Function at 0x180002070
Capabilities:
Encode data using xor
Get geographical location
Get keyboard layout

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rdi, qword [0x1800cfe40]
mov rsi, rcx
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x18000239b
lea rcx, [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x18000239b
mov ecx, Ordinal_50
mov qword [rsp + 0x60], rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x1800020d5
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
jmp 0x1800020d7
xor ebx, ebx
movups xmm3, xmmword [str.X_TAiUIVdKTP_frA]
movzx eax, byte [0x1800b3b60]
xor ecx, ecx
mov qword [rdi + 0x98], rbx
cmp dword [reloc.WS2_32.dll_accept], 2
movups xmmword [rsp + 0x28], xmm3
mov byte [rsp + 0x38], al
jl 0x1800022bb
movdqa xmm5, xmmword [0x1800c23d0]
movdqa xmm2, xmmword [0x1800c1fc0]
movdqa xmm4, xmmword [0x1800c2090]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
movd eax, xmm3
movdqa xmm3, xmmword [0x1800c1ff0]
movaps xmmword [rsp + 0x50], xmm6
movdqa xmm6, xmmword [0x1800c2040]
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
movaps xmmword [rsp + 0x40], xmm7
movdqa xmm7, xmmword [0x1800c20f0]
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
movd xmm0, eax
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm7
xorps xmm2, xmm0
movd dword [rsp + 0x28], xmm2
movdqa xmm2, xmmword [0x1800c1fe0]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm3
pmulld xmm0, xmm6
psubd xmm2, xmm0
punpckldq xmm1, xmm3
movd xmm0, dword [rsp + 0x2c]
andps xmm2, xmm4
pmuldq xmm1, xmm5
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm7
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm5
movd dword [rsp + 0x2c], xmm2
movdqa xmm2, xmmword [0x1800c2000]
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm2
pmulld xmm0, xmm6
psubd xmm3, xmm0
punpckldq xmm1, xmm2
movd xmm0, dword [rsp + 0x30]
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
pmuldq xmm1, xmm5
paddb xmm3, xmm7
xorps xmm3, xmm0
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
movd dword [rsp + 0x30], xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
mov ecx, reloc.WS2_32.dll_recv
pmulld xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x50]
psubd xmm2, xmm0
movd xmm0, dword [rsp + 0x34]
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm7
movaps xmm7, xmmword [rsp + 0x40]
xorps xmm2, xmm0
movd dword [rsp + 0x34], xmm2
mov eax, ecx
lea r8, [rsp + 0x28]
add r8, rax
nop word [rax + rax]
mov eax, 0x4bda12f7
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x36
movzx eax, cl
inc ecx
sub al, dl
add al, 0x31
xor byte [r8 - 1], al
cmp ecx, 0x11
jl 0x1800022d0
or dword [rdi + 0xc], 6
lea rax, [rsp + 0x28]
mov qword [rdi + 0x88], rax
mov qword [rbx], rsi
mov rax, qword [rsp + 0x90]
mov qword [rbx + 0x20], rax
mov rax, qword [rsp + 0x98]
mov qword [rbx + 0x18], rax
mov rax, qword [0x1800cfe40]
mov dword [rbx + 0x28], 9
test rax, rax
je 0x180002344
mov rdi, qword [rax + 0x98]
jmp 0x180002346
xor edi, edi
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rdi + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x180002371
mov dword [rdi + 0x2c], eax
mov rax, qword [0x1800cfe40]
mov rcx, qword [rax + 0x4ba0]
mov rax, qword [rbx]
mov rbx, qword [rsp + 0x60]
mov rdx, qword [rcx]
mov qword [rdx + 0x30], rax
mov qword [rdx + 0x28], rax
mov al, 1
add rsp, 0x68
pop rdi
pop rsi
ret
xor al, al
add rsp, 0x68
pop rdi
pop rsi
ret