Function at 0x1801afed0
Capabilities:
Encode data using xor
Get hostname
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
push rbp
push rbx
push rsi
push rdi
lea rbp, [r11 - 0x28]
sub rsp, 0x108
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rbp - 8], rax
mov qword [r11 + 0x18], r13
xor esi, esi
mov qword [r11 + 0x20], r14
mov r13, rcx
xor r14d, r14d
mov dword [rsp + 0x68], edx
mov ecx, 0xff
mov dword [rsp + 0x64], r14d
mov dword [rsp + 0x40], r14d
call fcn.1801aecb0
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1801b074d
movzx ecx, byte [r13 + 0x11]
movzx eax, byte [r13 + 0x10]
movzx edi, word [r13 + 2]
shl ecx, 8
and edi, 1
add ecx, eax
mov dword [rsp + 0x54], ecx
mov ecx, 0xa8
call fcn.1801aecb0
mov r14, rax
test rax, rax
je 0x1801b074d
lea r8, [rsp + 0x64]
lea edx, [rsi + 0x20]
lea ecx, [rsi + 1]
call fcn.1801aee30
mov rcx, r14
cmp dword [rsp + 0x64], esi
jne 0x1801aff84
call fcn.18010fbc0
mov rcx, qword [rsp + 0x48]
call fcn.18010fbc0
jmp 0x1801b0799
mov qword [0x18029cd18], rax
xor edx, edx
mov qword [rsp + 0x138], r12
mov r8d, 0xa8
mov qword [rsp + 0x100], r15
mov dword [rax], 4
mov qword [rax + 0x18], r14
call fcn.18020bef0
mov r15, 0xffffffffffffffff
mov rcx, r13
mov qword [r14 + 0x28], r15
mov dword [0x18029ccf4], 4
movzx eax, word [r13 + 0x30]
mov dword [r14 + 0x40], eax
mov rdx, qword [r13 + 0x28]
call fcn.1801b50f0
mov rdx, qword [r13 + 0x18]
mov rcx, r13
mov rsi, rax
mov qword [rsp + 0x58], rax
call fcn.1801b50f0
mov rbx, rax
test rsi, rsi
jne 0x1801b00c5
test rax, rax
je 0x1801b073d
mov ecx, 0x105
call fcn.1801aecb0
mov qword [rsp + 0x58], rax
mov rsi, rax
test rax, rax
je 0x1801b073d
mov r8d, edi
mov dword [rsp + 0x40], 1
mov edx, 0x200
mov rcx, rbx
call fcn.1801b4e80
mov dword [rsp + 0x50], eax
test eax, eax
je 0x1801b073d
test edi, edi
je 0x1801b009f
mov ecx, eax
call fcn.1801aecb0
mov r12, rax
test rax, rax
je 0x1801b073d
mov edx, dword [rsp + 0x50]
mov r9d, edi
mov r8, rbx
mov rcx, rax
call fcn.1801b4e30
lea rdx, [0x180056640]
mov rcx, rsi
mov rbx, r12
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9d, 0x105
lea ecx, [r15 + 0xb]
mov r8, rsi
mov rdx, r12
call fcn.1801af510
mov rcx, r12
call fcn.18010fbc0
jmp 0x1801b00c5
lea rdx, [0x180056640]
mov rcx, rsi
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9d, 0x105
mov r8, rsi
mov rdx, rbx
mov ecx, 0xa
call fcn.1801af510
movzx r12d, word [r13 + 0x12]
cmp r12d, 0xfffe
jne 0x1801b0103
test rbx, rbx
je 0x1801b0733
mov rdx, rbx
mov ecx, 8
call fcn.1801af3f0
test eax, eax
jne 0x1801b00fc
mov dword [0x18029ccf4], 0x29
jmp 0x1801b073d
dec ax
movzx r12d, ax
mov ebx, dword [rsp + 0x40]
mov edx, 0x105
xor ebx, 1
mov rcx, rsi
and ebx, edi
mov r8d, ebx
call fcn.1801b4e80
mov edi, eax
test eax, eax
je 0x1801b073d
mov ecx, eax
call fcn.1801aecb0
mov qword [r14 + 0x20], rax
test rax, rax
je 0x1801b073d
mov r9d, ebx
mov r8, rsi
mov edx, edi
mov rcx, rax
call fcn.1801b4e30
cmp dword [rsp + 0x40], 0
je 0x1801b0161
mov rcx, rsi
call fcn.18010fbc0
mov dword [rsp + 0x40], 0
mov rdx, qword [r13 + 0x38]
test rdx, rdx
je 0x1801b0733
mov rcx, r13
call fcn.1801b50f0
mov rcx, qword [r14 + 0x20]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0
movups xmm0, xmmword [rax]
lea r8d, [r9 + 3]
mov dword [rsp + 0x20], 3
movups xmmword [r14 + 0x88], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [r14 + 0x98], xmm1
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [r14 + 0x28], rax
cmp rax, r15
jne 0x1801b01d4
mov dword [0x18029ccf4], 0x60
jmp 0x1801b073d
mov r9d, 0x40
lea r8, [rbp - 0x80]
mov rcx, r14
lea edx, [r9 - 0x20]
call fcn.1801afa50
test eax, eax
je 0x1801b073d
mov rax, qword [rbp - 0x80]
cmp rax, qword [0x18029cd80]
je 0x1801b020e
mov dword [0x18029ccf4], 0x65
jmp 0x1801b073d
movzx eax, byte [rbp - 0x78]
mov byte [r14 + 0x18], al
movzx eax, byte [rbp - 0x77]
mov byte [r14 + 0x19], al
movzx ecx, byte [rbp - 0x73]
movzx eax, byte [rbp - 0x74]
shl ecx, 8
or ecx, eax
mov dword [r14 + 8], ecx
cmp byte [rbp - 0x78], 2
jb 0x1801b0258
movzx eax, byte [rbp - 0x66]
movzx ecx, byte [rbp - 0x65]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbp - 0x67]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbp - 0x68]
shl ecx, 8
or ecx, eax
mov dword [r14 + 0x38], ecx
mov rcx, r14
call fcn.1801af6c0
test eax, eax
je 0x1801b073d
movzx ecx, byte [r14 + 0x18]
movzx eax, byte [r14 + 0x19]
shl ecx, 8
add ecx, eax
cmp ecx, 0x120
je 0x1801b0287
cmp ecx, 0x200
jne 0x1801b028d
cmp dword [rsp + 0x54], ecx
jbe 0x1801b029c
mov dword [0x18029ccf4], 0xd
jmp 0x1801b073d
movzx eax, word [r13 + 0x32]
test ax, ax
je 0x1801b0359
movzx esi, word [r13 + 0x30]
lea rcx, [rsp + 0x70]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [rsp + 0x78]
movzx r8d, word [rsp + 0x76]
movzx edx, word [rsp + 0x72]
imul ecx, eax, 0x3c
movzx eax, word [rsp + 0x7a]
add ecx, eax
movzx eax, word [rsp + 0x7c]
imul ebx, ecx, 0x1e
movzx ecx, word [rsp + 0x70]
shr eax, 1
add ebx, eax
call fcn.1801b67e0
imul ecx, eax, 0xa8c0
add ebx, ecx
mov ecx, dword [r14 + 0x4c]
mov r8d, ecx
mov edx, ecx
shr ecx, 9
and r8d, 0x1f
and ecx, 0x7f
shr edx, 5
add ecx, 0x7bc
and edx, 0xf
call fcn.1801b67e0
imul edx, eax, 0xa8c0
mov eax, ebx
add edx, dword [r14 + 0x50]
sub eax, edx
mov r8d, edx
sub r8d, ebx
cmp edx, ebx
lea edx, [rsi + rsi]
cmovbe r8d, eax
imul ecx, edi, 0x1e
imul eax, edi, 0x3c
cmp eax, edx
cmovae esi, ecx
cmp r8d, esi
mov rsi, qword [rsp + 0x58]
jbe 0x1801b0359
mov dword [0x18029ccf4], 0x63
jmp 0x1801b073d
movzx eax, byte [rbp - 0x75]
shl ax, 8
movzx ecx, ax
movzx eax, byte [rbp - 0x76]
or ecx, eax
add ecx, 0x20
test dword [rsp + 0x68], 0x100000
mov dword [r14 + 0x64], ecx
je 0x1801b0395
mov dword [r14], 0xffffffff
mov dword [r14 + 0x68], ecx
mov dword [0x18029ccf4], 0
jmp 0x1801b073d
movzx eax, byte [rbp - 0x75]
mov rcx, r14
mov r9d, dword [r14 + 8]
xor ebx, ebx
mov r8, qword [rsp + 0x48]
xor edi, edi
shl ax, 8
movzx edx, ax
movzx eax, byte [rbp - 0x76]
or edx, eax
add edx, 0x20
call fcn.1801afa50
test eax, eax
je 0x1801b073d
mov r8d, dword [r14 + 8]
xor eax, eax
mov rdx, qword [rsp + 0x48]
test r8d, r8d
jle 0x1801b0403
movzx ecx, byte [rdx]
cmp cl, 0xff
jne 0x1801b03f2
test r15d, r15d
jns 0x1801b03ee
cmp r12d, 0xffff
cmove r15d, eax
inc ebx
jmp 0x1801b03f9
cmp cl, 0xfe
je 0x1801b03f9
inc edi
inc eax
inc rdx
cmp eax, r8d
jl 0x1801b03d6
lea eax, [rdi + rbx]
cmp eax, dword [r14 + 4]
jbe 0x1801b041b
mov dword [0x18029ccf4], 0x65
jmp 0x1801b073d
cmp r12d, 0xffff
je 0x1801b044c
cmp r12d, r8d
jae 0x1801b044c
mov rcx, qword [rsp + 0x48]
mov eax, r12d
add rcx, rax
movzx eax, byte [rcx]
cmp al, 0xfe
je 0x1801b044c
mov r15d, r12d
cmp al, 0xff
je 0x1801b044c
test byte [r13], 1
je 0x1801b044c
mov byte [rcx], 0xff
cmp r15d, 0xffffffff
je 0x1801b0727
mov rcx, qword [rsp + 0x48]
movsxd rax, r15d
cmp byte [rax + rcx], 0xff
jne 0x1801b0727
movzx eax, r15w
lea r8, [rbp - 0x2c]
mov dword [r14], eax
mov r9d, 0x1c
movzx eax, bx
dec eax
mov dword [r14 + 0xc], eax
movzx eax, byte [rbp - 0x6f]
shl ax, 8
movzx ecx, ax
movzx eax, byte [rbp - 0x70]
or ecx, eax
mov dword [r14 + 0x10], ecx
mov ecx, dword [r14 + 0x64]
add ecx, r15d
mov dword [r14 + 0x68], ecx
movzx eax, byte [rbp - 0x71]
shl ax, 8
movzx edx, ax
movzx eax, byte [rbp - 0x72]
or edx, eax
movzx eax, byte [rbp - 0x6f]
shl ax, 8
movzx ecx, ax
movzx eax, byte [rbp - 0x70]
or ecx, eax
movzx eax, byte [rbp - 0x73]
add edx, ecx
shl ax, 8
movzx ecx, ax
movzx eax, byte [rbp - 0x74]
or ecx, eax
imul edx, r15d
movzx eax, byte [rbp - 0x75]
shl ax, 8
add edx, ecx
movzx ecx, ax
movzx eax, byte [rbp - 0x76]
or ecx, eax
add ecx, 0x20
add edx, ecx
mov dword [r14 + 0x6c], edx
add edx, 0x14
movzx eax, byte [rbp - 0x71]
shl ax, 8
movzx ecx, ax
movzx eax, byte [rbp - 0x72]
or ecx, eax
mov dword [r14 + 0x70], ecx
mov rcx, r14
call fcn.1801afa50
test eax, eax
je 0x1801b073d
cmp word [rbp - 0x2c], 0
mov ebx, 0x18
je 0x1801b058d
movzx ecx, byte [rbp - 0x2c]
lea r8, [rbp - 0x28]
movzx edx, byte [rbp - 0x29]
movzx eax, byte [rbp - 0x2b]
shl dx, 8
shl ax, 8
or ax, cx
movzx ecx, byte [rbp - 0x2a]
or dx, cx
add ax, dx
mov edx, ebx
xor byte [r8], al
lea r8, [r8 + 1]
movzx ecx, ax
add ax, ax
shr cx, 0xf
add cx, ax
movzx eax, cx
add cx, cx
shr ax, 0xf
add ax, cx
sub rdx, 1
jne 0x1801b0552
cmp dword [rbp - 0x14], edx
je 0x1801b058d
mov dword [0x18029ccf4], 0x65
jmp 0x1801b073d
movzx eax, byte [rbp - 0x27]
lea rdx, [rsp + 0x68]
shl ax, 8
xorps xmm0, xmm0
movzx ecx, ax
xorps xmm1, xmm1
movzx eax, byte [rbp - 0x28]
or ecx, eax
mov qword [rbp - 0x40], 0
inc ecx
mov qword [rbp - 0x38], 0
mov dword [r14 + 0x60], ecx
movzx ecx, word [rbp - 0x64]
movzx eax, word [rbp - 0x62]
mov word [rbp - 0x30], cx
mov word [rbp - 0x2c], cx
lea rcx, [rbp - 0x40]
movdqu xmmword [rbp - 0x28], xmm0
mov word [rbp - 0x2e], ax
movdqu xmmword [rbp - 0x18], xmm1
mov word [rbp - 0x2a], ax
mov dword [rsp + 0x68], reloc.WS2_32.dll_recv
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
movzx eax, byte [r14 + 0x60]
lea r8, [rbp - 0x28]
movzx edx, byte [rbp - 0x63]
movzx ecx, byte [rbp - 0x61]
mov byte [rbp - 0x28], al
mov eax, dword [r14 + 0x60]
shr eax, 8
mov byte [rbp - 0x27], al
movzx eax, byte [rbp - 0x64]
shl dx, 8
or dx, ax
shl cx, 8
movzx eax, byte [rbp - 0x62]
or cx, ax
add dx, cx
nop word [rax + rax]
xor byte [r8], dl
lea r8, [r8 + 1]
movzx eax, dx
add dx, dx
shr ax, 0xf
add ax, dx
movzx edx, ax
add ax, ax
shr dx, 0xf
add dx, ax
sub rbx, 1
jne 0x1801b0630
mov edx, dword [r14 + 0x6c]
lea r9d, [rbx + 0x38]
lea r8, [rbp - 0x40]
mov rcx, r14
call fcn.1801b1c30
test eax, eax
je 0x1801b073d
movzx eax, byte [r14 + 0x5c]
lea r9d, [rbx + 1]
mov edx, dword [r14 + 0x68]
lea r8, [rsp + 0x60]
mov rcx, r14
mov byte [rsp + 0x60], al
call fcn.1801b1c30
test eax, eax
je 0x1801b073d
mov dword [r14 + 0x14], ebx
movzx eax, byte [rbp - 0x63]
shl ax, 8
movzx ecx, ax
movzx eax, byte [rbp - 0x64]
or ecx, eax
mov dword [r14 + 0x44], ecx
movzx eax, byte [rbp - 0x61]
shl ax, 8
movzx ecx, ax
movzx eax, byte [rbp - 0x62]
or ecx, eax
mov dword [r14 + 0x48], ecx
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [rsp + 0x70]
movzx eax, word [rsp + 0x72]
sub cx, 0x3c
and ax, 0xf
shl cx, 4
or cx, ax
movzx eax, word [rsp + 0x76]
and eax, 0x1f
shl cx, 5
movzx ecx, cx
or ecx, eax
movzx eax, word [rsp + 0x78]
mov dword [r14 + 0x54], ecx
imul ecx, eax, 0x3c
movzx eax, word [rsp + 0x7a]
add ecx, eax
movzx eax, word [rsp + 0x7c]
imul edx, ecx, 0x1e
shr eax, 1
add edx, eax
mov dword [r14 + 0x58], edx
mov dword [0x18029ccf4], ebx
jmp 0x1801b073d
mov dword [0x18029ccf4], 0x66
jmp 0x1801b073d
mov dword [0x18029ccf4], 4
mov r12, qword [rsp + 0x138]
mov r15, qword [rsp + 0x100]
mov rcx, qword [rsp + 0x48]
call fcn.18010fbc0
cmp dword [rsp + 0x40], 0
je 0x1801b0766
mov rcx, rsi
call fcn.18010fbc0
test r14, r14
je 0x1801b0799
cmp dword [r14 + 0x30], 0
je 0x1801b0799
mov rcx, qword [r14 + 0x28]
mov r9d, 0x24
xor r8d, r8d
mov dword [rsp + 0x20], 0
lea edx, [r9 + 0x18]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [r14 + 0x30], 0
cmp dword [0x18029ccf4], 0
mov r14, qword [rsp + 0x148]
mov r13, qword [rsp + 0x140]
jne 0x1801b07b8
mov eax, dword [rsp + 0x64]
jmp 0x1801b081b
mov ecx, dword [rsp + 0x64]
test ecx, ecx
je 0x1801b0819
call fcn.1801af2c0
mov rdi, rax
mov rbx, qword [rax + 0x18]
cmp dword [rbx + 0x30], 0
je 0x1801b07ef
mov rcx, qword [rbx + 0x28]
xor esi, esi
xor r8d, r8d
mov dword [rsp + 0x20], esi
lea r9d, [rsi + 0x24]
lea edx, [rsi + 0x3c]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rbx + 0x30], esi
mov rcx, qword [rbx + 0x28]
cmp rcx, 0xffffffffffffffff
je 0x1801b07ff
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rbx + 0x74]
call fcn.1801af1e0
mov rcx, qword [rdi + 0x18]
call fcn.18010fbc0
mov ecx, dword [rsp + 0x64]
call fcn.1801af070
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1801e68c0
add rsp, 0x108
pop rdi
pop rsi
pop rbx
pop rbp
ret