Function at 0x180002900
Capabilities:
Create thread
Encode data using xor

Disassembly:
push rbx
push rdi
sub rsp, 0x48
xor ecx, ecx
call qword [sym.imp.MSVCR90.dll__time64]
mov rcx, rax
call qword [sym.imp.MSVCR90.dll_srand]
mov edi, 4
nop dword [rax]
call qword [sym.imp.MSVCR90.dll_rand]
sub rdi, 1
jne 0x180002920
call qword [sym.imp.MSVCR90.dll_rand]
mov ebx, eax
imul ebx, ebx, 0x1d
call qword [sym.imp.MSVCR90.dll_rand]
add ebx, eax
mov eax, 0x431bde83
imul ebx
sar edx, 0x12
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0xf4240
sub ebx, edx
cmp ebx, 0xf4240
jl 0x180002966
sub ebx, 0xf4240
cmp ebx, 0x186a0
jge 0x18000297b
call qword [sym.imp.MSVCR90.dll_rand]
lea ebx, [rbx + rax + 0x186a0]
mov rcx, qword [0x18000b428]
or edx, 0xffffffff
mov dword [0x18000b3dc], ebx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
or rcx, 0xffffffffffffffff
xor eax, eax
lea r8, str.232258_69B_:C_
xor ebx, ebx
mov rdi, r8
repne scasb al, byte [rdi]
not rcx
lea rdi, [rcx - 1]
mov ecx, ebx
test edi, edi
jle 0x1800029cb
mov eax, ecx
inc r8
cdq
and eax, 1
xor eax, edx
sub eax, edx
add al, cl
inc ecx
sub byte [r8 - 1], al
cmp ecx, edi
jl 0x1800029b2
or rcx, 0xffffffffffffffff
xor eax, eax
lea r8, str.a5355:66kyw
mov rdi, r8
repne scasb al, byte [rdi]
not rcx
lea rdi, [rcx - 1]
mov ecx, ebx
test edi, edi
jle 0x180002a09
nop word [rax + rax]
mov eax, ecx
inc r8
cdq
and eax, 1
xor eax, edx
sub eax, edx
add al, cl
inc ecx
sub byte [r8 - 1], al
cmp ecx, edi
jl 0x1800029f0
mov rcx, qword [0x18000b428]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call fcn.180002d30
lea rdx, [0x18000b308]
mov qword [rsp + 0x20], rdx
lea rdx, [0x18000b430]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call fcn.1800038d0
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x28], rdx
lea r8, [0x180003e30]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180002a79
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x68]
lea r8, [0x180001a80]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180002aa9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x70]
lea r8, [0x180004270]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180002ad9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x78]
lea r8, [0x180004be0]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180002b09
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x30]
lea r8, [0x180005470]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180002b39
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x34]
lea r8, [0x1800054a0]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180002b69
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x48
pop rdi
pop rbx
ret