Function at 0x18001ffc0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe0
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
movaps xmmword [rax - 0x68], xmm8
movaps xmmword [rax - 0x78], xmm9
mov r13, rcx
cmp qword [rcx + 0xf8], 0
je 0x180020005
add rcx, 0xd0
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rdi, qword [r13 + 0x100]
xor r15d, r15d
mov qword [r13 + 0x100], r15
mov qword [rsp + 0x130], rdi
lea ecx, [r15 + 0x10]
call fcn.18009d1b8
mov rbx, rax
mov qword [rsp + 0x128], rax
mov qword [rax], r15
mov qword [rax + 8], r15
mov ecx, 0xa0
call fcn.18009d1b8
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
mov rcx, qword [r13 + 0x100]
cmp rbx, rcx
je 0x18002006d
test rcx, rcx
je 0x18002006d
call fcn.1800214b0
mov qword [r13 + 0x100], rbx
cmp qword [r13 + 0xf8], 0
je 0x18002008c
lea rcx, [r13 + 0xd0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov esi, r15d
mov dword [rsp + 0x128], r15d
mov rbx, qword [rdi]
mov rbx, qword [rbx]
movabs r12, 0xd993efbb19cfe32d
mov r14d, dword [0x18010bb98]
mov edx, 4
cmp rbx, qword [rdi]
je 0x180020581
test esi, esi
jne 0x1800201b2
lea rcx, [r13 + 0x110]
call fcn.1800466e8
test eax, eax
je 0x1800201ad
cmp byte [0x18010a364], sil
je 0x180020530
movdqa xmm6, xmmword [0x1800ec7d0]
movdqa xmm7, xmmword [0x1800ec870]
movdqa xmm8, xmmword [0x1800ebff0]
movdqa xmm9, xmmword [0x1800ec380]
mov dword [rsp + 0x90], 0x19e19a5f
mov rcx, qword gs:[0x58]
mov eax, r14d
mov edx, 4
mov rcx, qword [rcx + rax*8]
mov eax, dword [rdx + rcx]
cmp dword [0x18010d108], eax
jg 0x1800205e1
cmp byte [0x180105814], 0
je 0x180020197
mov r9, r15
mov r10d, 1
lea rax, [0x1801057d0]
sub r10, rax
lea rdx, [r9 + rax]
movzx ecx, r9b
and cl, 7
shl cl, 3
mov rax, r12
shr rax, cl
xor byte [rdx], al
lea r8, [rdx + 1]
lea ecx, [r10 + rdx]
and cl, 7
shl cl, 3
mov rdx, r12
shr rdx, cl
xor byte [r8], dl
add r9, 2
cmp r9, 0x44
lea rax, [0x1801057d0]
jb 0x180020152
mov byte [0x180105814], 0
lea rdx, [0x1801057d0]
mov ecx, 5
call fcn.18006a848
jmp 0x180020530
mov edx, 4
cmp byte [0x18010a364], 0
je 0x180020256
movdqa xmm6, xmmword [0x1800eca10]
mov dword [rsp + 0x40], 0x7deace49
mov word [rsp + 0x44], 0xef92
mov rcx, qword gs:[0x58]
mov eax, r14d
mov rcx, qword [rcx + rax*8]
mov eax, dword [rdx + rcx]
cmp dword [0x18010d100], eax
jg 0x18002064a
cmp byte [0x180105696], 0
je 0x18002022c
mov rdx, r15
movzx ecx, dl
and cl, 7
shl cl, 3
mov rax, r12
shr rax, cl
lea rcx, [0x180105680]
xor byte [rdx + rcx], al
inc rdx
cmp rdx, 0x16
jb 0x180020201
mov byte [0x180105696], 0
jmp 0x180020233
lea rcx, [0x180105680]
lea r8, [rbx + 0x48]
mov eax, dword [rbx + 0x28]
mov dword [rsp + 0x28], eax
mov eax, dword [rbx + 0x2c]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbx + 0x24]
mov rdx, rcx
mov ecx, 5
call fcn.18006a848
cmp dword [rbx + 0x24], 0x8f
jne 0x180020488
lea rdx, str.aolopen
lea rcx, [rbx + 0x48]
call fcn.18009eb24
test rax, rax
jne 0x1800202a6
lea rdx, str.aolhelix
lea rcx, [rbx + 0x48]
call fcn.18009eb24
test rax, rax
jne 0x1800202a6
lea rdx, str.aoldesktop
lea rcx, [rbx + 0x48]
call fcn.18009eb24
test rax, rax
je 0x18002047e
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x30], 0
mov rsi, 0xffffffffffffffff
inc rsi
cmp byte [rbx + rsi + 0x48], 0
jne 0x1800202c5
cmp rsi, 0xf
ja 0x1800202fa
mov qword [rsp + 0x40], rsi
mov r8, rsi
lea rdx, [rbx + 0x48]
lea rcx, [rsp + 0x30]
call fcn.18009fc20
mov byte [rsp + rsi + 0x30], 0
mov r15, qword [rsp + 0x30]
jmp 0x1800203a5
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
ja 0x1800206a5
mov r14, rsi
or r14, 0xf
cmp r14, rax
jbe 0x180020345
mov r14, rax
movabs rax, 0x8000000000000027
mov rcx, rax
call fcn.18009d1b8
test rax, rax
je 0x1800206af
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
jmp 0x18002037b
cmp r14, 0x16
mov eax, socket
cmovb r14, rax
lea rcx, [r14 + 1]
cmp rcx, 0x1000
jb 0x18002036e
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800206aa
jmp 0x180020326
test rcx, rcx
je 0x18002037b
call fcn.18009d1b8
mov r15, rax
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], r14
mov r8, rsi
lea rdx, [rbx + 0x48]
mov rcx, r15
call fcn.18009fc20
mov byte [r15 + rsi], 0
mov qword [rsp + 0x30], r15
mov r14d, dword [0x18010bb98]
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 5
jb 0x1800203ef
lea rax, [rcx + 5]
mov qword [rsp + 0x40], rax
lea rsi, [rsp + 0x30]
cmp rdx, 0x10
cmovae rsi, r15
add rsi, rcx
mov r8d, 5
lea rdx, str._imap
mov rcx, rsi
call fcn.18009fc20
mov byte [rsi + 5], 0
jmp 0x180020410
mov qword [rsp + 0x20], 5
lea r9, str._imap
xor r8d, r8d
lea edx, [r8 + 5]
lea rcx, [rsp + 0x30]
call fcn.1800037a0
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rdx, qword [rsp + 0x30]
lea rcx, [rbx + 0x48]
mov r8d, 0x40
call fcn.1800a8850
mov byte [rbx + 0x87], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x180020474
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002046f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800206af
call fcn.18009d1f4
xor r15d, r15d
mov esi, dword [rsp + 0x128]
movabs r12, 0xd993efbb19cfe32d
cmp byte [r13 + 0x138], 0
je 0x1800204f8
mov rcx, qword [r13 + 0x128]
mov eax, dword [rcx + 4]
cmp eax, 0x1f
je 0x1800204f8
inc rax
shl rax, 7
movups xmm0, xmmword [rbx + 0x20]
movups xmmword [rax + rcx], xmm0
movups xmm1, xmmword [rbx + 0x30]
movups xmmword [rax + rcx + 0x10], xmm1
movups xmm0, xmmword [rbx + 0x40]
movups xmmword [rax + rcx + 0x20], xmm0
movups xmm1, xmmword [rbx + 0x50]
movups xmmword [rax + rcx + 0x30], xmm1
movups xmm0, xmmword [rbx + 0x60]
movups xmmword [rax + rcx + 0x40], xmm0
movups xmm1, xmmword [rbx + 0x70]
movups xmmword [rax + rcx + 0x50], xmm1
movups xmm0, xmmword [rbx + 0x80]
movups xmmword [rax + rcx + 0x60], xmm0
movups xmm1, xmmword [rbx + 0x90]
movups xmmword [rax + rcx + 0x70], xmm1
inc dword [rcx + 4]
inc esi
mov dword [rsp + 0x128], esi
cmp esi, 0x1f
jl 0x180020530
mov esi, r15d
mov dword [rsp + 0x128], r15d
cmp byte [r13 + 0x138], 0
je 0x180020530
mov byte [r13 + 0x138], 0
mov rcx, qword [r13 + 0x110]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x18002055f
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x180020557
cmp rbx, qword [rax + 0x10]
jne 0x180020557
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x180020544
mov rbx, rax
jmp 0x1800200ae
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1800200ae
nop
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x180020570
jmp 0x1800200ae
test esi, esi
je 0x1800205a5
cmp byte [r13 + 0x138], 0
je 0x1800205a5
mov byte [r13 + 0x138], 0
mov rcx, qword [r13 + 0x110]
call qword [sym.imp.KERNEL32.dll_SetEvent]
nop
jmp 0x1800205af
mov rcx, rdi
lea r11, [rsp + 0xe0]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
jmp fcn.1800214b0
lea rcx, [0x18010d108]
call fcn.18009d704
cmp dword [0x18010d108], 0xffffffff
jne 0x180020136
mov byte [0x180105814], 1
movaps xmmword [0x1801057d0], xmm6
movaps xmmword [0x1801057e0], xmm7
movaps xmmword [0x1801057f0], xmm8
movaps xmmword [0x180105800], xmm9
mov eax, dword [rsp + 0x90]
mov dword [0x180105810], eax
lea rcx, [0x1800cd880]
call fcn.18009d564
lea rcx, [0x18010d108]
call fcn.18009d6a4
nop
jmp 0x180020136
lea rcx, [0x18010d100]
call fcn.18009d704
cmp dword [0x18010d100], 0xffffffff
jne 0x1800201f5
mov byte [0x180105696], 1
movaps xmmword [0x180105680], xmm6
mov eax, dword [rsp + 0x40]
mov dword [0x180105690], eax
movzx eax, word [rsp + 0x44]
mov word [0x180105694], ax
lea rcx, [0x1800cd8b0]
call fcn.18009d564
lea rcx, [0x18010d100]
call fcn.18009d6a4
nop
jmp 0x1800201f5
call fcn.180001e88
call fcn.180001df0
call fcn.1800a45b8
int3