Function at 0x180069e74
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0x88
mov r13, rcx
mov rcx, qword [rcx + 0x18]
xor r14d, r14d
test rcx, rcx
jne 0x180069eaa
mov eax, 0x80004005
jmp 0x18006a27a
mov rax, qword [rcx]
lea rdx, [rbp + 0x77]
call qword [rax + 0x38]
mov edi, eax
test eax, eax
js 0x18006a27a
mov esi, r14d
mov ecx, 3
movabs r15, 0xd993efbb19cfe32d
mov eax, dword [rbp + 0x77]
test eax, eax
jle 0x18006a03e
mov word [rbp - 0x21], cx
mov dword [rbp - 0x19], esi
mov qword [rbp - 0x31], r14
mov rcx, qword [r13 + 0x18]
movups xmm0, xmmword [rbp - 0x21]
movaps xmmword [rbp - 9], xmm0
movsd xmm1, qword [rbp - 0x11]
movsd qword [rbp + 7], xmm1
mov rax, qword [rcx]
lea r8, [rbp - 0x31]
lea rdx, [rbp - 9]
call qword [rax + 0x40]
mov edi, eax
test eax, eax
js 0x18006a25e
mov rcx, qword [rbp - 0x31]
cmp eax, 1
je 0x18006a014
test rcx, rcx
je 0x18006a014
mov qword [rbp - 0x39], r14
mov rax, qword [rcx]
lea r8, [rbp - 0x39]
lea rdx, [0x1800d3828]
call qword [rax]
mov edi, eax
test eax, eax
js 0x18006a00b
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x18006a00f
mov rax, qword [rcx]
lea rdx, [rbp - 0x29]
call qword [rax + pe_nt_image_headers64]
mov edi, eax
test eax, eax
jns 0x180069f81
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x180069f78
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov rcx, qword [rbp - 0x31]
jmp 0x18006a014
lea rdx, [rbp + 0x7f]
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp eax, dword [rbp + 0x7f]
jne 0x18006a00b
cmp byte [0x18010a364], r14b
je 0x180069fee
lea rcx, [rbp + 0x6f]
call fcn.180067690
mov rbx, rax
cmp byte [rax + 0x52], r14b
je 0x180069fd8
mov r9, r14
mov cl, r9b
and cl, 7
shl cl, 3
mov r8, r15
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x52
jb 0x180069fb8
mov byte [rax + 0x52], r14b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
mov rdx, rbx
mov ecx, 4
call fcn.18006a848
mov dword [0x18010a5a0], 1
mov r9b, 1
mov r8, qword [rbp - 0x29]
mov rdx, qword [rbp - 0x39]
mov rcx, r13
call fcn.180067998
mov rcx, qword [rbp - 0x39]
jmp 0x180069f6c
test rcx, rcx
je 0x18006a020
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
nop
lea rcx, [rbp - 0x21]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
inc esi
mov eax, dword [rbp + 0x77]
cmp esi, eax
mov ecx, 3
jl 0x180069edb
test eax, eax
jne 0x18006a278
mov r12b, r14b
mov edi, 1
mov r15d, r14d
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x21], xmm0
mov qword [rbp - 0x11], r14
cmp byte [0x18010a364], r14b
je 0x18006a0bc
lea rcx, [rbp + 0x6f]
call fcn.180066bac
mov rbx, rax
cmp byte [rax + 0x48], r14b
je 0x18006a0a6
mov rax, r14
movabs r13, 0xd993efbb19cfe32d
mov cl, al
and cl, 7
shl cl, 3
mov r8, r13
shr r8, cl
xor byte [rax + rbx], r8b
inc rax
cmp rax, 0x48
jb 0x18006a083
mov r13, qword [rbp + 0x67]
mov byte [rbx + 0x48], r14b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
mov rdx, rbx
mov ecx, 4
call fcn.18006a848
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Internet_Explorer_Server
lea rcx, [rbp - 0x21]
call fcn.180068e50
mov rax, qword [rbp - 0x19]
mov rsi, rax
mov rcx, qword [rbp - 0x21]
sub rsi, rcx
sar rsi, 3
test rsi, rsi
je 0x18006a375
cmp byte [0x18010a364], r14b
je 0x18006a15b
lea rcx, [rbp + 0x6f]
call fcn.18006714c
mov rbx, rax
cmp byte [rax + 0x52], r14b
je 0x18006a13a
mov r10, r14
movabs rax, 0xd993efbb19cfe32d
mov cl, r10b
and cl, 7
shl cl, 3
mov r9, rax
shr r9, cl
xor byte [r10 + rbx], r9b
inc r10
cmp r10, 0x52
jb 0x18006a11a
mov byte [rbx + 0x52], r14b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9d, eax
mov r8, rsi
mov rdx, rbx
mov ecx, 4
call fcn.18006a848
mov rax, qword [rbp - 0x19]
mov rcx, qword [rbp - 0x21]
sub rax, rcx
sar rax, 3
test rax, rax
je 0x18006a363
xor esi, esi
and qword [rbp + 0x7f], 0
lea rdx, [rbp + 0x7f]
mov rcx, qword [rcx + rsi*8]
call fcn.180068e8c
test al, al
je 0x18006a28e
and qword [rbp - 0x29], 0
mov rcx, qword [rbp + 0x7f]
mov rax, qword [rcx]
lea rdx, [rbp - 0x29]
call qword [rax + pe_nt_image_headers64]
test eax, eax
js 0x18006a2ef
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
and dword [rbp + 0x6f], 0
lea rdx, [rbp + 0x6f]
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [rbp + 0x6f], ebx
jne 0x18006a2ef
cmp byte [0x18010a364], 0
je 0x18006a228
lea rcx, [rbp + 0x6f]
call fcn.1800664a8
mov rbx, rax
cmp byte [rax + 0x43], 0
je 0x18006a212
xor eax, eax
movabs r13, 0xd993efbb19cfe32d
mov cl, al
and cl, 7
shl cl, 3
mov r8, r13
shr r8, cl
xor byte [rax + rbx], r8b
inc rax
cmp rax, 0x43
jb 0x18006a1ef
mov byte [rbx + 0x43], 0
mov r13, qword [rbp + 0x67]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
mov rdx, rbx
mov ecx, 4
call fcn.18006a848
mov rcx, qword [rbp - 0x21]
mov rcx, qword [rcx + rsi*8]
call fcn.180054140
test al, al
jne 0x18006a2ef
mov r12b, 1
mov r9b, r12b
mov r8, qword [rbp - 0x21]
mov r8, qword [r8 + rsi*8]
mov rdx, qword [rbp + 0x7f]
mov rcx, r13
call fcn.180067998
mov edi, eax
jmp 0x18006a2ef
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x18006a26e
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
nop
lea rcx, [rbp - 0x21]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, edi
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
cmp byte [0x18010a364], 0
je 0x18006a2ef
lea rcx, [rbp + 0x6f]
call fcn.180066ab0
mov rbx, rax
cmp byte [rax + 0x49], 0
je 0x18006a2d8
xor eax, eax
movabs r13, 0xd993efbb19cfe32d
mov cl, al
and cl, 7
shl cl, 3
mov r8, r13
shr r8, cl
xor byte [rax + rbx], r8b
inc rax
cmp rax, 0x49
jb 0x18006a2b5
mov byte [rbx + 0x49], 0
mov r13, qword [rbp + 0x67]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
mov rdx, rbx
mov ecx, 3
call fcn.18006a848
nop
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x18006a2fe
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
inc r14d
mov rax, qword [rbp - 0x19]
mov rcx, qword [rbp - 0x21]
sub rax, rcx
sar rax, 3
mov esi, r14d
cmp rsi, rax
jb 0x18006a16d
xor r14d, r14d
test r12b, r12b
je 0x18006a366
test rcx, rcx
je 0x18006a278
mov rdx, qword [rbp - 0x11]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006a359
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006a3bd
call fcn.18009d1f4
jmp 0x18006a278
xor r14d, r14d
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x18006a3ab
mov rdx, qword [rbp - 0x11]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006a3a6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006a3bd
call fcn.18009d1f4
inc r15d
cmp r15d, 0xa
jae 0x18006a278
jmp 0x18006a04f
call fcn.1800a45b8
int3