Function at 0x180003930
Capabilities:
Create thread
Encode data using xor
Get file size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r13d, dword [rsp + 0x90]
lea edi, [r8 - 0x9b0]
add r13d, 0xfffff64f
mov esi, r9d
mov r14d, ecx
mov dword [rsp + 0x90], r13d
mov eax, edi
lea r12d, [r8 - 0xf1d]
xor r14d, 0x1424
xor eax, 0x1c26
lea ebp, [rsi - 0x3fe]
mov rbx, rdx
cmp ebp, eax
jg 0x1800039b2
add r13d, 0xba2
add esi, 0xfffff82e
mov dword [rsp + 0x90], r13d
xor esi, 0x1948
jmp 0x180003a90
mov eax, dword [rdx + 0x104]
mov r15d, dword [0x18004a084]
and eax, 0x1a1d
sub eax, 0xf6e
cmp r15d, eax
jb 0x180003a29
nop
mov rax, qword [section..data]
mov ecx, dword [rbx + 0x28]
mov edx, dword [rax + 0x110]
mov eax, edi
xor rdx, rax
mov eax, dword [rbx + 0x110]
xor rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov eax, dword [0x18004a044]
add r15d, 3
and eax, r14d
imul edi, eax
mov eax, dword [0x18004a058]
sub eax, edi
sub eax, 0x142e
imul edi, eax
mov eax, dword [rbx + 0x104]
and eax, 0x1a1d
sub eax, 0xf6e
cmp r15d, eax
jae 0x1800039d0
mov rcx, qword [section..data]
mov r9d, r14d
mov r10d, dword [0x18004a0a0]
and r9d, 0x150d
mov r8d, dword [0x18004a050]
add r10d, 0x117c
movsxd r11, r12d
add r8d, 0xffffed64
mov eax, dword [rcx + 0x9c]
xor r11, 0xe7b
mov edx, dword [rcx + 0x70]
xor r9, rax
mov ecx, dword [rbx + 0xa8]
xor rdx, rsi
mov eax, edi
sub ecx, 0x182c
mov qword [rsp + 0x28], r11
or rdx, rax
mov dword [rsp + 0x20], r10d
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [r12 - 0x154]
cmp edi, eax
je 0x180003c52
lea edx, [r13 - 0x781]
xor r14d, 0x755
lea eax, [r13 - 0x919]
mov r9, rbx
mov dword [rsp + 0x28], eax
lea r8d, [rbp - 0x826]
mov dword [rsp + 0x20], edx
lea ecx, [r12 + 0xcac]
mov edx, r14d
call fcn.180002680
mov r14d, eax
lea r8d, [r13 - 0x1f1]
xor eax, 0x1b4d
lea rdx, [0x18004a010]
add esi, 0x7ce
mov dword [rsp + 0x20], eax
lea ecx, [r14 - 0x5f2]
lea r9d, [rsi + 0x69b]
call fcn.180002100
mov ebp, eax
xor r9d, r9d
nop
mov rcx, qword [section..data]
mov rax, qword [rcx + 0xb8]
mov r8d, dword [rax + r9]
mov eax, 0x88cbd
imul r8d, dword [rcx + 0x68]
add r9, 4
sub eax, dword [rbx + 0xe0]
mov ecx, 0x13db13
add dword [rbx + 0x94], eax
sub ecx, dword [rbx + 0x98]
sub ecx, dword [rbx]
mov rax, qword [section..data]
mov edx, r8d
shr edx, 0x10
add dword [rax], ecx
mov eax, dword [0x18004a03c]
mov ecx, dword [rbx + 0x98]
add eax, 0xffe9059d
add ecx, dword [rbx + 0xdc]
add ecx, eax
mov dword [0x18004a03c], ecx
movsxd rcx, dword [rbx + 0x6c]
mov rax, qword [rbx + 0xc0]
mov byte [rcx + rax], dl
mov edx, r8d
inc dword [rbx + 0x6c]
mov rcx, qword [section..data]
mov eax, dword [0x18004a010]
shr edx, 8
xor dword [rcx + 0x2c], eax
mov eax, dword [0x18004a0a4]
mov ecx, dword [rbx + 0x28]
add eax, 0xfff412aa
add ecx, eax
mov rax, qword [0x18004a0d0]
mov dword [0x18004a0a4], ecx
movsxd rcx, dword [0x18004a07c]
mov byte [rcx + rax], dl
inc dword [0x18004a07c]
mov rax, qword [section..data]
mov ecx, dword [rax + 0xe0]
add ecx, dword [rbx + 0x48]
xor ecx, 0x136097
sub dword [rbx + 0x28], ecx
mov eax, dword [0x18004a0a4]
add eax, 0xffe32e44
add dword [0x18004a058], eax
movsxd rcx, dword [rbx + 0x6c]
mov rax, qword [rbx + 0xc0]
mov byte [rcx + rax], r8b
mov eax, 0x88cbd
mov ecx, dword [rbx + 0xe0]
xor ecx, dword [rbx + 0x9c]
inc dword [rbx + 0x6c]
sub eax, ecx
add dword [0x18004a060], eax
mov eax, 0x14e0c2
sub eax, dword [rbx + 0x88]
add dword [rbx + 0xe0], eax
mov eax, 0x31f50
sub eax, dword [0x18004a0ec]
add dword [rbx + 0x60], eax
cmp r9, 0x1a300
jl 0x180003b10
sub ebp, 0x366
mov eax, r13d
xor eax, 0x1615
cmp edi, eax
jge 0x180003d72
xor ebp, 0x1d74
lea eax, [rbp + 0x8a1]
cmp edi, eax
je 0x180003d72
lea eax, [r14 - 0x324]
cmp edi, eax
jle 0x180003cda
mov rax, qword [section..data]
lea edx, [rsi - 0x4d8]
xor edi, 0x1e50
mov r9d, esi
xor r9d, 0x1ce8
mov dword [rsp + 0x28], edi
mov ecx, dword [rax + 0xdc]
mov eax, esi
add ecx, 0xfffcf8b7
xor eax, 0xafd
add ecx, dword [rbx + 0x110]
mov dword [rbx + 0x68], ecx
lea ecx, [r14 + 0x424]
mov r8, qword [section..data]
mov dword [rsp + 0x20], eax
call fcn.1800028d0
jmp 0x180003d72
mov ecx, edi
or ecx, ebp
cmp esi, ecx
jge 0x180003d72
lea eax, [r12 + r14]
mov r15d, r12d
imul r15d, ebp
sub ecx, esi
mov r14d, r12d
and r14d, ebp
imul r14d, r12d
sub r15d, r13d
imul r13d, eax, 0x5f0
imul eax, edi, 0x1a0b
lea edi, [rcx - 1]
shr edi, 2
inc edi
movsxd r12, eax
nop dword [rax + rax]
mov r9d, dword [0x18004a0a4]
mov ecx, ebp
sub ecx, dword [rbx + 0xe0]
sub r9d, esi
add ecx, dword [rbx + 8]
mov r8d, r13d
mov edx, dword [rbx + 0xa8]
imul r9d, dword [rbx + 0x98]
add edx, ebp
mov qword [rsp + 0x30], rcx
or edx, esi
mov dword [rsp + 0x28], r15d
mov rcx, r12
mov dword [rsp + 0x20], edx
mov edx, r14d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
sub rdi, 1
jne 0x180003d20
mov r13d, dword [rsp + 0x90]
mov rbx, qword [rsp + 0x70]
xor r13d, 0xb19
mov rbp, qword [rsp + 0x78]
mov eax, r13d
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret