Function at 0x18008d510
Capabilities:
Encode data using xor
Get local ipv4 addresses
Get socket information

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 0x10], rdx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1b8]
sub rsp, 0x290
mov r13d, r8d
mov r12, rdx
mov r15, rcx
movabs rdi, 0xd993efbb19cfe32d
xor ebx, ebx
cmp byte [0x18010a364], bl
je 0x18008d59b
lea rcx, [rsp + 0x30]
call fcn.18007f8b4
cmp byte [rax + 0x49], bl
je 0x18008d588
mov r9d, ebx
mov cl, r9b
and cl, 7
shl cl, 3
mov r8, rdi
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x49
jb 0x18008d569
mov byte [rax + 0x49], bl
mov r9d, r13d
mov r8, r15
mov rdx, rax
mov ecx, 4
call fcn.18006a848
xor edx, edx
mov rcx, r15
call fcn.180093d80
test al, al
je 0x18008d5b3
mov eax, 0x2746
jmp 0x18008ddbb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3c], eax
call fcn.1800864cc
mov rsi, rax
mov eax, 0x80
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], eax
cmp qword [rsi + 8], rbx
je 0x18008dc8c
cmp qword [rsi], rbx
je 0x18008dc8c
lea r8, [rsp + 0x34]
lea rdx, [rbp + 0x110]
mov rcx, r15
call sub.WS2_32.dll_getsockname
test eax, eax
jne 0x18008dc9d
lea r8, [rsp + 0x38]
lea rdx, [rbp + 0x90]
mov rcx, r15
call sub.WS2_32.dll_getpeername
test eax, eax
jne 0x18008dc9d
movzx ecx, word [rbp + 0x92]
call sub.WS2_32.dll_ntohs
movzx edi, ax
mov eax, 0x203e
cmp di, ax
jne 0x18008d642
call fcn.18005cbb8
test al, al
mov r14b, 1
jne 0x18008d645
mov r14b, bl
cmp byte [0x18010a364], bl
je 0x18008d698
lea rcx, [rsp + 0x30]
call fcn.18007eae8
cmp byte [rax + 0x3d], bl
je 0x18008d688
mov r9, rbx
movabs r10, 0xd993efbb19cfe32d
mov cl, r9b
and cl, 7
shl cl, 3
mov r8, r10
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x3d
jb 0x18008d669
mov byte [rax + 0x3d], bl
mov r8d, edi
mov rdx, rax
mov ecx, 4
call fcn.18006a848
lea rdx, [rbp + 0x110]
lea rcx, [rbp - 0x70]
call fcn.1800045fc
lea rdx, [rbp + 0x90]
lea rcx, [rbp]
call fcn.1800045fc
call fcn.18005c734
cmp eax, 0xb
jae 0x18008d6e0
call fcn.18000f3c4
test al, al
jne 0x18008d6e0
call fcn.18005cfac
test al, al
jne 0x18008d6e0
cmp byte [0x18010b09b], bl
je 0x18008d7cd
mov eax, 0x1bb
cmp di, ax
je 0x18008d703
movzx eax, word [0x18010aec4]
test ax, ax
je 0x18008d7f6
cmp di, ax
jne 0x18008d7e8
lea rcx, [rbp - 0x70]
call fcn.18000469c
movzx ebx, ax
xor eax, eax
mov qword [rbp - 0x50], rax
xor edx, edx
lea rcx, [rbp - 0x48]
call fcn.1800042f0
xor edx, edx
lea rcx, [rbp - 0x30]
call fcn.1800042f0
xor eax, eax
mov qword [rbp - 0x18], rax
mov dword [rbp - 0x10], eax
mov qword [rbp - 0x50], r15
lea rdx, [rbp + 0x60]
lea rcx, [rbp - 0x70]
call fcn.180004688
movups xmm0, xmmword [rax]
movaps xmmword [rbp - 0x30], xmm0
movsd xmm1, qword [rax + 0x10]
movsd qword [rbp - 0x20], xmm1
mov word [rbp - 0x16], bx
lea rdx, [rbp + 0x78]
lea rcx, [rbp]
call fcn.180004688
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x48], xmm0
movsd xmm1, qword [rax + 0x10]
movsd qword [rbp - 0x38], xmm1
mov word [rbp - 0x18], di
lea rax, [rbp - 0x50]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], 1
mov r9d, dword [rsi + 8]
mov r8, qword [rsi]
mov rdx, r15
lea rcx, [0x18010af30]
call fcn.18005f3ac
xor ebx, ebx
test al, al
je 0x18008d7cd
mov r9, rsi
lea r8, [rbp]
lea rdx, [rbp - 0x70]
mov rcx, r15
call fcn.180080d94
mov rcx, qword [rsi]
call fcn.18009d1f4
mov qword [rsi], rbx
mov qword [rsi + 8], rbx
jmp 0x18008dc9d
mov eax, 0x1bb
cmp ax, di
jne 0x18008d7e1
cmp dword [rsi + 0x10], 3
je 0x18008d932
movzx eax, word [0x18010aec4]
test ax, ax
je 0x18008d7f6
cmp di, ax
je 0x18008d932
cmp dword [rsi + 0x10], 4
jne 0x18008d826
cmp byte [0x18010ad90], bl
jne 0x18008d932
cmp byte [0x18010b09b], bl
je 0x18008d819
test r14b, r14b
je 0x18008d932
call fcn.18005cf58
test al, al
jne 0x18008d932
mov r14d, 0x203e
cmp r14w, di
jne 0x18008da4b
call fcn.180072560
lea rcx, [rax + 0xc8]
cmp qword [rax + 0xe0], 0x10
jb 0x18008d853
mov rcx, qword [rax + 0xc8]
mov r8d, 8
cmp qword [rax + 0xd8], r8
jne 0x18008d876
lea rdx, str.waol.exe
call fcn.18009fb20
test eax, eax
je 0x18008d938
call fcn.180072560
lea rcx, [rax + 0xc8]
cmp qword [rax + 0xe0], 0x10
jb 0x18008d893
mov rcx, qword [rax + 0xc8]
mov r14d, reloc.WS2_32.dll_ntohl
cmp qword [rax + 0xd8], r14
jne 0x18008d8b5
mov r8d, r14d
lea rdx, str.aolbrowser.exe
call fcn.18009fb20
test eax, eax
je 0x18008d932
call fcn.180072560
lea rcx, [rax + 0xc8]
cmp qword [rax + 0xe0], 0x10
jb 0x18008d8d2
mov rcx, qword [rax + 0xc8]
mov r8d, reloc.WS2_32.dll_inet_ntoa
cmp qword [rax + 0xd8], r8
jne 0x18008d8f1
lea rdx, str.aolhelix.exe
call fcn.18009fb20
test eax, eax
je 0x18008d932
call fcn.180072560
lea rcx, [rax + 0xc8]
cmp qword [rax + 0xe0], 0x10
jb 0x18008d90e
mov rcx, qword [rax + 0xc8]
cmp qword [rax + 0xd8], r14
jne 0x18008dc9d
mov r8, r14
lea rdx, str.aoldesktop.exe
call fcn.18009fb20
test eax, eax
jne 0x18008dc9d
mov r14d, 0x203e
cmp byte [0x18010a364], bl
je 0x18008d98f
lea rcx, [rsp + 0x30]
call fcn.18007e624
cmp byte [rax + 0x39], bl
je 0x18008d982
mov r9, rbx
movabs r12, 0xd993efbb19cfe32d
mov cl, r9b
and cl, 7
shl cl, 3
mov r8, r12
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x39
jb 0x18008d95c
mov byte [rax + 0x39], bl
mov r12, qword [rbp + 0x1c8]
mov rdx, rax
mov ecx, 4
call fcn.18006a848
mov r9, rsi
lea r8, [rbp]
lea rdx, [rbp - 0x70]
mov rcx, r15
call fcn.180080d94
lea r8, [rbp]
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x58]
call fcn.18003d904
nop
call fcn.180072560
add rax, 0xc8
cmp qword [rax + 0x18], 0x10
jb 0x18008d9ca
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.18003de44
mov edx, 1
lea rcx, [rsp + 0x58]
call fcn.18003e074
mov edx, 2
lea rcx, [rsp + 0x58]
call fcn.18003e07c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
lea rcx, [rsp + 0x58]
call fcn.18003e084
cmp r14w, di
je 0x18008da8b
mov eax, 0xd4ab
cmp ax, di
je 0x18008da8b
mov eax, 0x20fb
cmp ax, di
je 0x18008da8b
mov eax, 0x14e
cmp ax, di
je 0x18008da8b
movzx eax, word [0x18010aec4]
test ax, ax
je 0x18008da3c
cmp di, ax
je 0x18008da8b
cmp byte [0x18010ad90], bl
je 0x18008da86
mov eax, 0x1466
jmp 0x18008da90
mov eax, 0xd4ab
cmp ax, di
je 0x18008da5f
mov eax, 0x20fb
cmp ax, di
jne 0x18008da69
cmp dword [rsi + 0x10], 3
je 0x18008d938
mov eax, 0x14e
cmp ax, di
jne 0x18008dc9d
cmp dword [rsi + 0x10], 3
jne 0x18008dc9d
jmp 0x18008d938
movzx eax, di
jmp 0x18008da90
mov eax, 0x1bb
movzx edx, ax
lea rcx, [rsp + 0x58]
call fcn.18003e08c
mov rcx, qword [rsi + 8]
call fcn.18009d8b4
mov qword [rsp + 0x78], rax
mov r8b, byte [rsp + 0x30]
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.18001d800
nop
mov r8, qword [rsi + 8]
mov rdx, qword [rsi]
mov rcx, qword [rsp + 0x78]
call fcn.18009fc20
mov r8d, dword [rsi + 8]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x58]
call fcn.18003dfdc
lea rax, [rbp + 0x30]
mov qword [rbp - 0x78], rax
mov rax, qword [rsp + 0x58]
mov qword [rbp + 0x30], rax
mov rcx, qword [rsp + 0x60]
mov qword [rbp + 0x38], rcx
test rcx, rcx
je 0x18008db0a
mov eax, 1
lock xadd dword [rcx + 8], eax
mov rax, qword [rsp + 0x68]
mov qword [rbp + 0x40], rax
mov rcx, qword [rsp + 0x70]
mov qword [rbp + 0x48], rcx
test rcx, rcx
je 0x18008db2b
mov eax, 1
lock xadd dword [rcx + 8], eax
call fcn.180072560
mov rcx, rax
lea rdx, [rbp + 0x30]
call fcn.1800923b0
or r14d, 0xffffffff
cmp byte [0x18010ad90], bl
je 0x18008dc13
lea rdx, [rbp + 0x50]
lea rcx, [rsp + 0x58]
call fcn.18003d9b8
mov rcx, qword [rax]
mov qword [rbp + 0x28], rcx
mov rbx, qword [rbp + 0x58]
test rbx, rbx
je 0x18008db96
mov eax, r14d
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x18008db96
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, r14d
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x18008db96
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
lea rcx, [rsp + 0x58]
call fcn.18003d9dc
mov dword [rbp + 0x20], eax
call fcn.180072560
lea rcx, [rax + 0x60]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x18010aa1c]
xor ebx, ebx
test eax, eax
je 0x18008dc04
call fcn.180072560
mov rbx, qword [rax + 0x48]
mov rbx, qword [rbx]
call fcn.180072560
cmp rbx, qword [rax + 0x48]
je 0x18008dc02
mov rcx, qword [rbx + 0x10]
call fcn.18001e970
mov rcx, rax
lea rdx, str.IM_Capture
call fcn.1800a86c0
test eax, eax
je 0x18008dc63
mov rdi, qword [rbx]
mov rbx, rdi
call fcn.180072560
cmp rdi, qword [rax + 0x48]
jne 0x18008dbd5
xor ebx, ebx
call fcn.180072560
lea rcx, [rax + 0x60]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsi]
call fcn.18009d1f4
mov qword [rsi], rbx
mov qword [rsi + 8], rbx
mov rbx, qword [rbp - 0x80]
test rbx, rbx
je 0x18008dc57
mov eax, r14d
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x18008dc57
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lock xadd dword [rbx + 0xc], r14d
cmp r14d, 1
jne 0x18008dc57
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
nop
lea rcx, [rsp + 0x58]
call fcn.18001d6c0
jmp 0x18008dc9d
mov rcx, qword [rbx + 0x10]
mov rax, qword [rcx]
xor ebx, ebx
mov dword [rsp + 0x28], ebx
lea rdx, [rbp - 0x78]
mov qword [rsp + 0x20], rdx
lea r9d, [rbx + 1]
lea r8, [rbp + 0x20]
mov rdx, r15
call qword [rax + 0x30]
jmp 0x18008dc04
mov r8d, 2
mov edx, r13d
mov rcx, r12
call fcn.180090cf8
mov ecx, dword [rsp + 0x3c]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x48], r13d
call fcn.180072560
lea rcx, [rax + 0x60]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x18010aa1c]
test eax, eax
je 0x18008dcfd
call fcn.180072560
mov rbx, qword [rax + 0x48]
mov rbx, qword [rbx]
call fcn.180072560
cmp rbx, qword [rax + 0x48]
je 0x18008dcfd
mov rcx, qword [rbx + 0x10]
mov rax, qword [rcx]
mov r9d, 1
lea r8, [rsp + 0x48]
mov rdx, r15
call qword [rax + 0x28]
test al, al
jne 0x18008dcd3
call fcn.180072560
lea rcx, [rax + 0x60]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, dword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [rsp + 0x40], edi
call fcn.180072560
lea rcx, [rax + 0x60]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x18010aa1c]
test ecx, ecx
je 0x18008dd88
call fcn.180072560
mov rbx, qword [rax + 0x48]
mov rbx, qword [rbx]
call fcn.180072560
cmp rbx, qword [rax + 0x48]
je 0x18008dd88
xor r14d, r14d
mov rcx, qword [rbx + 0x10]
mov rax, qword [rcx]
mov dword [rsp + 0x28], r14d
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rdx
mov r9d, 1
lea r8, [rsp + 0x48]
mov rdx, r15
call qword [rax + 0x30]
test al, al
je 0x18008dd88
mov rbx, qword [rbx]
call fcn.180072560
cmp rbx, qword [rax + 0x48]
jne 0x18008dd4f
call fcn.180072560
lea rcx, [rax + 0x60]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsp + 0x50]
cmp rcx, r12
je 0x18008ddb1
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x48], r13d
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret