Function at 0x180001000
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xa8
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtDelayExecution
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r14d, r14d
lea rax, [0x180009820]
lea r15, [0x180009a28]
mov qword [0x180009a30], rax
mov rcx, r15
mov dword [0x180009a28], r14d
mov qword [0x1800097f0], r14
mov qword [0x180009800], r14
call fcn.180001fdc
lea rcx, [rbp + 0x6f]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov ebx, 0x504d444d
mov edi, 0xa793
movzx edx, di
mov dword [0x180009808], ebx
mov word [0x18000980c], dx
mov eax, ebx
movzx ecx, r14w
mov esi, 0xff
mov word [0x18000980e], cx
cmp eax, ebx
je 0x1800010b8
cmp dx, di
je 0x1800010b8
test cx, cx
jne 0x180001158
mov dword [0x180009808], r14d
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
shl eax, 0x11
or dword [0x180009808], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x7fff
shl eax, 2
or dword [0x180009808], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 3
mov word [0x18000980c], r14w
or dword [0x180009808], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
shl ax, 8
or word [0x18000980c], ax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and ax, si
mov word [0x18000980e], r14w
or word [0x18000980c], ax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
shl ax, 8
or word [0x18000980e], ax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movzx ecx, word [0x18000980e]
and ax, si
movzx edx, word [0x18000980c]
or cx, ax
mov eax, dword [0x180009808]
jmp 0x18000109f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebx, 0xc800000
mov r9d, 2
mov edx, ebx
mov qword [0x1800097e0], rax
mov r8d, 0x1000
mov dword [rbp + 0x67], r9d
xor ecx, ecx
mov qword [0x180009818], rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea r9, [rbp + 0x67]
mov r8d, 4
mov rcx, rax
mov qword [0x180009810], rax
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [0x180009818]
mov edi, r14d
mov rbx, qword [0x180009810]
mov esi, r14d
mov qword [0x180009800], rax
mov rax, qword [0x1800097e0]
mov qword [0x1800097e8], rax
mov eax, r14d
mov qword [0x1800097f0], rbx
mov dword [0x1800097f8], r14d
cmp esi, 0x96
jne 0x180001209
lea rcx, [0x1800097e8]
call fcn.180001ab4
mov edi, dword [0x1800097f8]
mov eax, 1
mov rbx, qword [0x1800097f0]
jmp 0x18000120e
cmp eax, 1
jne 0x18000122d
mov ecx, edi
test edi, edi
je 0x18000122d
xor byte [rbx], 0x2a
inc rbx
sub rcx, 1
jne 0x180001214
mov edi, dword [0x1800097f8]
mov rbx, qword [0x1800097f0]
inc esi
cmp esi, 0xf1
jl 0x1800011e1
mov dword [rsp + 0x50], r14d
lea r9, [rbp - 0x19]
mov qword [rsp + 0x48], r14
lea r8, [rbp - 9]
mov dword [rsp + 0x40], 0x20
lea rcx, [rbp + 0x77]
mov dword [rsp + 0x38], 5
xorps xmm0, xmm0
mov eax, edi
mov edx, 0x120116
mov qword [rbp + 0x7f], rax
lea rax, [rbp + 0x7f]
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rax
mov qword [rbp + 0x77], r14
mov qword [rbp - 9], 0x30
mov qword [rbp + 0xf], 0x40
mov qword [rbp - 1], r14
mov qword [rbp + 7], r15
movdqu xmmword [rbp + 0x17], xmm0
call fcn.18000343c
mov rcx, qword [rbp + 0x77]
lea rax, [rbp - 0x19]
mov qword [rsp + 0x40], r14
xor r9d, r9d
mov qword [rsp + 0x38], r14
xor r8d, r8d
mov dword [rsp + 0x30], edi
xor edx, edx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call fcn.180003450
mov rcx, qword [rbp + 0x77]
call fcn.180002365
add rsp, 0xa8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret