Function at 0x1801687e0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x420
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1802d1460]
xor rax, rsp
mov qword [rsp + 0x410], rax
mov r12, rdx
mov rsi, rcx
mov qword [rsp + 0x60], rdx
xor r13d, r13d
mov dword [rsp + 0x3c], r13d
mov qword [rdx + 0x10], r13
mov qword [rdx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdx], r13b
xor r8d, r8d
lea rdx, [0x18024c328]
mov rcx, r12
call fcn.180114020
mov dword [rsp + 0x3c], 1
mov qword [rsp + 0x30], r13
lea rcx, [rsp + 0xd8]
call fcn.18012c2f0
nop
lea r8d, [r13 + 0xa]
lea rdx, str.alidcp.dll
lea rcx, [rsp + 0xd8]
call fcn.1801144b0
lea rbx, [rsp + 0xd8]
cmp qword [rsp + 0xf0], 8
cmovae rbx, qword [rsp + 0xd8]
lea edi, [r13 + 1]
mov qword [rsp + 0x30], r13
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsi], rax
test rax, rax
jne 0x1801688c4
mov edx, edi
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoLoadLibrary]
mov qword [rsi], rax
test rax, rax
je 0x18016891e
lea rdx, str.DllGetClassObject
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18016891e
mov qword [rsp + 0x50], r13
lea r8, [rsp + 0x50]
lea rdx, reloc.WS2_32.dll_accept
lea rcx, [0x18024a848]
call rax
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x18016891e
mov rax, qword [rcx]
lea r9, [rsp + 0x30]
lea r8, [0x18024a838]
xor edx, edx
call qword [rax + Ordinal_26]
mov edi, eax
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
cmp qword [rsp + 0x30], 0
je 0x1801690e2
test edi, edi
jne 0x1801690e2
xor ecx, ecx
call fcn.1801d0780
mov rcx, rax
call fcn.1801d7fc0
call fcn.1801d7f94
movd xmm2, eax
cvtdq2pd xmm2, xmm2
divsd xmm2, qword [0x18026b2b0]
mov ecx, 0x5f5e0ff
xorps xmm0, xmm0
cvtsi2sd xmm0, rcx
mulsd xmm2, xmm0
mov eax, 0x989680
xorps xmm1, xmm1
cvtsi2sd xmm1, rax
addsd xmm2, xmm1
cvttsd2si rbx, xmm2
cmp rbx, rcx
jle 0x1801689a0
movabs rax, 0x6666666666666667
imul rbx
mov rbx, rdx
sar rbx, 2
mov rax, rbx
shr rax, 0x3f
add rbx, rax
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x300]
call fcn.1801c9e80
mov r9, rbx
lea r8, str._I64d
mov edx, 0x104
lea rcx, [rsp + 0x300]
call fcn.180132be0
movdqa xmm0, xmmword [0x18026b310]
movdqu xmmword [rsp + 0x1a8], xmm0
mov byte [rsp + 0x198], 0
lea rax, [rsp + 0x300]
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180168a00
lea rdx, [rsp + 0x300]
lea rcx, [rsp + 0x198]
call fcn.18011d640
mov rdx, rax
lea rcx, [rsp + 0x98]
call fcn.18011d1d0
mov dword [rsp + 0x3c], 3
lea rcx, [rsp + 0x198]
call fcn.180114430
nop
cmp qword [rsp + 0xa8], 8
jne 0x1801690d4
mov qword [rsp + 0xc8], r13
mov qword [rsp + 0xd0], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0xb8], 0
mov r8d, reloc.WS2_32.dll_recv
lea rdx, str.alipayUMIDwuguan
lea rcx, [rsp + 0xb8]
call fcn.180114020
nop
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x78]
call fcn.18011d1d0
mov r10, qword [rsp + 0xa8]
mov rax, r13
mov r9, r13
test r10, r10
je 0x180168b31
mov r11, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0xc8]
mov rsi, qword [rsp + 0xb8]
nop dword [rax]
mov r8, r13
cmp rax, rbx
cmovne r8, rax
lea rax, [rsp + 0x98]
cmp qword [rsp + 0xb0], 0x10
cmovae rax, qword [rsp + 0x98]
lea rdx, [rsp + 0xb8]
cmp r11, 0x10
cmovae rdx, rsi
lea rcx, [rsp + 0x78]
cmp qword [rsp + 0x90], 0x10
cmovae rcx, qword [rsp + 0x78]
movzx eax, byte [rax + r9]
xor al, byte [rdx + r8]
mov byte [rcx + r9], al
inc r9
lea rax, [r8 + 1]
cmp r9, r10
jb 0x180168ad0
mov dword [rsp + 0x40], r13d
movdqa xmm0, xmmword [0x18026b310]
movdqu xmmword [rsp + 0x168], xmm0
mov byte [rsp + 0x158], 0
lea rsi, [rsp + 0x158]
mov dword [rsp + 0x3c], reloc.WS2_32.dll_ntohs
mov ebx, r13d
nop dword [rax]
nop word [rax + rax]
mov ecx, ebx
cmp rcx, qword [rsp + 0x88]
jae 0x180168c28
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x90], 0x10
cmovae rax, qword [rsp + 0x78]
movzx r9d, byte [rax + rcx]
lea r8, [0x18025bf8c]
mov edx, 3
lea rcx, [rsp + 0x40]
call fcn.180132be0
mov qword [rsp + 0x148], r13
mov qword [rsp + 0x150], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x138], 0
mov r8d, 2
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x138]
call fcn.180114020
nop
lea rdx, [rsp + 0x138]
cmp qword [rsp + 0x150], 0x10
cmovae rdx, qword [rsp + 0x138]
mov r8, qword [rsp + 0x148]
lea rcx, [rsp + 0x158]
call fcn.18011d640
nop
lea rcx, [rsp + 0x138]
call fcn.180114430
inc ebx
jmp 0x180168b70
lea rcx, [rsp + 0x78]
call fcn.180114430
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rsp + 0x88], xmm1
movdqa xmm0, xmmword [0x18026b310]
movdqu xmmword [rsp + 0x168], xmm0
mov byte [rsp + 0x158], 0
mov dword [rsp + 0x3c], 7
lea rcx, [rsp + 0x158]
call fcn.180114430
lea rdx, [rsp + 0x78]
cmp qword [rsp + 0x90], 0x10
cmovae rdx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x88]
lea rcx, [rsp + 0x98]
call fcn.18011d640
mov qword [rsp + 0x58], r13
mov rsi, qword [rsp + 0x30]
mov ecx, Ordinal_27
call fcn.1801c7c04
mov rbx, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x180168cce
mov qword [rax + 8], r13
mov dword [rax + 0x10], 1
mov qword [rax], r13
jmp 0x180168cd1
mov rbx, r13
mov qword [rsp + 0x58], rbx
test rbx, rbx
je 0x180169138
mov rax, qword [rsi]
mov rdx, rbx
mov rcx, rsi
call qword [rax + 0x40]
test eax, eax
js 0x180169080
mov rdx, qword [rbx]
lea rax, [rsp + 0x1c8]
mov qword [rsp + 0x1c0], rax
lea rcx, [rsp + 0x1c0]
call fcn.1801691c0
nop
movdqa xmm0, xmmword [0x18026b310]
movdqu xmmword [rsp + 0x128], xmm0
mov byte [rsp + 0x118], 0
mov rdx, qword [rsp + 0x1c0]
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x180168d40
lea rcx, [rsp + 0x118]
call fcn.180114020
movdqa xmm0, xmmword [0x18026b310]
movdqu xmmword [rsp + 0x108], xmm0
mov byte [rsp + 0xf8], 0
mov r8d, 7
lea rdx, str.2.0.0.1
lea rcx, [rsp + 0xf8]
call fcn.180114020
nop
xor eax, eax
mov qword [rsp + 0x2e0], rax
mov qword [rsp + 0x2e8], rax
mov qword [rsp + 0x2f0], rax
mov qword [rsp + 0x2f8], rax
lea rcx, [rsp + 0x118]
cmp qword [rsp + 0x130], 0x10
cmovae rcx, qword [rsp + 0x118]
lea rax, [rsp + 0x2ec]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2e8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2e4]
lea r8, [rsp + 0x2e0]
lea rdx, [0x18025bf80]
call fcn.18013e5a0
lea rcx, [rsp + 0xf8]
cmp qword [rsp + 0x110], 0x10
cmovae rcx, qword [rsp + 0xf8]
lea rax, [rsp + 0x2fc]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2f8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2f4]
lea r8, [rsp + 0x2f0]
lea rdx, [0x18025bf80]
call fcn.18013e5a0
mov rax, r13
mov ecx, dword [rsp + rax + 0x2e0]
sub ecx, dword [rsp + rax + 0x2f0]
jne 0x180168e6c
add rax, 4
cmp rax, 0x10
jl 0x180168e50
jmp 0x180168e74
test ecx, ecx
js 0x180169049
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x178]
call fcn.1801be140
nop
mov r15, qword [rsp + 0x30]
lea r14, [rsp + 0x178]
cmp qword [rsp + 0x190], 8
cmovae r14, qword [rsp + 0x178]
mov ecx, Ordinal_27
call fcn.1801c7c04
mov rsi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x180168ee7
mov qword [rax + 8], r13
mov dword [rax + 0x10], 1
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsi], rax
test rax, rax
jne 0x180168eea
test r14, r14
jne 0x180169143
jmp 0x180168eea
mov rsi, r13
mov qword [rsp + 0x70], rsi
test rsi, rsi
je 0x18016914e
mov rax, qword [r15]
mov rdx, qword [rsi]
mov rcx, r15
call qword [rax + 0x48]
mov r14d, eax
mov ecx, edi
lock xadd dword [rsi + 0x10], ecx
cmp ecx, 1
jne 0x180168f43
mov rcx, qword [rsi]
test rcx, rcx
je 0x180168f24
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi], r13
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x180168f36
call fcn.1801c74d4
mov qword [rsi + 8], r13
mov edx, Ordinal_27
mov rcx, rsi
call fcn.1801c74d4
test r14d, r14d
js 0x18016903b
mov qword [rsp + 0x48], r13
mov r14, qword [rsp + 0x30]
mov ecx, Ordinal_27
call fcn.1801c7c04
mov rsi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x180168f7d
mov qword [rax + 8], r13
mov dword [rax + 0x10], 1
mov qword [rax], r13
jmp 0x180168f80
mov rsi, r13
mov qword [rsp + 0x48], rsi
test rsi, rsi
je 0x180169159
mov rax, qword [r14]
mov rdx, rsi
mov rcx, r14
call qword [rax + gethostname]
test eax, eax
js 0x180168ffe
mov rdx, qword [rsi]
lea rax, [rsp + 0x258]
mov qword [rsp + 0x250], rax
lea rcx, [rsp + 0x250]
call fcn.1801691c0
nop
mov rdx, qword [rsp + 0x250]
mov r8, rdi
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x180168fd0
mov rcx, r12
call fcn.180114020
nop
lea rax, [rsp + 0x258]
mov rcx, qword [rsp + 0x250]
cmp rcx, rax
je 0x180168ffe
call fcn.1801cc408
nop
mov eax, edi
lock xadd dword [rsi + 0x10], eax
cmp eax, 1
jne 0x18016903b
mov rcx, qword [rsi]
test rcx, rcx
je 0x18016901b
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi], r13
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x18016902d
call fcn.1801c74d4
mov qword [rsi + 8], r13
mov edx, Ordinal_27
mov rcx, rsi
call fcn.1801c74d4
nop
lea rcx, [rsp + 0x178]
call fcn.180114210
nop
lea rcx, [rsp + 0xf8]
call fcn.180114430
nop
lea rcx, [rsp + 0x118]
call fcn.180114430
nop
lea rax, [rsp + 0x1c8]
mov rcx, qword [rsp + 0x1c0]
cmp rcx, rax
je 0x180169080
call fcn.1801cc408
nop
lock xadd dword [rbx + 0x10], edi
cmp edi, 1
jne 0x1801690bb
mov rcx, qword [rbx]
test rcx, rcx
je 0x18016909b
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r13
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1801690ad
call fcn.1801c74d4
mov qword [rbx + 8], r13
mov edx, Ordinal_27
mov rcx, rbx
call fcn.1801c74d4
nop
lea rcx, [rsp + 0x78]
call fcn.180114430
nop
lea rcx, [rsp + 0xb8]
call fcn.180114430
nop
lea rcx, [rsp + 0x98]
call fcn.180114430
nop
lea rcx, [rsp + 0xd8]
call fcn.180114210
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x180169101
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
nop
jmp 0x180169108
mov rax, r12
mov rcx, qword [rsp + 0x410]
xor rcx, rsp
call fcn.1801c74b0
lea r11, [rsp + 0x420]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, 0x8007000e
call fcn.1801c8ac0
nop
mov ecx, 0x8007000e
call fcn.1801c8ac0
nop
mov ecx, 0x8007000e
call fcn.1801c8ac0
nop
mov ecx, 0x8007000e
call fcn.1801c8ac0
int3