Function at 0x180006510
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x18002f008]
xor rax, rsp
mov qword [rbp + 0x160], rax
movzx r15d, cx
movdqa xmm0, xmmword [0x18002a8b0]
mov edx, dword [0x180030258]
mov rax, qword gs:[0x58]
mov rbx, qword [rax + rdx*8]
mov ecx, 0x8c8
mov eax, dword [rcx + rbx]
test al, 1
jne 0x1800065bf
or eax, 1
mov dword [rcx + rbx], eax
mov eax, 0x8d0
mov edi, eax
add rax, rbx
mov byte [rax + 0x11], 1
lea rcx, [rax + 0x10]
lea rdx, [rsp + 0x40]
cmp rax, rdx
ja 0x1800065a9
lea rdx, [rsp + 0x30]
cmp rcx, rdx
jb 0x1800065a9
movups xmmword [rax], xmm0
mov byte [rax + 0x10], 0x59
jmp 0x1800065b0
movups xmmword [rax], xmm0
mov byte [rax + 0x10], 0x59
lea rcx, [0x180021740]
call fcn.1800095b0
nop
jmp 0x1800065c4
mov edi, 0x8d0
lea r14, [rbx + rdi]
xor edi, edi
cmp byte [r14 + 0x11], dil
je 0x180006600
mov edx, edi
movabs r8, 0x957a857c74b0f59
nop dword [rax]
movzx ecx, dl
and cl, 7
shl cl, 3
mov rax, r8
shr rax, cl
xor byte [rdx + r14], al
inc rdx
cmp rdx, 0x11
jb 0x1800065e0
mov byte [r14 + 0x11], dil
mov ecx, 0x8bc
mov eax, dword [rcx + rbx]
test al, 1
jne 0x180006636
or eax, 1
mov dword [rcx + rbx], eax
mov eax, 0x8c0
mov esi, eax
mov dword [rax + rbx + 2], 0x17ff4da
mov word [rax + rbx], 0x8d29
lea rcx, [0x180021770]
call fcn.1800095b0
nop
jmp 0x18000663b
mov esi, 0x8c0
add rsi, rbx
cmp byte [rsi + 5], 0
je 0x18000665b
xor byte [rsi], 0x64
xor byte [rsi + 1], 0xec
xor byte [rsi + 2], 0xb3
xor byte [rsi + 3], 0x9a
xor byte [rsi + 4], 0x7f
mov byte [rsi + 5], 0
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x60]
call fcn.18000b820
lea r9, [rsp + 0x60]
mov r8, r14
mov rdx, rsi
mov rcx, qword [0x180030ed0]
call fcn.180002370
test al, al
je 0x1800066ad
movsd xmm0, qword [0x18002a5a8]
call fcn.18000f4d8
cvttsd2si r8d, xmm0
xor edx, edx
lea rcx, [rbp + 0x5f]
call fcn.18000fcbc
test eax, eax
setne sil
jmp 0x1800066b0
mov sil, 1
movsd xmm0, qword [0x18002a6b8]
call fcn.18000f4d8
cvttsd2si eax, xmm0
lea r12, [0x180002ea0]
cmp r15d, eax
jne 0x180006992
test sil, sil
je 0x180006992
lea rcx, str.slc.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r9, rax
mov qword [0x180030ec8], rax
movdqa xmm0, xmmword [0x18002ab50]
mov dword [rsp + 0x40], 0x22306d75
mov dword [rsp + 0x44], 0x436b5a33
mov dword [rsp + 0x48], 0x12034f50
mov ecx, 0x8e4
mov eax, dword [rcx + rbx]
test al, 1
jne 0x180006794
or eax, 1
mov dword [rcx + rbx], eax
mov eax, 0x8e8
mov esi, eax
lea rcx, [rbx + rax]
mov byte [rcx + 0x1d], 1
lea rax, [rcx + 0x1c]
lea rdx, [rsp + 0x4c]
cmp rcx, rdx
ja 0x180006765
lea rdx, [rsp + 0x30]
cmp rax, rdx
jb 0x180006765
movups xmmword [rcx], xmm0
movsd xmm0, qword [rsp + 0x40]
movsd qword [rcx + 0x10], xmm0
mov eax, dword [rsp + 0x48]
mov dword [rcx + 0x18], eax
mov byte [rcx + 0x1c], 0x5a
jmp 0x18000677e
movups xmmword [rcx], xmm0
movsd xmm0, qword [rsp + 0x40]
movsd qword [rcx + 0x10], xmm0
mov eax, dword [rsp + 0x48]
mov dword [rcx + 0x18], eax
mov byte [rcx + 0x1c], 0x5a
lea rcx, [0x180021710]
call fcn.1800095b0
nop
mov r9, qword [0x180030ec8]
jmp 0x180006799
mov esi, 0x8e8
lea rdx, [rbx + rsi]
cmp byte [rdx + 0x1d], 0
je 0x1800067d1
mov r8, rdi
movabs r10, 0x705355a56510007
movzx ecx, r8b
and cl, 7
shl cl, 3
mov rax, r10
shr rax, cl
xor byte [r8 + rdx], al
inc r8
cmp r8, 0x1d
jb 0x1800067b0
mov byte [rdx + 0x1d], 0
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180030ed8], rax
cmp rax, 0xffffffffffffffff
je 0x180006992
movdqa xmm0, xmmword [0x18002acb0]
movdqa xmm1, xmmword [0x18002a9c0]
mov dword [rsp + 0x50], 0xe165216e
mov ecx, 0x908
mov eax, dword [rcx + rbx]
test al, 1
jne 0x180006869
or eax, 1
mov dword [rcx + rbx], eax
mov eax, 0x910
mov esi, eax
lea rcx, [rbx + rax]
mov byte [rcx + 0x24], 1
lea rax, [rcx + 0x23]
lea rdx, [rsp + 0x53]
cmp rcx, rdx
ja 0x18000684c
lea rdx, [rsp + 0x30]
cmp rax, rdx
jb 0x18000684c
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
mov eax, dword [rsp + 0x50]
mov dword [rcx + 0x20], eax
jmp 0x18000685a
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
mov eax, dword [rsp + 0x50]
mov dword [rcx + 0x20], eax
lea rcx, [0x1800216e0]
call fcn.1800095b0
nop
jmp 0x18000686e
mov esi, 0x910
lea r9, [rbx + rsi]
cmp byte [r9 + 0x24], 0
je 0x1800068cd
lea r8, [r9 + 1]
mov r10, r9
not r10
movabs r11, 0xe1e30dae16f2c2a
nop dword [rax]
lea ecx, [r10 + r8]
and cl, 7
shl cl, 3
mov rdx, r11
shr rdx, cl
xor byte [r8 - 1], dl
movzx ecx, r8b
sub cl, r9b
and cl, 7
shl cl, 3
mov rdx, r11
shr rdx, cl
xor byte [r8], dl
add r8, 2
lea rax, [r8 + r10]
cmp rax, 0x24
jb 0x180006890
mov byte [r9 + 0x24], 0
mov rcx, r9
call fcn.180009270
movsd xmm0, qword [0x18002a5e0]
call fcn.18000f4d8
cvttsd2si eax, xmm0
mov byte [0x180030ee0], al
movsd xmm0, qword [0x18002a620]
call fcn.18000f4d8
cvttsd2si eax, xmm0
mov byte [0x180030ee1], al
mov qword [0x180030ee2], r12
movsd xmm0, qword [0x18002a600]
call fcn.18000f4d8
cvttsd2si eax, xmm0
mov byte [0x180030eea], al
movsd xmm0, qword [0x18002a640]
call fcn.18000f4d8
cvttsd2si eax, xmm0
mov byte [0x180030eeb], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0xc
lea r8, [0x180030ef0]
mov rdx, qword [0x180030ed8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0xc
lea r8, [0x180030ee0]
mov rdx, qword [0x180030ed8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movdqa xmm0, xmmword [0x18002a8c0]
mov ecx, 0x944
mov eax, dword [rcx + rbx]
test al, 1
jne 0x1800069f1
or eax, 1
mov dword [rcx + rbx], eax
mov eax, 0x948
mov esi, eax
add rax, rbx
mov byte [rax + 0x11], 1
lea rcx, [rax + 0x10]
lea rdx, [rsp + 0x40]
cmp rax, rdx
ja 0x1800069db
lea rdx, [rsp + 0x30]
cmp rcx, rdx
jb 0x1800069db
movups xmmword [rax], xmm0
mov byte [rax + 0x10], 0x33
jmp 0x1800069e2
movups xmmword [rax], xmm0
mov byte [rax + 0x10], 0x33
lea rcx, [0x180021680]
call fcn.1800095b0
nop
jmp 0x1800069f6
mov esi, 0x948
lea r14, [rbx + rsi]
cmp byte [r14 + 0x11], 0
je 0x180006a31
mov rdx, rdi
movabs r8, 0xf68a7ee5adab833
nop
movzx ecx, dl
and cl, 7
shl cl, 3
mov rax, r8
shr rax, cl
xor byte [rdx + r14], al
inc rdx
cmp rdx, 0x11
jb 0x180006a10
mov byte [r14 + 0x11], 0
mov ecx, 0x938
mov eax, dword [rcx + rbx]
test al, 1
jne 0x180006a67
or eax, 1
mov dword [rcx + rbx], eax
mov eax, 0x93c
mov esi, eax
mov dword [rbx + rax + 2], 0x1701210
mov word [rbx + rax], 0xc6a
lea rcx, [0x1800216b0]
call fcn.1800095b0
nop
jmp 0x180006a6c
mov esi, 0x93c
add rsi, rbx
cmp byte [rsi + 5], 0
je 0x180006a8c
xor byte [rsi], 0x27
xor byte [rsi + 1], 0x6d
xor byte [rsi + 2], 0x79
xor byte [rsi + 3], 0x7c
xor byte [rsi + 4], 0x70
mov byte [rsi + 5], 0
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x60]
call fcn.18000b820
lea r9, [rsp + 0x60]
mov r8, r14
mov rdx, rsi
mov rcx, qword [0x180030ed0]
call fcn.180002370
test al, al
je 0x180006ade
movsd xmm0, qword [0x18002a5a8]
call fcn.18000f4d8
cvttsd2si r8d, xmm0
xor edx, edx
lea rcx, [rbp + 0x5f]
call fcn.18000fcbc
test eax, eax
setne sil
jmp 0x180006ae1
mov sil, 1
movsd xmm0, qword [0x18002a6c0]
call fcn.18000f4d8
cvttsd2si eax, xmm0
cmp r15d, eax
jne 0x180006dc2
test sil, sil
je 0x180006dc2
lea rcx, str.slc.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r9, rax
mov qword [0x180030ec8], rax
movdqa xmm0, xmmword [0x18002ab60]
mov dword [rsp + 0x40], 0x3ce2d33c
mov dword [rsp + 0x44], 0x4208c386
mov dword [rsp + 0x48], 0xcd1f119
mov ecx, 0x95c
mov eax, dword [rcx + rbx]
test al, 1
jne 0x180006bbe
or eax, 1
mov dword [rcx + rbx], eax
mov eax, 0x960
mov esi, eax
lea rcx, [rbx + rax]
mov byte [rcx + 0x1d], 1
lea rax, [rcx + 0x1c]
lea rdx, [rsp + 0x4c]
cmp rcx, rdx
ja 0x180006b8f
lea rdx, [rsp + 0x30]
cmp rax, rdx
jb 0x180006b8f
movups xmmword [rcx], xmm0
movsd xmm0, qword [rsp + 0x40]
movsd qword [rcx + 0x10], xmm0
mov eax, dword [rsp + 0x48]
mov dword [rcx + 0x18], eax
mov byte [rcx + 0x1c], 0xef
jmp 0x180006ba8
movups xmmword [rcx], xmm0
movsd xmm0, qword [rsp + 0x40]
movsd qword [rcx + 0x10], xmm0
mov eax, dword [rsp + 0x48]
mov dword [rcx + 0x18], eax
mov byte [rcx + 0x1c], 0xef
lea rcx, [0x180021650]
call fcn.1800095b0
nop
mov r9, qword [0x180030ec8]
jmp 0x180006bc3
mov esi, 0x960
lea rdx, [rbx + rsi]
cmp byte [rdx + 0x1d], 0
je 0x180006c01
mov r8, rdi
movabs r10, 0x666acef4883be4e
nop word [rax + rax]
movzx ecx, r8b
and cl, 7
shl cl, 3
mov rax, r10
shr rax, cl
xor byte [r8 + rdx], al
inc r8
cmp r8, 0x1d
jb 0x180006be0
mov byte [rdx + 0x1d], 0
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180030ed8], rax
cmp rax, 0xffffffffffffffff
je 0x180006dc2
movdqa xmm0, xmmword [0x18002ac20]
movdqa xmm1, xmmword [0x18002a970]
mov dword [rsp + 0x50], 0x44da4125
mov ecx, 0x980
mov eax, dword [rcx + rbx]
test al, 1
jne 0x180006c99
or eax, 1
mov dword [rcx + rbx], eax
mov eax, 0x988
mov esi, eax
lea rcx, [rbx + rax]
mov byte [rcx + 0x24], 1
lea rax, [rcx + 0x23]
lea rdx, [rsp + 0x53]
cmp rcx, rdx
ja 0x180006c7c
lea rdx, [rsp + 0x30]
cmp rax, rdx
jb 0x180006c7c
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
mov eax, dword [rsp + 0x50]
mov dword [rcx + 0x20], eax
jmp 0x180006c8a
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
mov eax, dword [rsp + 0x50]
mov dword [rcx + 0x20], eax
lea rcx, [0x180021620]
call fcn.1800095b0
nop
jmp 0x180006c9e
mov esi, 0x988
lea r10, [rbx + rsi]
cmp byte [r10 + 0x24], 0
je 0x180006cfd
lea r8, [r10 + 1]
mov r9, r10
not r9
movabs r11, 0x5781e1844d04c61
nop dword [rax]
lea ecx, [r9 + r8]
and cl, 7
shl cl, 3
mov rdx, r11
shr rdx, cl
xor byte [r8 - 1], dl
movzx ecx, r8b
sub cl, r10b
and cl, 7
shl cl, 3
mov rdx, r11
shr rdx, cl
xor byte [r8], dl
add r8, 2
lea rax, [r8 + r9]
cmp rax, 0x24
jb 0x180006cc0
mov byte [r10 + 0x24], 0
mov rcx, r10
call fcn.180009270
movsd xmm0, qword [0x18002a5f8]
call fcn.18000f4d8
cvttsd2si eax, xmm0
mov byte [0x180030ee0], al
movsd xmm0, qword [0x18002a628]
call fcn.18000f4d8
cvttsd2si eax, xmm0
mov byte [0x180030ee1], al
mov qword [0x180030ee2], r12
movsd xmm0, qword [0x18002a610]
call fcn.18000f4d8
cvttsd2si eax, xmm0
mov byte [0x180030eea], al
movsd xmm0, qword [0x18002a650]
call fcn.18000f4d8
cvttsd2si eax, xmm0
mov byte [0x180030eeb], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0xc
lea r8, [0x180030ef0]
mov rdx, qword [0x180030ed8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0xc
lea r8, [0x180030ee0]
mov rdx, qword [0x180030ed8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movsd xmm0, qword [0x18002a6c8]
call fcn.18000f4d8
cvttsd2si eax, xmm0
cmp r15d, eax
jne 0x180006ee0
lea rcx, str.slc.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r8, rax
mov qword [0x180030ec8], rax
movdqa xmm0, xmmword [0x18002aba0]
mov dword [rsp + 0x40], 0x79bc060e
mov dword [rsp + 0x44], 0x409a6ec1
mov dword [rsp + 0x48], 0x498f242b
mov ecx, 0x9b0
mov eax, dword [rcx + rbx]
test al, 1
jne 0x180006e96
or eax, 1
mov dword [rcx + rbx], eax
mov eax, 0x9b8
mov esi, eax
lea rcx, [rbx + rax]
mov byte [rcx + 0x1d], 1
lea rax, [rcx + 0x1c]
lea rdx, [rsp + 0x4c]
cmp rcx, rdx
ja 0x180006e67
lea rdx, [rsp + 0x30]
cmp rax, rdx
jb 0x180006e67
movups xmmword [rcx], xmm0
movsd xmm0, qword [rsp + 0x40]
movsd qword [rcx + 0x10], xmm0
mov eax, dword [rsp + 0x48]
mov dword [rcx + 0x18], eax
mov byte [rcx + 0x1c], 0xa8
jmp 0x180006e80
movups xmmword [rcx], xmm0
movsd xmm0, qword [rsp + 0x40]
movsd qword [rcx + 0x10], xmm0
mov eax, dword [rsp + 0x48]
mov dword [rcx + 0x18], eax
mov byte [rcx + 0x1c], 0xa8
lea rcx, [0x1800215f0]
call fcn.1800095b0
nop
mov r8, qword [0x180030ec8]
jmp 0x180006e9b
mov esi, 0x9b8
lea rdx, [rbx + rsi]
cmp byte [rdx + 0x1d], 0
je 0x180006ed0
movabs r9, 0x4f401a80ddd6b7c
nop
movzx ecx, dil
and cl, 7
shl cl, 3
mov rax, r9
shr rax, cl
xor byte [rdi + rdx], al
inc rdi
cmp rdi, 0x1d
jb 0x180006eb0
mov byte [rdx + 0x1d], 0
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180030ed8], rax
movsd xmm0, qword [0x18002a6d0]
call fcn.18000f4d8
movsd xmm0, qword [0x18002a6d8]
call fcn.18000f4d8
mov al, 1
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.180009470
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret