Function at 0x180073a7c
Capabilities:
Create thread
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
xor edi, edi
mov rsi, r8
mov r15, rdx
mov r14d, ecx
test ecx, ecx
js 0x180074029
call fcn.180071420
test al, al
jne 0x180074029
xor eax, eax
lea r12d, [rdi + 1]
lock cmpxchg dword [0x18010a808], r12d
jne 0x180073aec
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea r8, [0x180071b6c]
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call fcn.1800a8cdc
movzx ecx, word [rsi + 0x10]
cmp ecx, 0x18
ja 0x180073ded
je 0x180073ee9
sub ecx, r12d
je 0x180073c4a
sub ecx, 5
je 0x180073b28
sub ecx, r12d
je 0x180073ee9
sub ecx, r12d
je 0x180073ee9
cmp ecx, 8
jne 0x180074029
movzx ecx, word [rsi + 8]
test ecx, ecx
je 0x180073bc5
sub ecx, r12d
je 0x180073b42
cmp ecx, r12d
jne 0x180074029
cmp byte [0x18010a5a4], dil
je 0x180073b87
cmp qword [0x18010aae8], rdi
jne 0x180074029
mov rcx, qword [0x18010aaf0]
test rcx, rcx
je 0x180074029
call fcn.18005aacc
mov rax, qword [0x18010aaf0]
mov qword [0x18010aae8], rax
mov qword [0x18010aaf0], rdi
jmp 0x180074029
mov rcx, qword [0x18010aae8]
test rcx, rcx
jne 0x180073ba3
mov rcx, qword [rsi + 0x18]
mov qword [0x18010aae8], rcx
jmp 0x180073e78
mov rax, qword [rsi + 0x18]
cmp rax, rcx
je 0x180074029
mov qword [0x18010aae8], rax
call fcn.18005c168
mov rcx, qword [rsi + 0x18]
jmp 0x180073e78
cmp byte [0x18010a5a4], dil
je 0x180073c0f
mov rax, qword [0x18010aaf8]
cmp qword [rsi], rax
jne 0x180074029
test rax, rax
je 0x180074029
mov rcx, qword [0x18010aae8]
test rcx, rcx
je 0x180074029
call fcn.18005c168
mov rax, qword [0x18010aae8]
mov qword [0x18010aaf0], rax
jmp 0x180074022
mov rcx, qword [rsi + 0x18]
mov rax, qword [0x18010aae8]
cmp rcx, rax
jne 0x180073c24
test rax, rax
jne 0x180073c39
test rax, rax
jne 0x180074029
cmp dword [0x180108504], edi
je 0x180074029
mov qword [0x18010aae8], rdi
call fcn.18005c168
jmp 0x180074029
call fcn.18005ceb8
test al, al
je 0x180074029
mov ebx, 0x96
lea rcx, [rsp + 0x40]
mov r8d, ebx
xor edx, edx
call fcn.1800a02d0
mov rcx, qword [rsi + 0x18]
lea rdx, [rsp + 0x40]
mov r8d, ebx
call qword [sym.imp.USER32.dll_GetClassNameA]
lea rdx, str.Internet_Explorer_Server
lea rcx, [rsp + 0x40]
call fcn.1800a84ac
test eax, eax
jne 0x180073d32
cmp qword [0x18010a5e0], rdi
je 0x180074029
cmp byte [0x18010a364], dil
je 0x180073d17
lea rcx, [rbp + 0xb0]
call fcn.18006e074
mov rbx, rax
cmp byte [rax + 0x6e], dil
je 0x180073cee
mov r8, rdi
movabs r10, 0xd993efbb19cfe32d
mov cl, r8b
mov rax, r10
and cl, 7
shl cl, 3
shr rax, cl
xor byte [r8 + rbx], al
add r8, r12
cmp r8, 0x6e
jb 0x180073cce
mov byte [rbx + 0x6e], dil
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [0x18010a5a0], edi
lea r9, [rsp + 0x40]
mov rdx, rbx
mov dword [rsp + 0x20], eax
setne dil
mov ecx, 4
mov r8d, edi
call fcn.18006a848
xor eax, eax
lock cmpxchg dword [0x18010a5b0], r12d
jne 0x180073ddb
call fcn.180071a20
jmp 0x180073ddb
lea rdx, str.Frame_Tab
lea rcx, [rsp + 0x40]
call fcn.1800a84ac
test eax, eax
je 0x180073d60
lea rdx, str.IEFrame
lea rcx, [rsp + 0x40]
call fcn.1800a84ac
test eax, eax
jne 0x180074029
cmp byte [0x18010a364], dil
je 0x180073dd4
lea rcx, [rbp + 0xc8]
call fcn.18006dd50
mov rbx, rax
cmp byte [rax + 0x5e], dil
je 0x180073dab
mov r8, rdi
movabs r10, 0xd993efbb19cfe32d
mov cl, r8b
mov rax, r10
and cl, 7
shl cl, 3
shr rax, cl
xor byte [r8 + rbx], al
add r8, r12
cmp r8, 0x5e
jb 0x180073d8b
mov byte [rbx + 0x5e], dil
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [0x18010a5a0], edi
lea r9, [rsp + 0x40]
mov rdx, rbx
mov dword [rsp + 0x20], eax
setne dil
mov ecx, 4
mov r8d, edi
call fcn.18006a848
mov dword [0x18010a5a0], r12d
mov rcx, qword [0x18010a5e0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x180074029
sub ecx, 0x1c
je 0x180073ff9
sub ecx, 0x65
je 0x180073f4d
sub ecx, 5
je 0x180073eae
sub ecx, 0x19b
je 0x180073e82
cmp ecx, r12d
jne 0x180074029
call fcn.180049f74
test al, al
je 0x180074029
cmp qword [0x18010aaf8], rdi
jne 0x180073e45
mov rcx, qword [rsi + 0x18]
mov edx, 2
call qword [sym.imp.USER32.dll_GetAncestor]
mov qword [0x18010aaf8], rax
mov rcx, qword [rsi]
mov rax, qword [0x18010aae8]
cmp rcx, rax
je 0x180074029
test rax, rax
je 0x180073e68
mov rcx, rax
call fcn.18005c168
mov rcx, qword [rsi]
mov qword [0x18010aae8], rcx
test rcx, rcx
je 0x180074029
call fcn.18005aacc
jmp 0x180074029
call fcn.180049f74
test al, al
je 0x180074029
mov rcx, qword [0x18010aae8]
cmp qword [rsi + 8], rcx
jne 0x180074029
test rcx, rcx
je 0x180074029
jmp 0x18007401d
call fcn.180049f74
test al, al
je 0x180073ee9
cmp qword [rsi + 8], rdi
je 0x180073ed3
mov rcx, qword [0x18010aaf0]
cmp qword [rsi + 0x18], rcx
jne 0x180074029
jmp 0x180073b68
mov rcx, qword [0x18010aae8]
cmp qword [rsi + 0x18], rcx
jne 0x180074029
jmp 0x180073bf7
call fcn.18004a0b0
test al, al
jne 0x180073eff
call fcn.180049e38
test al, al
je 0x180074029
mov rcx, qword [rsi + 0x18]
call fcn.180049d88
mov rcx, qword [0x18010aae8]
mov rbx, rax
test rax, rax
je 0x180073f39
cmp rax, rcx
je 0x180074029
test rcx, rcx
je 0x180073f2a
call fcn.18005c168
mov qword [0x18010aae8], rbx
mov rcx, rbx
jmp 0x180073e78
call fcn.180049d88
mov rcx, qword [0x18010aae8]
cmp rax, rcx
jmp 0x180073ea3
call fcn.180049e38
test al, al
je 0x180074029
mov ebx, 0x96
lea rcx, [rbp - 0x20]
mov r8d, ebx
xor edx, edx
call fcn.1800a02d0
mov rcx, qword [rsi + 0x18]
lea rdx, [rbp - 0x20]
mov r8d, ebx
call qword [sym.imp.USER32.dll_GetClassNameA]
cmp byte [0x18010a364], dil
je 0x180073fda
lea rcx, [rbp + 0xc8]
call fcn.18006e3c0
mov r9, rax
cmp byte [rax + 0x1c], dil
je 0x180073fc9
mov r8, rdi
movabs r10, 0xd993efbb19cfe32d
mov cl, r8b
mov rax, r10
and cl, 7
shl cl, 3
shr rax, cl
xor byte [r8 + r9], al
add r8, r12
cmp r8, 0x1c
jb 0x180073fa9
mov byte [r9 + 0x1c], dil
lea r8, [rbp - 0x20]
mov rdx, r9
mov ecx, 3
call fcn.18006a848
lea rdx, str.Shell_Embedding
lea rcx, [rbp - 0x20]
call fcn.1800a86c0
test eax, eax
jne 0x180074029
mov rcx, qword [rsi + 0x18]
call fcn.18006a3e4
jmp 0x180074029
cmp byte [0x18010a5a4], dil
je 0x180074029
mov ebx, dword [rsi + 8]
mov ecx, ebx
call fcn.18004a26c
test ebx, ebx
jne 0x180074029
cmp qword [0x18010aae8], rdi
je 0x180074029
mov rcx, qword [rsi + 0x18]
call fcn.18005c168
mov qword [0x18010aae8], rdi
mov r9, rsi
mov r8, r15
mov edx, r14d
xor ecx, ecx
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
jmp qword [sym.imp.USER32.dll_CallNextHookEx]