Function at 0x180077350
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xa0
mov rsi, rcx
xor ebx, ebx
mov edi, ebx
mov dword [rax + 0x10], ebx
call fcn.18000f3c4
mov byte [rsi + 0x48], al
test al, al
je 0x180077422
cmp byte [0x18010a364], bl
je 0x1800773d5
lea rcx, [rsp + 0xd8]
call fcn.180077090
movabs r14, 0xd993efbb19cfe32d
cmp byte [rax + 0x3c], bl
je 0x1800773c6
mov r9d, ebx
mov cl, r9b
and cl, 7
shl cl, 3
mov rdx, r14
shr rdx, cl
xor byte [r9 + rax], dl
inc r9
cmp r9, 0x3c
jb 0x1800773a7
mov byte [rax + 0x3c], bl
mov rdx, rax
mov ecx, 4
call fcn.18006a848
jmp 0x1800773df
movabs r14, 0xd993efbb19cfe32d
lea rdx, str.OSMIM_PQ
mov rcx, rsi
call fcn.1800779ac
mov qword [rsi], rax
lea rdx, str.OSMIM_SQ
mov rcx, rsi
call fcn.1800779ac
mov qword [rsi + 8], rax
lea rdx, str.OSMIM_CFS
mov rcx, rsi
call fcn.180077180
mov qword [rsi + 0x10], rax
mov r15d, 0x1000
jmp 0x180077652
lea rcx, [rsp + 0x78]
call fcn.18000ee24
mov r8d, 1
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x40]
call fcn.18000ee54
mov r12d, 0x50
mov ecx, r12d
call fcn.18009d1b8
mov qword [rsp + 0xe0], rax
lea r14d, [r12 - 0x41]
test rax, rax
je 0x1800774a8
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x68], 8
movabs rcx, 0x51505f4d494d534f
mov qword [rsp + 0x58], rcx
mov byte [rsp + 0x60], bl
lea edi, [r12 - 0x4f]
mov dword [rsp + 0xd8], edi
lea r9, [rsp + 0x40]
mov r8d, CoInitializeEx
lea rdx, [rsp + 0x58]
mov rcx, rax
call fcn.18003e26c
jmp 0x1800774ab
mov rax, rbx
mov qword [rsi], rax
mov r15d, 0x1000
test dil, 1
je 0x1800774f6
and edi, 0xfffffffe
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x1800774f6
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, r15
jb 0x1800774f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180077975
call fcn.18009d1f4
mov rcx, r12
call fcn.18009d1b8
mov qword [rsp + 0xe0], rax
test rax, rax
je 0x180077550
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x68], 8
movabs rcx, 0x51535f4d494d534f
mov qword [rsp + 0x58], rcx
mov byte [rsp + 0x60], bl
or edi, 2
mov dword [rsp + 0xd8], edi
lea r9, [rsp + 0x40]
mov r8d, CoInitializeEx
lea rdx, [rsp + 0x58]
mov rcx, rax
call fcn.18003e26c
jmp 0x180077553
mov rax, rbx
mov qword [rsi + 8], rax
test dil, 2
je 0x180077599
and edi, 0xfffffffd
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x180077599
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, r15
jb 0x180077594
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18007797b
call fcn.18009d1f4
mov ecx, 0x28
call fcn.18009d1b8
mov qword [rsp + 0xe0], rax
test rax, rax
je 0x1800775fe
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x68], 9
movsd xmm0, qword [str.OSMIM_CFS]
movsd qword [rsp + 0x58], xmm0
mov cl, byte [0x1800d61e0]
mov byte [rsp + 0x60], cl
mov byte [rsp + 0x61], bl
or edi, 4
mov dword [rsp + 0xd8], edi
lea r9, [rsp + 0x40]
mov r8d, 0x10000
lea rdx, [rsp + 0x58]
mov rcx, rax
call fcn.18003fefc
jmp 0x180077601
mov rax, rbx
mov qword [rsi + 0x10], rax
test dil, 4
je 0x180077648
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x180077648
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, r15
jb 0x18007763f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180077981
call fcn.18009d1f4
mov rax, qword [rsi + 0x10]
movabs r14, 0xd993efbb19cfe32d
test rax, rax
je 0x18007788d
lea rdi, [rsi + 0x28]
mov rcx, qword [rdi + 0x10]
movabs r12, 0x7fffffffffffffff
mov rax, r12
sub rax, rcx
cmp rax, 0xb
jb 0x180077987
mov r9, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18007768a
mov r9, qword [rdi]
mov qword [rsp + 0x30], inet_ntoa
lea rax, str.:usecsproxy
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov r8, rdi
mov dl, byte [rsp + 0xd8]
lea rcx, [rsp + 0x58]
call fcn.1800090dc
nop
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae rdx, qword [rsp + 0x58]
lea r8, [0x18010ad74]
mov rcx, qword [rsi + 0x10]
call fcn.180040524
mov byte [0x18010ad71], al
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x180077719
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, r15
jb 0x180077714
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18007798c
call fcn.18009d1f4
mov rcx, qword [rdi + 0x10]
mov rax, r12
sub rax, rcx
cmp rax, 0x13
jb 0x180077992
mov r9, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18007773a
mov r9, qword [rdi]
mov qword [rsp + 0x30], reloc.WS2_32.dll_send
lea rax, str.:canswitchtocsproxy
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov r8, rdi
mov dl, byte [rsp + 0xd8]
lea rcx, [rsp + 0x58]
call fcn.1800090dc
nop
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae rdx, qword [rsp + 0x58]
lea r8, [0x18010ad74]
mov rcx, qword [rsi + 0x10]
call fcn.180040524
mov byte [0x18010ad72], al
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x1800777c9
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, r15
jb 0x1800777c4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180077997
call fcn.18009d1f4
mov rax, qword [rdi + 0x10]
sub r12, rax
cmp r12, 8
jb 0x18007799d
mov r9, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1800777e7
mov r9, qword [rdi]
mov qword [rsp + 0x30], 8
lea rcx, str.:nohttp2
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov r8, rdi
mov dl, byte [rsp + 0xd8]
lea rcx, [rsp + 0x58]
call fcn.1800090dc
nop
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae rdx, qword [rsp + 0x58]
xor r8d, r8d
mov rcx, qword [rsi + 0x10]
call fcn.180040524
mov byte [0x18010ad70], al
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x180077872
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, r15
jb 0x18007786d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800779a2
call fcn.18009d1f4
mov rdx, rdi
mov rcx, qword [rsi + 0x10]
call fcn.18004039c
mov byte [rsi + 0x49], al
mov rcx, qword [rsi + 0x10]
call fcn.18004046c
mov byte [rsi + 0x4a], al
jmp 0x18007789b
cmp byte [0x18010ad70], bl
je 0x1800778f0
cmp byte [0x18010a364], bl
je 0x18007795d
lea rcx, [rsp + 0xd8]
call fcn.180076ec4
cmp byte [rax + 0x3e], bl
je 0x1800778e3
mov r9, rbx
mov cl, r9b
and cl, 7
shl cl, 3
mov r8, r14
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x3e
jb 0x1800778c4
mov byte [rax + 0x3e], bl
mov rdx, rax
mov ecx, 4
call fcn.18006a848
cmp byte [0x18010a364], bl
je 0x18007795d
lea rcx, [rsp + 0xd8]
call fcn.180076d44
mov rdi, rax
cmp byte [rax + 0x30], bl
je 0x18007792f
mov r9, rbx
mov cl, r9b
and cl, 7
shl cl, 3
mov r8, r14
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x30
jb 0x180077910
mov byte [rax + 0x30], bl
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9d, eax
lea rax, str.TRUE
lea r8, str.FALSE
cmp byte [0x18010ad71], bl
cmovne r8, rax
mov rdx, rdi
mov ecx, 4
call fcn.18006a848
mov rbx, qword [rsp + 0xd0]
add rsp, 0xa0
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call fcn.1800a45b8
nop
call fcn.1800a45b8
int3
call fcn.1800a45b8
int3
call fcn.180001e88
call fcn.1800a45b8
int3
call fcn.180001e88
call fcn.1800a45b8
int3
call fcn.180001e88
call fcn.1800a45b8
int3