Function at 0x1800bb090
Capabilities:
Check for time delay via gettickcount
Create process on windows
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0xc8]
sub rsp, 0x1a0
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
movaps xmmword [rax - 0x98], xmm12
mov rax, qword [0x1802dd180]
xor rax, rsp
mov qword [rbp + 0x28], rax
mov qword [rsp + 0x70], rcx
xor r12d, r12d
cmp dword [0x1802e0b18], r12d
je 0x1800bbbe8
movss xmm11, dword [0x180164ea8]
mov dword [rsp + 0x60], 0x43960000
movss xmm12, dword [0x180164ea0]
mov dword [rsp + 0x64], 0x42f00000
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.180026a30
xorps xmm10, xmm10
mov qword [rsp + 0x60], r12
movss xmm1, dword [rsp + 0x74]
addss xmm1, dword [0x1801aeb3c]
movss xmm0, dword [rsp + 0x70]
addss xmm0, dword [0x180164ea4]
movss dword [rbp], xmm0
movss dword [rbp + 4], xmm1
lea r8, [rsp + 0x60]
mov edx, 1
lea rcx, [rbp]
call fcn.1800269f0
movsd xmm0, qword [str.qCZH]
movsd qword [rbp - 0x20], xmm0
mov eax, dword [0x1801ac820]
mov dword [rbp - 0x18], eax
cmp byte [0x1801ac823], r12b
je 0x1800bb309
mov r8d, r12d
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x1800bb2d9
movdqa xmm5, xmmword [0x1801aecf0]
movdqa xmm6, xmmword [str.1111]
movdqa xmm7, xmmword [str.5555555555555555]
movdqa xmm2, xmmword [0x180168c90]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm5
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
movdqa xmm4, xmmword [0x18016fe50]
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm7
movd xmm0, dword [str.qCZH]
xorps xmm2, xmm0
movd dword [rbp - 0x20], xmm2
movdqa xmm2, xmmword [0x18016fd90]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm5
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm7
movd xmm0, dword [rbp - 0x1c]
xorps xmm2, xmm0
movd dword [rbp - 0x1c], xmm2
movdqa xmm3, xmmword [0x18016fdb0]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm5
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmm7
movd xmm0, eax
xorps xmm3, xmm0
movd dword [rbp - 0x18], xmm3
jmp 0x1800bb309
lea r9, [rbp - 0x20]
nop dword [rax]
mov eax, 0x5397829d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
movzx eax, r8b
sub al, cl
add al, 0x35
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0xc
jl 0x1800bb2e0
xor edx, edx
mov r8d, 0xab
lea rcx, [rbp - 0x20]
call fcn.180012b70
call fcn.18001b1e0
mov rbx, rax
lea rcx, [rbp]
call fcn.18001b230
movss xmm2, dword [rbp + 4]
movaps xmm3, xmm2
addss xmm3, xmm10
movss xmm0, dword [rbp]
movaps xmm1, xmm0
addss xmm1, xmm11
subss xmm2, dword [0x180164c90]
subss xmm0, xmm10
movss dword [rbp - 0x10], xmm0
movss dword [rbp - 0xc], xmm2
movss dword [rbp - 8], xmm1
movss dword [rbp - 4], xmm3
lea rcx, [0x1801d90c0]
call fcn.1800177e0
movss xmm1, dword [rbp + 4]
addss xmm1, xmm12
movss xmm0, dword [rbp]
addss xmm0, xmm11
movss dword [rsp + 0x60], xmm0
movss dword [rsp + 0x64], xmm1
mov dword [rsp + 0x28], r12d
movss xmm6, dword [0x180164c60]
movss dword [rsp + 0x20], xmm6
mov r9d, eax
lea r8, [rsp + 0x60]
lea rdx, [rbp]
mov rcx, rbx
call fcn.18002e3d0
call fcn.18001a580
mov rbx, rax
lea rcx, [0x1801d90a0]
call fcn.1800177e0
mov dword [rsp + 0x28], Ordinal_50
movss dword [rsp + 0x20], xmm6
mov r9d, eax
lea r8, [rbp - 8]
lea rdx, [rbp - 0x10]
mov rcx, rbx
call fcn.18002e3d0
call fcn.18001a580
mov r15, rax
lea rcx, section..data
call fcn.1800177e0
mov r14d, eax
lea rcx, section..data
call fcn.1800177e0
mov esi, eax
lea rcx, section..data
call fcn.1800177e0
mov edi, eax
lea rcx, section..data
call fcn.1800177e0
mov ebx, eax
lea rcx, [0x1801d90a0]
call fcn.1800177e0
mov dword [rsp + 0x48], Ordinal_50
movss dword [rsp + 0x40], xmm6
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebx
mov r9d, eax
lea r8, [rbp - 8]
lea rdx, [rbp - 0x10]
mov rcx, r15
call fcn.18002e580
movss xmm9, dword [0x180164c70]
cmp dword [0x1802e0b18], 1
jne 0x1800bb6fe
mov dword [rsp + 0x60], 0x41200000
mov dword [rsp + 0x64], 0x41200000
lea rcx, [rsp + 0x60]
call fcn.180026520
mov dword [rsp + 0x60], 0x438c0000
mov dword [rsp + 0x64], 0x42340000
movsd xmm0, qword [0x1801ac838]
movsd qword [rbp - 0x20], xmm0
movzx eax, word [0x1801ac840]
mov word [rbp - 0x18], ax
movsd xmm0, qword [0x1801ac828]
movzx eax, byte [0x1801ac830]
movsd qword [rsp + 0x50], xmm0
cmp byte [0x1801ac841], r12b
je 0x1800bb50b
mov byte [rbp - 0x20], reloc.WLDAP32.dll_Ordinal_35
xor byte [rbp - 0x1f], 0x36
xor byte [rbp - 0x1e], 0x37
xor byte [rbp - 0x1d], 0x38
xor byte [rbp - 0x1c], 0x39
xor byte [rbp - 0x1b], 0x3a
xor byte [rbp - 0x1a], 0x3b
xor byte [rbp - 0x19], 0x3c
xor byte [rbp - 0x18], 0x3d
xor byte [rbp - 0x17], 0x3e
mov byte [rsp + 0x50], reloc.WLDAP32.dll_Ordinal_35
xor byte [rsp + 0x51], 0x36
xor byte [rsp + 0x52], 0x37
xor byte [rsp + 0x53], 0x38
xor byte [rsp + 0x54], 0x39
xor byte [rsp + 0x55], 0x3a
xor byte [rsp + 0x56], 0x3b
xor byte [rsp + 0x57], 0x3c
xor al, 0x3d
mov byte [rsp + 0x58], al
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x100
lea r8, str.C:SharkExecutorDumpsDumpName
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x50]
call fcn.18004e820
mov dword [rsp + 0x60], 0x41200000
mov dword [rsp + 0x64], 0x42820000
lea rcx, [rsp + 0x60]
call fcn.180026520
mov dword [rsp + 0x60], 0x43070000
mov dword [rsp + 0x64], 0x42340000
mov eax, dword [str.fWA_9]
mov dword [rsp + 0x50], eax
movzx eax, byte [reloc.WS2_32.dll_gethostname]
mov byte [rsp + 0x50], 0x53
xor byte [rsp + 0x51], 0x36
xor byte [rsp + 0x52], 0x37
xor byte [rsp + 0x53], 0x38
xor al, 0x39
mov byte [rsp + 0x54], al
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x50]
call fcn.18004b9c0
test al, al
je 0x1800bb674
mov cl, 1
call fcn.1800bc920
mov rcx, qword [rax]
mov r8, qword [rcx + 0x38]
lea rcx, vtable.std::_Func_impl_no_alloc_class__void___cdecl_WinDump::DumpWindowRender_struct_ImVec2_::_11::_lambda_5___void__class_fwRefContainer_class_fx::Resource__const____ptr64_.0
mov qword [rbp - 0x60], rcx
lea rcx, [rbp - 0x60]
mov qword [rbp - 0x28], rcx
lea rdx, [rbp - 0x60]
mov rcx, rax
call r8
nop
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x1800bb61e
mov rax, qword [rcx]
lea rdx, [rbp - 0x60]
cmp rcx, rdx
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
mov eax, dword [0x1801ac84c]
mov dword [rsp + 0x50], eax
movzx eax, byte [reloc.WS2_32.dll_gethostname]
mov byte [rsp + 0x50], reloc.WS2_32.dll_WSAGetLastError
xor byte [rsp + 0x51], 0x36
xor byte [rsp + 0x52], 0x37
xor byte [rsp + 0x53], 0x38
xor al, 0x39
mov byte [rsp + 0x54], al
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, str.C:SharkExecutorDumpsDumpName
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [0x1802e0b18], r12d
movss xmm8, dword [0x180164cb8]
movaps xmm1, xmm8
movaps xmm0, xmm10
call fcn.180025b90
mov eax, dword [str.vWY_V_]
mov dword [rsp + 0x50], eax
movzx eax, word [0x1801ac858]
mov word [rsp + 0x54], ax
movzx eax, byte [0x1801ac85a]
mov dword [rsp + 0x64], 0x42340000
mov dword [rsp + 0x60], 0x43070000
mov byte [rsp + 0x50], 0x43
xor byte [rsp + 0x51], 0x36
xor byte [rsp + 0x52], 0x37
xor byte [rsp + 0x53], 0x38
xor byte [rsp + 0x54], 0x39
xor byte [rsp + 0x55], 0x3a
xor al, 0x3b
mov byte [rsp + 0x56], al
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x50]
call fcn.18004b9c0
test al, al
je 0x1800bbaf1
mov dword [0x1802e0b18], r12d
jmp 0x1800bbaf1
movss xmm2, dword [rbp - 4]
movaps xmm3, xmm2
addss xmm3, dword [0x1801aeb08]
movss xmm1, dword [rbp - 8]
subss xmm1, xmm9
addss xmm2, dword [0x1801aeb04]
movss xmm0, dword [rbp - 0x10]
addss xmm0, xmm9
movss dword [rbp - 0x20], xmm0
movss dword [rbp - 0x1c], xmm2
movss dword [rbp - 0x18], xmm1
movss dword [rbp - 0x14], xmm3
call fcn.18001a580
mov rbx, rax
lea rcx, [0x1801d9010]
call fcn.1800177e0
mov dword [rsp + 0x28], r12d
movss dword [rsp + 0x20], xmm6
mov r9d, eax
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x20]
mov rcx, rbx
call fcn.18002e3d0
call fcn.18001a580
mov rbx, rax
lea rcx, section..data
call fcn.1800177e0
movss xmm0, dword [rbp - 0x20]
addss xmm0, dword [0x1802e0e18]
movss dword [rsp + 0x60], xmm0
movss xmm0, dword [rbp - 0x14]
movss dword [rsp + 0x64], xmm0
mov dword [rsp + 0x28], r12d
movss dword [rsp + 0x20], xmm6
mov r9d, eax
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x20]
mov rcx, rbx
call fcn.18002e3d0
movss xmm1, dword [0x1802e0e1c]
subss xmm1, dword [0x1802e0e18]
mulss xmm1, dword [0x1801d9150]
addss xmm1, dword [0x1802e0e18]
movss dword [0x1802e0e18], xmm1
mov ecx, dword [0x1802e1470]
mov rax, qword gs:[0x58]
mov edx, Ordinal_41
mov rax, qword [rax + rcx*8]
mov eax, dword [rdx + rax]
cmp dword [0x1802e0f44], eax
jg 0x1800bbc33
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x1802e0f40]
movss xmm7, dword [0x1801aeac4]
cmp eax, 0x64
jbe 0x1800bb8ba
movss xmm2, dword [0x1802e0e1c]
movaps xmm1, xmm2
mulss xmm1, xmm7
movss xmm0, dword [0x1801aeb24]
comiss xmm0, xmm1
jbe 0x1800bb858
addss xmm2, xmm9
movss dword [0x1802e0e1c], xmm2
jmp 0x1800bb8ae
mov eax, dword [str.ZFRV9]
mov dword [rsp + 0x50], eax
movzx eax, byte [reloc.WS2_32.dll_gethostname]
mov byte [rsp + 0x50], reloc.WS2_32.dll_WSAGetLastError
xor byte [rsp + 0x51], 0x36
xor byte [rsp + 0x52], 0x37
xor byte [rsp + 0x53], 0x38
xor al, 0x39
mov byte [rsp + 0x54], al
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, str.C:SharkExecutorDumpsDumpName
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [0x1802e0b18], r12d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1802e0f40], eax
call fcn.18001a580
mov rdi, rax
lea rcx, [0x1801d9030]
call fcn.1800177e0
mov ebx, eax
movss xmm8, dword [0x180164cb8]
movss dword [rsp + 0x20], xmm8
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Loading
lea rcx, [rsp + 0x50]
call fcn.180016700
movss xmm0, dword [rax + 4]
addss xmm0, xmm6
movss xmm1, dword [rbp - 0x1c]
subss xmm1, xmm0
movss xmm0, dword [rbp - 0x20]
subss xmm0, xmm10
movss dword [rsp + 0x60], xmm0
movss dword [rsp + 0x64], xmm1
mov qword [rsp + 0x20], r12
lea r9, str.Loading
mov r8d, ebx
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.180031b20
movss xmm0, dword [0x1802e0e1c]
mulss xmm0, xmm7
cvttss2si edx, xmm0
lea rcx, [rsp + 0x78]
call fcn.1800f6700
mov rcx, rax
mov rdx, qword [rax + 0x10]
mov r8, qword [rax + 0x18]
mov rax, r8
sub rax, rdx
cmp rax, 4
jb 0x1800bb98e
lea rax, [rdx + 4]
mov qword [rcx + 0x10], rax
mov rax, rcx
cmp r8, 0xf
jbe 0x1800bb980
mov rax, qword [rcx]
mov dword [rax + rdx], 0x3030312f
mov byte [rax + rdx + 4], 0
jmp 0x1800bb9b1
mov qword [rsp + 0x20], 4
lea r9, str._100
movzx r8d, byte [rsp + 0x68]
mov edx, 4
call fcn.18004a540
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x18], xmm1
movups xmm0, xmmword [rcx]
movups xmmword [rbp + 8], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rbp + 0x18], xmm1
mov qword [rcx + 0x10], r12
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], 0
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x1800bba1d
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800bba18
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800bba18
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180157870
movdqa xmm0, xmmword [0x180169910]
movdqu xmmword [rbp - 0x78], xmm0
mov byte [rsp + 0x78], 0
call fcn.18001a580
mov rsi, rax
lea rdi, [rbp + 8]
cmp qword [rbp + 0x20], 0xf
cmova rdi, qword [rbp + 8]
lea rcx, [0x1801d9030]
call fcn.1800177e0
mov ebx, eax
lea rdx, [rbp + 8]
cmp qword [rbp + 0x20], 0xf
cmova rdx, qword [rbp + 8]
movss dword [rsp + 0x20], xmm8
xor r9d, r9d
xor r8d, r8d
lea rcx, [rsp + 0x50]
call fcn.180016700
movss xmm1, dword [rbp - 0x14]
subss xmm1, dword [0x1801aeb68]
movss xmm0, dword [rbp - 0x18]
subss xmm0, dword [rax]
movss dword [rsp + 0x60], xmm0
movss dword [rsp + 0x64], xmm1
mov qword [rsp + 0x20], r12
mov r9, rdi
mov r8d, ebx
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.180031b20
nop
mov rdx, qword [rbp + 0x20]
cmp rdx, 0xf
jbe 0x1800bbaf1
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800bbaec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800bbaec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180157870
call fcn.18001a580
mov rbx, rax
lea rcx, [0x1801d90a0]
call fcn.1800177e0
movss xmm0, dword [rbp]
addss xmm0, xmm11
movss dword [rsp + 0x60], xmm0
movss xmm1, dword [rbp + 4]
addss xmm1, xmm12
movss dword [rsp + 0x64], xmm1
movss xmm0, dword [0x180164c4c]
movss dword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], r12d
movss dword [rsp + 0x20], xmm6
mov r9d, eax
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x10]
mov rcx, rbx
call fcn.18002e2c0
call fcn.18001a580
mov rdi, rax
lea rcx, [0x1801d9030]
call fcn.1800177e0
mov ebx, eax
movss xmm7, dword [rbp - 4]
movss xmm6, dword [rbp - 0xc]
movss dword [rsp + 0x20], xmm8
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Dump_location
lea rcx, [rsp + 0x50]
call fcn.180016700
subss xmm7, xmm6
mulss xmm7, dword [0x180164c18]
addss xmm7, xmm6
movss xmm0, dword [rax + 4]
mulss xmm0, dword [0x180164c18]
subss xmm7, xmm0
movss xmm0, dword [rbp - 0x10]
addss xmm0, xmm9
movss dword [rsp + 0x60], xmm0
movss dword [rsp + 0x64], xmm7
mov qword [rsp + 0x20], r12
lea r9, str.Dump_location
mov r8d, ebx
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.180031b20
call fcn.1800185d0
mov rcx, qword [rbp + 0x28]
xor rcx, rsp
call fcn.180157e20
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
lea rcx, [0x1802e0f44]
call fcn.180157c90
cmp dword [0x1802e0f44], 0xffffffff
jne 0x1800bb810
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1802e0f40], eax
lea rcx, [0x1802e0f44]
call fcn.180157c24
jmp 0x1800bb810