Function at 0x18001b540
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x1800ac030]
xor rax, rsp
mov qword [rbp + 0x30], rax
or esi, 0xffffffff
xor ebx, ebx
xor r9d, r9d
test ecx, ecx
lea rcx, [rsp + 0x30]
lea r8d, [rsi + 0x31]
mov edi, esi
mov dword [rsp + 0x20], ebx
je 0x18001b678
lea rdx, str.c63w
call fcn.18001b000
test eax, eax
jne 0x18001b5e8
lea r8d, [rsi + 0x21]
lea rdx, [0x18009a9e0]
lea rcx, [rsp + 0x30]
call fcn.18001a7f0
test eax, eax
jne 0x18001b5e8
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x30]
mov r8d, pe_nt_image_headers64
call fcn.18001ac00
test eax, eax
jne 0x18001b5e8
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x30]
mov r8d, pe_nt_image_headers64
call fcn.18001ac00
test eax, eax
cmove edi, ebx
lea rcx, [rsp + 0x30]
call fcn.18001b0b0
test eax, eax
cmovne edi, esi
test edi, edi
jne 0x18001b823
mov r8, rbx
lea r12, [0x180000000]
nop dword [rax]
movzx eax, byte [rbp + r8 - 0x4d]
movzx edx, byte [r8 + r12 + 0x9aa03]
movzx ecx, byte [r8 + r12 + 0x9aa02]
xor edx, eax
movzx eax, byte [rbp + r8 - 0x4e]
add r8, 4
xor ecx, eax
movzx eax, byte [rbp + r8 - 0x53]
or edx, ecx
movzx ecx, byte [r8 + r12 + 0x9a9fd]
xor ecx, eax
movzx eax, byte [rbp + r8 - 0x54]
or edx, ecx
movzx ecx, byte [r8 + r12 + 0x9a9fc]
xor ecx, eax
or edx, ecx
or ebx, edx
cmp r8, 0x80
jl 0x18001b610
test ebx, ebx
je 0x18001b823
mov eax, esi
jmp 0x18001b825
lea rdx, [0x18009aa80]
call fcn.18001b000
test eax, eax
jne 0x18001b6b9
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x30]
mov r8d, pe_nt_image_headers64
call fcn.18001ac00
test eax, eax
jne 0x18001b6b9
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x30]
mov r8d, pe_nt_image_headers64
call fcn.18001ac00
test eax, eax
cmove edi, ebx
lea rcx, [rsp + 0x30]
call fcn.18001b0b0
test eax, eax
cmovne edi, esi
test edi, edi
jne 0x18001b823
mov r10d, ebx
mov r9, rbx
lea r12, [0x180000000]
nop dword [rax]
movzx eax, byte [rbp + r9 - 0x4d]
movzx r8d, byte [r9 + r12 + 0x9aab3]
movzx ecx, byte [r9 + r12 + 0x9aab2]
movzx edx, byte [r9 + r12 + 0x9aab0]
xor r8d, eax
movzx eax, byte [rbp + r9 - 0x4e]
xor ecx, eax
movzx eax, byte [rbp + r9 - 0x4f]
add r9, 4
or r8d, ecx
movzx ecx, byte [r9 + r12 + 0x9aaad]
xor ecx, eax
or r8d, ecx
movzx ecx, byte [rbp + r9 - 0x54]
xor edx, ecx
or r8d, edx
or r10d, r8d
cmp r9, 0x80
jl 0x18001b6e0
test r10d, r10d
jne 0x18001b671
lea r9, [0x18009aaa0]
lea r8d, [r10 + 0x20]
lea rdx, [0x18009aa80]
lea rcx, [rsp + 0x30]
mov edi, esi
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
call fcn.18001b000
test eax, eax
jne 0x18001b7a2
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x30]
mov r8d, pe_nt_image_headers64
call fcn.18001ac00
test eax, eax
jne 0x18001b7a2
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x30]
mov r8d, pe_nt_image_headers64
call fcn.18001ac00
test eax, eax
cmove edi, ebx
lea rcx, [rsp + 0x30]
call fcn.18001b0b0
test eax, eax
cmovne edi, esi
test edi, edi
jne 0x18001b823
mov r9, rbx
nop dword [rax + rax]
movzx eax, byte [rbp + r9 - 0x4d]
movzx r8d, byte [r9 + r12 + 0x9aab3]
movzx ecx, byte [r9 + r12 + 0x9aab2]
movzx edx, byte [r9 + r12 + 0x9aab0]
xor r8d, eax
movzx eax, byte [rbp + r9 - 0x4e]
xor ecx, eax
movzx eax, byte [rbp + r9 - 0x4f]
add r9, 4
or r8d, ecx
movzx ecx, byte [r9 + r12 + 0x9aaad]
xor ecx, eax
or r8d, ecx
movzx ecx, byte [rbp + r9 - 0x54]
xor edx, ecx
or r8d, edx
or ebx, r8d
cmp r9, 0x80
jl 0x18001b7c0
test ebx, ebx
cmovne edi, esi
mov eax, edi
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.1800334b0
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r12, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret