Function at 0x18001b47c
Capabilities:
Encode data using xor
Get hostname
Get session user name

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rbx, rcx
mov ecx, 0x500
call fcn.180015fec
mov edx, pe_nt_image_headers64
mov rcx, rax
mov r12, rax
call fcn.1800161e8
mov edx, pe_nt_image_headers64
mov rcx, r12
mov rsi, rax
call fcn.1800161e8
mov edx, pe_nt_image_headers64
mov rcx, r12
mov r15, rax
call fcn.1800161e8
mov edi, 0x80
mov rcx, r12
mov edx, edi
mov r14, rax
call fcn.1800161e8
mov edx, edi
mov rcx, r12
call fcn.1800161e8
mov qword [0x180051cf8], rbx
mov ebx, pe_nt_image_headers64
xor r13d, r13d
mov edx, ebx
mov rcx, r12
mov edi, r13d
call fcn.1800161e8
mov r8d, ebx
mov rcx, rax
xor edx, edx
mov qword [0x180051d08], rax
call fcn.18001f530
call fcn.18001b288
mov ebx, 0x800
mov ecx, ebx
call fcn.18001f284
mov r8d, ebx
xor edx, edx
mov rcx, rax
mov qword [0x180051d00], rax
call fcn.18001f530
mov rcx, qword [0x180051d00]
lea eax, [r13 + 1]
mov r9d, eax
mov r8d, eax
mov edx, ebx
mov qword [rsp + 0x20], r13
call fcn.18001eaa8
lea ecx, [r13 + 8]
call fcn.18001b268
mov ebx, eax
test ax, ax
je 0x18001b5c5
xor ecx, ecx
call fcn.18000f014
mov ecx, eax
call sub.WS2_32.dll_htonl
lea ecx, [r13 + 1]
mov dword [rbp + 0x48], eax
cmp bx, cx
jne 0x18001b58f
and eax, 0xff000000
jmp 0x18001b5a7
cmp bx, 2
jne 0x18001b59c
and eax, 0xffff0000
jmp 0x18001b5a7
cmp bx, 3
jne 0x18001b5aa
and eax, 0xffffff00
mov dword [rbp + 0x48], eax
lea r8, [rbp + 0x48]
lea rcx, str.._._._.._._._1
mov r9d, 4
mov edx, 0x1800
call fcn.18001b3b8
mov ecx, 7
call fcn.18001b278
movzx ebx, ax
test ax, ax
je 0x18001b5ff
lea r8, [rbp + 0x40]
mov rdx, r14
mov ecx, 6
mov dword [rbp + 0x40], pe_nt_image_headers64
call qword [sym.imp.KERNEL32.dll_GetComputerNameExA]
mov r8d, dword [rbp + 0x40]
movzx edx, bx
mov rcx, r14
call fcn.18001baa8
mov ecx, 6
call fcn.18001b278
movzx ebx, ax
test ax, ax
je 0x18001b634
lea rdx, [rbp + 0x40]
mov rcx, rsi
mov dword [rbp + 0x40], pe_nt_image_headers64
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov r8d, dword [rbp + 0x40]
movzx edx, bx
mov rcx, rsi
call fcn.18001baa8
mov ecx, 5
call fcn.18001b278
movzx ebx, ax
test ax, ax
je 0x18001b678
lea rdx, [rbp + 0x40]
mov rcx, r15
mov dword [rbp + 0x40], pe_nt_image_headers64
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov r8d, dword [rbp + 0x40]
mov r14d, 1
sub r8d, r14d
movzx edx, bx
mov rcx, r15
mov dword [rbp + 0x40], r8d
call fcn.18001baa8
jmp 0x18001b67e
mov r14d, 1
mov rax, r13
lea r15, str.._._._.._._._1
mov esi, 0x1800
xor byte [rax + r15], 0x2e
add rax, r14
cmp rax, rsi
jl 0x18001b68d
mov ecx, 9
call fcn.18001b268
mov ebx, eax
test eax, eax
je 0x18001b6fa
mov r8d, r13d
mov r9, r15
mov eax, 0x55555556
imul r8d
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea eax, [rdx + rdx*2]
mov edx, r8d
add r8d, r14d
sub edx, eax
movsx eax, byte [r9]
add r9, r14
add edx, r14d
movzx ecx, al
mov eax, 0xabcc772f
imul edx, ecx
add edx, edi
mov edi, edx
mul edx
shr edx, 0x1a
imul edx, edx, 0x5f5e0ff
sub edi, edx
cmp r8d, esi
jl 0x18001b6b0
sub ebx, r14d
jmp 0x18001b6fd
mov ebx, r13d
lea rcx, [rbp - 0x20]
mov r8d, esi
mov rdx, r15
call fcn.180016104
cmp ebx, edi
jne 0x18001b807
lea rcx, [rbp - 0x20]
call fcn.18001624c
movzx edi, ax
test ax, ax
jle 0x18001b807
lea rcx, [rbp - 0x20]
call fcn.18001624c
lea rcx, [rbp - 0x20]
movsx ebx, ax
call fcn.18001624c
mov rcx, qword [0x180051d00]
movsx rdi, di
mov edx, ebx
movzx esi, ax
shl rdi, 4
mov word [rdi + rcx], bx
dec edx
je 0x18001b7d8
dec edx
je 0x18001b7c2
dec edx
jne 0x18001b7ed
movsx rbx, ax
mov rcx, rbx
call fcn.18001f284
mov r8, qword [0x180051d00]
lea rcx, [rbp - 0x20]
movsx edx, si
mov qword [rdi + r8 + 8], rax
call fcn.1800161e8
mov rcx, qword [0x180051d00]
mov r8, rbx
mov rcx, qword [rdi + rcx + 8]
mov rdx, rax
call fcn.18001f920
mov rcx, qword [0x180051d00]
mov r9d, r14d
mov rcx, qword [rdi + rcx + 8]
mov r8d, r14d
mov rdx, rbx
mov qword [rsp + 0x20], r13
call fcn.18001eaa8
jmp 0x18001b7ed
lea rcx, [rbp - 0x20]
call fcn.180016114
mov rcx, qword [0x180051d00]
mov dword [rdi + rcx + 8], eax
jmp 0x18001b7ed
lea rcx, [rbp - 0x20]
call fcn.18001624c
mov rcx, qword [0x180051d00]
mov word [rdi + rcx + 8], ax
lea rcx, [rbp - 0x20]
call fcn.18001624c
movzx edi, ax
test ax, ax
jg 0x18001b729
mov esi, 0x1800
mov rcx, r12
call fcn.1800160e0
mov r8, rsi
xor edx, edx
mov rcx, r15
call fcn.18001f530
mov ecx, reloc.WS2_32.dll_recvfrom
call fcn.18001b434
mov ecx, eax
call fcn.18001c680
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret