Function at 0x180005780
Capabilities:
Create thread
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [0x1800371c8]
xor rax, rsp
mov qword [rbp + 0xb0], rax
xor edi, edi
mov ebx, edx
mov dword [rsp + 0x40], edi
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
cmp ebx, 1
jne 0x180005d9d
mov eax, 0xce9e3d82
mov qword [rsp + 0x1e8], r15
lea rdx, str.bikl___iuk
mov qword [0x180052a58], rsi
add rdx, rax
lea rcx, [rbp - 0x80]
call fcn.1800061c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18000581a
mov qword [rsp + 0x28], rdi
lea r8, [0x180005330]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor sil, sil
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x1000
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9d, 0x104
lea r8, [rbp - 0x60]
mov rcx, rax
xor edx, edx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
test rbx, rbx
je 0x180005859
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, edi
lea rdx, [rbp - 0x60]
or rbx, 0xffffffffffffffff
movzx ecx, byte [rdx]
lea eax, [rcx - 0x41]
cmp al, 0x19
ja 0x180005873
add cl, 0x20
mov byte [rdx], cl
inc r8d
lea rax, [rbp - 0x60]
inc rdx
mov rcx, rbx
inc rcx
cmp byte [rax + rcx], dil
jne 0x180005880
movsxd rax, r8d
cmp rax, rcx
jbe 0x180005864
lea rcx, [rbp - 0x60]
mov rax, rbx
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], dil
jne 0x1800058a0
lea r15, [0x180000000]
cmp rax, 0x17
jne 0x1800058fb
mov edx, 0xe8
mov rcx, rdi
nop
movzx eax, byte [rcx + r15 + 0x31a70]
xor al, dl
mov byte [rsp + rcx + 0x48], al
inc rcx
lea rax, [rdx + 1]
movzx edx, al
cmp rcx, 0x17
jb 0x1800058c0
lea rdx, [rsp + 0x48]
mov byte [rsp + 0x5f], dil
lea rcx, [rbp - 0x60]
call fcn.18000a93c
test rax, rax
je 0x1800058fb
mov al, 1
jmp 0x1800058fd
xor al, al
test al, al
lea rcx, [rbp - 0x60]
mov r14d, 1
mov rax, rbx
cmovne esi, r14d
inc rax
cmp byte [rcx + rax], dil
jne 0x180005910
cmp rax, 0x1e
jne 0x180005981
lea ecx, [rax + 0x11]
mov rdx, rdi
lea r8, [0x180031a89]
lea r9, [rsp + 0x49]
movzx eax, byte [rdx + r15 + 0x31a88]
xor al, cl
mov byte [rsp + rdx + 0x48], al
lea rax, [rcx + 1]
movzx ecx, al
movzx eax, byte [r8 + rdx]
xor al, cl
mov byte [r9 + rdx], al
add rdx, 2
lea rax, [rcx + 1]
movzx ecx, al
cmp rdx, 0x1e
jb 0x180005931
lea rdx, [rsp + 0x48]
mov byte [rsp + 0x66], dil
lea rcx, [rbp - 0x60]
call fcn.18000a93c
test rax, rax
je 0x180005981
movzx eax, r14b
jmp 0x180005983
xor al, al
test al, al
lea rcx, [rbp - 0x60]
mov rax, rbx
cmovne esi, r14d
inc rax
cmp byte [rcx + rax], dil
jne 0x180005990
cmp rax, 0x1e
jne 0x1800059cf
mov eax, 0xf459aed5
lea rdx, [0x180031aa8]
add rdx, rax
lea rcx, [rsp + 0x48]
call fcn.180006290
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.18000a93c
test rax, rax
je 0x1800059cf
movzx eax, r14b
jmp 0x1800059d1
xor al, al
test al, al
lea rcx, [rbp - 0x60]
mov rax, rbx
cmovne esi, r14d
nop
inc rax
cmp byte [rcx + rax], dil
jne 0x1800059e0
cmp rax, 0x1f
jne 0x180005a3d
mov edx, 0x33
mov rcx, rdi
nop word [rax + rax]
movzx eax, byte [rcx + r15 + 0x31ac8]
xor al, dl
mov byte [rsp + rcx + 0x48], al
inc rcx
lea rax, [rdx + 1]
movzx edx, al
cmp rcx, 0x1f
jb 0x180005a00
lea rdx, [rsp + 0x48]
mov byte [rsp + 0x67], dil
lea rcx, [rbp - 0x60]
call fcn.18000a93c
test rax, rax
je 0x180005a3d
movzx eax, r14b
jmp 0x180005a3f
xor al, al
test al, al
lea rcx, [rbp - 0x60]
mov rax, rbx
cmovne esi, r14d
nop dword [rax]
inc rax
cmp byte [rcx + rax], dil
jne 0x180005a50
cmp rax, 0x1f
jne 0x180005aad
mov edx, 0x79
mov rcx, rdi
nop word [rax + rax]
movzx eax, byte [rcx + r15 + 0x31ae8]
xor al, dl
mov byte [rsp + rcx + 0x48], al
inc rcx
lea rax, [rdx + 1]
movzx edx, al
cmp rcx, 0x1f
jb 0x180005a70
lea rdx, [rsp + 0x48]
mov byte [rsp + 0x67], dil
lea rcx, [rbp - 0x60]
call fcn.18000a93c
test rax, rax
je 0x180005aad
movzx eax, r14b
jmp 0x180005aaf
xor al, al
test al, al
lea rcx, [rbp - 0x60]
mov rax, rbx
cmovne esi, r14d
nop dword [rax]
inc rax
cmp byte [rcx + rax], dil
jne 0x180005ac0
cmp rax, 0x1f
jne 0x180005b1d
mov edx, 0x53
mov rcx, rdi
nop word [rax + rax]
movzx eax, byte [rcx + r15 + 0x31b08]
xor al, dl
mov byte [rsp + rcx + 0x48], al
inc rcx
lea rax, [rdx + 1]
movzx edx, al
cmp rcx, 0x1f
jb 0x180005ae0
lea rdx, [rsp + 0x48]
mov byte [rsp + 0x67], dil
lea rcx, [rbp - 0x60]
call fcn.18000a93c
test rax, rax
je 0x180005b1d
movzx eax, r14b
jmp 0x180005b1f
xor al, al
test al, al
lea rcx, [rbp - 0x60]
mov rax, rbx
cmovne esi, r14d
nop dword [rax]
inc rax
cmp byte [rcx + rax], dil
jne 0x180005b30
cmp rax, 0x25
jne 0x180005b8d
mov edx, 0xb7
mov rcx, rdi
nop word [rax + rax]
movzx eax, byte [rcx + r15 + 0x31b28]
xor al, dl
mov byte [rsp + rcx + 0x48], al
inc rcx
lea rax, [rdx + 1]
movzx edx, al
cmp rcx, 0x25
jb 0x180005b50
lea rdx, [rsp + 0x48]
mov byte [rsp + 0x6d], dil
lea rcx, [rbp - 0x60]
call fcn.18000a93c
test rax, rax
je 0x180005b8d
movzx eax, r14b
jmp 0x180005b8f
xor al, al
test al, al
lea rcx, [rbp - 0x60]
mov rax, rbx
cmovne esi, r14d
nop dword [rax]
inc rax
cmp byte [rcx + rax], dil
jne 0x180005ba0
cmp rax, 0x2c
jne 0x180005bdf
mov eax, 0xe8a5e296
lea rdx, [0x180031b50]
add rdx, rax
lea rcx, [rsp + 0x48]
call fcn.180006310
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.18000a93c
test rax, rax
je 0x180005bdf
movzx eax, r14b
jmp 0x180005be1
xor al, al
test al, al
lea rcx, [rbp - 0x60]
mov rax, rbx
cmovne esi, r14d
nop
inc rax
cmp byte [rcx + rax], dil
jne 0x180005bf0
cmp rax, 0x2d
jne 0x180005c4d
mov edx, 0x3f
mov rcx, rdi
nop word [rax + rax]
movzx eax, byte [rcx + r15 + 0x31b80]
xor al, dl
mov byte [rsp + rcx + 0x48], al
inc rcx
lea rax, [rdx + 1]
movzx edx, al
cmp rcx, 0x2d
jb 0x180005c10
lea rdx, [rsp + 0x48]
mov byte [rsp + 0x75], dil
lea rcx, [rbp - 0x60]
call fcn.18000a93c
test rax, rax
je 0x180005c4d
movzx eax, r14b
jmp 0x180005c4f
xor al, al
test al, al
lea rax, [rbp - 0x60]
cmovne esi, r14d
nop dword [rax]
inc rbx
cmp byte [rax + rbx], dil
jne 0x180005c60
cmp rbx, 0x35
jne 0x180005cbd
mov edx, 4
mov rcx, rdi
nop word [rax + rax]
movzx eax, byte [rcx + r15 + 0x31bb0]
xor al, dl
mov byte [rsp + rcx + 0x48], al
inc rcx
lea rax, [rdx + 1]
movzx edx, al
cmp rcx, 0x35
jb 0x180005c80
lea rdx, [rsp + 0x48]
mov byte [rsp + 0x7d], dil
lea rcx, [rbp - 0x60]
call fcn.18000a93c
test rax, rax
je 0x180005cbd
movzx eax, r14b
jmp 0x180005cbf
xor al, al
test al, al
movzx ebx, sil
mov edx, 0x7f
mov rcx, rdi
cmovne ebx, r14d
movzx eax, byte [rcx + r15 + 0x31be8]
xor al, dl
mov byte [rbp + rcx - 0x80], al
inc rcx
lea rax, [rdx + 1]
movzx edx, al
cmp rcx, 0x10
jb 0x180005cd1
lea rdx, [rbp - 0x80]
mov byte [rbp - 0x70], dil
lea rcx, [rbp - 0x60]
call fcn.18000a93c
test rax, rax
je 0x180005d6d
mov ecx, 0xfa
nop dword [rax + rax]
movzx eax, byte [rdi + r15 + 0x31c00]
xor al, cl
mov byte [rsp + rdi + 0x48], al
inc rdi
lea rax, [rcx + 1]
movzx ecx, al
cmp rdi, 0x10
jb 0x180005d10
lea rdx, [rsp + 0x48]
mov byte [rsp + 0x58], 0
lea rcx, [rbp - 0x60]
call fcn.18000a93c
test rax, rax
je 0x180005d6d
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x746f6f72
lea rcx, [rbp - 0x60]
mov byte [rsp + 0x44], 0
call fcn.18000a93c
test rax, rax
je 0x180005d6d
movzx eax, r14b
jmp 0x180005d6f
xor al, al
mov r15, qword [rsp + 0x1e8]
test al, al
jne 0x180005d84
test bl, bl
jne 0x180005d84
call fcn.180002540
xor edx, edx
lea rcx, [0x180037d10]
mov r8d, 0x18e00
call fcn.18000b240
mov eax, r14d
jmp 0x180005da2
mov eax, 1
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.180007b00
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret