Function at 0x1801afdf0
Capabilities:
Encode data using xor
Get hostname
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
push rbp
push rbx
push rsi
push rdi
lea rbp, [r11 - 0x28]
sub rsp, 0x108
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rbp - 8], rax
mov qword [r11 + 0x18], r13
xor esi, esi
mov qword [r11 + 0x20], r14
mov r13, rcx
xor r14d, r14d
mov dword [rsp + 0x68], edx
mov ecx, 0xff
mov dword [rsp + 0x64], r14d
mov dword [rsp + 0x40], r14d
call fcn.1801aebd0
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1801b066d
movzx ecx, byte [r13 + 0x11]
movzx eax, byte [r13 + 0x10]
movzx edi, word [r13 + 2]
shl ecx, 8
and edi, 1
add ecx, eax
mov dword [rsp + 0x54], ecx
mov ecx, 0xa8
call fcn.1801aebd0
mov r14, rax
test rax, rax
je 0x1801b066d
lea r8, [rsp + 0x64]
lea edx, [rsi + 0x20]
lea ecx, [rsi + 1]
call fcn.1801aed50
mov rcx, r14
cmp dword [rsp + 0x64], esi
jne 0x1801afea4
call fcn.18010fae0
mov rcx, qword [rsp + 0x48]
call fcn.18010fae0
jmp 0x1801b06b9
mov qword [0x18029cd18], rax
xor edx, edx
mov qword [rsp + 0x138], r12
mov r8d, 0xa8
mov qword [rsp + 0x100], r15
mov dword [rax], 4
mov qword [rax + 0x18], r14
call fcn.18020be10
mov r15, 0xffffffffffffffff
mov rcx, r13
mov qword [r14 + 0x28], r15
mov dword [0x18029ccf4], 4
movzx eax, word [r13 + 0x30]
mov dword [r14 + 0x40], eax
mov rdx, qword [r13 + 0x28]
call fcn.1801b5010
mov rdx, qword [r13 + 0x18]
mov rcx, r13
mov rsi, rax
mov qword [rsp + 0x58], rax
call fcn.1801b5010
mov rbx, rax
test rsi, rsi
jne 0x1801affe5
test rax, rax
je 0x1801b065d
mov ecx, 0x105
call fcn.1801aebd0
mov qword [rsp + 0x58], rax
mov rsi, rax
test rax, rax
je 0x1801b065d
mov r8d, edi
mov dword [rsp + 0x40], 1
mov edx, 0x200
mov rcx, rbx
call fcn.1801b4da0
mov dword [rsp + 0x50], eax
test eax, eax
je 0x1801b065d
test edi, edi
je 0x1801affbf
mov ecx, eax
call fcn.1801aebd0
mov r12, rax
test rax, rax
je 0x1801b065d
mov edx, dword [rsp + 0x50]
mov r9d, edi
mov r8, rbx
mov rcx, rax
call fcn.1801b4d50
lea rdx, [0x180056640]
mov rcx, rsi
mov rbx, r12
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9d, 0x105
lea ecx, [r15 + 0xb]
mov r8, rsi
mov rdx, r12
call fcn.1801af430
mov rcx, r12
call fcn.18010fae0
jmp 0x1801affe5
lea rdx, [0x180056640]
mov rcx, rsi
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9d, 0x105
mov r8, rsi
mov rdx, rbx
mov ecx, 0xa
call fcn.1801af430
movzx r12d, word [r13 + 0x12]
cmp r12d, 0xfffe
jne 0x1801b0023
test rbx, rbx
je 0x1801b0653
mov rdx, rbx
mov ecx, 8
call fcn.1801af310
test eax, eax
jne 0x1801b001c
mov dword [0x18029ccf4], 0x29
jmp 0x1801b065d
dec ax
movzx r12d, ax
mov ebx, dword [rsp + 0x40]
mov edx, 0x105
xor ebx, 1
mov rcx, rsi
and ebx, edi
mov r8d, ebx
call fcn.1801b4da0
mov edi, eax
test eax, eax
je 0x1801b065d
mov ecx, eax
call fcn.1801aebd0
mov qword [r14 + 0x20], rax
test rax, rax
je 0x1801b065d
mov r9d, ebx
mov r8, rsi
mov edx, edi
mov rcx, rax
call fcn.1801b4d50
cmp dword [rsp + 0x40], 0
je 0x1801b0081
mov rcx, rsi
call fcn.18010fae0
mov dword [rsp + 0x40], 0
mov rdx, qword [r13 + 0x38]
test rdx, rdx
je 0x1801b0653
mov rcx, r13
call fcn.1801b5010
mov rcx, qword [r14 + 0x20]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0
movups xmm0, xmmword [rax]
lea r8d, [r9 + 3]
mov dword [rsp + 0x20], 3
movups xmmword [r14 + 0x88], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [r14 + 0x98], xmm1
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [r14 + 0x28], rax
cmp rax, r15
jne 0x1801b00f4
mov dword [0x18029ccf4], 0x60
jmp 0x1801b065d
mov r9d, 0x40
lea r8, [rbp - 0x80]
mov rcx, r14
lea edx, [r9 - 0x20]
call fcn.1801af970
test eax, eax
je 0x1801b065d
mov rax, qword [rbp - 0x80]
cmp rax, qword [0x18029cd80]
je 0x1801b012e
mov dword [0x18029ccf4], 0x65
jmp 0x1801b065d
movzx eax, byte [rbp - 0x78]
mov byte [r14 + 0x18], al
movzx eax, byte [rbp - 0x77]
mov byte [r14 + 0x19], al
movzx ecx, byte [rbp - 0x73]
movzx eax, byte [rbp - 0x74]
shl ecx, 8
or ecx, eax
mov dword [r14 + 8], ecx
cmp byte [rbp - 0x78], 2
jb 0x1801b0178
movzx eax, byte [rbp - 0x66]
movzx ecx, byte [rbp - 0x65]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbp - 0x67]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbp - 0x68]
shl ecx, 8
or ecx, eax
mov dword [r14 + 0x38], ecx
mov rcx, r14
call fcn.1801af5e0
test eax, eax
je 0x1801b065d
movzx ecx, byte [r14 + 0x18]
movzx eax, byte [r14 + 0x19]
shl ecx, 8
add ecx, eax
cmp ecx, 0x120
je 0x1801b01a7
cmp ecx, 0x200
jne 0x1801b01ad
cmp dword [rsp + 0x54], ecx
jbe 0x1801b01bc
mov dword [0x18029ccf4], 0xd
jmp 0x1801b065d
movzx eax, word [r13 + 0x32]
test ax, ax
je 0x1801b0279
movzx esi, word [r13 + 0x30]
lea rcx, [rsp + 0x70]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [rsp + 0x78]
movzx r8d, word [rsp + 0x76]
movzx edx, word [rsp + 0x72]
imul ecx, eax, 0x3c
movzx eax, word [rsp + 0x7a]
add ecx, eax
movzx eax, word [rsp + 0x7c]
imul ebx, ecx, 0x1e
movzx ecx, word [rsp + 0x70]
shr eax, 1
add ebx, eax
call fcn.1801b6700
imul ecx, eax, 0xa8c0
add ebx, ecx
mov ecx, dword [r14 + 0x4c]
mov r8d, ecx
mov edx, ecx
shr ecx, 9
and r8d, 0x1f
and ecx, 0x7f
shr edx, 5
add ecx, 0x7bc
and edx, 0xf
call fcn.1801b6700
imul edx, eax, 0xa8c0
mov eax, ebx
add edx, dword [r14 + 0x50]
sub eax, edx
mov r8d, edx
sub r8d, ebx
cmp edx, ebx
lea edx, [rsi + rsi]
cmovbe r8d, eax
imul ecx, edi, 0x1e
imul eax, edi, 0x3c
cmp eax, edx
cmovae esi, ecx
cmp r8d, esi
mov rsi, qword [rsp + 0x58]
jbe 0x1801b0279
mov dword [0x18029ccf4], 0x63
jmp 0x1801b065d
movzx eax, byte [rbp - 0x75]
shl ax, 8
movzx ecx, ax
movzx eax, byte [rbp - 0x76]
or ecx, eax
add ecx, 0x20
test dword [rsp + 0x68], 0x100000
mov dword [r14 + 0x64], ecx
je 0x1801b02b5
mov dword [r14], 0xffffffff
mov dword [r14 + 0x68], ecx
mov dword [0x18029ccf4], 0
jmp 0x1801b065d
movzx eax, byte [rbp - 0x75]
mov rcx, r14
mov r9d, dword [r14 + 8]
xor ebx, ebx
mov r8, qword [rsp + 0x48]
xor edi, edi
shl ax, 8
movzx edx, ax
movzx eax, byte [rbp - 0x76]
or edx, eax
add edx, 0x20
call fcn.1801af970
test eax, eax
je 0x1801b065d
mov r8d, dword [r14 + 8]
xor eax, eax
mov rdx, qword [rsp + 0x48]
test r8d, r8d
jle 0x1801b0323
movzx ecx, byte [rdx]
cmp cl, 0xff
jne 0x1801b0312
test r15d, r15d
jns 0x1801b030e
cmp r12d, 0xffff
cmove r15d, eax
inc ebx
jmp 0x1801b0319
cmp cl, 0xfe
je 0x1801b0319
inc edi
inc eax
inc rdx
cmp eax, r8d
jl 0x1801b02f6
lea eax, [rdi + rbx]
cmp eax, dword [r14 + 4]
jbe 0x1801b033b
mov dword [0x18029ccf4], 0x65
jmp 0x1801b065d
cmp r12d, 0xffff
je 0x1801b036c
cmp r12d, r8d
jae 0x1801b036c
mov rcx, qword [rsp + 0x48]
mov eax, r12d
add rcx, rax
movzx eax, byte [rcx]
cmp al, 0xfe
je 0x1801b036c
mov r15d, r12d
cmp al, 0xff
je 0x1801b036c
test byte [r13], 1
je 0x1801b036c
mov byte [rcx], 0xff
cmp r15d, 0xffffffff
je 0x1801b0647
mov rcx, qword [rsp + 0x48]
movsxd rax, r15d
cmp byte [rax + rcx], 0xff
jne 0x1801b0647
movzx eax, r15w
lea r8, [rbp - 0x2c]
mov dword [r14], eax
mov r9d, 0x1c
movzx eax, bx
dec eax
mov dword [r14 + 0xc], eax
movzx eax, byte [rbp - 0x6f]
shl ax, 8
movzx ecx, ax
movzx eax, byte [rbp - 0x70]
or ecx, eax
mov dword [r14 + 0x10], ecx
mov ecx, dword [r14 + 0x64]
add ecx, r15d
mov dword [r14 + 0x68], ecx
movzx eax, byte [rbp - 0x71]
shl ax, 8
movzx edx, ax
movzx eax, byte [rbp - 0x72]
or edx, eax
movzx eax, byte [rbp - 0x6f]
shl ax, 8
movzx ecx, ax
movzx eax, byte [rbp - 0x70]
or ecx, eax
movzx eax, byte [rbp - 0x73]
add edx, ecx
shl ax, 8
movzx ecx, ax
movzx eax, byte [rbp - 0x74]
or ecx, eax
imul edx, r15d
movzx eax, byte [rbp - 0x75]
shl ax, 8
add edx, ecx
movzx ecx, ax
movzx eax, byte [rbp - 0x76]
or ecx, eax
add ecx, 0x20
add edx, ecx
mov dword [r14 + 0x6c], edx
add edx, 0x14
movzx eax, byte [rbp - 0x71]
shl ax, 8
movzx ecx, ax
movzx eax, byte [rbp - 0x72]
or ecx, eax
mov dword [r14 + 0x70], ecx
mov rcx, r14
call fcn.1801af970
test eax, eax
je 0x1801b065d
cmp word [rbp - 0x2c], 0
mov ebx, 0x18
je 0x1801b04ad
movzx ecx, byte [rbp - 0x2c]
lea r8, [rbp - 0x28]
movzx edx, byte [rbp - 0x29]
movzx eax, byte [rbp - 0x2b]
shl dx, 8
shl ax, 8
or ax, cx
movzx ecx, byte [rbp - 0x2a]
or dx, cx
add ax, dx
mov edx, ebx
xor byte [r8], al
lea r8, [r8 + 1]
movzx ecx, ax
add ax, ax
shr cx, 0xf
add cx, ax
movzx eax, cx
add cx, cx
shr ax, 0xf
add ax, cx
sub rdx, 1
jne 0x1801b0472
cmp dword [rbp - 0x14], edx
je 0x1801b04ad
mov dword [0x18029ccf4], 0x65
jmp 0x1801b065d
movzx eax, byte [rbp - 0x27]
lea rdx, [rsp + 0x68]
shl ax, 8
xorps xmm0, xmm0
movzx ecx, ax
xorps xmm1, xmm1
movzx eax, byte [rbp - 0x28]
or ecx, eax
mov qword [rbp - 0x40], 0
inc ecx
mov qword [rbp - 0x38], 0
mov dword [r14 + 0x60], ecx
movzx ecx, word [rbp - 0x64]
movzx eax, word [rbp - 0x62]
mov word [rbp - 0x30], cx
mov word [rbp - 0x2c], cx
lea rcx, [rbp - 0x40]
movdqu xmmword [rbp - 0x28], xmm0
mov word [rbp - 0x2e], ax
movdqu xmmword [rbp - 0x18], xmm1
mov word [rbp - 0x2a], ax
mov dword [rsp + 0x68], reloc.WS2_32.dll_recv
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
movzx eax, byte [r14 + 0x60]
lea r8, [rbp - 0x28]
movzx edx, byte [rbp - 0x63]
movzx ecx, byte [rbp - 0x61]
mov byte [rbp - 0x28], al
mov eax, dword [r14 + 0x60]
shr eax, 8
mov byte [rbp - 0x27], al
movzx eax, byte [rbp - 0x64]
shl dx, 8
or dx, ax
shl cx, 8
movzx eax, byte [rbp - 0x62]
or cx, ax
add dx, cx
nop word [rax + rax]
xor byte [r8], dl
lea r8, [r8 + 1]
movzx eax, dx
add dx, dx
shr ax, 0xf
add ax, dx
movzx edx, ax
add ax, ax
shr dx, 0xf
add dx, ax
sub rbx, 1
jne 0x1801b0550
mov edx, dword [r14 + 0x6c]
lea r9d, [rbx + 0x38]
lea r8, [rbp - 0x40]
mov rcx, r14
call fcn.1801b1b50
test eax, eax
je 0x1801b065d
movzx eax, byte [r14 + 0x5c]
lea r9d, [rbx + 1]
mov edx, dword [r14 + 0x68]
lea r8, [rsp + 0x60]
mov rcx, r14
mov byte [rsp + 0x60], al
call fcn.1801b1b50
test eax, eax
je 0x1801b065d
mov dword [r14 + 0x14], ebx
movzx eax, byte [rbp - 0x63]
shl ax, 8
movzx ecx, ax
movzx eax, byte [rbp - 0x64]
or ecx, eax
mov dword [r14 + 0x44], ecx
movzx eax, byte [rbp - 0x61]
shl ax, 8
movzx ecx, ax
movzx eax, byte [rbp - 0x62]
or ecx, eax
mov dword [r14 + 0x48], ecx
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [rsp + 0x70]
movzx eax, word [rsp + 0x72]
sub cx, 0x3c
and ax, 0xf
shl cx, 4
or cx, ax
movzx eax, word [rsp + 0x76]
and eax, 0x1f
shl cx, 5
movzx ecx, cx
or ecx, eax
movzx eax, word [rsp + 0x78]
mov dword [r14 + 0x54], ecx
imul ecx, eax, 0x3c
movzx eax, word [rsp + 0x7a]
add ecx, eax
movzx eax, word [rsp + 0x7c]
imul edx, ecx, 0x1e
shr eax, 1
add edx, eax
mov dword [r14 + 0x58], edx
mov dword [0x18029ccf4], ebx
jmp 0x1801b065d
mov dword [0x18029ccf4], 0x66
jmp 0x1801b065d
mov dword [0x18029ccf4], 4
mov r12, qword [rsp + 0x138]
mov r15, qword [rsp + 0x100]
mov rcx, qword [rsp + 0x48]
call fcn.18010fae0
cmp dword [rsp + 0x40], 0
je 0x1801b0686
mov rcx, rsi
call fcn.18010fae0
test r14, r14
je 0x1801b06b9
cmp dword [r14 + 0x30], 0
je 0x1801b06b9
mov rcx, qword [r14 + 0x28]
mov r9d, 0x24
xor r8d, r8d
mov dword [rsp + 0x20], 0
lea edx, [r9 + 0x18]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [r14 + 0x30], 0
cmp dword [0x18029ccf4], 0
mov r14, qword [rsp + 0x148]
mov r13, qword [rsp + 0x140]
jne 0x1801b06d8
mov eax, dword [rsp + 0x64]
jmp 0x1801b073b
mov ecx, dword [rsp + 0x64]
test ecx, ecx
je 0x1801b0739
call fcn.1801af1e0
mov rdi, rax
mov rbx, qword [rax + 0x18]
cmp dword [rbx + 0x30], 0
je 0x1801b070f
mov rcx, qword [rbx + 0x28]
xor esi, esi
xor r8d, r8d
mov dword [rsp + 0x20], esi
lea r9d, [rsi + 0x24]
lea edx, [rsi + 0x3c]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [rbx + 0x30], esi
mov rcx, qword [rbx + 0x28]
cmp rcx, 0xffffffffffffffff
je 0x1801b071f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rbx + 0x74]
call fcn.1801af100
mov rcx, qword [rdi + 0x18]
call fcn.18010fae0
mov ecx, dword [rsp + 0x64]
call fcn.1801aef90
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1801e67e0
add rsp, 0x108
pop rdi
pop rsi
pop rbx
pop rbp
ret