Function at 0x180003900
Capabilities:
Create thread
Encode data using xor
Get file size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r13d, dword [rsp + 0x90]
lea edi, [r8 - 0x7e1]
add r13d, 0xfffff442
lea ebp, [r9 - 0x646]
mov eax, edi
mov dword [rsp + 0x90], r13d
mov r14d, ecx
lea esi, [r9 + 0x424]
xor eax, 0x4c8
lea r12d, [r8 + 0x3af]
xor r14d, 0x1bfc
mov rbx, rdx
cmp ebp, eax
jg 0x180003987
add r13d, 0xad2
add esi, 0x721
mov dword [rsp + 0x90], r13d
xor esi, 0x607
jmp 0x180003a65
mov eax, dword [rdx + 0x104]
mov r15d, dword [0x180026084]
and eax, 0x129c
sub eax, 0x150d
cmp r15d, eax
jb 0x1800039fc
mov rax, qword [section..data]
mov ecx, dword [rbx + 0x110]
mov edx, dword [rax + 0x110]
mov eax, edi
xor rdx, rax
mov eax, dword [rbx + 0x28]
xor rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov eax, dword [0x180026044]
add r15d, 4
and eax, r14d
imul edi, eax
mov eax, dword [0x180026058]
sub eax, edi
sub eax, 0x1a1d
imul edi, eax
mov eax, dword [rbx + 0x104]
and eax, 0x129c
sub eax, 0x150d
cmp r15d, eax
jae 0x1800039a3
mov rcx, qword [section..data]
mov r9d, r14d
mov r10d, dword [0x1800260a0]
and r9d, 0x142e
mov r8d, dword [0x180026050]
add r10d, 0x165c
movsxd r11, r12d
add r8d, 0xfffffb64
mov eax, dword [rcx + 0x9c]
xor r11, 0x142e
mov edx, dword [rcx + 0x70]
xor r9, rax
mov ecx, dword [rbx + 0xa8]
mov eax, esi
sub ecx, 0x49c
xor rdx, rax
mov qword [rsp + 0x28], r11
mov eax, edi
or rdx, rax
mov dword [rsp + 0x20], r10d
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [r12 - 0x5dd]
cmp edi, eax
je 0x180003c22
lea eax, [r13 + 0x59f]
mov dword [rsp + 0x28], r13d
xor r14d, 0x1815
mov dword [rsp + 0x20], eax
mov edx, r14d
lea r8d, [rbp + 0x97e]
lea ecx, [r12 - 0xdd5]
mov r9, rbx
call fcn.180002660
mov r14d, eax
lea r8d, [r13 - 0x92a]
xor eax, 0x16
lea rdx, [0x180026010]
sub esi, 0x546
mov dword [rsp + 0x20], eax
mov ecx, r14d
lea r9d, [rsi - 0x79a]
call fcn.1800020e0
mov ebp, eax
xor r9d, r9d
nop dword [rax + rax]
mov rcx, qword [section..data]
mov rax, qword [rcx + 0xb8]
mov r8d, dword [rax + r9]
mov eax, 0x88cbd
imul r8d, dword [rcx + 0x68]
add r9, 4
sub eax, dword [rbx + 0xe0]
mov ecx, 0x13db13
add dword [rbx + 0x94], eax
sub ecx, dword [rbx]
sub ecx, dword [rbx + 0x98]
mov rax, qword [section..data]
mov edx, r8d
shr edx, 0x10
add dword [rax], ecx
mov eax, dword [0x18002603c]
mov ecx, dword [rbx + 0x98]
add eax, 0xffe9059d
add ecx, dword [rbx + 0xdc]
add ecx, eax
mov dword [0x18002603c], ecx
movsxd rcx, dword [rbx + 0x6c]
mov rax, qword [rbx + 0xc0]
mov byte [rcx + rax], dl
mov edx, r8d
inc dword [rbx + 0x6c]
mov rcx, qword [section..data]
mov eax, dword [0x180026010]
shr edx, 8
xor dword [rcx + 0x2c], eax
mov eax, dword [0x1800260a4]
mov ecx, dword [rbx + 0x28]
add eax, 0xfff412aa
add ecx, eax
mov rax, qword [0x1800260d0]
mov dword [0x1800260a4], ecx
movsxd rcx, dword [0x18002607c]
mov byte [rcx + rax], dl
inc dword [0x18002607c]
mov rax, qword [section..data]
mov ecx, dword [rax + 0xe0]
add ecx, dword [rbx + 0x48]
xor ecx, 0x136097
sub dword [rbx + 0x28], ecx
mov eax, dword [0x1800260a4]
add eax, 0xffe32e44
add dword [0x180026058], eax
movsxd rcx, dword [rbx + 0x6c]
mov rax, qword [rbx + 0xc0]
mov byte [rcx + rax], r8b
mov eax, 0x88cbd
inc dword [rbx + 0x6c]
mov ecx, dword [rbx + 0x9c]
xor ecx, dword [rbx + 0xe0]
sub eax, ecx
add dword [0x180026060], eax
mov eax, 0x14e0c2
sub eax, dword [rbx + 0x88]
add dword [rbx + 0xe0], eax
mov eax, 0x31f50
sub eax, dword [0x1800260ec]
add dword [rbx + 0x60], eax
cmp r9, 0x6cc0
jl 0x180003ae0
add ebp, 0x88f
mov eax, r13d
xor eax, 0x1565
cmp edi, eax
jge 0x180003d42
xor ebp, 0x1603
lea eax, [rbp + 0xb73]
cmp edi, eax
je 0x180003d42
lea eax, [r14 - 0x781]
cmp edi, eax
jge 0x180003caa
mov rax, qword [section..data]
lea edx, [rsi + 0xde7]
xor edi, 0x115
mov r9d, esi
xor r9d, 0x358
mov dword [rsp + 0x28], edi
mov ecx, dword [rax + 0xdc]
mov eax, esi
add ecx, 0xfffcf8b7
xor eax, 0x193b
add ecx, dword [rbx + 0x110]
mov dword [rbx + 0x68], ecx
lea ecx, [r14 - 0x93d]
mov r8, qword [section..data]
mov dword [rsp + 0x20], eax
call fcn.1800028b0
jmp 0x180003d42
mov ecx, edi
or ecx, ebp
cmp esi, ecx
jge 0x180003d42
lea eax, [r12 + r14]
mov r15d, r12d
imul r15d, ebp
sub ecx, esi
mov r14d, r12d
and r14d, ebp
imul r14d, r12d
sub r15d, r13d
imul r13d, eax, 0xb5d
imul eax, edi, 0x117c
lea edi, [rcx - 1]
shr edi, 2
inc edi
movsxd r12, eax
nop dword [rax + rax]
mov ecx, dword [rbx + 8]
mov r8d, r13d
sub ecx, dword [rbx + 0xe0]
mov r9d, dword [0x1800260a4]
add ecx, ebp
mov edx, dword [rbx + 0xa8]
sub r9d, esi
imul r9d, dword [rbx + 0x98]
add edx, ebp
mov qword [rsp + 0x30], rcx
or edx, esi
mov dword [rsp + 0x28], r15d
mov rcx, r12
mov dword [rsp + 0x20], edx
mov edx, r14d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
sub rdi, 1
jne 0x180003cf0
mov r13d, dword [rsp + 0x90]
mov rbx, qword [rsp + 0x70]
xor r13d, 0x1573
mov rbp, qword [rsp + 0x78]
mov eax, r13d
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret