Function at 0x18002bbd0
Capabilities:
Encode data using xor
Resolve dns

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3f]
sub rsp, 0xd0
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
movaps xmmword [rax - 0x68], xmm8
mov r14, r8
mov rsi, rcx
movzx r12d, word [r8 + 2]
mov ecx, dword [r8 + 4]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov r15, rax
xor ebx, ebx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x48], rbx
mov qword [rbp - 0x79], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x38], bl
mov rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp byte [rax + rdi], bl
jne 0x18002bc40
movabs rax, 0x8000000000000027
movabs r13, 0x7fffffffffffffff
cmp rdi, 0xf
ja 0x18002bc80
mov qword [rsp + 0x48], rdi
mov r8, rdi
mov rdx, r15
lea rcx, [rsp + 0x38]
call fcn.18009fc20
mov byte [rsp + rdi + 0x38], bl
jmp 0x18002bd19
cmp rdi, r13
ja 0x18002c324
mov rsi, rdi
or rsi, 0xf
cmp rsi, r13
jbe 0x18002bcb7
mov rsi, r13
mov rcx, rax
call fcn.18009d1b8
test rax, rax
je 0x18002c3d3
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x18002bcf1
mov eax, socket
cmp rsi, rax
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x18002bcdf
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18002c2bc
jmp 0x18002bc98
test rcx, rcx
je 0x18002bcee
call fcn.18009d1b8
mov r14, rax
jmp 0x18002bcf1
mov r14, rbx
mov qword [rsp + 0x48], rdi
mov qword [rbp - 0x79], rsi
mov r8, rdi
mov rdx, r15
mov rcx, r14
call fcn.18009fc20
mov byte [r14 + rdi], bl
mov qword [rsp + 0x38], r14
mov rsi, qword [rbp + 0x47]
mov r14, qword [rbp + 0x57]
mov edx, 4
movabs r9, 0xd993efbb19cfe32d
cmp byte [0x18010a364], 0
je 0x18002be30
lea rdi, [rsp + 0x38]
cmp qword [rbp - 0x79], 0x10
cmovae rdi, qword [rsp + 0x38]
movdqa xmm6, xmmword [0x1800ec550]
movdqa xmm7, xmmword [0x1800ec5f0]
movdqa xmm8, xmmword [0x1800ec830]
mov dword [rbp - 0x39], 0x19e69308
mov rcx, qword gs:[0x58]
mov eax, dword [0x18010bb98]
mov rcx, qword [rcx + rax*8]
mov eax, dword [rdx + rcx]
cmp dword [0x18010d19c], eax
jg 0x18002c2c2
jmp 0x18002bd93
movabs r9, 0xd993efbb19cfe32d
cmp byte [0x180106174], 0
je 0x18002bdf2
mov r10, rbx
mov r11d, 1
lea rsi, [0x180106140]
sub r11, rsi
nop
lea rdx, [r10 + rsi]
movzx ecx, r10b
and cl, 7
shl cl, 3
mov rax, r9
shr rax, cl
xor byte [rdx], al
lea r8, [rdx + 1]
lea ecx, [r11 + rdx]
and cl, 7
shl cl, 3
mov rdx, r9
shr rdx, cl
xor byte [r8], dl
add r10, 2
cmp r10, 0x34
jb 0x18002bdb0
mov byte [0x180106174], 0
mov rsi, qword [rbp + 0x47]
movzx ecx, word [r14 + 2]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, ax
mov r15, qword [rbp + 0x8f]
mov rax, qword [r15]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov r9, rdi
mov rdi, qword [rbp + 0x4f]
mov r8, rdi
lea rdx, [0x180106140]
mov ecx, 5
call fcn.18006a848
jmp 0x18002be3b
mov r15, qword [rbp + 0x8f]
mov rdi, qword [rbp + 0x4f]
cmp qword [r15], 0
jne 0x18002c24e
cmp byte [rsi + 0x104], 0
je 0x18002c24e
cmp r12w, word [rsi + 0x102]
jne 0x18002c24e
cmp word [r14], 2
jne 0x18002c24e
mov dword [rbp - 0x71], 4
lea rax, [rbp - 0x71]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
mov edx, 0xffff
mov r8d, 0x1008
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x18002c24e
cmp dword [rsp + 0x30], 1
sete al
test al, al
je 0x18002c24e
movzx eax, byte [r14 + 4]
movzx ecx, byte [r14 + 5]
cmp al, 0xa
je 0x18002c24e
cmp al, 0x7f
je 0x18002c24e
cmp al, 0xac
jne 0x18002bed7
sub cl, 0x10
cmp cl, 0xf
ja 0x18002bee4
jmp 0x18002c24e
cmp al, 0xc0
jne 0x18002bee4
cmp cl, 0xa8
je 0x18002c24e
cmp word [rsi + 0xf2], 0
jne 0x18002bf3a
lea rdi, [rsi + 0xd0]
mov rcx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18002bf02
mov rcx, qword [rdi]
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x18002bfdc
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov eax, dword [rcx]
mov dword [rsi + 0xf4], eax
movzx eax, word [rsi + 0x100]
mov word [rsi + 0xf2], ax
mov eax, 2
mov word [rsi + 0xf0], ax
mov ecx, 0x38
call fcn.18009d1b8
mov r15, rax
mov qword [rsp + 0x30], rax
mov qword [rax + 8], rbx
mov dword [rax + 0x10], ebx
mov qword [rax + 0x18], rbx
mov qword [rax + 0x28], rbx
mov qword [rax + 0x30], reloc.WS2_32.dll_ntohs
mov dword [rax], 3
movzx ecx, word [r14 + 2]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, ax
mov dword [r15 + 0x10], ecx
lea rsi, [r15 + 0x18]
lea rax, [rsp + 0x38]
cmp rsi, rax
je 0x18002c17b
lea rax, [rsp + 0x38]
cmp qword [rbp - 0x79], 0x10
cmovae rax, qword [rsp + 0x38]
mov qword [rsp + 0x30], rax
mov r14, qword [rsp + 0x48]
mov r12, qword [rsi + 0x18]
cmp r14, r12
ja 0x18002c094
mov rdi, rsi
cmp r12, 0x10
jb 0x18002bfc0
mov rdi, qword [rsi]
mov qword [rsi + 0x10], r14
mov r8, r14
mov rdx, rax
mov rcx, rdi
call fcn.18009fc20
mov byte [rdi + r14], 0
jmp 0x18002c177
mov byte [rsi + 0x104], 0
cmp byte [0x18010a364], 0
je 0x18002c24e
cmp qword [rdi + 0x18], 0x10
jb 0x18002bffa
mov rdi, qword [rdi]
movdqa xmm6, xmmword [0x1800ec240]
movdqa xmm7, xmmword [0x1800ec620]
mov dword [rbp - 0x49], 0x6aeac317
mov rcx, qword gs:[0x58]
mov eax, dword [0x18010bb98]
mov edx, 4
mov rcx, qword [rcx + rax*8]
mov eax, dword [rdx + rcx]
cmp dword [0x18010d1d0], eax
jg 0x18002c32a
lea rdx, [0x180106260]
cmp byte [0x180106285], 0
je 0x18002c082
movabs r8, 0xd993efbb19cfe32d
nop dword [rax]
nop word [rax + rax]
movzx ecx, bl
and cl, 7
shl cl, 3
mov rax, r8
shr rax, cl
xor byte [rbx + rdx], al
inc rbx
cmp rbx, 0x25
jb 0x18002c060
mov byte [0x180106285], 0
mov r8, rdi
mov ecx, 3
call fcn.18006a848
jmp 0x18002c24e
cmp r14, r13
ja 0x18002c380
mov rdx, r14
or rdx, 0xf
cmp rdx, r13
ja 0x18002c0e4
mov rcx, r12
shr rcx, 1
mov rax, r13
sub rax, rcx
cmp r12, rax
ja 0x18002c0e4
lea rax, [rcx + r12]
mov r13, rdx
cmp rdx, rax
cmovb r13, rax
lea rcx, [r13 + 1]
cmp rcx, 0x1000
jb 0x18002c10d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18002c31e
jmp 0x18002c0ee
movabs rax, 0x8000000000000027
mov rcx, rax
call fcn.18009d1b8
test rax, rax
je 0x18002c2b6
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x18002c11f
test rcx, rcx
je 0x18002c11c
call fcn.18009d1b8
mov rdi, rax
jmp 0x18002c11f
mov rdi, rbx
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], r13
mov r8, r14
mov rdx, qword [rsp + 0x30]
mov rcx, rdi
call fcn.18009fc20
mov byte [rdi + r14], 0
cmp r12, 0x10
jb 0x18002c174
mov rcx, qword [rsi]
lea rdx, [r12 + 1]
cmp rdx, 0x1000
jb 0x18002c16f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18002c2b6
mov rcx, r8
call fcn.18009d1f4
mov qword [rsi], rdi
mov r14, qword [rbp + 0x57]
mov rax, qword [rbp + 0x4f]
mov qword [r15 + 8], rax
mov rax, qword [rbp + 0x8f]
mov qword [rax], r15
mov rax, qword [rbp + 0x47]
movups xmm0, xmmword [rax + 0xf0]
movups xmmword [r14], xmm0
cmp byte [0x18010a364], 0
je 0x18002c24e
movdqa xmm6, xmmword [0x1800ec0f0]
movdqa xmm7, xmmword [0x1800ec690]
mov rcx, qword gs:[0x58]
mov eax, dword [0x18010bb98]
mov edx, 4
mov rcx, qword [rcx + rax*8]
mov eax, dword [rdx + rcx]
cmp dword [0x18010d1c0], eax
jg 0x18002c386
lea rdi, [0x180106000]
cmp byte [0x180106021], 0
je 0x18002c222
movabs r8, 0xd993efbb19cfe32d
nop word [rax + rax]
movzx ecx, bl
and cl, 7
shl cl, 3
mov rax, r8
shr rax, cl
xor byte [rbx + rdi], al
inc rbx
cmp rbx, 0x21
jb 0x18002c200
mov byte [0x180106021], 0
movzx ecx, word [r14 + 2]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ebx, ax
mov ecx, dword [r14 + 4]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov r8, rax
mov r9d, ebx
mov rdx, rdi
mov ecx, 5
call fcn.18006a848
nop
mov rdx, qword [rbp - 0x79]
cmp rdx, 0x10
jb 0x18002c28a
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002c285
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002c3d3
call fcn.18009d1f4
mov al, 1
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x58]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1800a45b8
nop
call fcn.180001df0
nop
lea rcx, [0x18010d19c]
call fcn.18009d704
cmp dword [0x18010d19c], 0xffffffff
jne 0x18002bd89
mov byte [0x180106174], 1
movaps xmmword [0x180106140], xmm6
movaps xmmword [0x180106150], xmm7
movaps xmmword [0x180106160], xmm8
mov eax, dword [rbp - 0x39]
mov dword [0x180106170], eax
lea rcx, [0x1800cdf40]
call fcn.18009d564
lea rcx, [0x18010d19c]
call fcn.18009d6a4
jmp 0x18002bd89
call fcn.180001df0
nop
call fcn.180001e88
nop
lea rcx, [0x18010d1d0]
call fcn.18009d704
cmp dword [0x18010d1d0], 0xffffffff
jne 0x18002c038
mov word [0x180106284], 0x1bb
movaps xmmword [0x180106260], xmm6
movaps xmmword [0x180106270], xmm7
mov eax, dword [rbp - 0x49]
mov dword [0x180106280], eax
lea rcx, [0x1800cdf20]
call fcn.18009d564
lea rcx, [0x18010d1d0]
call fcn.18009d6a4
jmp 0x18002c038
call fcn.180001e88
int3
lea rcx, [0x18010d1c0]
call fcn.18009d704
cmp dword [0x18010d1c0], 0xffffffff
jne 0x18002c1e0
mov word [0x180106020], 0x12d
movaps xmmword [0x180106000], xmm6
movaps xmmword [0x180106010], xmm7
lea rcx, [0x1800cdf00]
call fcn.18009d564
lea rcx, [0x18010d1c0]
call fcn.18009d6a4
jmp 0x18002c1e0
call fcn.1800a45b8
int3