Function at 0x180033dc0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0xb0
mov edi, ecx
xor esi, esi
mov rcx, qword [0x1803a32e0]
mov rbx, rdx
lea rax, [rcx + 1]
test rax, 0xfffffffffffffffe
jne 0x180033a86
cmp dword [reloc.WS2_32.dll_accept], 2
mov ecx, esi
movups xmm0, xmmword [str.ohejVJNIIP_Q4]
movzx eax, word [0x1801828f8]
movups xmm1, xmmword [0x1801828d8]
movups xmmword [rsp + 0x50], xmm0
movups xmm0, xmmword [0x1801828e8]
movups xmmword [rsp + 0x60], xmm1
movups xmmword [rsp + 0x70], xmm0
mov word [r11 - 0x38], ax
jl 0x1800339fc
movdqa xmm5, xmmword [0x180186340]
lea rdx, [r11 - 0x68]
movdqa xmm4, xmmword [0x1801865e0]
movaps xmmword [r11 - 0x18], xmm6
movdqa xmm6, xmmword [0x1801863c0]
movaps xmmword [r11 - 0x28], xmm7
movdqa xmm7, xmmword [0x1801864a0]
nop
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 0x10]
paddd xmm2, xmm5
add ecx, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm7
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
xorps xmm3, xmm0
movq qword [rdx - 0x10], xmm3
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm7
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx - 8]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
xorps xmm3, xmm0
movq qword [rdx - 8], xmm3
cmp ecx, 0x18
jl 0x180033900
movaps xmm7, xmmword [rsp + 0x90]
movaps xmm6, xmmword [rsp + 0xa0]
cmp ecx, 0x19
jge 0x180033a41
movsxd rax, ecx
lea r8, [rsp + 0x50]
lea r8, [r8 + rax*2]
nop dword [rax + rax]
mov eax, 0x4ec4ec4f
lea r8, [r8 + 2]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul edx, eax, 0x34
movzx eax, cx
inc ecx
sub ax, dx
add ax, 0x33
xor word [r8 - 2], ax
cmp ecx, 0x19
jl 0x180033a10
mov qword [rsp + 0x30], rsi
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x28], 4
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x10000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, rax
mov qword [0x1803a32e0], rax
dec rax
cmp rax, 0xfffffffffffffffd
jbe 0x180033a86
mov eax, 1
jmp 0x180033af8
mov dword [rsp + 0x48], esi
lea rax, [0x1803a32c8]
mov qword [rsp + 0x40], rsi
lea r10, [0x18019e3d8]
mov dword [rsp + 0x38], 0x50
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], 0x221998
xor edx, edx
mov qword [rsp + 0x20], rax
mov dword [rbx + 0x44], edi
call r10
mov ebx, eax
cmp edi, 0x666
jne 0x180033af6
test eax, eax
je 0x180033af6
cmp eax, 0x25
je 0x180033af6
mov rcx, qword [0x1803a32e0]
lea rdx, [rcx - 1]
cmp rdx, 0xfffffffffffffffd
ja 0x180033af6
call qword [sym.imp.ntdll.dll_NtClose]
mov qword [0x1803a32e0], rsi
mov eax, ebx
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov edi, ecx
xor esi, esi
mov rcx, qword [0x1803a32e0]
mov rbx, rdx
lea rax, [rcx + 1]
test rax, 0xfffffffffffffffe
jne 0x180033d29
cmp dword [reloc.WS2_32.dll_accept], 2
mov ecx, esi
movups xmm3, xmmword [str.opP___fuIQR_]
movzx eax, word [0x180182940]
movsd xmm0, qword [0x180182938]
movups xmmword [rbp + 7], xmm3
mov word [rbp + 0x1f], ax
movsd qword [rbp + 0x17], xmm0
jl 0x180033c5a
movdqa xmm2, xmmword [0x180186340]
mov ecx, 8
movdqa xmm4, xmmword [0x1801865e0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1801863c0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movq xmm1, xmm3
movdqa xmm3, xmmword [0x180186380]
paddw xmm2, xmmword [0x1801864a0]
movdqa xmm0, xmm3
xorps xmm2, xmm1
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movq qword [rbp + 7], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1801863c0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rbp + 0xf]
pshufd xmm2, xmm1, 0xd8
paddw xmm2, xmmword [0x1801864a0]
xorps xmm2, xmm0
movq qword [rbp + 0xf], xmm2
movsxd rax, ecx
lea r8, [rbp + 7]
lea r8, [r8 + rax*2]
nop word [rax + rax]
mov eax, 0x4ec4ec4f
lea r8, [r8 + 2]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul edx, eax, 0x34
movzx eax, cx
inc ecx
sub ax, dx
add ax, 0x33
xor word [r8 - 2], ax
cmp ecx, 0xd
jl 0x180033c70
xorps xmm0, xmm0
mov dword [rbp + 0x2b], esi
lea rdx, [rbp + 7]
mov dword [rbp + 0x43], esi
lea rcx, [rbp - 0x19]
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rbp - 0x19]
mov dword [rsp + 0x28], 0x40
xorps xmm0, xmm0
mov qword [rbp + 0x37], rax
lea r9, [rbp - 9]
mov dword [rbp + 0x27], 0x30
lea r8, [rbp + 0x27]
mov qword [rbp + 0x2f], rsi
mov edx, 0x12019f
mov dword [rbp + 0x3f], 0x40
lea rcx, [rbp + 0x77]
mov qword [rbp + 0x77], rsi
movdqu xmmword [rbp + 0x47], xmm0
mov dword [rsp + 0x20], 3
call qword [sym.imp.ntdll.dll_NtOpenFile]
mov rcx, qword [rbp + 0x77]
mov qword [0x1803a32e0], rcx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
jbe 0x180033d29
mov eax, 1
jmp 0x180033d9b
mov dword [rsp + 0x48], esi
lea rax, [0x1803a32c8]
mov qword [rsp + 0x40], rsi
lea r10, [0x18019e3d8]
mov dword [rsp + 0x38], 0x50
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], 0x221998
xor edx, edx
mov qword [rsp + 0x20], rax
mov dword [rbx + 0x44], edi
call r10
mov ebx, eax
cmp edi, 0x666
jne 0x180033d99
test eax, eax
je 0x180033d99
cmp eax, 0x25
je 0x180033d99
mov rcx, qword [0x1803a32e0]
lea rdx, [rcx - 1]
cmp rdx, 0xfffffffffffffffd
ja 0x180033d99
call qword [sym.imp.ntdll.dll_NtClose]
mov qword [0x1803a32e0], rsi
mov eax, ebx
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
push rbx
sub rsp, 0xc0
mov r8d, dword [0x1803a32dc]
mov rbx, rdx
mov dword [rdx + 0x44], ecx
sub r8d, 1
je 0x180033ffa
sub r8d, 1
je 0x180033fed
sub r8d, 1
je 0x180033fed
cmp r8d, 1
je 0x180033e08
mov eax, 0x2f9cb3ce
add rsp, 0xc0
pop rbx
ret
mov qword [rsp + 0xb8], rbp
xor ebp, ebp
mov qword [rsp + 0xb0], rsi
mov dword [rdx + 0x4c], 0x458
mov rsi, qword gs:[0x50]
mov qword [rsp + 0xa8], rdi
mov edi, dword [0x1803a32c0]
mov qword gs:[0x50], rbx
cmp byte [0x1803a3a70], bpl
jne 0x180033e80
xor ecx, ecx
mov byte [0x1803a3a70], 1
mov dword [rsp + 0xd0], ebp
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edx, 4
lea r9, [rsp + 0xd0]
mov r8d, edx
mov qword [0x1803a3a60], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [0x1803a3a60]
mov word [rax], 0x4855
lea eax, [rdi - 1]
mov rdi, qword [rsp + 0xa8]
cmp eax, 6
ja case.default.0x180033eb3
lea rdx, [0x180000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0x34008]
add rcx, rdx
jmp rcx
call fcn.180032b30
jmp case.default.0x180033eb3
lea rdx, [0x180140230]
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rsp + 0xe8]
mov dword [rsp + 0xd8], ebp
mov r9d, 0x25
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0xd8]
xor edx, edx
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntdll.dll_NtQueryLicenseValue]
jmp case.default.0x180033eb3
mov qword [rsp + 0x48], rbp
lea r8, [rsp + 0x68]
mov qword [rsp + 0x40], rbp
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x38], ebp
xorps xmm0, xmm0
mov dword [rsp + 0x30], ebp
xor r9d, r9d
mov dword [rsp + 0x28], ebp
mov edx, 0xffffffff
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x68], 0x30
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rbp
movdqu xmmword [rsp + 0x88], xmm0
call qword [sym.imp.ntdll.dll_NtCreateTransaction]
jmp case.default.0x180033eb3
call fcn.1800330b0
jmp case.default.0x180033eb3
call fcn.180032e00
jmp case.default.0x180033eb3
call fcn.180033340
jmp case.default.0x180033eb3
call fcn.1800335c0
mov qword gs:[0x50], rsi
cmp byte [0x1803a3a70], bpl
mov rsi, qword [rsp + 0xb0]
jne 0x180033fcd
xor ecx, ecx
mov byte [0x1803a3a70], 1
mov dword [rsp + 0xe0], ebp
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edx, 4
lea r9, [rsp + 0xe0]
mov r8d, edx
mov qword [0x1803a3a60], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [0x1803a3a60]
mov rbp, qword [rsp + 0xb8]
mov word [rax], 0x5a4d
mov eax, dword [rbx + 0x4c]
add rsp, 0xc0
pop rbx
ret
add rsp, 0xc0
pop rbx
jmp 0x180033860
add rsp, 0xc0
pop rbx
jmp 0x180033b10