Function at 0x1800324c0
Capabilities:
Encode data using xor
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x250]
sub rsp, 0x350
mov rax, qword [0x1800ab9c8]
xor rax, rsp
mov qword [rbp + 0x240], rax
mov eax, dword [rbp + 0x2c0]
mov rdi, r9
mov qword [rbp - 0x30], r9
mov r9, qword [rbp + 0x2b0]
mov qword [rbp - 0x28], rdx
mov rdx, rcx
lea ebx, [rax - 0xb]
mov qword [rbp - 0x58], r8
mov qword [rbp - 0x70], rcx
mov qword [rbp - 0x50], r9
mov dword [rsp + 0x50], ebx
cmp eax, ebx
jbe 0x180032d2d
movzx r13d, byte [rbp - 0x80]
lea ebx, [rax - 0x75]
mov eax, dword [rbp - 0x68]
lea r10, [0x180000000]
mov esi, dword [rsp + 0x48]
xor r11d, r11d
mov r12d, dword [rsp + 0x68]
movzx r14d, byte [rsp + 0x60]
mov ecx, dword [rsp + 0x50]
mov dword [rsp + 0x78], ebx
mov dword [rbp - 0x68], eax
mov byte [rsp + 0x40], r13b
nop word [rax + rax]
cmp ebx, 0x13
ja case.default.0x180032574
mov ecx, dword [r10 + rbx*4 + 0x32f50]
add rcx, r10
jmp rcx
movzx eax, byte [r8]
lea rdx, [rsp + 0x60]
lea r8, [rbp - 0x5c]
mov byte [rbp - 0x5b], al
mov ecx, 0xb8
mov qword [rsp + 0x60], 2
call fcn.18003d2c0
mov r9, rdi
mov byte [rbp - 0x80], 0
mov r8d, 0x5c
mov dword [rsp + 0x60], 3
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.180060ec0
test eax, eax
js 0x180032d5b
mov r9, rdi
mov byte [rbp - 0x80], 0
mov r8d, 0x5c
mov dword [rsp + 0x60], ILRemoveLastID
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.180060ec0
mov ebx, 0x104
nop dword [rax]
mov eax, ebx
sub eax, 0x104
je 0x18003265d
sub eax, 2
je 0x180032649
cmp eax, 1
jne 0x18003263f
xor eax, eax
mov dword [rbp - 0x80], 3
mov dword [rsp + 0x60], eax
lea rdx, [rbp - 0x80]
mov dword [rbp - 0x68], eax
xor r9d, r9d
lea rax, [rbp - 0x68]
xor ecx, ecx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 0x42]
call fcn.180068a40
mov qword [rbp - 0x68], rax
mov dword [rbp - 0x68], eax
dec ebx
cmp ebx, 0x101
ja 0x1800325f0
mov eax, dword [rbp - 0x68]
test eax, eax
js 0x180032d5b
mov ebx, dword [rsp + 0x78]
jmp 0x180032d02
mov rax, qword [rdi + 8]
xor r11d, r11d
mov dword [rdi + 0x528], r11d
mov r10, qword [rax + 0x5c]
test r10, r10
je 0x18003269c
mov dword [rsp + 0x28], 0xffffffff
lea r9, [rbp + 0x20]
lea r8d, [r11 + 4]
mov qword [rsp + 0x20], 0x108
lea rdx, [rbp - 0x5c]
mov rcx, rdi
call r10
mov dword [rbp - 0x68], eax
jmp 0x18003264c
mov ebx, dword [rsp + 0x78]
mov dword [rdi + 0x528], 0xfffffffd
mov dword [rbp - 0x68], r11d
jmp 0x180032d05
lea rdi, [rbp + 0x20]
mov ebx, r11d
nop word [rax + rax]
mov edx, dword [rdx]
mov ecx, 0x18
mov r9, qword [rbp - 0x40]
sub ecx, ebx
shr edx, cl
mov r8d, 0x45
xor dl, byte [rdi]
lea rcx, [rsp + 0x60]
mov byte [rbp - 0x80], dl
lea rdx, [rbp - 0x80]
mov dword [rsp + 0x60], r11d
call fcn.18005d470
mov rdx, qword [rbp - 0x70]
lea rdi, [rdi + 1]
add ebx, 8
mov r11d, 0
cmp ebx, 0x20
jb 0x1800326c0
mov rdi, qword [rbp - 0x30]
mov ebx, dword [rsp + 0x78]
jmp 0x180032d09
mov rsi, qword [rbp - 0x40]
mov edi, 4
mov r15d, dword [rbp - 0x78]
mov rbx, r11
mov byte [rsp + 0x60], 0
lea r12d, [rdi - 3]
nop dword [rax]
mov r9, rsi
mov dword [rbp - 0x78], r11d
mov r8d, 0x45
mov byte [rbp - 0x80], 0
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x78]
call fcn.18005d470
mov byte [rbp + rbx - 8], al
lea rcx, [rbp - 0x78]
mov eax, dword [rsi]
mov edx, 0xf9
mov dword [rbp - 0x78], eax
call fcn.18006e390
mov edx, 0x88
nop word [rax + rax]
mov ecx, edx
sub ecx, 0x88
je 0x1800327dd
sub ecx, 0x2f
je 0x1800327e1
sub ecx, 0xb
je 0x1800327ec
cmp ecx, 0x2f
jne 0x1800327e1
xor r11d, r11d
lea r8, [rsp + 0x60]
mov edx, r11d
lea r9, str.AUTO
nop dword [rax + rax]
movzx ecx, byte [r8 + rdx]
inc rdx
cmp cl, byte [r9 + rdx - 1]
jne 0x180032896
cmp rdx, 5
jne 0x1800327a0
mov word [0x188], r12w
movzx r13d, r12b
mov ecx, dword [SHChangeNotifyDeregister]
inc ecx
mov word [rbp - 0x80], r12w
mov dword [0], ecx
jmp 0x1800327ef
movzx r13d, r12b
add edx, 0x3a
cmp edx, 0x170
jb 0x180032770
xor r11d, r11d
xor al, r13b
shl r15d, 8
mov byte [rbp + rbx], al
movzx eax, byte [rbp + rbx - 8]
inc rbx
or r15d, eax
sub rdi, r12
jne 0x180032730
mov r12d, dword [rsp + 0x68]
lea r9, [rsp + 0x68]
mov dword [rbp - 0x78], r15d
lea rcx, [rsp + 0x70]
mov r15d, dword [rsp + 0x70]
xor r8d, r8d
mov edx, 0x127
mov dword [rsp + 0x70], r15d
mov byte [rsp + 0x40], r13b
mov dword [rsp + 0x68], 0x20
call fcn.180046310
xor r10d, r10d
mov dword [rsp + 0x70], eax
mov r15d, eax
mov qword [rbp - 0x80], 4
mov edi, r10d
lea r13d, [r10 + 1]
nop
mov rsi, qword [rbp - 0x40]
mov ebx, 0x48
nop dword [rax]
mov eax, ebx
sub eax, 0x48
je 0x1800329b7
sub eax, 0x66
je 0x1800328a4
cmp eax, 0x66
jne 0x1800329e1
movzx eax, byte [rbp + rdi - 4]
or r12d, eax
jmp 0x1800329e1
mov word [rbp - 0x80], r11w
movzx r13d, r11b
jmp 0x1800327ef
mov r9, rsi
mov dword [rsp + 0x68], r10d
mov r8d, 0x45
mov byte [rsp + 0x60], 0
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x68]
call fcn.18005d470
xor al, r15b
lea rcx, [rsp + 0x68]
mov byte [rbp + rdi - 4], al
mov edx, 0xf9
mov eax, dword [rsi]
mov dword [rsp + 0x68], eax
call fcn.18006e390
mov r8d, 0x88
mov byte [rsp + 0x60], r15b
nop dword [rax]
mov ecx, r8d
sub ecx, 0x88
je 0x180032965
sub ecx, 0x2f
je 0x18003297f
sub ecx, 0xb
je 0x180032990
cmp ecx, 0x2f
jne 0x18003297f
xor r10d, r10d
lea r8, [rsp + 0x60]
mov edx, r10d
lea r9, str.AUTO
movzx ecx, byte [r8 + rdx]
inc rdx
cmp cl, byte [r9 + rdx - 1]
jne 0x1800329a0
cmp rdx, 5
jne 0x180032920
mov word [0x188], r13w
xor al, r13b
mov ecx, dword [SHChangeNotifyDeregister]
movzx r14d, r13b
inc ecx
mov word [rsp + 0x60], r13w
mov dword [0], ecx
mov byte [rbp + rdi + 4], al
shl r12d, 8
jmp 0x1800329e1
movzx edx, r15b
mov r14d, 0x9669
mov ecx, edx
shr ecx, 4
xor ecx, edx
and ecx, 0xf
sar r14d, cl
and r14b, r13b
add r8d, 0x3a
cmp r8d, 0x170
jb 0x1800328f0
xor al, r14b
xor r10d, r10d
mov byte [rbp + rdi + 4], al
shl r12d, 8
jmp 0x1800329e1
xor al, r10b
mov word [rsp + 0x60], r10w
mov byte [rbp + rdi + 4], al
movzx r14d, r10b
shl r12d, 8
jmp 0x1800329e1
lea r9, [rsp + 0x68]
mov dword [rsp + 0x68], 8
xor r8d, r8d
mov dword [rsp + 0x70], r15d
mov edx, 0x127
lea rcx, [rsp + 0x70]
call fcn.180046310
mov r15d, eax
xor r10d, r10d
add ebx, 0x66
cmp ebx, 0x17a
jb 0x180032870
inc rdi
mov dword [rsp + 0x68], r12d
sub qword [rbp - 0x80], r13
mov dword [rsp + 0x70], r15d
jne 0x180032860
mov rdi, qword [rbp - 0x30]
lea rdx, [rsp + 0x60]
movzx r13d, byte [rsp + 0x40]
lea rcx, [rbp - 0x80]
mov r9, rdi
mov byte [rsp + 0x60], 0
mov r8d, 0x5c
mov dword [rbp - 0x80], 4
call fcn.180060ec0
test eax, eax
js 0x180032d5b
mov dword [rsp + 0x38], reloc.SHELL32.dll_SHTestTokenMembership
lea rax, [rbp - 8]
mov qword [rsp + 0x30], rdi
lea r9, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea r8, [rbp]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x60], 0x40
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x130]
call fcn.18005a3e0
mov esi, eax
test eax, eax
jns 0x180032654
mov eax, 2
jmp 0x180032d31
mov qword [rbp - 0x18], 0
mov rax, qword [rbp - 0x18]
mov qword [rbp], rax
jmp case.0x180032574.9
mov dword [rbp - 0x60], 0
mov eax, dword [rbp - 0x60]
mov dword [rbp - 0x5c], eax
mov qword [rbp - 0x10], 0
mov rax, qword [rbp - 0x10]
mov qword [rbp - 8], rax
jmp case.0x180032574.9
lea r9, [rsp + 0x78]
mov dword [rsp + 0x78], 0xfa
mov r8d, 0x11f
lea rcx, [rbp - 0x38]
mov rdx, rdi
call fcn.1800318d0
jmp 0x180032d02
mov rax, qword [rbp + 0x2b8]
mov eax, dword [rax]
sub eax, 0x60
cmp eax, 1
ja 0x180032d70
movzx ecx, byte [r9]
lea eax, [rcx - 8]
test al, 0x6f
jne 0x180032d69
mov eax, dword [r8]
lea rdx, [rsp + 0x60]
mov byte [rsp + 0x60], cl
mov r8d, 0x77
lea rcx, [rsp + 0x78]
mov dword [rsp + 0x78], eax
call fcn.1800340f0
test al, al
je 0x180032d62
mov rax, qword [rbp + 0x2b8]
movzx eax, byte [rax]
mov byte [rbp - 0x5c], al
jmp 0x180032d02
mov dword [rbp - 0x78], r11d
mov r12d, r11d
mov dword [rsp + 0x68], r11d
mov dword [rbp - 0x48], r11d
mov dword [rbp - 0x44], r11d
jmp case.0x180032574.9
mov eax, dword [rbp - 0x38]
cmp eax, 1
jne 0x180032c8c
mov r15d, dword [rsp + 0x58]
lea r13d, [rax + 0x68]
mov ebx, 0xc9
nop dword [rax]
cmp ebx, 0x349b
ja 0x180032c3a
je 0x180032bfe
cmp ebx, 0xc9
je 0x180032bf8
cmp ebx, 0x120f
je 0x180032bcb
cmp ebx, 0x2355
jne 0x180032c69
mov r8d, 5
lea rdx, str._Ne:_
lea rcx, [rbp + 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov word [rbp + 0x11], r13w
jmp 0x180032c69
mov r8d, 2
lea rdx, [0x18009e498]
lea rcx, [rbp + 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, 0xa
lea rdx, [rbp + 0xa]
lea ecx, [r8 + 0x54]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultoa]
jmp 0x180032c69
mov byte [rbp + 8], 0
jmp 0x180032c69
movzx eax, word [0x18009e488]
lea rcx, [rbp + 8]
movsd xmm0, qword [str.ghbourAbo]
mov word [rbp + 0x1a], ax
movzx eax, word [0x18009e48c]
mov word [rbp + 0x1b], ax
movzx eax, byte [0x18009e48e]
mov byte [rbp + 0x1d], al
movsd qword [rbp + 0x12], xmm0
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov r15d, eax
jmp 0x180032c69
cmp ebx, 0x45e1
je 0x180032c5c
cmp ebx, 0x5727
jne 0x180032c69
xor r8d, r8d
mov edx, 0xd3
mov rcx, rdi
call fcn.180033060
jmp 0x180032c69
mov edx, r15d
lea rcx, [rbp + 8]
call qword [sym.imp.SHLWAPI.dll_PathIsSystemFolderA]
add ebx, 0x1146
cmp ebx, 0x67a4
jbe 0x180032b80
movzx r13d, byte [rsp + 0x40]
mov ebx, dword [rsp + 0x78]
mov dword [rsp + 0x58], r15d
jmp 0x180032d02
cmp eax, 2
jne case.0x180032574.9
mov rdx, rdi
mov ecx, 0xbd
call fcn.180033190
jmp 0x180032d02
mov r9, rdi
mov byte [rsp + 0x60], 1
mov r8d, 0x5c
mov dword [rsp + 0x70], ILRemoveLastID
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x70]
call fcn.180060ec0
mov r8d, 0x25
lea rdx, [rbp + 0x20]
xor ecx, ecx
call fcn.1800341e0
mov dword [rsp + 0x70], eax
lea r8, [rbp - 0x40]
mov dword [rsp + 0x48], eax
xor edx, edx
mov rax, qword [rbp - 0x28]
xor r9d, r9d
lea ecx, [rdx + 7]
mov rax, qword [rax]
mov qword [rbp - 0x40], rax
call fcn.180069290
mov qword [rbp - 0x40], rax
xor r11d, r11d
mov rdx, qword [rbp - 0x70]
mov r9, qword [rbp - 0x50]
lea r10, [0x180000000]
mov r8, qword [rbp - 0x58]
mov ecx, dword [rsp + 0x50]
dec ebx
mov dword [rsp + 0x78], ebx
lea eax, [rbx + 0x75]
cmp eax, ecx
ja 0x180032560
mov eax, dword [rsp + 0x48]
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.180089600
mov rbx, qword [rsp + 0x3a0]
add rsp, 0x350
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, 8
jmp 0x180032d31
mov eax, 6
jmp 0x180032d31
mov eax, 4
jmp 0x180032d31
mov eax, 5
jmp 0x180032d31
mov rdi, qword [rbp - 0x40]
mov r9d, 0x66
mov rcx, rdi
xor r8d, r8d
xor edx, edx
call fcn.1800498e0
cmp esi, 0x20
jne 0x180032a87
mov esi, dword [rbp - 0x48]
mov ebx, 0xca
mov r14d, dword [rbp - 0x78]
mov r15d, dword [rbp - 0x44]
mov r13d, dword [rsp + 0x48]
nop dword [rax]
cmp ebx, 0xca
je 0x180032ee8
cmp ebx, 0x586
je 0x180032e5e
cmp ebx, 0xa42
je 0x180032e4f
cmp ebx, 0xefe
jne 0x180032f37
mov rax, qword [rbp - 0x70]
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x58]
mov dword [rsp + 0x58], 0
mov rdx, rdi
mov ecx, SHSetFolderPathW
mov eax, dword [rax]
xor eax, r13d
mov dword [rsp + 0x48], eax
call fcn.1800392a0
mov r9, rdi
mov dword [rsp + 0x20], 0x20
xor r8d, r8d
lea rdx, [rbp - 0x20]
xor ecx, ecx
call fcn.1800499b0
mov r9d, 0x66
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.1800498e0
mov rcx, qword [rbp - 0x28]
mov rax, qword [rcx]
cmp qword [rbp - 0x20], rax
je 0x180032f37
mov eax, 3
jmp 0x180032d31
mov dword [rsp + 0x58], 1
mov dword [rsp + 0x48], r14d
jmp 0x180032ecf
lea r9, [rsp + 0x48]
mov dword [rsp + 0x48], 0x60
xor r8d, r8d
mov dword [rsp + 0x58], r13d
mov edx, 0x127
lea rcx, [rsp + 0x58]
call fcn.180046310
xor eax, esi
mov dword [rsp + 0x48], r15d
lea r8, [rsp + 0x48]
mov dword [rsp + 0x58], eax
lea rdx, [rsp + 0x58]
mov ecx, 0x1f
call fcn.18005d8e0
mov rdi, rax
lea r9, [rsp + 0x48]
xor eax, eax
lea r8, [rsp + 0x58]
mov rdx, rdi
mov dword [rsp + 0x58], eax
mov ecx, SHSetFolderPathW
mov dword [rsp + 0x48], eax
call fcn.1800392a0
xor eax, eax
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x48], eax
lea r9, [rsp + 0x48]
mov rdx, rdi
lea r8, [rsp + 0x58]
mov ecx, SHSetFolderPathW
call fcn.1800392a0
jmp 0x180032f37
movzx ecx, byte [rbp + 0x20]
lea r9, [rsp + 0x48]
movzx eax, byte [rbp + 0x21]
xor r8d, r8d
shl ecx, 8
mov edx, 0x127
or ecx, eax
mov dword [rsp + 0x48], 0x40
movzx eax, byte [rbp + 0x22]
shl ecx, 8
or ecx, eax
mov dword [rsp + 0x58], r13d
movzx eax, byte [rbp + 0x23]
shl ecx, 8
or ecx, eax
mov dword [rbp - 0x48], ecx
lea rcx, [rsp + 0x58]
call fcn.180046310
mov esi, dword [rbp - 0x48]
xor eax, r12d
mov r15d, eax
add ebx, 0x4bc
cmp ebx, 0x12f0
jbe 0x180032db0
xor eax, eax
jmp 0x180032d31