Function at 0x180008950
Capabilities:
Encode data using xor
Get hostname
Get session user name
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x70
xor ebp, ebp
mov rsi, rcx
cmp qword [0x1800a01f8], rbp
jne 0x1800089c6
nop word [rax + rax]
xor eax, eax
lock cmpxchg dword [0x1800a01f0], ebp
je 0x18000898e
nop dword [rax]
pause
xor eax, eax
lock cmpxchg dword [0x1800a01f0], ebp
jne 0x180008980
lock inc dword [0x1800a01f0]
cmp qword [0x1800a01f8], rbp
jne 0x1800089b6
mov ecx, reloc.WS2_32.dll_recv
call fcn.18002aeb4
mov qword [0x1800a01f8], rax
mov qword [rax], rbp
mov qword [rax + 8], rbp
lock dec dword [0x1800a01f0]
cmp qword [0x1800a01f8], rbp
je 0x180008970
lea rdi, [rsi + 0x10]
mov rdx, rdi
call fcn.180007460
test al, al
jne 0x1800089df
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoCreateGuid]
mov ebx, ebp
movsxd rax, ebx
lea rdx, [rsi + 0x430]
lea r8, [rsp + 0x98]
mov dword [rsp + 0x98], 0x28
lea rcx, [rax + rax*4]
shl rcx, 4
add rdx, rcx
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x180008a1c
inc ebx
cmp ebx, 8
jl 0x1800089e1
lea rbx, [rsi + 0x20]
mov dword [rsp + 0x90], 0x208
mov rcx, rbx
lea rdx, [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov eax, dword [rsp + 0x90]
mov r8d, eax
cmp eax, 0x10
jb 0x180008a51
mov r8d, reloc.WS2_32.dll_recv
mov edx, ebp
cmp r8, 0x40
jb 0x180008ad9
lea eax, [r8 - 1]
movsxd rcx, eax
lea rax, [rcx + rbx]
lea r9, [rcx + rdi]
cmp rdi, rax
ja 0x180008a76
cmp r9, rbx
jae 0x180008ad9
mov r9, r8
and r9, 0xffffffffffffffc0
mov rcx, rdi
movdqu xmm0, xmmword [rcx]
add edx, 0x40
movdqu xmm1, xmmword [rcx + 0x10]
movsxd rax, edx
lea rcx, [rcx + 0x40]
pxor xmm1, xmm0
movdqu xmmword [rcx - 0x40], xmm1
movdqu xmm0, xmmword [rcx - 0x30]
movdqu xmm1, xmmword [rcx - 0x20]
pxor xmm1, xmm0
movdqu xmmword [rcx - 0x30], xmm1
movdqu xmm0, xmmword [rcx - 0x20]
movdqu xmm1, xmmword [rcx - 0x10]
pxor xmm1, xmm0
movdqu xmmword [rcx - 0x20], xmm1
movdqu xmm0, xmmword [rcx - 0x10]
movdqu xmm1, xmmword [rcx]
pxor xmm1, xmm0
movdqu xmmword [rcx - 0x10], xmm1
cmp rax, r9
jb 0x180008a80
movsxd rax, edx
cmp rax, r8
jae 0x180008b04
add rax, rdi
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [rax + 0x10]
inc edx
xor byte [rax], cl
lea rax, [rax + 1]
movsxd rcx, edx
cmp rcx, r8
jb 0x180008af0
cmp qword [0x1800a01c8], rbp
jne 0x180008b66
nop dword [rax]
xor eax, eax
lock cmpxchg dword [0x1800a01c0], ebp
je 0x180008b2e
nop dword [rax]
pause
xor eax, eax
lock cmpxchg dword [0x1800a01c0], ebp
jne 0x180008b20
lock inc dword [0x1800a01c0]
cmp qword [0x1800a01c8], rbp
jne 0x180008b56
mov ecx, reloc.WS2_32.dll_recv
call fcn.18002aeb4
mov qword [0x1800a01c8], rax
mov qword [rax], rbp
mov qword [rax + 8], rbp
lock dec dword [0x1800a01c0]
cmp qword [0x1800a01c8], rbp
je 0x180008b10
lea rdx, [rsp + 0x20]
call fcn.1800030c0
cmp qword [rsp + 0x38], 8
lea r8, [rsp + 0x20]
mov edx, 0x104
lea rcx, [rsi + 0x228]
cmovae r8, qword [rsp + 0x20]
call fcn.1800505c4
xor eax, eax
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rsp + 0x40]
cmp ax, 9
je 0x180008bce
cmp ax, 6
jne 0x180008be6
lea r8, [0x180083088]
mov edx, 0x104
lea rcx, [rsi + 0x228]
call fcn.1800507a4
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x180008c24
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008c1f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008c34
call fcn.18002aef0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
call fcn.18004df84
int3