xmmword [str.Cp]
movdqa xmm8, xmmword [0x1800ec5d0]
movdqa xmm9, xmmword [0x1800ec050]
mov dword [rbp - 0x60], 0x19bb8d48
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx + r14*8]
mov eax, dword [rdi + rcx]
cmp dword [0x18010d17c], eax
jg 0x1800241c8
lea rdx, [0x180105d20]
xor ebx, ebx
cmp byte [0x180105d64], bl
je 0x1800241ad
mov r10d, ebx
mov r11, rsi
sub r11, rdx
nop word [rax + rax]
lea r8, [r10 + rdx]
movzx ecx, r10b
and cl, 7
shl cl, 3
mov rax, r12
shr rax, cl
xor byte [r8], al
lea r9, [r8 + 1]
lea ecx, [r11 + r8]
and cl, 7
shl cl, 3
mov r8, r12
shr r8, cl
xor byte [r9], r8b
add r10, r13
cmp r10, 0x44
jb 0x180024170
mov byte [0x180105d64], bl
mov ecx, r13d
call fcn.18006a848
jmp 0x180023f19
xor ebx, ebx
jmp 0x180023f14
xor ebx, ebx
jmp 0x180023f19
lea rcx, [0x18010d17c]
call fcn.18009d704
cmp dword [0x18010d17c], 0xffffffff
jne 0x180024150
mov byte [0x180105d64], 1
movaps xmmword [0x180105d20], xmm6
movaps xmmword [0x180105d30], xmm7
movaps xmmword [0x180105d40], xmm8
movaps xmmword [0x180105d50], xmm9
mov eax, dword [rbp - 0x60]
mov dword [0x180105d60], eax
lea rcx, [0x1800cda70]
call fcn.18009d564
lea rcx, [0x18010d17c]
call fcn.18009d6a4
jmp 0x180024150
lea rcx, [0x18010d138]
call fcn.18009d704
cmp dword [0x18010d138], 0xffffffff
jne 0x180023eac
mov byte [0x180105aae], 1
movaps xmmword [0x180105a80], xmm6
movaps xmmword [0x180105a90], xmm7
movsd xmm0, qword [rbp - 0x80]
movsd qword [0x180105aa0], xmm0
mov eax, dword [rbp - 0x78]
mov dword [0x180105aa8], eax
movzx eax, word [rbp - 0x74]
mov word [0x180105aac], ax
lea rcx, [0x1800cdaa0]
call fcn.18009d564
lea rcx, [0x18010d138]
call fcn.18009d6a4
jmp 0x180023eac
lea rcx, [0x18010d188]
call fcn.18009d704
cmp dword [0x18010d188], 0xffffffff
jne 0x180023f8e
mov byte [0x1801059fa], 1
movaps xmmword [0x1801059d0], xmm6
movaps xmmword [0x1801059e0], xmm7
movsd xmm0, qword [rbp - 0x80]
movsd qword [0x1801059f0], xmm0
movzx eax, word [rbp - 0x78]
mov word [0x1801059f8], ax
lea rcx, [0x1800cda40]
call fcn.18009d564
lea rcx, [0x18010d188]
call fcn.18009d6a4
jmp 0x180023f8e
call fcn.1800a45b8
nop
call fcn.1800a45b8
int3