Function at 0x18000b160
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd0
lea rbp, [rsp + 0x30]
imul eax, ecx, 0xbb
mov rdi, r9
mov qword [rbp + 0xe8], rbx
mov r13, rdx
mov r15d, ecx
mov dword [rbp + 0x44], eax
cmp ecx, eax
ja 0x18000b80c
mov rbx, qword [rbp + 0x38]
mov r9, qword [rbp + 0x38]
mov rcx, qword [rbp + 0x38]
mov r14, qword [rbp + 0x100]
mov r12d, dword [rbp + 0xe0]
mov qword [rbp + 8], rbx
mov qword [rbp + 0x30], r9
mov qword [rbp + 0x50], rcx
xor esi, esi
mov r10d, 0x6f
movabs r11, 0xffffffffffffff0
cmp r15d, 0xa2c
ja 0x18000b5ed
je 0x18000b5d5
cmp r15d, 0xec
ja 0x18000b504
je 0x18000b4e7
mov eax, r15d
sub eax, 0x2c
je 0x18000b3eb
sub eax, 0x41
je 0x18000b380
sub eax, 0x19
je 0x18000b232
cmp eax, 0x53
jne 0x18000b351
mov word [rbp + 0x18], 0x6f43
jmp 0x18000b351
cmp dword [r14 + 0x30], 0
mov qword [r14 + 0x18], rsi
mov dword [rbp], esi
jbe 0x18000b351
mov eax, esi
nop word [rax + rax]
mov r8, qword [r14 + 0x38]
lea rcx, [rax + rax*2]
mov rdx, qword [r14 + 0x40]
xor r9d, r9d
shl rcx, 4
add r8, rcx
mov qword [rsp + 0x28], rsi
add rdx, rcx
mov qword [rsp + 0x20], rsi
lea ecx, [r9 + 0x31]
call fcn.18001d6c0
mov rbx, qword [r14]
mov edx, dword [rbp]
mov rcx, rbx
mov qword [rbp + 0x38], rax
mov dword [rbp + 0x68], esi
mov rax, qword [rbx + 8]
mov qword [rbp + 0x60], rax
cmp byte [rax + 0x19], 0
jne 0x18000b2c5
nop word [rax + rax]
mov qword [rbp + 0x60], rax
cmp dword [rax + 0x20], edx
jae 0x18000b2b2
mov rax, qword [rax + 0x10]
mov dword [rbp + 0x68], esi
jmp 0x18000b2bf
mov rcx, rax
mov dword [rbp + 0x68], 1
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x18000b2a0
cmp byte [rcx + 0x19], 0
jne 0x18000b2d0
cmp edx, dword [rcx + 0x20]
jae 0x18000b325
movabs rax, 0x555555555555555
cmp qword [r14 + 8], rax
je 0x18000b829
mov ecx, 0x30
call fcn.18004738c
movups xmm0, xmmword [rbp + 0x60]
mov r8, rax
lea rdx, [rbp + 0x60]
mov eax, dword [rbp]
mov rcx, r14
movaps xmmword [rbp + 0x60], xmm0
mov dword [r8 + 0x20], eax
mov qword [r8 + 0x28], rsi
mov qword [r8], rbx
mov qword [r8 + 8], rbx
mov qword [r8 + 0x10], rbx
mov word [r8 + 0x18], 0
call fcn.18001a530
mov rcx, rax
movsd xmm0, qword [rbp + 0x38]
movsd qword [rcx + 0x28], xmm0
mov eax, dword [rbp]
addsd xmm0, qword [r14 + 0x18]
inc eax
mov dword [rbp], eax
movsd qword [r14 + 0x18], xmm0
cmp eax, dword [r14 + 0x30]
jb 0x18000b250
mov rbx, qword [rbp + 8]
imul eax, dword [rbp + 0xe0], 0xb
add r15d, eax
cmp r15d, dword [rbp + 0x44]
ja 0x18000b80c
mov r9, qword [rbp + 0x30]
mov rcx, qword [rbp + 0x50]
mov rdi, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
jmp 0x18000b1cc
mov ebx, dword [r8]
mov r12d, esi
mov r9d, esi
test ebx, ebx
jle 0x18000b34d
mov r11d, dword [r13]
mov edx, esi
test r11d, r11d
jle 0x18000b3de
mov eax, dword [rdi]
mov r10d, r9d
imul eax, r9d
sar r10d, 8
movsxd r8, eax
add r8, r14
nop dword [rax + rax]
mov eax, edx
lea r8, [r8 + 1]
sar eax, 8
movzx ecx, al
movzx eax, dl
inc edx
xor ecx, eax
movzx eax, r9b
xor ecx, eax
movzx eax, r10b
xor ecx, eax
movzx eax, byte [r8 - 1]
xor ecx, eax
add r12d, ecx
cmp edx, r11d
jl 0x18000b3b0
inc r9d
cmp r9d, ebx
jl 0x18000b391
jmp 0x18000b34d
mov eax, dword [r13]
lea edx, [rax + rax]
lea eax, [rdx + 2]
movsxd rcx, eax
lea rax, [rcx + 0xf]
cmp rax, rcx
ja 0x18000b404
mov rax, r11
and rax, 0xfffffffffffffff0
call fcn.180047770
sub rsp, rax
movsxd rax, edx
mov edx, esi
lea r9, [rsp + 0x30]
mov byte [rax + r9 + 1], 0
mov r8d, dword [r13]
mov qword [rbp + 0x30], r9
lea eax, [r8*2 + 1]
test eax, eax
jle 0x18000b459
mov rcx, r9
nop word [rax + rax]
mov byte [rcx], 0x2e
lea rcx, [rcx + 1]
mov r8d, dword [r13]
inc edx
lea eax, [r8*2 + 1]
cmp edx, eax
jl 0x18000b440
movsxd rax, r8d
mov byte [rax + r9], 0x7c
mov eax, dword [r14 + 4]
sub eax, 1
movsxd rbx, eax
js 0x18000b34d
lea rsi, [r14 + 0x8c]
lea rdi, [rbx + 3]
add rsi, rbx
lea rdi, [r14 + rdi*4]
mov r14d, 0x6f
nop dword [rax]
mov ecx, dword [r13]
mov eax, ecx
mov r8d, dword [rdi]
neg eax
cmp r8d, eax
jl 0x18000b4b9
cmp byte [rsi], 0
lea eax, [r8 + rcx]
movsxd rcx, eax
mov eax, 0x58
cmove eax, r14d
mov byte [r9 + rcx], al
jmp 0x18000b4ce
lea rdx, str._d
mov ecx, 1
call fcn.1800334a0
mov r9, qword [rbp + 0x30]
sub rdi, 4
dec rsi
sub rbx, 1
jns 0x18000b490
mov r14, qword [rbp + 0x100]
jmp 0x18000b34d
mov rcx, qword [r14 + 0x20]
test rcx, rcx
je 0x18000b4f6
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [r14 + 0x10]
call fcn.1800473c8
jmp 0x18000b351
cmp r15d, 0x210
je 0x18000b548
cmp r15d, 0x51c
je 0x18000b7fe
cmp r15d, 0x648
jne 0x18000b351
movsd xmm1, qword [r14 + 0x18]
xorps xmm0, xmm0
mov eax, dword [r14 + 0x30]
cvtsi2sd xmm0, rax
divsd xmm1, xmm0
movsd qword [r14 + 0x18], xmm1
jmp 0x18000b351
mov eax, dword [r14 + 8]
sub eax, 1
movsxd rbx, eax
js 0x18000b5bc
lea rsi, [r14 + 0x9c]
lea rdi, [rbx + 0x13]
add rsi, rbx
lea rdi, [r14 + rdi*4]
nop word [rax + rax]
mov r8d, dword [rdi]
mov eax, dword [r13]
cmp r8d, eax
jg 0x18000b594
cmp byte [rsi], 0
mov edx, 0x58
cmove edx, r10d
add eax, r8d
movsxd rcx, eax
mov byte [rcx + r9], dl
jmp 0x18000b5af
lea rdx, str._d
mov ecx, 1
call fcn.1800334a0
mov r9, qword [rbp + 0x30]
mov r10d, 0x6f
sub rdi, 4
dec rsi
sub rbx, 1
jns 0x18000b570
mov r8, r9
lea rdx, str._s_n
mov ecx, 1
call fcn.1800334a0
jmp 0x18000b34d
mov eax, dword [0x18006abb8]
mov dword [rbp + 0x1a], eax
movzx eax, byte [0x18006abbc]
mov byte [rbp + 0x1e], al
jmp 0x18000b351
cmp r15d, 0x38cb
ja 0x18000b721
je 0x18000b6dc
cmp r15d, 0x137f
je 0x18000b6a7
cmp r15d, 0x1cd2
je 0x18000b672
cmp r15d, 0x2625
je 0x18000b669
cmp r15d, 0x2f78
jne 0x18000b351
movsd xmm0, qword [str.shell]
lea rdx, [rbp + 0x8a]
mov eax, dword [0x18006ab78]
mov r8d, 0xa
mov word [rbp + 0x29], 0x57
movsd qword [rbp + 0x80], xmm0
mov dword [rbp + 0x88], eax
lea ecx, [r8 - 7]
call fcn.18004bf94
jmp 0x18000b351
mov byte [rbp + 0x29], 0
jmp 0x18000b351
mov r8d, 4
lea rdx, [0x18006ab03]
lea rcx, [rbp + 0x22]
call fcn.18004bbb0
mov r8d, 3
mov byte [rbp + 0x26], 0
lea rdx, [0x18006ab64]
lea rcx, [rbp + 0x26]
call fcn.18004bbb0
jmp 0x18000b351
mov r8d, 2
mov byte [rbp + 0x1f], 0
lea rdx, [0x18006ac3c]
lea rcx, [rbp + 0x18]
call fcn.18004ba00
mov r8d, 1
lea rdx, [0x18006ac57]
lea rcx, [rbp + 0x18]
call fcn.18004ba00
jmp 0x18000b351
mov r8d, 0xa
lea rdx, [rbp + 0x8c]
lea ecx, [r8 - 8]
call fcn.18004bf20
movabs rax, 0x6c0064002e
lea rdx, [0x180068240]
mov r8d, 2
mov qword [rbp + 0x8e], rax
lea rcx, [rbp + 0x94]
call fcn.18004b7f4
jmp 0x18000b351
cmp r15d, 0x421e
je 0x18000b78c
cmp r15d, 0x4b71
je 0x18000b745
cmp r15d, 0x54c4
je 0x18000b80c
jmp 0x18000b351
test rbx, rbx
je 0x18000b803
cmp dword [rbp + 0x40], 0
je 0x18000b803
mov rdx, qword [rbx]
xor r9d, r9d
mov qword [rsp + 0x28], r13
mov r8d, 0xf2
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.180009ca0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp qword [r13 + 0x10], 0
setne byte [rbp + 0x10]
jmp 0x18000b351
mov ebx, 0x26
mov eax, ebx
sub eax, 0x25
je 0x18000b7da
sub eax, 1
je 0x18000b7b8
sub eax, 4
je 0x18000b7e8
cmp eax, 1
jne 0x18000b7d1
movzx eax, byte [rbp + 0x80]
sub al, 0x10
cmp al, 7
setbe byte [rbp + 0x48]
jmp 0x18000b7d1
xor r8d, r8d
lea rcx, [rbp + 0x80]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
mov qword [rbp + 0x50], rax
dec ebx
cmp ebx, 0x21
ja 0x18000b791
jmp 0x18000b7e8
lea rdx, [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x48], rax
mov rcx, qword [r14]
lea rdx, [rbp + 0x40]
call qword [rbp + 0x48]
mov rbx, rax
mov qword [rbp + 8], rax
jmp 0x18000b351
mov eax, r12d
jmp 0x18000b80f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [rbp + 0x10]
mov rbx, qword [rbp + 0xe8]
lea rsp, [rbp + 0xa0]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.18001b760
int3