Function at 0x18005abf0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov edx, dword [0x1802848b4]
lea rax, [0x18027a718]
mov qword [rcx], rax
lea r13, [0x180286970]
mov rax, qword gs:[0x58]
mov rsi, rcx
mov ecx, 4
xor r15d, r15d
movabs r12, 0xaaaaaaaaaaaaaaab
mov r14, qword [rax + rdx*8]
add r14, rcx
mov eax, dword [r14]
cmp dword [0x18028aed0], eax
jle 0x18005aec3
lea rcx, [0x18028aed0]
call fcn.180249e18
cmp dword [0x18028aed0], 0xffffffff
jne 0x18005aec3
xorps xmm0, xmm0
mov qword [0x180286978], r15
xorps xmm1, xmm1
movdqa xmmword [0x180286980], xmm0
mov ecx, 0x118
movdqa xmmword [0x1802869b0], xmm0
movdqa xmmword [0x1802869c0], xmm1
movdqa xmmword [0x1802869d0], xmm0
movdqa xmmword [0x1802869e0], xmm1
mov qword [0x180286990], r15
mov qword [0x180286998], r15
mov qword [0x1802869a0], r15
mov qword [0x180286970], r13
mov qword [0x1802869a8], r13
mov qword [0x1802869f0], r15
mov word [0x18028873c], r15w
mov word [0x18028a484], r15w
mov qword [0x18028a498], r15
mov qword [0x18028a4a0], r15
call fcn.180249f28
mov dword [rbp - 0x30], 0xf6540ee6
mov dword [rbp - 0x2c], 0x14d710a8
mov dword [rbp - 0x28], 0xfd6e6259
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [0x18028a498], rax
mov dword [0x18028a488], r15d
mov qword [0x18028a490], r15
mov word [rbp - 0x24], 0x83
mov qword [rbp + 0x30], r15
mov rax, qword [rbp + 0x30]
nop dword [rax]
mov rcx, qword [rbp + 0x30]
mov rax, qword [rbp + 0x30]
movzx r8d, byte [rbp + rax - 0x2f]
mov rax, r12
mul rcx
shr rdx, 4
movzx eax, dl
add al, al
add dl, al
mov rax, qword [rbp + 0x30]
shl dl, 3
sub cl, dl
mov edx, 0x736e164d
sar edx, cl
xor dl, r8b
mov byte [rbp + rax - 0x2f], dl
mov rax, qword [rbp + 0x30]
inc rax
mov qword [rbp + 0x30], rax
mov rax, qword [rbp + 0x30]
cmp rax, 0xc
jb 0x18005ad40
mov byte [rbp - 0x23], r15b
call fcn.1800015c0
mov ecx, dword [r14]
mov rbx, rax
cmp dword [0x180286968], ecx
jle 0x18005add1
lea rcx, [0x180286968]
call fcn.180249e18
cmp dword [0x180286968], 0xffffffff
jne 0x18005add1
mov rcx, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x18028a9f8], rcx
lea rcx, [0x180286968]
call fcn.180249db8
mov eax, dword [r14]
cmp dword [0x18028a99c], eax
jle 0x18005ae0b
lea rcx, [0x18028a99c]
call fcn.180249e18
cmp dword [0x18028a99c], 0xffffffff
jne 0x18005ae0b
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x18028a99c]
mov qword [0x18028a9a0], rax
call fcn.180249db8
mov rax, qword [0x18028a9f8]
mov rcx, rbx
call rax
mov r8, qword [0x18028a9a0]
lea rdx, [rbp - 0x2f]
mov rcx, rax
call r8
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rax
mov ecx, 0x28
mov qword [0x18028a4b8], rax
mov qword [0x18028a4c8], r15
mov qword [0x18028a4d0], r15
call fcn.180249f28
xorps xmm0, xmm0
lea rcx, [0x180269f20]
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [0x18028a4c8], rax
movdqa xmmword [0x18028a4e0], xmm0
mov qword [0x18028a4f0], r15
mov qword [0x18028a4a8], r15
mov qword [0x18028a4b0], r15
mov byte [0x18028a4c0], r15b
mov dword [0x18028a4d8], 0x10000
mov dword [0x18028a4f8], r15d
mov qword [0x18028a910], r15
mov qword [0x18028a918], r15
mov byte [0x18028a920], r15b
call fcn.18024a2cc
lea rcx, [0x18028aed0]
call fcn.180249db8
lea rcx, [0x18028a4b8]
call fcn.180001a60
mov eax, dword [r14]
cmp dword [0x18028aed0], eax
jle 0x18005b150
lea rcx, [0x18028aed0]
call fcn.180249e18
cmp dword [0x18028aed0], 0xffffffff
jne 0x18005b150
xorps xmm0, xmm0
mov qword [0x180286978], r15
xorps xmm1, xmm1
movdqa xmmword [0x180286980], xmm0
mov ecx, 0x118
movdqa xmmword [0x1802869b0], xmm0
movdqa xmmword [0x1802869c0], xmm1
movdqa xmmword [0x1802869d0], xmm0
movdqa xmmword [0x1802869e0], xmm1
mov qword [0x180286990], r15
mov qword [0x180286998], r15
mov qword [0x1802869a0], r15
mov qword [0x180286970], r13
mov qword [0x1802869a8], r13
mov qword [0x1802869f0], r15
mov word [0x18028873c], r15w
mov word [0x18028a484], r15w
mov qword [0x18028a498], r15
mov qword [0x18028a4a0], r15
call fcn.180249f28
mov dword [rbp - 0x22], 0xf6540ee6
mov dword [rbp - 0x1e], 0x14d710a8
mov dword [rbp - 0x1a], 0xfd6e6259
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [0x18028a498], rax
mov dword [0x18028a488], r15d
mov qword [0x18028a490], r15
mov word [rbp - 0x16], 0x83
mov qword [rbp + 0x30], r15
mov rax, qword [rbp + 0x30]
nop dword [rax]
mov rcx, qword [rbp + 0x30]
mov rax, qword [rbp + 0x30]
movzx r8d, byte [rbp + rax - 0x21]
mov rax, r12
mul rcx
shr rdx, 4
movzx eax, dl
add al, al
add dl, al
mov rax, qword [rbp + 0x30]
shl dl, 3
sub cl, dl
mov edx, 0x736e164d
sar edx, cl
xor dl, r8b
mov byte [rbp + rax - 0x21], dl
mov rax, qword [rbp + 0x30]
inc rax
mov qword [rbp + 0x30], rax
mov rax, qword [rbp + 0x30]
cmp rax, 0xc
jb 0x18005afc0
mov byte [rbp - 0x15], r15b
call fcn.1800015c0
mov ecx, dword [r14]
mov rbx, rax
cmp dword [0x180286968], ecx
jle 0x18005b051
lea rcx, [0x180286968]
call fcn.180249e18
cmp dword [0x180286968], 0xffffffff
jne 0x18005b051
mov rcx, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x18028a9f8], rcx
lea rcx, [0x180286968]
call fcn.180249db8
mov eax, dword [r14]
cmp dword [0x18028a99c], eax
jle 0x18005b08b
lea rcx, [0x18028a99c]
call fcn.180249e18
cmp dword [0x18028a99c], 0xffffffff
jne 0x18005b08b
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x18028a99c]
mov qword [0x18028a9a0], rax
call fcn.180249db8
mov rax, qword [0x18028a9f8]
mov rcx, rbx
call rax
mov r8, qword [0x18028a9a0]
lea rdx, [rbp - 0x21]
mov rcx, rax
call r8
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rax
mov ecx, 0x28
mov qword [0x18028a4b8], rax
mov qword [0x18028a4c8], r15
mov qword [0x18028a4d0], r15
call fcn.180249f28
xorps xmm0, xmm0
lea rcx, [0x180269f20]
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [0x18028a4c8], rax
movdqa xmmword [0x18028a4e0], xmm0
mov qword [0x18028a4f0], r15
mov qword [0x18028a4a8], r15
mov qword [0x18028a4b0], r15
mov byte [0x18028a4c0], r15b
mov dword [0x18028a4d8], 0x10000
mov dword [0x18028a4f8], r15d
mov qword [0x18028a910], r15
mov qword [0x18028a918], r15
mov byte [0x18028a920], r15b
call fcn.18024a2cc
lea rcx, [0x18028aed0]
call fcn.180249db8
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [0x180286990]
mov r8, qword [0x180286998]
mov rbx, qword [0x180286978]
cmp rcx, r8
je 0x18005b18c
nop word [rax + rax]
lea rdx, [rcx + 8]
lea rdi, [rbx + 4]
cmp qword [rcx], rsi
je 0x18005b561
mov rcx, rdx
mov rbx, rdi
cmp rdx, r8
jne 0x18005b170
mov eax, dword [r14]
cmp dword [0x18028aed0], eax
jle 0x18005b403
lea rcx, [0x18028aed0]
call fcn.180249e18
cmp dword [0x18028aed0], 0xffffffff
jne 0x18005b403
xorps xmm0, xmm0
mov qword [0x180286978], r15
xorps xmm1, xmm1
movdqa xmmword [0x180286980], xmm0
mov ecx, 0x118
movdqa xmmword [0x1802869b0], xmm0
movdqa xmmword [0x1802869c0], xmm1
movdqa xmmword [0x1802869d0], xmm0
movdqa xmmword [0x1802869e0], xmm1
mov qword [0x180286990], r15
mov qword [0x180286998], r15
mov qword [0x1802869a0], r15
mov qword [0x180286970], r13
mov qword [0x1802869a8], r13
mov qword [0x1802869f0], r15
mov word [0x18028873c], r15w
mov word [0x18028a484], r15w
mov qword [0x18028a498], r15
mov qword [0x18028a4a0], r15
call fcn.180249f28
mov dword [rbp - 0x14], 0xf6540ee6
mov dword [rbp - 0x10], 0x14d710a8
mov dword [rbp - 0xc], 0xfd6e6259
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [0x18028a498], rax
mov dword [0x18028a488], r15d
mov qword [0x18028a490], r15
mov word [rbp - 8], 0x83
mov qword [rbp + 0x30], r15
mov rax, qword [rbp + 0x30]
nop word [rax + rax]
mov rcx, qword [rbp + 0x30]
mov rax, qword [rbp + 0x30]
movzx r8d, byte [rbp + rax - 0x13]
mov rax, r12
mul rcx
shr rdx, 4
movzx eax, dl
add al, al
add dl, al
mov rax, qword [rbp + 0x30]
shl dl, 3
sub cl, dl
mov edx, 0x736e164d
sar edx, cl
xor dl, r8b
mov byte [rbp + rax - 0x13], dl
mov rax, qword [rbp + 0x30]
inc rax
mov qword [rbp + 0x30], rax
mov rax, qword [rbp + 0x30]
cmp rax, 0xc
jb 0x18005b280
mov byte [rbp - 7], r15b
call fcn.1800015c0
mov edx, dword [r14]
mov rbx, rax
cmp dword [0x180286968], edx
jle 0x18005b311
lea rcx, [0x180286968]
call fcn.180249e18
cmp dword [0x180286968], 0xffffffff
jne 0x18005b311
mov rdx, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x180286968]
mov qword [0x18028a9f8], rdx
call fcn.180249db8
mov eax, dword [r14]
cmp dword [0x18028a99c], eax
jle 0x18005b34b
lea rcx, [0x18028a99c]
call fcn.180249e18
cmp dword [0x18028a99c], 0xffffffff
jne 0x18005b34b
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x18028a99c]
mov qword [0x18028a9a0], rax
call fcn.180249db8
mov rax, qword [0x18028a9f8]
mov rcx, rbx
call rax
mov r8, qword [0x18028a9a0]
lea rdx, [rbp - 0x13]
mov rcx, rax
call r8
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rax
mov ecx, 0x28
mov qword [0x18028a4b8], rax
mov qword [0x18028a4c8], r15
mov qword [0x18028a4d0], r15
call fcn.180249f28
xorps xmm0, xmm0
lea rcx, [0x180269f20]
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [0x18028a4c8], rax
movdqa xmmword [0x18028a4e0], xmm0
mov qword [0x18028a4f0], r15
mov qword [0x18028a4a8], r15
mov qword [0x18028a4b0], r15
mov byte [0x18028a4c0], r15b
mov dword [0x18028a4d8], 0x10000
mov dword [0x18028a4f8], r15d
mov qword [0x18028a910], r15
mov qword [0x18028a918], r15
mov byte [0x18028a920], r15b
call fcn.18024a2cc
lea rcx, [0x18028aed0]
call fcn.180249db8
lea rcx, [0x18028a4b8]
call fcn.180001bf0
lea rbx, [rsi + 0x90]
mov rcx, rbx
call fcn.180009ea0
mov rcx, qword [rbx + 0x118]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x100]
test rcx, rcx
je 0x18005b480
mov rdx, qword [rbx + 0x110]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x18005b466
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18005b593
mov rcx, r8
call fcn.180249cb8
mov qword [rbx + 0x100], r15
mov qword [rbx + 0x108], r15
mov qword [rbx + 0x110], r15
mov rcx, qword [rsi + 0x40]
test rcx, rcx
je 0x18005b4c6
mov rdx, qword [rsi + 0x50]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x18005b4b5
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18005b593
mov rcx, r8
call fcn.180249cb8
mov qword [rsi + 0x40], r15
mov qword [rsi + 0x48], r15
mov qword [rsi + 0x50], r15
mov rcx, qword [rsi + 0x28]
test rcx, rcx
je 0x18005b50c
mov rdx, qword [rsi + 0x38]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x18005b4fb
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18005b593
mov rcx, r8
call fcn.180249cb8
mov qword [rsi + 0x28], r15
mov qword [rsi + 0x30], r15
mov qword [rsi + 0x38], r15
lea rax, [0x18027a450]
mov qword [rsi], rax
cmp byte [rsi + 0x19], r15b
jne 0x18005b52a
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x18005b52a
call fcn.18000a3d0
mov rcx, qword [rsi + 8]
lea rax, [0x18027a9d0]
mov qword [rsi], rax
test rcx, rcx
je 0x18005b543
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
sub r8, rdx
call fcn.18024af30
mov r8, qword [0x180286980]
mov rdx, rdi
sub qword [0x180286998], 8
sub r8, rdi
mov rcx, rbx
call fcn.18024af30
sub qword [0x180286980], 4
jmp 0x18005b150
call fcn.1802514a4
int3