Function at 0x180001000
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
lea rbp, [rax - 0x168]
sub rsp, 0x250
mov rax, qword [0x18004b8d8]
xor rax, rsp
mov qword [rbp + 0x140], rax
lea rax, vtable.AES.0
mov rbx, rdx
mov rdi, rcx
mov dword [rsp + 0x40], 0x7b777c63
mov dword [rsp + 0x44], 0xc56f6bf2
mov r13d, 1
mov qword [rcx], rax
mov dword [rsp + 0x48], 0x2b670130
mov dword [rsp + 0x4c], 0x76abd7fe
mov dword [rsp + 0x50], 0x7dc982ca
mov dword [rsp + 0x54], 0xf04759fa
mov dword [rsp + 0x58], 0xafa2d4ad
mov dword [rsp + 0x5c], 0xc072a49c
mov dword [rsp + 0x60], 0x2693fdb7
mov dword [rsp + 0x64], 0xccf73f36
mov dword [rsp + 0x68], 0xf1e5a534
mov dword [rsp + 0x6c], 0x1531d871
mov dword [rsp + 0x70], 0xc323c704
mov dword [rsp + 0x74], 0x9a059618
mov dword [rsp + 0x78], 0xe2801207
mov dword [rsp + 0x7c], 0x75b227eb
mov dword [rbp - 0x80], 0x1a2c8309
mov dword [rbp - 0x7c], 0xa05a6e1b
mov dword [rbp - 0x78], 0xb3d63b52
mov dword [rbp - 0x74], 0x842fe329
mov dword [rbp - 0x70], 0xed00d153
mov dword [rbp - 0x6c], 0x5bb1fc20
mov dword [rbp - 0x68], 0x39becb6a
mov dword [rbp - 0x64], 0xcf584c4a
mov dword [rbp - 0x60], 0xfbaaefd0
mov dword [rbp - 0x5c], 0x85334d43
mov dword [rbp - 0x58], 0x7f02f945
mov dword [rbp - 0x54], 0xa89f3c50
mov dword [rbp - 0x50], 0x8f40a351
mov dword [rbp - 0x4c], 0xf5389d92
mov dword [rbp - 0x48], 0x21dab6bc
mov dword [rbp - 0x44], 0xd2f3ff10
mov dword [rbp - 0x40], 0xec130ccd
mov dword [rbp - 0x3c], 0x1744975f
mov dword [rbp - 0x38], 0x3d7ea7c4
mov dword [rbp - 0x34], 0x73195d64
mov dword [rbp - 0x30], 0xdc4f8160
mov dword [rbp - 0x2c], 0x88902a22
mov dword [rbp - 0x28], 0x14b8ee46
mov dword [rbp - 0x24], 0xdb0b5ede
mov dword [rbp - 0x20], 0xa3a32e0
mov dword [rbp - 0x1c], 0x5c240649
mov dword [rbp - 0x18], 0x62acd3c2
mov dword [rbp - 0x14], 0x79e49591
mov dword [rbp - 0x10], 0x6d37c8e7
mov dword [rbp - 0xc], 0xa94ed58d
mov dword [rbp - 8], 0xeaf4566c
mov dword [rbp - 4], 0x8ae7a65
mov dword [rbp], 0x2e2578ba
mov dword [rbp + 4], 0xc6b4a61c
mov dword [rbp + 8], 0x1f74dde8
mov dword [rbp + 0xc], 0x8a8bbd4b
mov dword [rbp + 0x10], 0x66b53e70
mov dword [rbp + 0x14], 0xef60348
mov dword [rbp + 0x18], 0xb9573561
mov dword [rbp + 0x1c], 0x9e1dc186
mov dword [rbp + 0x20], 0x1198f8e1
mov dword [rbp + 0x24], 0x948ed969
mov dword [rbp + 0x28], 0xe9871e9b
mov dword [rbp + 0x2c], 0xdf2855ce
mov dword [rbp + 0x30], 0xd89a18c
mov dword [rbp + 0x34], 0x6842e6bf
mov dword [rbp + 0x38], 0xf2d9941
mov dword [rbp + 0x3c], 0x16bb54b0
mov dword [rbp + 0x40], 0xd56a0952
mov dword [rbp + 0x44], 0x38a53630
mov dword [rbp + 0x48], 0x9ea340bf
mov dword [rbp + 0x4c], 0xfbd7f381
mov dword [rbp + 0x50], 0x8239e37c
mov dword [rbp + 0x54], 0x87ff2f9b
mov dword [rbp + 0x58], 0x44438e34
mov dword [rbp + 0x5c], 0xcbe9dec4
mov dword [rbp + 0x60], 0x32947b54
mov dword [rbp + 0x64], 0x3d23c2a6
mov dword [rbp + 0x68], 0xb954cee
mov dword [rbp + 0x6c], 0x4ec3fa42
mov esi, 0x100
lea rdx, [rsp + 0x40]
add rcx, 8
mov r8d, esi
mov dword [rbp + 0x70], 0x66a12e08
mov dword [rbp + 0x74], 0xb224d928
mov dword [rbp + 0x78], 0x49a25b76
mov dword [rbp + 0x7c], 0x25d18b6d
mov dword [rbp + 0x80], 0x64f6f872
mov dword [rbp + 0x84], 0x16986886
mov dword [rbp + 0x88], 0xcc5ca4d4
mov dword [rbp + 0x8c], 0x92b6655d
mov dword [rbp + 0x90], 0x5048706c
mov dword [rbp + 0x94], 0xdab9edfd
mov dword [rbp + 0x98], 0x5746155e
mov dword [rbp + 0x9c], 0x849d8da7
mov dword [rbp + 0xa0], 0xabd890
mov dword [rbp + 0xa4], 0xad3bc8c
mov dword [rbp + 0xa8], 0x558e4f7
mov dword [rbp + 0xac], 0x645b3b8
mov dword [rbp + 0xb0], 0x8f1e2cd0
mov dword [rbp + 0xb4], 0x20f3fca
mov dword [rbp + 0xb8], 0x3bdafc1
mov dword [rbp + 0xbc], 0x6b8a1301
mov dword [rbp + 0xc0], 0x4111913a
mov dword [rbp + 0xc4], 0xeadc674f
mov dword [rbp + 0xc8], 0xcecff297
mov dword [rbp + 0xcc], 0x73e6b4f0
mov dword [rbp + 0xd0], 0x2274ac96
mov dword [rbp + 0xd4], 0x8535ade7
mov dword [rbp + 0xd8], 0xe837f9e2
mov dword [rbp + 0xdc], 0x6edf751c
mov dword [rbp + 0xe0], 0x711af147
mov dword [rbp + 0xe4], 0x89c5291d
mov dword [rbp + 0xe8], 0xe62b76f
mov dword [rbp + 0xec], 0x1bbe18aa
mov dword [rbp + 0xf0], 0x4b3e56fc
mov dword [rbp + 0xf4], 0x2079d2c6
mov dword [rbp + 0xf8], 0xfec0db9a
mov dword [rbp + 0xfc], 0xf45acd78
mov dword [rbp + 0x100], 0x33a8dd1f
mov dword [rbp + 0x104], 0x31c70788
mov dword [rbp + 0x108], 0x591012b1
mov dword [rbp + 0x10c], 0x5fec8027
mov dword [rbp + 0x110], 0xa97f5160
mov dword [rbp + 0x114], 0xd4ab519
mov dword [rbp + 0x118], 0x9f7ae52d
mov dword [rbp + 0x11c], 0xef9cc993
mov dword [rbp + 0x120], 0x4d3be0a0
mov dword [rbp + 0x124], 0xb0f52aae
mov dword [rbp + 0x128], 0x3cbbebc8
mov dword [rbp + 0x12c], 0x61995383
mov dword [rbp + 0x130], 0x7e042b17
mov dword [rbp + 0x134], 0x26d677ba
mov dword [rbp + 0x138], 0x631469e1
mov dword [rbp + 0x13c], 0x7d0c2155
call fcn.18001bc00
lea rcx, [rdi + 0x108]
lea rdx, [rbp + 0x40]
mov r8d, esi
call fcn.18001bc00
mov dword [rsp + 0x28], 0x8040201
mov dword [rsp + 0x2c], 0x80402010
mov word [rsp + 0x30], 0x361b
xor edx, edx
lea r9, [rdi + 0x208]
xor ecx, ecx
lea r8, [rdx + rbx]
mov al, byte [r8]
add r8, 4
mov byte [r9 + rcx], al
add rcx, r13
cmp rcx, 4
jl 0x1800014b8
add rdx, r13
add r9, 4
cmp rdx, 4
jl 0x1800014b2
lea rbx, [rsp + 0x28]
mov r9, r13
mov r10d, reloc.WS2_32.dll_recv
sub rbx, r13
xor edx, edx
xor r8d, r8d
lea rax, [r8 + r9*4]
test rdx, rdx
je 0x180001505
lea rcx, [rdx + rax*4]
mov al, byte [rcx + rdi + 0x207]
jmp 0x18000150c
mov al, byte [rdi + rax*4 + 0x1fb]
mov byte [rsp + r8 + 0x20], al
add r8, r13
cmp r8, 4
jl 0x1800014ef
test rdx, rdx
jne 0x18000156d
mov r12b, byte [rsp + 0x20]
xor r8d, r8d
mov r11d, r13d
mov eax, r11d
and eax, 0x80000003
jge 0x18000153d
sub eax, r13d
or eax, 0xfffffffc
add eax, r13d
cdqe
add r11d, r13d
movzx ecx, byte [rsp + rax + 0x20]
mov al, byte [rcx + rdi + 8]
mov byte [rsp + r8 + 0x20], al
add r8, r13
cmp r8, 3
jl 0x18000152a
movzx eax, r12b
mov cl, byte [rax + rdi + 8]
mov al, byte [r9 + rbx]
xor byte [rsp + 0x20], al
mov byte [rsp + 0x23], cl
lea rcx, [rdx + rdi + 0x208]
xor r8d, r8d
add rcx, r10
mov al, byte [rsp + r8 + 0x20]
add r8, r13
xor al, byte [rcx - 0x10]
mov byte [rcx], al
add rcx, 4
cmp r8, 4
jl 0x18000157b
add rdx, r13
cmp rdx, 4
jl 0x1800014ec
add r10, 0x10
add r9, r13
cmp r10, 0xa0
jle 0x1800014ea
mov rax, rdi
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.18001bbd0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rbp
ret