Function at 0x180083e88
Capabilities:
Check for time delay via gettickcount
Encode data using xor
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x12f8]
mov eax, 0x13c0
call fcn.18009d830
sub rsp, rax
mov r13, r9
mov r12, rcx
lea rcx, [rbp + 0x120]
call fcn.18000ee24
mov r8d, 1
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0x80]
call fcn.18000ee54
mov qword [rbp - 0x50], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x58], 9
movsd xmm0, qword [str.OSMIM_FLS]
movsd qword [rbp - 0x68], xmm0
mov al, byte [0x1800d6360]
mov byte [rbp - 0x60], al
xor r15d, r15d
mov byte [rbp - 0x5f], r15b
lea r9, [rbp + 0x80]
mov r8d, 0x80000
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0xa0]
call fcn.180016438
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x180083f6b
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180083f66
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180084899
call fcn.18009d1f4
mov qword [rbp + 0x48], r15
mov qword [rbp + 0x58], r15
mov qword [rbp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x48], r15b
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], r15b
mov ebx, 0x105
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0x1b0]
call fcn.1800a02d0
mov r8d, ebx
lea rdx, [rbp + 0x1b0]
mov rcx, qword [0x18010ad98]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x180083fd0
mov sil, r15b
jmp 0x18008481d
lea rax, [rbp + 0x1b0]
or rdi, 0xffffffffffffffff
mov rsi, rdi
inc rsi
cmp byte [rax + rsi], r15b
jne 0x180083fde
cmp rsi, qword [rsp + 0x60]
ja 0x18008401c
lea rbx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rbx, qword [rsp + 0x48]
mov qword [rsp + 0x58], rsi
mov r8, rsi
lea rdx, [rbp + 0x1b0]
mov rcx, rbx
call fcn.18009fc20
mov byte [rbx + rsi], r15b
jmp 0x180084033
lea r9, [rbp + 0x1b0]
mov r8b, r15b
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.180003a38
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x1800840f1
dec rax
mov r8, rdi
cmp rax, rdi
cmovb r8, rax
add r8, rcx
jmp 0x180084070
cmp r8, rcx
je 0x1800840f1
dec r8
cmp byte [r8], 0x5c
jne 0x180084064
sub r8, rcx
cmp r8, rdi
je 0x1800840f1
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x28], r15
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
inc r8
mov r9, rdi
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x38]
call fcn.18000764c
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x1800840df
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800840da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008489f
call fcn.18009d1f4
movups xmm0, xmmword [rbp - 0x38]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rbp - 0x28]
movups xmmword [rsp + 0x58], xmm1
lea rdx, [0x1800ea54c]
lea rcx, [rbp + 0x1b0]
call fcn.1800afe20
mov r14, rax
movabs rbx, 0xd993efbb19cfe32d
test rax, rax
je 0x1800842d8
xor edx, edx
lea r8d, [rdx + 0x58]
lea rcx, [rbp + 0x150]
call fcn.1800a02d0
lea rdx, [rbp + 0x150]
lea rcx, [rsp + 0x40]
call fcn.18000fdd8
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r12d, eax
mov dword [rsp + 0x68], r15d
or dword [rsp + 0x6c], 0xffffffff
lea r8, [0x1801025d0]
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae r8, qword [0x1801025d0]
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rdx, qword [rsp + 0x48]
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea rcx, [rbp + 0xa0]
call fcn.180017428
mov edx, dword [rsp + 0x68]
shl edx, 0xc
xor r8d, r8d
mov rcx, r14
call fcn.1800b03a4
xor ebx, ebx
cmp byte [0x18010a5dc], bl
jne 0x1800841c3
cmp byte [0x18010a5dd], bl
je 0x180084280
cmp byte [0x18010a364], bl
je 0x180084280
lea rcx, [rsp + 0x41]
call fcn.18007ed78
mov rsi, rax
cmp byte [rax + 0x65], bl
je 0x18008420d
mov r9, rbx
movabs rax, 0xd993efbb19cfe32d
mov cl, r9b
and cl, 7
shl cl, 3
mov r8, rax
shr r8, cl
xor byte [r9 + rsi], r8b
inc r9
cmp r9, 0x65
jb 0x1800841ee
mov byte [rsi + 0x65], bl
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
sub ebx, r12d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
mov dword [rsp + 0x28], ebx
mov eax, dword [rsp + 0x6c]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x68]
mov rdx, rsi
mov ecx, 4
call fcn.18006a848
jmp 0x180084280
cmp r15d, dword [rsp + 0x6c]
jae 0x18008428c
mov r9, r14
mov edx, 1
mov r8d, 0x1000
lea rcx, [rbp + 0x2c0]
call fcn.1800b008c
mov r9d, eax
lea r8, [rbp + 0x2c0]
lea rdx, [rbp + 0x150]
lea rcx, [rsp + 0x40]
call fcn.18000fdfc
inc r15d
mov rcx, r14
call fcn.1800afd38
test eax, eax
je 0x180084241
lea r8, [rbp + 0x150]
lea rdx, [rbp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.18000fee0
lea r9, [0x18010b0a0]
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.18000fff0
mov rcx, r14
call fcn.1800afca0
mov r12, qword [rbp + 0x1300]
xor r15d, r15d
movabs rbx, 0xd993efbb19cfe32d
cmp byte [0x18010a5dc], r15b
jne 0x1800842ea
cmp byte [0x18010a5dd], r15b
je 0x180084358
cmp byte [0x18010a364], r15b
je 0x180084358
lea rcx, [rsp + 0x41]
call fcn.18007f62c
mov rsi, rax
cmp byte [rax + 0x42], r15b
je 0x180084329
mov r9, r15
mov cl, r9b
and cl, 7
shl cl, 3
mov r8, rbx
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x42
jb 0x180084309
mov byte [rax + 0x42], r15b
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
sub ebx, dword [0x18010aee4]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
mov dword [rsp + 0x20], ebx
lea r9, [0x18010b0a0]
mov rdx, rsi
mov ecx, 4
call fcn.18006a848
mov r15, qword [rbp + 0x1320]
mov byte [r15], 1
lea rcx, [rsp + 0x78]
call fcn.180019474
nop
lea rcx, [rbp - 0x78]
call fcn.180019474
nop
lea r9, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae r9, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
mov rax, qword [reloc.WS2_32.dll_ntohs]
cmp rsi, rax
ja 0x1800843c8
lea rbx, [0x180102b50]
cmp rax, 0x10
cmovae rbx, qword [0x180102b50]
mov qword [0x180102b60], rsi
mov r8, rsi
mov rdx, r9
mov rcx, rbx
call fcn.18009fc20
mov byte [rbx + rsi], 0
jmp 0x1800843da
xor r8d, r8d
mov rdx, rsi
lea rcx, [0x180102b50]
call fcn.180003a38
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x28], rax
mov r14, qword [rbp + 0x1330]
mov qword [rsp + 0x20], r14
mov rsi, qword [rbp + 0x1328]
mov r9, rsi
mov r8, r13
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x78]
call fcn.180082718
xor r13d, r13d
test al, al
jne 0x1800845ac
lea r8, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae r8, qword [rsp + 0x48]
mov dword [rsp + 0x28], r13d
lea rax, str.ssl_SecureSend
mov qword [rsp + 0x20], rax
lea r9, [0x18010b0a0]
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0xa0]
call fcn.1800169e8
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.18007c380
mov rbx, qword [rbp - 0x10]
test rbx, rbx
je 0x18008449b
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x18008449b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x18008449b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
lea r8, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae r8, qword [rsp + 0x48]
mov dword [rsp + 0x28], r13d
lea rax, str.ssl_SecureRecv
mov qword [rsp + 0x20], rax
lea r9, [0x18010b0a0]
lea rdx, [rbp - 8]
lea rcx, [rbp + 0xa0]
call fcn.1800169e8
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.18007c380
mov rbx, qword [rbp]
test rbx, rbx
je 0x180084513
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x180084513
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x180084513
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
mov byte [r15], r13b
mov r13d, reloc.WS2_32.dll_ntohl
cmp qword [rsi + 0x18], r13
jb 0x18008454e
mov rbx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x18008452f
mov rbx, qword [rsi]
mov qword [rsi + 0x10], r13
mov r8, r13
lea rdx, str.ssl_SecureSend
mov rcx, rbx
call fcn.18009fc20
xor r15d, r15d
mov byte [rbx + 0xe], r15b
jmp 0x180084566
lea r9, str.ssl_SecureSend
xor r15d, r15d
mov r8b, r15b
mov rdx, r13
mov rcx, rsi
call fcn.180003a38
cmp qword [r14 + 0x18], r13
jb 0x180084595
mov rbx, r14
cmp qword [r14 + 0x18], 0x10
jb 0x180084579
mov rbx, qword [r14]
mov qword [r14 + 0x10], r13
mov r8, r13
lea rdx, str.ssl_SecureRecv
mov rcx, rbx
call fcn.18009fc20
mov byte [rbx + 0xe], r15b
jmp 0x1800845af
lea r9, str.ssl_SecureRecv
mov r8b, r15b
mov rdx, r13
mov rcx, r14
call fcn.180003a38
jmp 0x1800845af
xor r15d, r15d
lea rdx, [rbp + 8]
lea rcx, [rsp + 0x78]
call fcn.180019634
mov rcx, qword [rax]
mov eax, dword [rcx + 0x251]
mov dword [r12], eax
mov rbx, qword [rbp + 0x10]
test rbx, rbx
je 0x1800845fd
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1800845fd
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x1800845fd
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
lea rdx, [rbp + 0x18]
lea rcx, [rbp - 0x78]
call fcn.180019634
mov rcx, qword [rax]
mov eax, dword [rcx + 0x251]
mov rsi, qword [rbp + 0x1308]
mov dword [rsi], eax
mov rbx, qword [rbp + 0x20]
test rbx, rbx
je 0x18008464f
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x18008464f
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x18008464f
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
lea r8, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae r8, qword [rsp + 0x48]
mov dword [rsp + 0x28], r15d
lea rax, str.SSL_SetNextProtoCallback
mov qword [rsp + 0x20], rax
lea r9, [0x18010b0a0]
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0xa0]
call fcn.1800169e8
nop
lea rdx, [rbp + 0x28]
lea rcx, [rbp - 0x48]
call fcn.180019634
mov rcx, qword [rax]
mov eax, dword [rcx + 0x251]
mov rcx, qword [rbp + 0x1310]
mov dword [rcx], eax
mov rbx, qword [rbp + 0x30]
test rbx, rbx
je 0x1800846db
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1800846db
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x1800846db
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
cmp dword [r12], r15d
je 0x180084780
cmp dword [rsi], r15d
je 0x180084780
call fcn.18000ce3c
test al, al
je 0x18008477b
cmp dword [0x18010aec0], r15d
jne 0x18008477b
mov dword [rsp + 0x70], r15d
lea rdx, [rbp + 0x38]
lea rcx, [rsp + 0x78]
call fcn.180019634
mov rcx, qword [rax]
add rcx, 0x10c
lea r8, [rsp + 0x70]
lea rdx, [0x1800d6b7c]
call fcn.18005f2c8
mov rbx, qword [rbp + 0x40]
test rbx, rbx
je 0x180084765
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x180084765
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x180084765
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
movzx eax, byte [0x180102acc]
cmp dword [rsp + 0x70], 0x3f
cmovl eax, r15d
mov byte [0x180102acc], al
mov sil, 1
jmp 0x180084783
mov sil, r15b
mov rbx, qword [rbp - 0x40]
test rbx, rbx
je 0x1800847b7
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1800847b7
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x1800847b7
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov rbx, qword [rbp - 0x70]
test rbx, rbx
je 0x1800847eb
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1800847eb
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x1800847eb
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov rbx, qword [rbp - 0x80]
test rbx, rbx
je 0x18008481d
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x18008481d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x18008481d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x180084856
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180084851
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180084893
call fcn.18009d1f4
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], r15b
lea rcx, [rbp + 0xa0]
call fcn.18006d8cc
mov al, sil
mov rbx, qword [rsp + 0x1418]
add rsp, 0x13c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1800a45b8
nop
call fcn.1800a45b8
nop
call fcn.1800a45b8
int3