Function at 0x18003a020
Capabilities:
Create thread
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov rax, qword [0x1801561e0]
xor rax, rsp
mov qword [rbp + 0xa0], rax
mov rdi, rcx
mov qword [rbp + 0x98], rcx
xor r15d, r15d
mov dword [rbp - 0x78], r15d
mov dword [rsp + 0x58], 0xc0c1c5c2
mov dword [rsp + 0x5c], 0xf2eef0ba
mov word [rsp + 0x60], 0x100
lea rdx, [rbp + 0x78]
lea rcx, [rsp + 0x58]
call fcn.18001e1e0
lea rcx, [rbp + 0x78]
call fcn.18000ee90
test al, al
jne 0x18003a7db
movdqa xmm0, xmmword [0x180138a60]
movdqu xmmword [rbp], xmm0
mov dword [rbp + 0x10], 0xdbc78f94
mov word [rbp + 0x14], 0xc1
mov byte [rbp + 0x16], 1
mov ecx, r15d
nop word [rax + rax]
lea eax, [rcx - 0x70]
xor byte [rbp + rcx], al
inc rcx
cmp rcx, 0x15
jb 0x18003a0c0
mov byte [rbp + 0x16], 0
mov qword [rbp + 0x18], r15
mov qword [rbp + 0x28], r15
mov qword [rbp + 0x30], reloc.WS2_32.dll_ntohs
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, [rbp]
lea rcx, [rbp + 0x18]
call fcn.180040b10
lea rcx, [rbp + 0x18]
call fcn.18000ee90
test al, al
jne 0x18003a7db
movdqa xmm0, xmmword [0x18013a490]
movdqu xmmword [rsp + 0x68], xmm0
mov dword [rsp + 0x78], 0x95d0c4d2
mov dword [rsp + 0x7c], 0xcbc28b90
mov word [rbp - 0x80], Ordinal_200
mov byte [rbp - 0x7e], 1
mov rcx, r15
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x70]
xor byte [rsp + rcx + 0x68], al
inc rcx
cmp rcx, 0x19
jb 0x18003a140
mov byte [rbp - 0x7e], 0
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r14, rax
test rax, rax
jne 0x18003a173
cmp byte [0x180180816], al
je 0x18003a745
mov dword [rsp + 0x50], 0xa3aaa3f2
mov word [rsp + 0x54], 0xa6
mov byte [rsp + 0x56], 1
mov rcx, r15
nop word [rax + rax]
lea eax, [rcx - 0x70]
xor byte [rsp + rcx + 0x50], al
inc rcx
cmp rcx, 5
jb 0x18003a190
mov byte [rsp + 0x56], 0
mov qword [rbp + 0x38], r15
movdqa xmm0, xmmword [0x180137dd0]
movdqu xmmword [rbp + 0x48], xmm0
mov r8d, 5
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x38]
call fcn.180040b10
lea rdx, [rbp + 0x38]
cmp qword [rbp + 0x50], 0x10
cmovae rdx, qword [rbp + 0x38]
mov r8, qword [rdi + 0x10]
mov rcx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18003a1e9
mov rcx, qword [rdi]
cmp r8, qword [rbp + 0x48]
jne 0x18003a210
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x18003a210
lea rcx, [rbp + 0x38]
call fcn.180040a10
mov dword [0x1801807d8], 0x300
jmp 0x18003a380
lea rcx, [rbp + 0x38]
call fcn.180040a10
mov dword [rsp + 0x48], 0xa7aba3f2
mov word [rsp + 0x4c], 0xa0
mov byte [rsp + 0x4e], 1
mov rcx, r15
lea eax, [rcx - 0x70]
xor byte [rsp + rcx + 0x48], al
inc rcx
cmp rcx, 5
jb 0x18003a230
mov byte [rsp + 0x4e], 0
mov qword [rbp + 0x58], r15
movdqa xmm0, xmmword [0x180137dd0]
movdqu xmmword [rbp + 0x68], xmm0
mov byte [rbp + 0x58], 0
mov r8d, 5
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x58]
call fcn.180040b10
nop
mov ebx, 0x1fd
mov dword [rbp - 0x78], ebx
lea rdx, [rbp + 0x58]
cmp qword [rbp + 0x70], 0x10
cmovae rdx, qword [rbp + 0x58]
mov r8, qword [rdi + 0x10]
mov rcx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18003a296
mov rcx, qword [rdi]
cmp r8, qword [rbp + 0x68]
jne 0x18003a2a9
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x18003a330
mov dword [rsp + 0x40], 0xaaa2a2f2
mov word [rsp + 0x44], 0xa1
mov byte [rsp + 0x46], 1
mov rcx, r15
lea eax, [rcx - 0x70]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 5
jb 0x18003a2c0
mov byte [rsp + 0x46], 0
mov qword [rbp - 0x50], r15
movdqa xmm0, xmmword [0x180137dd0]
movdqu xmmword [rbp - 0x40], xmm0
mov r8d, 5
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x50]
call fcn.180040b10
mov ebx, 0x7ff
mov dword [rbp - 0x78], ebx
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov r8, qword [rdi + 0x10]
mov rcx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18003a321
mov rcx, qword [rdi]
cmp r8, qword [rbp - 0x40]
jne 0x18003a335
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x18003a335
mov sil, 1
jmp 0x18003a338
xor sil, sil
test bl, 2
je 0x18003a34d
and ebx, 0xfffffffd
mov dword [rbp - 0x78], ebx
lea rcx, [rbp - 0x50]
call fcn.180040a10
nop
test bl, 1
je 0x18003a35b
lea rcx, [rbp + 0x58]
call fcn.180040a10
test sil, sil
je 0x18003a376
mov dword [0x1801807d8], 0x300
mov dword [0x1801807d4], 0xe8
jmp 0x18003a38a
mov dword [0x1801807d8], 0x320
mov dword [0x1801807d4], 0x88
mov dword [rsp + 0x30], 0xc4f1e3f7
mov dword [rsp + 0x34], 0xf8f2fbfd
mov word [rsp + 0x38], 0xef
mov byte [rsp + 0x3a], 1
mov rcx, r15
nop dword [rax]
lea eax, [rcx - 0x70]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 9
jb 0x18003a3b0
mov byte [rsp + 0x3a], 0
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x1801846d0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [0x1801846d8], rax
movdqa xmm0, xmmword [0x18013a260]
movdqu xmmword [rbp - 0x70], xmm0
mov dword [rbp - 0x60], 0x8dc7d7c9
mov dword [rbp - 0x5c], 0xcac9c0
mov byte [rbp - 0x58], 1
mov rcx, r15
nop word [rax + rax]
lea eax, [rcx - 0x70]
xor byte [rbp + rcx - 0x70], al
inc rcx
cmp rcx, 0x17
jb 0x18003a410
mov byte [rbp - 0x58], 0
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [0x1801847a0], rax
mov rsi, qword [0x180180750]
add rsi, r14
add r14, qword [0x180180758]
lea rdx, [0x1801806d0]
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rdx, qword [0x1801806d0]
mov rcx, rax
call fcn.180010380
mov qword [0x1801847a8], rax
lea rdx, [0x1801806f0]
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rdx, qword [0x1801806f0]
mov rcx, qword [0x1801847a0]
call fcn.180010380
mov qword [0x1801847b0], rax
mov rdx, qword [0x1801846d8]
mov rax, qword [0x180180710]
add rax, rdx
je 0x18003a4ae
mov rax, qword [rax]
jmp 0x18003a4b1
mov rax, r15
mov qword [0x180184700], rax
mov rax, qword [0x180180718]
add rax, rdx
je 0x18003a4c9
mov rax, qword [rax]
jmp 0x18003a4cc
mov rax, r15
mov qword [0x180184708], rax
mov rax, qword [0x180180730]
add rax, rdx
je 0x18003a4e4
mov rax, qword [rax]
jmp 0x18003a4e7
mov rax, r15
mov qword [0x180184718], rax
mov rcx, qword [0x180180728]
add rcx, rdx
je 0x18003a4ff
mov rax, qword [rcx]
jmp 0x18003a502
mov rax, r15
mov qword [0x180184710], rax
mov rcx, qword [0x180180738]
add rcx, rdx
mov qword [0x1801846f0], rcx
mov rcx, qword [0x180180720]
add rcx, rdx
mov qword [0x180184720], rcx
mov rcx, qword [0x180180740]
add rcx, rdx
lea rax, [rcx - 0xc]
mov qword [0x1801846f8], rax
lea rax, [rcx - 0xb]
test rax, rax
je 0x18003a54e
mov r8d, dword [rax]
jmp 0x18003a551
mov r8d, r15d
movsxd rax, r8d
add rcx, 0xfffffffffffffff9
add rcx, rax
mov qword [0x1801846f8], rcx
mov rcx, qword [0x180180760]
add rcx, rdx
mov qword [0x180184750], rcx
mov rcx, qword [0x180180770]
add rcx, rdx
mov qword [0x180184758], rcx
mov rcx, qword [0x180180778]
add rcx, rdx
mov qword [0x180184760], rcx
mov rcx, qword [0x180180768]
add rcx, rdx
mov qword [0x180184768], rcx
mov rcx, qword [0x180180780]
add rcx, rdx
mov qword [0x180184770], rcx
mov rcx, qword [0x180180788]
add rcx, rdx
mov qword [0x180184778], rcx
mov rcx, qword [0x180180790]
add rcx, rdx
mov qword [0x180184780], rcx
mov rcx, qword [0x1801807a0]
add rcx, rdx
mov qword [0x180184790], rcx
mov rcx, qword [0x180180798]
add rcx, rdx
mov qword [0x180184788], rcx
lea rcx, [rdx - 0x56]
add rcx, qword [0x180180748]
mov qword [0x180184630], rcx
mov rcx, qword [0x1801807a8]
add rcx, rdx
mov qword [0x180184628], rcx
mov rbx, r15
xor eax, eax
mov r12d, 1
lock cmpxchg dword [0x180184698], r12d
je 0x18003a657
cmp rbx, 0x20
jae 0x18003a63e
xor ecx, ecx
jmp 0x18003a641
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x180184698], r12d
jne 0x18003a634
cmp qword [0x1801846a0], 0
jne 0x18003a675
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [0x1801846a0], rax
mov eax, r15d
xchg dword [0x180184698], eax
cmp byte [0x180180816], 0
je 0x18003a6a7
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [0x180039970]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x18003a6d3
lea r8, [0x180184670]
lea rdx, [0x180039410]
mov rcx, r14
call fcn.1800a6dc0
lea r8, [0x180184650]
lea rdx, [0x180039510]
mov rcx, rsi
call fcn.1800a6dc0
lea r8, [0x180184620]
lea rdx, [0x1800390d0]
mov rcx, qword [0x1801846f8]
call fcn.1800a6dc0
lea r8, [0x180184618]
lea rdx, [0x180038e40]
mov rcx, qword [0x1801846f0]
call fcn.1800a6dc0
mov edx, r12d
xor ecx, ecx
call fcn.1800a70f0
nop
mov rcx, rdi
call fcn.180040a10
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.180112970
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
lea rax, [rbp + 0x78]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x30], 0xe6f6fedd
mov dword [rsp + 0x34], 0xb7e5f0f8
mov dword [rsp + 0x38], 0xf4e8ebdd
mov word [rsp + 0x3c], 0x100
lea rdx, [rbp + 0x78]
lea rcx, [rsp + 0x30]
call fcn.18003da50
mov rbx, rax
movdqa xmm0, xmmword [0x180139d90]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x1801392e0]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmmword [0x1801396f0]
movdqa xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0xaaa1a8ae
mov dword [rbp - 0x1c], 0xe7a9e5a1
mov dword [rbp - 0x18], 0xaebca08e
mov dword [rbp - 0x14], 0x100e381
lea rdx, [rbp + 0x18]
lea rcx, [rbp - 0x50]
call fcn.18003aa90
nop
mov rdx, rbx
mov rcx, rax
call fcn.18000edc0
int3
lea rax, [rbp + 0x78]
mov qword [rsp + 0x40], rax
movdqa xmm0, xmmword [0x180139e70]
movdqu xmmword [rsp + 0x68], xmm0
mov dword [rsp + 0x78], 0xc1cbd5c1
mov dword [rsp + 0x7c], 0xd3cfc9cd
mov word [rbp - 0x80], Ordinal_211
mov byte [rbp - 0x7e], 1
lea rdx, [rbp + 0x78]
lea rcx, [rsp + 0x68]
call fcn.18003c130
mov rbx, rax
movdqa xmm0, xmmword [0x180138d60]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x1801385d0]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmmword [0x1801392d0]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x1801388d0]
movdqa xmmword [rbp - 0x20], xmm1
mov dword [rbp - 0x10], 0x100ffbf
lea rdx, [rbp + 0x18]
lea rcx, [rbp - 0x50]
call fcn.18003ac50
nop
mov rdx, rbx
mov rcx, rax
call fcn.18000edc0
int3