Function at 0x1800685c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
xor r15d, r15d
mov r14, rcx
cmp byte [0x18010a364], r15b
movabs rdi, 0xd993efbb19cfe32d
mov r12d, 4
je 0x180068640
lea rcx, [rbp + 0x40]
call fcn.1800667a8
mov rbx, rax
cmp byte [rax + 0x36], r15b
je 0x18006862c
mov eax, r15d
mov cl, al
mov r8, rdi
and cl, 7
shl cl, 3
shr r8, cl
xor byte [rax + rbx], r8b
inc rax
cmp rax, 0x36
jb 0x18006860d
mov byte [rbx + 0x36], r15b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rdx, rbx
mov ecx, r12d
mov r8d, eax
call fcn.18006a848
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
mov qword [rbp - 0x10], r15
movdqu xmmword [rbp - 0x20], xmm0
mov esi, 1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9b, sil
lea rdx, str.Internet_Explorer_Server
lea rcx, [rbp - 0x20]
mov dword [rsp + 0x20], eax
xor r8d, r8d
call fcn.180068e50
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x20]
sub rax, rcx
sar rax, 3
test rax, rax
je 0x18006882c
cmp byte [0x18010a364], r15b
je 0x180068758
lea rcx, [rbp + 0x40]
call fcn.1800661a8
mov rbx, rax
cmp byte [rax + 0x31], r15b
je 0x1800686d5
mov rax, r15
mov cl, al
mov r8, rdi
and cl, 7
shl cl, 3
shr r8, cl
xor byte [rax + rbx], r8b
inc rax
cmp rax, 0x31
jb 0x1800686b6
mov byte [rbx + 0x31], r15b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rdx, rbx
mov ecx, r12d
mov r8d, eax
call fcn.18006a848
cmp byte [0x18010a364], r15b
je 0x180068754
mov rdi, qword [rbp - 0x18]
lea rcx, [rbp + 0x40]
sub rdi, qword [rbp - 0x20]
sar rdi, 3
call fcn.180066328
mov rbx, rax
cmp byte [rax + 0x30], r15b
je 0x18006873d
mov r10, r15
movabs rax, 0xd993efbb19cfe32d
mov cl, r10b
mov r9, rax
and cl, 7
shl cl, 3
shr r9, cl
xor byte [r10 + rbx], r9b
inc r10
cmp r10, 0x30
jb 0x18006871d
mov byte [rbx + 0x30], r15b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8, rdi
mov rdx, rbx
mov r9d, eax
mov ecx, r12d
call fcn.18006a848
mov rcx, qword [rbp - 0x20]
mov rax, qword [rbp - 0x18]
mov edi, r15d
sub rax, rcx
sar rax, 3
test rax, rax
je 0x18006888b
mov rbx, r15
movabs r12, 0xd993efbb19cfe32d
mov qword [rbp + 0x48], r15
lea rdx, [rbp + 0x48]
mov rcx, qword [rcx + rbx*8]
call fcn.180068e8c
test al, al
je 0x1800687ac
mov r8, qword [rbp - 0x20]
xor r9d, r9d
mov rdx, qword [rbp + 0x48]
mov rcx, r14
mov r8, qword [r8 + rbx*8]
call fcn.180067998
mov esi, eax
jmp 0x1800687ff
cmp byte [0x18010a364], r15b
je 0x1800687ff
lea rcx, [rbp + 0x40]
call fcn.180067254
mov rbx, rax
cmp byte [rax + 0x3c], r15b
je 0x1800687e9
mov rax, r15
mov cl, al
mov r8, r12
and cl, 7
shl cl, 3
shr r8, cl
xor byte [rax + rbx], r8b
inc rax
cmp rax, 0x3c
jb 0x1800687ca
mov byte [rbx + 0x3c], r15b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rdx, rbx
mov ecx, 3
mov r8d, eax
call fcn.18006a848
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x18006880e
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rax, qword [rbp - 0x18]
inc edi
mov rcx, qword [rbp - 0x20]
sub rax, rcx
mov ebx, edi
sar rax, 3
cmp rbx, rax
jb 0x18006877c
jmp 0x18006888b
cmp byte [0x18010a364], r15b
je 0x18006887d
lea rcx, [rbp + 0x40]
call fcn.180066ecc
mov rbx, rax
cmp byte [rax + 0x37], r15b
je 0x180068869
mov rax, r15
mov cl, al
mov r8, rdi
and cl, 7
shl cl, 3
shr r8, cl
xor byte [rax + rbx], r8b
inc rax
cmp rax, 0x37
jb 0x18006884a
mov byte [rbx + 0x37], r15b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rdx, rbx
mov ecx, r12d
mov r8d, eax
call fcn.18006a848
mov rcx, r14
call fcn.180069e74
mov rcx, qword [rbp - 0x20]
mov esi, eax
cmp dword [0x18010a5a0], r15d
je 0x18006889d
call fcn.180069880
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x1800688d3
mov rdx, qword [rbp - 0x10]
mov rax, rcx
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x1800688ce
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800688ee
call fcn.18009d1f4
lea r11, [rsp + 0x50]
mov eax, esi
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.1800a45b8
int3