Function at 0x1801d19b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov rax, qword [0x1803c1370]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp dword [rsp + 0xa8], 1
mov r13, qword [rsp + 0xa0]
mov r14, r9
mov ebp, r8d
mov rbx, rdx
mov rsi, rcx
mov rdi, r13
jne 0x1801d1b00
cmp ebp, 0x10
jb 0x1801d1a89
mov r12d, ebp
shr r12, 4
nop word [rax + rax]
mov rcx, rsi
mov rdx, rbx
mov r8d, 4
sub rcx, rdi
sub rdx, rdi
nop word [rax + rax]
movzx eax, byte [rcx + rdi]
add rdi, 4
xor al, byte [rdi - 4]
mov byte [rdx + rdi - 4], al
movzx eax, byte [rcx + rdi - 3]
xor al, byte [rdi - 3]
mov byte [rdx + rdi - 3], al
movzx eax, byte [rcx + rdi - 2]
xor al, byte [rdi - 2]
mov byte [rdx + rdi - 2], al
movzx eax, byte [rcx + rdi - 1]
xor al, byte [rdi - 1]
dec r8
mov byte [rdx + rdi - 1], al
jne 0x1801d1a30
mov r8, r14
mov rdx, rbx
mov rcx, rbx
call sym.VBoxRT.dll_AES_encrypt
mov rdi, rbx
add rbx, 0x10
add ebp, 0xfffffff0
add rsi, 0x10
dec r12
jne 0x1801d1a10
test ebp, ebp
je 0x1801d1af0
mov r8, rbx
sub rsi, rdi
mov rcx, rdi
sub r8, rdi
mov edx, ebp
nop dword [rax + rax]
movzx eax, byte [rcx + rsi]
inc rcx
xor al, byte [rcx - 1]
dec rdx
mov byte [rcx + r8 - 1], al
jne 0x1801d1aa0
movsxd rax, ebp
cmp ebp, 0x10
jae 0x1801d1adf
mov edx, reloc.WS2_32.dll_recv
sub rdi, rbx
lea rcx, [rax + rbx]
sub edx, ebp
nop word [rax + rax]
movzx eax, byte [rdi + rcx]
inc rcx
dec rdx
mov byte [rcx - 1], al
jne 0x1801d1ad0
mov r8, r14
mov rdx, rbx
mov rcx, rbx
call sym.VBoxRT.dll_AES_encrypt
mov rdi, rbx
mov rax, qword [rdi]
mov qword [r13], rax
mov rax, qword [rdi + 8]
jmp 0x1801d1cdd
cmp rcx, rdx
je 0x1801d1bd8
cmp ebp, 0x10
jb 0x1801d1b83
mov r12, rbp
shr r12, 4
nop word [rax + rax]
mov r8, r14
mov rdx, rbx
mov rcx, rsi
call sym.VBoxRT.dll_AES_decrypt
mov r11, rbx
sub rdi, rbx
mov ecx, 4
nop dword [rax]
movzx eax, byte [rdi + r11]
add r11, 4
xor byte [r11 - 4], al
movzx eax, byte [rdi + r11 - 3]
xor byte [r11 - 3], al
movzx eax, byte [rdi + r11 - 2]
xor byte [r11 - 2], al
movzx eax, byte [rdi + r11 - 1]
xor byte [r11 - 1], al
dec rcx
jne 0x1801d1b40
mov rdi, rsi
add ebp, 0xfffffff0
add rbx, 0x10
add rsi, 0x10
dec r12
jne 0x1801d1b20
test ebp, ebp
je 0x1801d1bc8
lea rdx, [rsp + 0x20]
mov r8, r14
mov rcx, rsi
call sym.VBoxRT.dll_AES_decrypt
test ebp, ebp
je 0x1801d1bc5
lea rax, [rsp + 0x20]
lea rcx, [rsp + 0x20]
mov edx, ebp
sub rdi, rax
lea rax, [rsp + 0x20]
sub rbx, rax
movzx eax, byte [rdi + rcx]
inc rcx
xor al, byte [rcx - 1]
dec rdx
mov byte [rbx + rcx - 1], al
jne 0x1801d1bb2
mov rdi, rsi
mov rax, qword [rdi]
mov qword [r13], rax
mov rax, qword [rdi + 8]
jmp 0x1801d1cdd
cmp ebp, 0x10
jb 0x1801d1c5f
sub rdi, rdx
mov r12, rbp
add rdi, 2
shr r12, 4
nop
mov rax, qword [rsi]
mov r8, r14
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov rax, qword [rsi + 8]
mov rcx, rsi
mov qword [rsp + 0x28], rax
call sym.VBoxRT.dll_AES_decrypt
mov ecx, 4
movzx eax, byte [rdi + rbx - 2]
add rbx, 4
xor byte [rbx - 4], al
movzx eax, byte [rdi + rbx - 5]
xor byte [rbx - 3], al
movzx eax, byte [rdi + rbx - 4]
xor byte [rbx - 2], al
movzx eax, byte [rdi + rbx - 3]
xor byte [rbx - 1], al
dec rcx
jne 0x1801d1c14
mov rax, qword [rsp + 0x20]
add ebp, 0xfffffff0
add rsi, 0x10
mov qword [r13], rax
mov rax, qword [rsp + 0x28]
sub rdi, 0x10
dec r12
mov qword [r13 + 8], rax
jne 0x1801d1bf0
test ebp, ebp
je 0x1801d1ce1
mov rax, qword [rsi]
lea rcx, [rsp + 0x20]
mov r8, r14
mov qword [rsp + 0x20], rax
mov rax, qword [rsi + 8]
mov rdx, rbx
mov qword [rsp + 0x28], rax
call sym.VBoxRT.dll_AES_decrypt
test ebp, ebp
je 0x1801d1cb0
mov r8, r13
mov rcx, rbx
mov edx, ebp
sub r8, rbx
nop word [rax + rax]
movzx eax, byte [rcx + r8]
inc rcx
xor byte [rcx - 1], al
dec rdx
jne 0x1801d1ca0
movsxd rax, ebp
cmp ebp, 0x10
jae 0x1801d1ccf
mov r8d, reloc.WS2_32.dll_recv
lea rcx, [rax + rbx]
lea rdx, [rsp + rax + 0x20]
sub r8d, ebp
call sub.MSVCR100.dll_memcpy
mov rax, qword [rsp + 0x20]
mov qword [r13], rax
mov rax, qword [rsp + 0x28]
mov qword [r13 + 8], rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180227610
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret